inmanta-module-openstack 6.1.1__tar.gz → 6.1.2__tar.gz

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.1.1
+Version: 6.1.2
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/inmanta_module_openstack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.1.1
+Version: 6.1.2
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/inmanta_module_openstack.egg-info/SOURCES.txt

@@ -50,14 +50,17 @@ tests/test_flavor.py
 tests/test_host_aggregate.py
 tests/test_image.py
 tests/test_keystone.py
+tests/test_network.py
+tests/test_network_port.py
 tests/test_network_port_fixed_ips.py
-tests/test_network_port_missing_network.py
 tests/test_network_port_security_groups.py
-tests/test_network_port_shared_network.py
-tests/test_neutron.py
 tests/test_nova.py
+tests/test_qos_policy.py
 tests/test_quota.py
+tests/test_router.py
+tests/test_security_group.py
 tests/test_security_group_ethertype.py
 tests/test_server_group.py
+tests/test_subnet.py
 tests/test_trunk.py
 tests/test_vm_boot_nic.py

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/common/base.py

@@ -360,6 +360,16 @@ class OpenStackHandler(CRUDHandler):
 
         return self.require_single_item(servers)
 
+    def get_project_server(self, resource, name, project_id):
+        """
+        Retrieve a server by name in the project of the resource
+        """
+        # Nova lists only the servers of the token's own project. Servers of another
+        # project need all_projects, the project_id filter is ignored without it.
+        if resource.project == resource.admin_project_name:
+            return self.get_server_by_name(name)
+        return self.get_server_by_name(name, project_id, all_projects=True)
+
     def _get_qos_policy(self, **query_params):
         try:
             policies = self._connection.network.qos_policies(**query_params)

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/compute/virtual_machine.py

@@ -17,6 +17,7 @@ Contact: code@inmanta.com
 """
 
 import time
+from collections.abc import Callable
 from typing import Any
 
 from inmanta import ast
@@ -29,7 +30,7 @@ from inmanta.agent.handler import (
 )
 from inmanta.execute import proxy
 from inmanta.resources import resource
-from openstack.exceptions import NotFoundException, ResourceFailure, ResourceTimeout
+from openstack.exceptions import NotFoundException
 
 from inmanta_plugins.openstack.common.base import (
     NotUniqueException,
@@ -190,13 +191,9 @@ class VirtualMachine(OpenstackResource):
 
 @provider("openstack::VirtualMachine", name="openstack")
 class VirtualMachineHandler(OpenStackHandler):
-    @cache(timeout=1, cache_none=False)
     def _get_server(self, ctx, resource):
-        if resource.project == resource.admin_project_name:
-            return self.get_server_by_name(resource.name)
-
         project_id = self.get_project_id(resource, resource.project)
-        server = self.get_server_by_name(resource.name, project_id, all_projects=True)
+        server = self.get_project_server(resource, resource.name, project_id)
         if server is None:
             ctx.debug(
                 "No server named %(name)s found in project %(project)s.",
@@ -299,26 +296,18 @@ class VirtualMachineHandler(OpenStackHandler):
             self._connection.compute.create_keypair(**keypair_args)
             ctx.info(f"Created a new keypair with name {resource.key_name}")
 
-    def _server_with_name_exists(self, resource):
-        if resource.project == resource.admin_project_name:
-            server = self.get_server_by_name(resource.name)
-        else:
-            project_id = self.get_project_id(resource, resource.project)
-            server = self.get_server_by_name(
-                resource.name, project_id, all_projects=True
-            )
-        return server is not None
+    def _bound_ports(self) -> list:
+        """Ports that are still bound to self.server."""
+        return list(self._connection.network.ports(device_id=self.server.id))
 
-    def _raise_server_error(self, ctx: HandlerContext, log_message: str) -> None:
-        """Re-fetch self.server, log its Nova fault, and raise.
+    def _raise_server_error(
+        self, ctx: HandlerContext, server: Any, log_message: str
+    ) -> None:
+        """Log the Nova fault of `server` and raise.
 
