inmanta-module-openstack 5.1.2__tar.gz → 6.1.0__tar.gz

{inmanta_module_openstack-5.1.2 → inmanta_module_openstack-6.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 5.1.2
+Version: 6.1.0
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-5.1.2 → inmanta_module_openstack-6.1.0}/inmanta_module_openstack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 5.1.2
+Version: 6.1.0
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-5.1.2 → inmanta_module_openstack-6.1.0}/inmanta_module_openstack.egg-info/SOURCES.txt

@@ -16,6 +16,7 @@ inmanta_plugins/openstack/common/deps.py
 inmanta_plugins/openstack/compute/__init__.py
 inmanta_plugins/openstack/compute/flavor.py
 inmanta_plugins/openstack/compute/host_aggregate.py
+inmanta_plugins/openstack/compute/server_group.py
 inmanta_plugins/openstack/compute/virtual_machine.py
 inmanta_plugins/openstack/identity/__init__.py
 inmanta_plugins/openstack/identity/group.py
@@ -49,8 +50,13 @@ tests/test_host_aggregate.py
 tests/test_image.py
 tests/test_keystone.py
 tests/test_network_port_fixed_ips.py
+tests/test_network_port_missing_network.py
 tests/test_network_port_security_groups.py
+tests/test_network_port_shared_network.py
 tests/test_neutron.py
 tests/test_nova.py
 tests/test_quota.py
-tests/test_trunk.py
+tests/test_security_group_ethertype.py
+tests/test_server_group.py
+tests/test_trunk.py
+tests/test_vm_boot_nic.py

{inmanta_module_openstack-5.1.2 → inmanta_module_openstack-6.1.0}/inmanta_plugins/openstack/common/base.py

@@ -18,9 +18,11 @@ Contact: code@inmanta.com
 
 import openstack.connection
 import openstack.exceptions
-from inmanta.agent.handler import CRUDHandler, cache
+from inmanta.agent.handler import CRUDHandler, SkipResource, cache
 from inmanta.execute import proxy
 from inmanta.resources import ManagedResource, PurgeableResource
+from openstack.network.v2.network import Network as OSNetwork
+from openstack.network.v2.subnet import Subnet as OSSubnet
 
 CRED_TIMEOUT = 600  # OpenStackHandler
 
@@ -94,8 +96,12 @@ class Port(OpenstackResource):
 
     fields = ("name", "address", "subnet", "network")
     name: str
-    address: str
-    subnet: str
+    # A NetworkPort does not need a fixed ip, nor to be pinned to a subnet: its getters
+    # report None for both when the relation is unset. RouterPort re-declares them as
+    # mandatory, which its model cardinality guarantees. The network is always there,
+    # taken from the relation itself or from the subnet the port is pinned to.
+    address: str | None
+    subnet: str | None
     network: str
 
     @staticmethod
@@ -185,14 +191,30 @@ class OpenStackHandler(CRUDHandler):
             f"Project not found or not visible: {name}"
         )
 
-    def get_network(self, project_id=None, name=None, network_id=None):
+    def get_network(
+        self,
+        project_id: str | None = None,
+        name: str | None = None,
+        network_id: str | None = None,
+        include_shared: bool = False,
+        include_external: bool = False,
+    ) -> OSNetwork | None:
         """
         Retrieve the network id based on the name of the network
+
+        :param include_shared: also consider networks owned by another project when the
+            project scoped lookup comes up empty, restricted to shared networks. A shared
+            network is owned by the project that created it, so a lookup scoped to a
+            project merely using it never finds it.
+        :param include_external: likewise for external networks, which another project
+            owns as well: the management network of an appliance typically is one. Note
+            that every project can read an external network, but only an admin can create
+            a port in its own project on one, unless it is shared as well.
         """
         if not name and not network_id:
             raise Exception("Either a name or an id needs to be provided.")
 
