inmanta-module-openstack 6.0.0__tar.gz → 6.1.1__tar.gz

{inmanta_module_openstack-6.0.0 → inmanta_module_openstack-6.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.0.0
+Version: 6.1.1
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.0.0 → inmanta_module_openstack-6.1.1}/inmanta_module_openstack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.0.0
+Version: 6.1.1
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.0.0 → inmanta_module_openstack-6.1.1}/inmanta_module_openstack.egg-info/SOURCES.txt

@@ -16,6 +16,7 @@ inmanta_plugins/openstack/common/deps.py
 inmanta_plugins/openstack/compute/__init__.py
 inmanta_plugins/openstack/compute/flavor.py
 inmanta_plugins/openstack/compute/host_aggregate.py
+inmanta_plugins/openstack/compute/server_group.py
 inmanta_plugins/openstack/compute/virtual_machine.py
 inmanta_plugins/openstack/identity/__init__.py
 inmanta_plugins/openstack/identity/group.py
@@ -42,6 +43,7 @@ inmanta_plugins/openstack/network/trunk_port.py
 inmanta_plugins/openstack/quota/__init__.py
 inmanta_plugins/openstack/quota/quota.py
 tests/test_block_devices.py
+tests/test_common_base.py
 tests/test_dependency_handling.py
 tests/test_examples.py
 tests/test_flavor.py
@@ -49,8 +51,13 @@ tests/test_host_aggregate.py
 tests/test_image.py
 tests/test_keystone.py
 tests/test_network_port_fixed_ips.py
+tests/test_network_port_missing_network.py
 tests/test_network_port_security_groups.py
+tests/test_network_port_shared_network.py
 tests/test_neutron.py
 tests/test_nova.py
 tests/test_quota.py
-tests/test_trunk.py
+tests/test_security_group_ethertype.py
+tests/test_server_group.py
+tests/test_trunk.py
+tests/test_vm_boot_nic.py

{inmanta_module_openstack-6.0.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/common/base.py

@@ -18,9 +18,11 @@ Contact: code@inmanta.com
 
 import openstack.connection
 import openstack.exceptions
-from inmanta.agent.handler import CRUDHandler, cache
+from inmanta.agent.handler import CRUDHandler, SkipResource, cache
 from inmanta.execute import proxy
 from inmanta.resources import ManagedResource, PurgeableResource
+from openstack.network.v2.network import Network as OSNetwork
+from openstack.network.v2.subnet import Subnet as OSSubnet
 
 CRED_TIMEOUT = 600  # OpenStackHandler
 
@@ -94,8 +96,12 @@ class Port(OpenstackResource):
 
     fields = ("name", "address", "subnet", "network")
     name: str
-    address: str
-    subnet: str
+    # A NetworkPort does not need a fixed ip, nor to be pinned to a subnet: its getters
+    # report None for both when the relation is unset. RouterPort re-declares them as
+    # mandatory, which its model cardinality guarantees. The network is always there,
+    # taken from the relation itself or from the subnet the port is pinned to.
+    address: str | None
+    subnet: str | None
     network: str
 
     @staticmethod
@@ -169,15 +175,19 @@ class OpenStackHandler(CRUDHandler):
         """
         Retrieve the id of a project based on the given name
         """
+        # A project-scoped token already knows its own project id. Use it before
+        # querying Keystone: non-admin users may be forbidden to get/list projects.
+        current_project_id = self._connection.current_project_id
+        if name == resource.admin_project_name and current_project_id:
+            return current_project_id
+
         project = self._connection.identity.find_project(name)
         if project:
             return project.id
 
         # fallback for non-admins: if we’re scoped to a project and its name matches
-        if self._connection.current_project_id:
-            current = self._connection.identity.get_project(
-                self._connection.current_project_id
-            )
+        if current_project_id:
+            current = self._connection.identity.get_project(current_project_id)
             if current and current.name == name:
                 return current.id
 
@@ -185,14 +195,30 @@ class OpenStackHandler(CRUDHandler):
             f"Project not found or not visible: {name}"
         )
 
-    def get_network(self, project_id=None, name=None, network_id=None):
+    def get_network(
+        self,
+        project_id: str | None = None,
+        name: str | None = None,
+        network_id: str | None = None,
+        include_shared: bool = False,
+        include_external: bool = False,
+    ) -> OSNetwork | None:
         """
         Retrieve the network id based on the name of the network
+
+        :param include_shared: also consider networks owned by another project when the
+            project scoped lookup comes up empty, restricted to shared networks. A shared
+            network is owned by the project that created it, so a lookup scoped to a
+            project merely using it never finds it.
+        :param include_external: likewise for external networks, which another project
+            owns as well: the management network of an appliance typically is one. Note
+            that every project can read an external network, but only an admin can create
+            a port in its own project on one, unless it is shared as well.
         """
         if not name and not network_id:
             raise Exception("Either a name or an id needs to be provided.")
 