-        Used both when a server is found in ERROR state by read_resource and
-        when it transitions to ERROR during a build. Re-fetching is necessary
-        because the list API used by get_server_by_name may omit the fault body.
         The ERROR-state server must be deleted (manually or via purge) before
         Inmanta will attempt to recreate it.
         """
-        server = self._connection.compute.get_server(self.server.id)
         fault = getattr(server, "fault", None) or {}
         msg = fault.get("message", "unknown error")
         details = fault.get("details", "")
@@ -326,12 +315,42 @@ class VirtualMachineHandler(OpenStackHandler):
             log_message,
             fault_message=msg,
             fault_details=details,
-            server_id=self.server.id,
+            server_id=server.id,
         )
         raise Exception(
-            f"Server {self.server.id} ({self.server.name}) is in ERROR state: {msg}"
+            f"Server {server.id} ({server.name}) is in ERROR state: {msg}"
         ) from None
 
+    def _poll_server(self, ctx: HandlerContext, operation: str) -> Any:
+        """Fetch self.server by id, None when it is not found.
+
+        Raises when Nova left it in ERROR state. An ERROR server that still has
+        a task state is left alone, Nova is still working on it.
+        """
+        try:
+            server = self._connection.compute.get_server(self.server.id)
+        except NotFoundException:
+            return None
+        if server.status == "ERROR" and not server.task_state:
+            self._raise_server_error(
+                ctx, server, f"VM entered ERROR state during {operation}"
+            )
+        return server
+
+    def _wait_until(
+        self, condition: Callable[[], bool], timeout: int, interval: int = 2
+    ) -> bool:
+        """Poll `condition` every `interval` seconds until it returns True.
+
+        Returns False when `timeout` seconds pass before the condition is met.
+        """
+        deadline = time.monotonic() + timeout
+        while not condition():
+            if time.monotonic() >= deadline:
+                return False
+            time.sleep(interval)
+        return True
+
     def _wait_for_status(
         self,
         ctx: HandlerContext,
@@ -345,40 +364,31 @@ class VirtualMachineHandler(OpenStackHandler):
         and is only used to build the error messages.
 
         Nova may briefly return a 404 for the instance while a resize is being
-        applied; such transient NotFoundException errors are tolerated and polling
-        resumes until the status is reached or the timeout elapses.
+        applied, this is treated as not ready yet.
         """
-        deadline = time.monotonic() + timeout
-        while True:
-            remaining = deadline - time.monotonic()
-            if remaining <= 0:
-                self._raise_status_timeout(ctx, status, timeout)
-            try:
-                self.server = self._connection.compute.wait_for_server(
-                    self.server, status=status, wait=max(1, int(remaining))
-                )
-                return
-            except ResourceFailure:
-                self._raise_server_error(
-                    ctx, f"VM entered ERROR state during {operation}"
-                )
-            except ResourceTimeout:
-                self._raise_status_timeout(ctx, status, timeout)
-            except NotFoundException:
-                # The instance is temporarily not retrievable (e.g. mid-resize);
-                # give it a moment and keep polling until the deadline.
-                time.sleep(2)
+
+        def has_status() -> bool:
+            server = self._poll_server(ctx, operation)
+            if server is None:
+                return False
+            self.server = server
+            return server.status == status
+
+        if not self._wait_until(has_status, timeout):
+            self._raise_status_timeout(ctx, status, operation, timeout)
 
     def _raise_status_timeout(
-        self, ctx: HandlerContext, status: str, timeout: int
+        self, ctx: HandlerContext, status: str, operation: str, timeout: int
     ) -> None:
-        try:
-            server = self._connection.compute.get_server(self.server.id)
-            current_status = getattr(server, "status", "unknown")
-            task_state = getattr(server, "task_state", "unknown")
-        except NotFoundException:
+        # Fetch again so the error shows the state at timeout, not the last
+        # successful poll.
+        server = self._poll_server(ctx, operation)
+        if server is None:
             current_status = "not_found"
             task_state = "unknown"
+        else:
+            current_status = server.status
+            task_state = server.task_state
         ctx.error(
             f"Timed out waiting for VM to reach {status}",
             timeout_seconds=timeout,
@@ -391,6 +401,27 @@ class VirtualMachineHandler(OpenStackHandler):
             f"(status={current_status}, task_state={task_state})"
         ) from None
 
+    def _raise_ports_timeout(self, ctx: HandlerContext, timeout: int) -> None:
+        ports = [
+            {
+                "id": port.id,
+                "name": port.name,
+                "status": port.status,
+                "device_owner": port.device_owner,
+            }
+            for port in self._bound_ports()
+        ]
+        ctx.error(
+            "Timed out waiting for the ports of the deleted VM to be released",
+            timeout_seconds=timeout,
+            ports=ports,
+            server_id=self.server.id,
+        )
+        raise Exception(
+            f"Server {self.server.id} is deleted but its ports are still bound after "
+            f"{timeout}s: {', '.join(port['id'] for port in ports)}"
+        ) from None
+
     def _get_server_flavor_name(self, server) -> str:
         """Return the flavor name of `server`.
 