-        query_params = {}
+        query_params: dict[str, object] = {}
         if project_id:
             query_params["project_id"] = project_id
         if name:
@@ -201,26 +223,70 @@ class OpenStackHandler(CRUDHandler):
             query_params["id"] = network_id
 
         networks = self._connection.network.networks(**query_params)
-        return self.require_single_item(networks)
-
-    def get_subnet(self, project_id=None, name=None, subnet_id=None):
+        network = self.require_single_item(networks)
+
+        if network is None and project_id and (include_shared or include_external):
+            del query_params["project_id"]
+            if include_shared:
+                networks = self._connection.network.networks(
+                    **query_params, is_shared=True
+                )
+                network = self.require_single_item(networks)
+            if network is None and include_external:
+                networks = self._connection.network.networks(
+                    **query_params, is_router_external=True
+                )
+                network = self.require_single_item(networks)
+
+        return network
+
+    def get_subnet(
+        self,
+        project_id: str | None = None,
+        name: str | None = None,
+        subnet_id: str | None = None,
+        network_id: str | None = None,
+    ) -> OSSubnet | None:
         """
         Retrieve the subnet based on name or id
         """
         if not name and not subnet_id:
             raise Exception("Either a name or an id needs to be provided.")
 
-        query_params = {}
+        query_params: dict[str, object] = {}
         if project_id:
             query_params["project_id"] = project_id
         if name:
             query_params["name"] = name
         if subnet_id:
             query_params["id"] = subnet_id
+        if network_id:
+            query_params["network_id"] = network_id
 
         subnets = self._connection.network.subnets(**query_params)
         return self.require_single_item(subnets)
 
+    def get_server_group(self, name: str):
+        """
+        Retrieve a Nova server group by name.
+
+        Nova does not filter server groups by name server-side, so list the groups in the
+        connection's project scope and match on the name ourselves. Nova does allow
+        several groups to share a name, which cannot be managed unambiguously: skip
+        rather than pick one.
+        """
+        groups = [
+            group
+            for group in self._connection.compute.server_groups()
+            if group.name == name
+        ]
+        if len(groups) > 1:
+            raise SkipResource(
+                f"Found more than one server group named '{name}'; refusing "
+                "to manage a non-unique server group."
+            )
+        return groups[0] if groups else None
+
     def get_router(self, project_id=None, name=None, router_id=None):
         """
         Retrieve the router based on name or id

{inmanta_module_openstack-5.1.2 → inmanta_module_openstack-6.1.0}/inmanta_plugins/openstack/common/deps.py

@@ -18,11 +18,17 @@ Contact: code@inmanta.com
 
 from collections import defaultdict
 from collections.abc import Mapping
+from typing import TYPE_CHECKING, cast
 
 from inmanta.export import dependency_manager
 
 from inmanta_plugins.openstack.common.base import OpenstackResource
 
+if TYPE_CHECKING:
+    # Only a name for the cast below: this export-time module does not depend on a
+    # handler module at runtime.
+    from inmanta_plugins.openstack.network.network_port import NetworkPort
+
 # Per-provider view of the collected resources: resource type -> resource name -> resource.
 ResourceCollector = Mapping[str, Mapping[str, OpenstackResource]]
 
@@ -35,6 +41,7 @@ MANAGED_DEPENDENCIES = {
     "openstack::NetworkPort",
     "openstack::FloatingIP",
     "openstack::SecurityGroup",
+    "openstack::ServerGroup",
 }
 
 
@@ -68,9 +75,14 @@ def set_dependencies_on_purged_resources(collector: ResourceCollector) -> None:
     vms = collector.get("openstack::VirtualMachine", {})
     ports = collector.get("openstack::NetworkPort", {})
     sgs = collector.get("openstack::SecurityGroup", {})
+    server_groups = collector.get("openstack::ServerGroup", {})
 
     # When the VM is purged, all its purged ports should be deployed first
     for vm in vms.values():
+        # A purged server group is removed only after the VMs scheduled into it are gone.
+        if vm.server_group in server_groups:
+            server_groups[vm.server_group].requires.add(vm.id)
+
         for vm_port in vm.ports:
             if vm_port["name"] in ports:
                 port = ports[vm_port["name"]]
@@ -99,6 +111,7 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
     ports = collector.get("openstack::NetworkPort", {})
     fips = collector.get("openstack::FloatingIP", {})
     sgs = collector.get("openstack::SecurityGroup", {})
+    server_groups = collector.get("openstack::ServerGroup", {})
     router_map = {}
 
     # they require the project to exist
@@ -133,22 +146,40 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
         if vm.model.project.name in projects:
             vm.requires.add(projects[vm.model.project.name].id)
 