-        query_params = {}
+        query_params: dict[str, object] = {}
         if project_id:
             query_params["project_id"] = project_id
         if name:
@@ -201,26 +227,70 @@ class OpenStackHandler(CRUDHandler):
             query_params["id"] = network_id
 
         networks = self._connection.network.networks(**query_params)
-        return self.require_single_item(networks)
-
-    def get_subnet(self, project_id=None, name=None, subnet_id=None):
+        network = self.require_single_item(networks)
+
+        if network is None and project_id and (include_shared or include_external):
+            del query_params["project_id"]
+            if include_shared:
+                networks = self._connection.network.networks(
+                    **query_params, is_shared=True
+                )
+                network = self.require_single_item(networks)
+            if network is None and include_external:
+                networks = self._connection.network.networks(
+                    **query_params, is_router_external=True
+                )
+                network = self.require_single_item(networks)
+
+        return network
+
+    def get_subnet(
+        self,
+        project_id: str | None = None,
+        name: str | None = None,
+        subnet_id: str | None = None,
+        network_id: str | None = None,
+    ) -> OSSubnet | None:
         """
         Retrieve the subnet based on name or id
         """
         if not name and not subnet_id:
             raise Exception("Either a name or an id needs to be provided.")
 
-        query_params = {}
+        query_params: dict[str, object] = {}
         if project_id:
             query_params["project_id"] = project_id
         if name:
             query_params["name"] = name
         if subnet_id:
             query_params["id"] = subnet_id
+        if network_id:
+            query_params["network_id"] = network_id
 
         subnets = self._connection.network.subnets(**query_params)
         return self.require_single_item(subnets)
 
+    def get_server_group(self, name: str):
+        """
+        Retrieve a Nova server group by name.
+
+        Nova does not filter server groups by name server-side, so list the groups in the
+        connection's project scope and match on the name ourselves. Nova does allow
+        several groups to share a name, which cannot be managed unambiguously: skip
+        rather than pick one.
+        """
+        groups = [
+            group
+            for group in self._connection.compute.server_groups()
+            if group.name == name
+        ]
+        if len(groups) > 1:
+            raise SkipResource(
+                f"Found more than one server group named '{name}'; refusing "
+                "to manage a non-unique server group."
+            )
+        return groups[0] if groups else None
+
     def get_router(self, project_id=None, name=None, router_id=None):
         """
         Retrieve the router based on name or id
@@ -276,14 +346,15 @@ class OpenStackHandler(CRUDHandler):
             return None
         return self._connection.identity.find_domain(domain_name)
 
-    def get_server_by_name(self, name, project_id=None):
+    def get_server_by_name(self, name, project_id=None, all_projects=False):
         """
         Retrieve a server by name
         """
         additional_args = {}
         if project_id is not None:
-            additional_args["all_projects"] = True
             additional_args["project_id"] = project_id
+        if all_projects:
+            additional_args["all_projects"] = True
         # regex for exact match
         servers = self._connection.compute.servers(name=f"^{name}$", **additional_args)
 

{inmanta_module_openstack-6.0.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/common/deps.py

@@ -18,11 +18,17 @@ Contact: code@inmanta.com
 
 from collections import defaultdict
 from collections.abc import Mapping
+from typing import TYPE_CHECKING, cast
 
 from inmanta.export import dependency_manager
 
 from inmanta_plugins.openstack.common.base import OpenstackResource
 
+if TYPE_CHECKING:
+    # Only a name for the cast below: this export-time module does not depend on a
+    # handler module at runtime.
+    from inmanta_plugins.openstack.network.network_port import NetworkPort
+
 # Per-provider view of the collected resources: resource type -> resource name -> resource.
 ResourceCollector = Mapping[str, Mapping[str, OpenstackResource]]
 
@@ -35,6 +41,7 @@ MANAGED_DEPENDENCIES = {
     "openstack::NetworkPort",
     "openstack::FloatingIP",
     "openstack::SecurityGroup",
+    "openstack::ServerGroup",
 }
 