@@ -442,15 +473,24 @@ class VirtualMachineHandler(OpenStackHandler):
         """
         This method will check what the status of the give resource is on
         openstack.
+
+        A server in ERROR state raises, unless it is being deleted or purged.
         """
         self.server = self._get_server(ctx, resource)
         if self.server is None:
             raise ResourcePurged()
 
-        # Raise error always except when the resource is being purged.
-        if self.server.status == "ERROR" and not resource.purged:
+        # A server that is being deleted, or that is to be purged, goes away anyway.
+        if (
+            self.server.status == "ERROR"
+            and self.server.task_state != "deleting"
+            and not resource.purged
+        ):
             self._raise_server_error(
-                ctx, "Server is in ERROR state; delete it to allow redeployment"
+                ctx,
+                self.server,
+                "Server is in ERROR state. Please check the OpenStack console for details. "
+                "Deployment cannot continue, please repair the server manually!",
             )
 
         resource.purged = False
@@ -504,6 +544,8 @@ class VirtualMachineHandler(OpenStackHandler):
             metadata=resource.metadata,
             files=resource.personality,
         )
+        # With block devices the boot disk, and its image, come from the mapping.
+        # image_id is only for booting from an image on local disk.
         if resource.block_devices:
             args["block_device_mapping_v2"] = list(resource.block_devices)
         else:
@@ -534,32 +576,36 @@ class VirtualMachineHandler(OpenStackHandler):
 
     def delete_resource(self, ctx: HandlerContext, resource: VirtualMachine) -> None:
         self._connection.compute.delete_server(self.server, ignore_missing=True)
+        timeout = 120
 
-        def is_server_deletion_finished() -> bool:
-            ports = list(self._connection.network.ports(device_id=self.server.id))
-            if ports:
-                return False
-            return self._get_server(ctx, resource) is None
+        def is_server_deleted() -> bool:
+            return self._poll_server(ctx, "delete") is None
 
-        # Wait until the server has been deleted
-        count = 0
-        ctx.info("Waiting until server is deleted.")
-        while not is_server_deletion_finished() and count < 60:
-            time.sleep(1)
-            count += 1
+        # Nova releases the ports after the server is gone. A port that is still
+        # bound cannot be reused by a new server or by the NetworkPort handler.
+        def are_ports_released() -> bool:
+            return not self._bound_ports()
 
-        if count >= 60:
-            ctx.warning("Delete still in progress, giving up waiting.")
+        ctx.info("Waiting until server is deleted.")
+        if not self._wait_until(is_server_deleted, timeout):
+            self._raise_status_timeout(ctx, "DELETED", "delete", timeout)
+        if not self._wait_until(are_ports_released, timeout):
+            self._raise_ports_timeout(ctx, timeout)
 
+        ctx.info("Server was deleted.")
         ctx.set_purged()
 
     def update_resource(
         self, ctx: HandlerContext, changes: dict, resource: VirtualMachine
     ) -> None:
-
+        # read_resource lets through an ERROR server that is being deleted.
         if self.server.status == "ERROR":
             self._raise_server_error(
-                ctx, "Server is in ERROR state; delete it to allow redeployment"
+                ctx,
+                self.server,
+                "Server is in ERROR state, thus cannot be updated. "
+                "Please check the OpenStack console for details. "
+                "Deployment cannot continue, please repair the server manually!",
             )
 
         self.validate_allowed_fields(
@@ -587,7 +633,6 @@ class VirtualMachineHandler(OpenStackHandler):
                     self.server, remove_rule
                 )
 
-        self.server = self._get_server(ctx, resource)
         ctx.set_updated()
 
     def _set_facts(self, ctx):