+        # The vm resolves each boot NIC through the port's subnet, or through its network
+        # when the port is not pinned to a subnet. Either way that object has to exist
+        # before the vm boots.
         for port in vm.ports:
-            if port["network"] in subnets:
-                vm.requires.add(subnets[port["network"]].id)
+            if port["subnet"] in subnets:
+                vm.requires.add(subnets[port["subnet"]].id)
+            elif port["network"] in networks:
+                vm.requires.add(networks[port["network"]].id)
 
         for sg in vm.security_groups:
             if sg in sgs:
                 vm.requires.add(sgs[sg].id)
 
-    for port in ports.values():
+        # The scheduler hint is resolved at boot, so the group must exist by then.
+        if vm.server_group in server_groups:
+            vm.requires.add(server_groups[vm.server_group].id)
+
+    for collected_port in ports.values():
+        # The collector hands out the base type; every entry here is a NetworkPort.
+        port = cast("NetworkPort", collected_port)
+
         if port.model.project.name in projects:
             port.requires.add(projects[port.model.project.name].id)
 
-        if port.network in projects:
-            port.requires.add(subnets[port.network].id)
+        # The port lives on a network, and is pinned to one of its subnets when it
+        # requests a fixed ip. The network has to exist before the port is created at
+        # all; the subnet has to exist before the port can pin a fixed ip in it.
+        if port.network in networks:
+            port.requires.add(networks[port.network].id)
+
+        if port.subnet is not None and port.subnet in subnets:
+            port.requires.add(subnets[port.subnet].id)
 
-        if port.host in vms:
+        if port.host is not None and port.host in vms:
             if port.is_trunk_parent:
                 # A trunk parent must exist (unbound) before its vm: the trunk is built
                 # on it and the vm then boots on the pre-created port. Ordering the port
@@ -167,13 +198,31 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
             fip.requires.add(networks[fip.external_network].id)
 
         if fip.port in ports:
-            port = ports[fip.port]
+            port = cast("NetworkPort", ports[fip.port])
             fip.requires.add(port.id)
 
-            # find router on which this floating ip is added
-            key = (fip.external_network, port.subnet)
-            if key in router_map:
-                fip.requires.add(router_map[key].id)
+            # Find the router this floating ip is routed over: the one with a gateway on
+            # the external network and an interface on the port's network. A port pinned
+            # to a subnet names that subnet; a port that only knows its network is
+            # matched through every managed subnet of that network instead, as the
+            # router is attached to the network by one of them.
+            if port.subnet is not None:
+                port_subnets = [port.subnet]
+            else:
+                # Matching networks by name is enough even though the collector spans
+                # every project of the provider: a network resource is identified by
+                # (provider, name), so two projects of one provider cannot both hold a
+                # network under this name.
+                port_subnets = [
+                    subnet_name
+                    for subnet_name, subnet in subnets.items()
+                    if subnet.model.network.name == port.network
+                ]
+
+            for subnet_name in port_subnets:
+                key = (fip.external_network, subnet_name)
+                if key in router_map:
+                    fip.requires.add(router_map[key].id)
 
 
 @dependency_manager

{inmanta_module_openstack-5.1.2 → inmanta_module_openstack-6.1.0}/inmanta_plugins/openstack/compute/flavor.py

@@ -21,6 +21,7 @@ from typing import Any
 from inmanta.agent import handler
 from inmanta.agent.handler import ResourcePurged, cache, provider
 from inmanta.resources import resource
+from openstack.compute.v2.flavor import Flavor as SdkFlavor
 
 from inmanta_plugins.openstack.common.base import (
     NotUniqueException,
@@ -45,6 +46,7 @@ class Flavor(OpenstackAdminResource):
         "swap",
         "rxtx_factor",
         "is_public",
+        "description",
         "extra_specs",
     )
     name: str
@@ -56,16 +58,25 @@ class Flavor(OpenstackAdminResource):
     swap: int
     rxtx_factor: float
     is_public: bool
-    extra_specs: dict[str, Any]
+    description: str | None
+    extra_specs: dict[str, Any] | None
 
     @staticmethod
     def get_extra_specs(_, obj):
+        if obj.extra_specs is None:
+            return None
         return {key: str(val) for key, val in obj.extra_specs.items()}
 