 
@@ -68,9 +75,14 @@ def set_dependencies_on_purged_resources(collector: ResourceCollector) -> None:
     vms = collector.get("openstack::VirtualMachine", {})
     ports = collector.get("openstack::NetworkPort", {})
     sgs = collector.get("openstack::SecurityGroup", {})
+    server_groups = collector.get("openstack::ServerGroup", {})
 
     # When the VM is purged, all its purged ports should be deployed first
     for vm in vms.values():
+        # A purged server group is removed only after the VMs scheduled into it are gone.
+        if vm.server_group in server_groups:
+            server_groups[vm.server_group].requires.add(vm.id)
+
         for vm_port in vm.ports:
             if vm_port["name"] in ports:
                 port = ports[vm_port["name"]]
@@ -99,6 +111,7 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
     ports = collector.get("openstack::NetworkPort", {})
     fips = collector.get("openstack::FloatingIP", {})
     sgs = collector.get("openstack::SecurityGroup", {})
+    server_groups = collector.get("openstack::ServerGroup", {})
     router_map = {}
 
     # they require the project to exist
@@ -133,22 +146,40 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
         if vm.model.project.name in projects:
             vm.requires.add(projects[vm.model.project.name].id)
 
+        # The vm resolves each boot NIC through the port's subnet, or through its network
+        # when the port is not pinned to a subnet. Either way that object has to exist
+        # before the vm boots.
         for port in vm.ports:
-            if port["network"] in subnets:
-                vm.requires.add(subnets[port["network"]].id)
+            if port["subnet"] in subnets:
+                vm.requires.add(subnets[port["subnet"]].id)
+            elif port["network"] in networks:
+                vm.requires.add(networks[port["network"]].id)
 
         for sg in vm.security_groups:
             if sg in sgs:
                 vm.requires.add(sgs[sg].id)
 
-    for port in ports.values():
+        # The scheduler hint is resolved at boot, so the group must exist by then.
+        if vm.server_group in server_groups:
+            vm.requires.add(server_groups[vm.server_group].id)
+
+    for collected_port in ports.values():
+        # The collector hands out the base type; every entry here is a NetworkPort.
+        port = cast("NetworkPort", collected_port)
+
         if port.model.project.name in projects:
             port.requires.add(projects[port.model.project.name].id)
 
-        if port.network in projects:
-            port.requires.add(subnets[port.network].id)
+        # The port lives on a network, and is pinned to one of its subnets when it
+        # requests a fixed ip. The network has to exist before the port is created at
+        # all; the subnet has to exist before the port can pin a fixed ip in it.
+        if port.network in networks:
+            port.requires.add(networks[port.network].id)
+
+        if port.subnet is not None and port.subnet in subnets:
+            port.requires.add(subnets[port.subnet].id)
 
-        if port.host in vms:
+        if port.host is not None and port.host in vms:
             if port.is_trunk_parent:
                 # A trunk parent must exist (unbound) before its vm: the trunk is built
                 # on it and the vm then boots on the pre-created port. Ordering the port
@@ -167,13 +198,31 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
             fip.requires.add(networks[fip.external_network].id)
 
         if fip.port in ports:
-            port = ports[fip.port]
+            port = cast("NetworkPort", ports[fip.port])
             fip.requires.add(port.id)
 
-            # find router on which this floating ip is added
-            key = (fip.external_network, port.subnet)
-            if key in router_map:
-                fip.requires.add(router_map[key].id)
+            # Find the router this floating ip is routed over: the one with a gateway on
+            # the external network and an interface on the port's network. A port pinned
+            # to a subnet names that subnet; a port that only knows its network is
+            # matched through every managed subnet of that network instead, as the
+            # router is attached to the network by one of them.
+            if port.subnet is not None:
+                port_subnets = [port.subnet]
+            else:
+                # Matching networks by name is enough even though the collector spans
+                # every project of the provider: a network resource is identified by
+                # (provider, name), so two projects of one provider cannot both hold a
+                # network under this name.
+                port_subnets = [
+                    subnet_name
+                    for subnet_name, subnet in subnets.items()
+                    if subnet.model.network.name == port.network
+                ]
+
+            for subnet_name in port_subnets:
+                key = (fip.external_network, subnet_name)
+                if key in router_map:
+                    fip.requires.add(router_map[key].id)
 
 
 @dependency_manager