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/network/network_port.py

@@ -224,12 +224,7 @@ class NetworkPortHandler(OpenStackHandler):
         tries = 0
         max_attempts = resource.retries if resource.retries > 0 else 1
         while tries < max_attempts:
-            cross_project = resource.project != resource.admin_project_name
-            vm = self.get_server_by_name(
-                resource.host,
-                project_id if cross_project else None,
-                all_projects=cross_project,
-            )
+            vm = self.get_project_server(resource, resource.host, project_id)
             if vm is None:
                 return None
 

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/network/router.py

@@ -20,6 +20,7 @@ from inmanta.agent import handler
 from inmanta.agent.handler import ResourcePurged, SkipResource, provider
 from inmanta.execute import proxy
 from inmanta.resources import resource
+from openstack.network.v2.subnet import Subnet as OSSubnet
 
 from inmanta_plugins.openstack.common.base import (
     OpenStackHandler,
@@ -163,14 +164,24 @@ class RouterHandler(OpenStackHandler):
         self._connection.network.delete_router(self.router.id, ignore_missing=True)
         ctx.set_purged()
 
+    def _get_router_subnet(self, name: str) -> OSSubnet | None:
+        """
+        Retrieve a subnet of the router by name. A subnet name is only unique within a
+        project, so the router's own project is searched first. Only when it has no such
+        subnet, the subnet of another project is looked up, e.g. one of a shared network.
+        """
+        subnet = self.get_subnet(self.project_id, name=name)
+        if subnet is None:
+            subnet = self.get_subnet(name=name)
+        return subnet
+
     def _update_subnets(self, current, desired):
         current = set(current)
         to = set(desired)
 
         # subnets to add to the router
         for subnet_name in to - current:
-            # query for the subnet id.
-            subnet = self.get_subnet(name=subnet_name)
+            subnet = self._get_router_subnet(subnet_name)
             if subnet is None:
                 raise Exception(f"Unable to find id of subnet {subnet_name}")
 
@@ -180,10 +191,9 @@ class RouterHandler(OpenStackHandler):
 
         # subnets to delete
         for subnet_name in current - to:
-            # query for the subnet id.
-            subnet = self.get_subnet(name=subnet_name)
+            subnet = self._get_router_subnet(subnet_name)
             if subnet is None:
-                raise Exception("Unable to find id of subnet %s" % subnet)
+                raise Exception(f"Unable to find id of subnet {subnet_name}")
 
             self._connection.network.remove_interface_from_router(
                 self.router, subnet_id=subnet.id

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/setup.cfg

@@ -22,7 +22,7 @@ target-version = 'py36', 'py37', 'py38'
 name = inmanta-module-openstack
 freeze_recursive = False
 freeze_operator = ~=
-version = 6.1.1
+version = 6.1.2
 license = Apache 2.0
 
 [egg_info]

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/setup.cfg

@@ -22,7 +22,7 @@ target-version = 'py36', 'py37', 'py38'
 name = inmanta-module-openstack
 freeze_recursive = False
 freeze_operator = ~=
-version = 6.1.1
+version = 6.1.2
 license = Apache 2.0
 
 [egg_info]

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/tests/test_block_devices.py

@@ -22,7 +22,7 @@ from typing import Optional
 import pytest
 from conftest import assert_dryrun_deploy_dryrun
 
-TEST_VM_NAME = "inmanta-unit-test-bdm"
+TEST_VM_NAME = "os-unit-test-bdm"
 
 
 def get_bdm_model(

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/tests/test_common_base.py

@@ -29,6 +29,11 @@ def _handler(connection) -> OpenStackHandler:
 
 
 def test_get_project_id_uses_scoped_project_without_identity_lookup() -> None:
+    """
+    A project-scoped token already knows its own project id, so it is used without a
+    Keystone lookup: a non-admin user may be forbidden to get or list projects. The
+    deployment tests run with admin credentials, which are never refused that lookup.
+    """
     connection = SimpleNamespace(
         current_project_id="project-id",
         identity=MagicMock(),
@@ -43,6 +48,7 @@ def test_get_project_id_uses_scoped_project_without_identity_lookup() -> None:
 
 
 def test_get_project_id_can_still_resolve_another_visible_project() -> None:
+    """Another project than the one the token is scoped to is still looked up."""
     connection = SimpleNamespace(
         current_project_id="current-project-id",
         identity=MagicMock(),