 
 @provider("openstack::Flavor", name="openstack")
 class FlavorHandler(OpenStackHandler):
-    # NOTE: Description is mentioned in the documentation, but does not seem to work currently
+    # Fields Nova can change on an existing flavor. Any other change requires
+    # deleting and recreating it.
+    IN_PLACE_FIELDS = {"description", "extra_specs"}
+
+    # Set by read_resource, which raises ResourcePurged when the flavor is gone,
+    # so the other handler methods can rely on it being there.
+    flavor: SdkFlavor
 
     def _resource_has_explicit_flavor_id(self, resource: Flavor) -> bool:
         return resource.flavor_id not in (None, "", "auto")
@@ -74,13 +85,26 @@ class FlavorHandler(OpenStackHandler):
         if self._resource_has_explicit_flavor_id(resource):
             return self._connection.get_flavor(resource.flavor_id, get_extra=True)
 
-        flavors = self._connection.compute.flavors(
-            name=resource.name, get_extra_specs=True
+        # Nova has no name filter on the flavor list, and openstacksdk silently
+        # discards unknown query parameters, so we have to match client-side.
+        flavors = (
+            flavor
+            for flavor in self._connection.compute.flavors(get_extra_specs=True)
+            if flavor.name == resource.name
         )
         return self.require_single_item(flavors)
 
-    def _create_flavor(self, resource: Flavor):
-        """Create a flavor in OpenStack."""
+    def _create_flavor(
+        self,
+        resource: Flavor,
+        description: str | None,
+        extra_specs: dict[str, Any] | None,
+    ):
+        """Create a flavor in OpenStack.
+
+        The description and extra specs are passed in rather than read off the
+        resource, so a recreate can carry over the values it does not manage.
+        """
         flavor = self._connection.compute.create_flavor(
             name=resource.name,
             ram=resource.ram,
@@ -91,17 +115,32 @@ class FlavorHandler(OpenStackHandler):
             swap=resource.swap,
             rxtx_factor=resource.rxtx_factor,
             is_public=resource.is_public,
+            description=description,
         )
 
-        if resource.extra_specs:
-            self._connection.compute.create_flavor_extra_specs(
-                flavor, resource.extra_specs
-            )
+        if extra_specs:
+            self._connection.compute.create_flavor_extra_specs(flavor, extra_specs)
         return flavor
 
     def _delete_flavor(self) -> None:
         self._connection.compute.delete_flavor(self.flavor.id, ignore_missing=True)
 
+    def _update_extra_specs(self, extra_specs: dict[str, Any]) -> None:
+        """Reconcile the extra specs of an existing flavor.
+
+        Nova has no endpoint to replace the whole set at once: keys that are no
+        longer desired have to be deleted one by one, the rest is overwritten in
+        a single call.
+        """
+        for key in self.flavor.extra_specs:
+            if key not in extra_specs:
+                self._connection.compute.delete_flavor_extra_specs_property(
+                    self.flavor, key
+                )
+
+        if extra_specs:
+            self._connection.compute.create_flavor_extra_specs(self.flavor, extra_specs)
+
     def read_resource(self, ctx: handler.HandlerContext, resource: Flavor) -> None:
         self.flavor = self._get_flavor(resource)
         if self.flavor is None:
@@ -120,11 +159,18 @@ class FlavorHandler(OpenStackHandler):
         resource.swap = self.flavor.swap or 0
         resource.rxtx_factor = self.flavor.rxtx_factor
         resource.is_public = self.flavor.is_public
-        resource.extra_specs = self.flavor.extra_specs
+        # A null description or extra_specs means "not managed": leaving the desired
+        # value in place keeps whatever is on the flavor out of the diff.
+        if resource.description is not None:
+            resource.description = self.flavor.description or ""
+        if resource.extra_specs is not None:
+            resource.extra_specs = self.flavor.extra_specs
         self._set_facts(ctx)
 
     def create_resource(self, ctx: handler.HandlerContext, resource: Flavor) -> None:
-        self.flavor = self._create_flavor(resource)
+        self.flavor = self._create_flavor(
+            resource, resource.description, resource.extra_specs
+        )
         self._set_facts(ctx)
         ctx.set_created()
 
@@ -140,12 +186,27 @@ class FlavorHandler(OpenStackHandler):
     ) -> None:
         """Update flavor parameters.
 