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/tests/test_host_aggregate.py

@@ -19,12 +19,12 @@ Contact: code@inmanta.com
 import inmanta
 import pytest
 
-AGGREGATE_NAME = "inmanta_unit_test_aggregate"
+AGGREGATE_NAME = "os_unit_test_aggregate"
 # An unrelated key seeded on the aggregate that must survive every operation, proving
 # the resource only manages its own key and never clobbers others.
 OTHER_KEY = "filter_tenant_id_other"
 OTHER_VALUE = "other-project-uuid"
-MANAGED_KEY = "filter_tenant_id_inmanta_unit_test"
+MANAGED_KEY = "filter_tenant_id_os_unit_test"
 
 
 def _find_aggregate(connection):
@@ -128,7 +128,7 @@ def test_host_aggregate_metadata_missing_aggregate_is_skipped(project, os_tester
     os_tester.compile_with_provider("""
 openstack::HostAggregateMetadata(
     provider=provider,
-    aggregate="inmanta_unit_test_missing_aggregate",
+    aggregate="os_unit_test_missing_aggregate",
     key="filter_tenant_id_x",
     value="uuid-x",
 )

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/tests/test_image.py

@@ -24,7 +24,7 @@ import inmanta
 import inmanta.agent.handler
 import pytest
 
-TEST_IMAGE_NAME = "inmanta_unit_test"
+TEST_IMAGE_NAME = "os_unit_test"
 CIRROS_URI = "http://download.cirros-cloud.net/0.6.2/cirros-0.6.2-x86_64-disk.img"
 
 
@@ -424,6 +424,7 @@ image=openstack::Image(
 
         ctx_deploy = project.deploy(created_image)
         assert ctx_deploy.status == inmanta.const.ResourceState.deployed
+        assert not project.dryrun(created_image).changes
 
         matching_images = list(os_tester.connection.image.images(name=TEST_IMAGE_NAME))
         assert len(matching_images) == 1
@@ -436,7 +437,9 @@ def test_file_upload_without_glance_direct(tmp_path):
     Uploading a local file must not require the 'glance-direct' import method.
     When the cloud only enables 'web-download', the handler falls back to the
     classic direct data upload (PUT /v2/images/{id}/file) instead of raising.
-    Regression test for clouds that do not enable glance-direct.
+    Regression test for clouds that do not enable glance-direct. The lab cloud does
+    enable it, so this cannot be a deployment test: test_create_image_from_file covers
+    the glance-direct upload.
     """
     from unittest.mock import MagicMock
 
@@ -459,32 +462,3 @@ def test_file_upload_without_glance_direct(tmp_path):
     handler.image.upload.assert_called_once()
     handler._connection.image.stage_image.assert_not_called()
     handler._connection.image.import_image.assert_not_called()
-
-
-def test_file_upload_with_glance_direct(tmp_path):
-    """
-    When the cloud enables 'glance-direct', a local file is staged and imported
-    through the interoperable image import API rather than uploaded directly.
-    """
-    from unittest.mock import MagicMock
-
-    from inmanta_plugins.openstack.image.image import ImageHandler
-
-    image_file = tmp_path / "image.img"
-    image_file.write_bytes(b"fake-image-data")
-
-    handler = ImageHandler.__new__(ImageHandler)
-    handler._connection = MagicMock()
-    handler.image = MagicMock()
-
-    resource = MagicMock()
-    resource.file = str(image_file)
-    resource.uri = None
-
-    handler._import_image_via_methods(resource, {"web-download", "glance-direct"})
-
-    handler._connection.image.stage_image.assert_called_once()
-    handler._connection.image.import_image.assert_called_once_with(
-        handler.image, method="glance-direct"
-    )
-    handler.image.upload.assert_not_called()

{inmanta_module_openstack-6.1.1 → inmanta_module_openstack-6.1.2}/tests/test_keystone.py

@@ -27,7 +27,7 @@ import pytest
 USERNAME = "test_user123"
 EMAIL = "test@example.com"
 PASSWORD = "password123"
-PROJECT_NAME = "inmanta_unit_test"
+PROJECT_NAME = "os_unit_test"
 ROLE_MEMBER = "member"
 GROUP_NAME = "inmanta_test_group"
 GROUP_USER_NAME = "inmanta_group_test_user"