-        OpenStack flavors must be immutable, so *every* change - including
-        extra_specs - is applied by deleting the existing flavor and
-        recreating it. This is only safe when OpenStack assigns the id: an
-        explicit flavor_id would collide with the soft-deleted flavor, so we
-        refuse such changes instead.
+        Nova lets us change the description and the extra specs on an existing
+        flavor. The sizing fields are immutable, so a change to any of those is
+        applied by deleting the existing flavor and recreating it. That is only
+        safe when OpenStack assigns the id: an explicit flavor_id would collide
+        with the soft-deleted flavor, so we refuse such changes instead.
+
+        A description or extra specs set to null are not managed, so they are
+        never updated, and a recreate carries the live values over rather than
+        dropping them.
         """
+        if not set(changes) - self.IN_PLACE_FIELDS:
+            if "description" in changes:
+                self._connection.compute.update_flavor(
+                    self.flavor, description=resource.description
+                )
+            # Unmanaged fields never end up in changes, so both are set here.
+            if "extra_specs" in changes and resource.extra_specs is not None:
+                self._update_extra_specs(resource.extra_specs)
+            ctx.set_updated()
+            return
+
         if self._resource_has_explicit_flavor_id(resource):
             raise ValueError(
                 f"Cannot change {sorted(changes)} on a flavor with an explicit "
@@ -157,8 +218,20 @@ class FlavorHandler(OpenStackHandler):
             "Recreating flavor; changed field(s): %(fields)s",
             fields=sorted(changes),
         )
+        # Carry over the fields the model does not manage, so recreating does not
+        # drop a description or specs set outside of it.
+        description = (
+            self.flavor.description
+            if resource.description is None
+            else resource.description
+        )
+        extra_specs = (
+            dict(self.flavor.extra_specs)
+            if resource.extra_specs is None
+            else resource.extra_specs
+        )
         self._delete_flavor()
-        self.flavor = self._create_flavor(resource)
+        self.flavor = self._create_flavor(resource, description, extra_specs)
         self._set_facts(ctx)
         ctx.set_updated()
 

inmanta_module_openstack-6.1.0/inmanta_plugins/openstack/compute/server_group.py

@@ -0,0 +1,87 @@
+"""
+Copyright 2026 Inmanta
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Contact: code@inmanta.com
+"""
+
+import logging
+
+from inmanta.agent import handler
+from inmanta.agent.handler import ResourcePurged, SkipResource, provider
+from inmanta.resources import resource
+
+from inmanta_plugins.openstack.common.base import OpenStackHandler, OpenstackResource
+
+LOGGER = logging.getLogger(__name__)
+
+
+@resource("openstack::ServerGroup", agent="provider.name", id_attribute="name")
+class ServerGroup(OpenstackResource):
+    """A Nova server group with a scheduling policy."""
+
+    fields = ("name", "policy")
+    name: str
+    policy: str
+
+
+@provider("openstack::ServerGroup", name="openstack")
+class ServerGroupHandler(OpenStackHandler):
+    @staticmethod
+    def _policy_of(group) -> str:
+        # A server group always has exactly one policy. Nova returns it as a single
+        # string from microversion 2.64, and as a one-element list on older ones.
+        if group.policy:
+            return group.policy
+        return group.policies[0]
+
+    def read_resource(self, ctx: handler.HandlerContext, resource: ServerGroup) -> None:
+        group = self.get_server_group(resource.name)
+        if group is None:
+            raise ResourcePurged()
+
+        resource.purged = False
+        resource.policy = self._policy_of(group)
+        ctx.set_fact("server_group_id", group.id, expires=False)
+
+    def create_resource(
+        self, ctx: handler.HandlerContext, resource: ServerGroup
+    ) -> None:
+        # The soft-affinity/soft-anti-affinity policies require compute API microversion
+        # 2.15 or higher. openstacksdk negotiates up to the server's maximum supported
+        # microversion (>= 2.15 on any supported Nova) and translates the `policy`
+        # argument to the `policies` list on older clouds, so the policy is accepted.
+        group = self._connection.compute.create_server_group(
+            name=resource.name, policy=resource.policy
+        )
+        ctx.set_fact("server_group_id", group.id, expires=False)
+        ctx.set_created()
+
+    def update_resource(
+        self, ctx: handler.HandlerContext, changes: dict, resource: ServerGroup
+    ) -> None:
+        # A server group is immutable in Nova: its policy cannot be changed after
+        # creation. Surface the drift as a skip rather than silently ignoring it.
+        raise SkipResource(
+            "A server group's policy cannot be changed in place; delete and recreate "
+            "the server group to change its policy."
+        )
+
+    def delete_resource(
+        self, ctx: handler.HandlerContext, resource: ServerGroup
+    ) -> None:
+        group = self.get_server_group(resource.name)
+        if group is not None:
+            self._connection.compute.delete_server_group(group, ignore_missing=True)
+        ctx.set_purged()