Add support for defining OpenStack groups

roles/os_projects/README.md

@@ -55,6 +55,25 @@ Each item should be a dict containing the following items:
   - `create_user`: Boolean to indicate whether or not to create the user.  Can
     be useful if the user already exists e.g the user is defined in LDAP.
     (optional)
+- `groups`: Optional list of groups to register. Each group should be a dict
+  containing the following items:
+  - `name`: The name of the group.
+  - `description`: Optional description for the group.
+  - `domain`: The domain of the group.
+  - `roles`: Optional list of roles to assign to the group in the project.
+  - `domain_roles`: Optional list of roles to assign to the group in the
+    group domain.
+  - `users`: Optional list of users to register. Each user should be a dict
+    containing the following items:
+    - `name`: The name of the user.
+    - `password`: The user's password.
+    - `openrc_file`: Optional path to an environment file to create.
+    - `create_user`: Optional boolean (Default: true) to indicate whether to
+      create the user. This can be useful if the user already exists.
+    (e.g. LDAP defined users)
+  - `create_group`: Optional boolean (Default: true) to indicate whether to
+      create the group. This can be useful if the group already exists.
+    (e.g. LDAP defined groups)
 - `keypairs`: Optional list of SSH key pairs to register with Nova. Each key
   pair should be a dict containing the following items:
   - `name`: The name of the keypair.
@@ -106,6 +125,14 @@ resources.
                   roles:
                     - admin
                   openrc_file: /home/user/user1.openrc
+              groups:
+                - name: group_a
+                  domain: default
+                  roles:
+                    - member
+                  users:
+                    - name: user2
+                      password: ashpineapplevictorcommand
               keypairs:
                 - name: keypair1
                   public_key_file: /path/to/key
@@ -116,3 +143,4 @@ Author Information
 ------------------
 
 - Mark Goddard (<mark@stackhpc.com>)
+- Seunghun Lee (<seunghun@stackhpc.com>)

roles/os_projects/defaults/main.yml

@@ -31,6 +31,28 @@ os_projects_domains: []
 #   - 'domain_roles': Optional list of roles to assign to the user in the user
 #     domain.
 #   - 'openrc_file': Optional path to an environment file to create.
+#   - 'create_user': Optional boolean (Default: true) to indicate whether to
+#     create the user. This can be useful if the user already exists.
+#   (e.g. LDAP defined users)
+# - 'groups': Optional list of groups to register. Each group should be a dict
+#   containing the following items:
+#   - 'name': The name of the group.
+#   - 'description': Optional description for the group.
+#   - 'domain': The domain of the group.
+#   - 'roles': Optional list of roles to assign to the group in the project.
+#   - 'domain_roles': Optional list of roles to assign to the group in the
+#     group domain.
+#   - 'users': Optional list of users to register. Each user should be a dict
+#     containing the following items:
+#     - 'name': The name of the user.
+#     - 'password': The user's password.
+#     - 'openrc_file': Optional path to an environment file to create.
+#     - 'create_user': Optional boolean (Default: true) to indicate whether to
+#       create the user. This can be useful if the user already exists.
+#     (e.g. LDAP defined users)
+#   - 'create_group': Optional boolean (Default: true) to indicate whether to
+#     create the group. This can be useful if the group already exists.
+#   (e.g. LDAP defined groups)
 # - 'keypairs': Optional list of SSH key pairs to register with Nova. Each key
 #   pair should be a dict containing the following items:
 #   - 'name': The name of the keypair.

roles/os_projects/tasks/group-user-openrc.yml

@@ -0,0 +1,16 @@
+---
+- name: Ensure openrc environment file exists for group users
+  ansible.builtin.template:
+    src: group-openrc.j2
+    dest: "{{ item.1.openrc_file }}"
+    mode: "0600"
+  with_subelements:
+    - "{{ project.groups }}"
+    - users
+    - skip_missing: true
+  when:
+    - project.groups is defined
+    - item.1.openrc_file is defined
+  loop_control:
+    label: "{{ project.name }}: {{ item.0.name }}: {{ item.1.name }}"
+  delegate_to: localhost

roles/os_projects/tasks/group-users.yml

@@ -0,0 +1,103 @@
+---
+- name: Ensure group users exist
+  openstack.cloud.identity_user:
+    auth_type: "{{ os_projects_auth_type }}"
+    auth: "{{ os_projects_admin_auth }}"
+    region_name: "{{ os_projects_region | default(omit) }}"
+    cacert: "{{ os_projects_cacert | default(omit) }}"
+    cloud: "{{ os_projects_cloud | default(omit) }}"
+    interface: "{{ os_projects_interface | default(omit, true) }}"
+    name: "{{ item.1.name }}"
+    description: "{{ item.1.description | default(omit) }}"
+    email: "{{ item.1.email | default(omit) }}"
+    password: "{{ item.1.password | default(omit) }}"
+    # NOTE(bbezak): identity_user looks up default_project in the user domain
+    # ('domain'). Omit default_project for cross-domain users to avoid false
+    # "No Project found" errors.
+    default_project: "{{ (user_domain_id == project_domain_id) | ternary(project.name, omit) }}"
+    domain: "{{ user_domain_id }}"
+    state: present
+    enabled: true
+    wait: true
+  with_subelements:
+    - "{{ project.groups }}"
+    - users
+    - skip_missing: true
+  when:
+    - project.groups is defined
+    - item.1.create_user | default(true) | bool
+  environment: "{{ os_projects_environment }}"
+  vars:
+    user_domain_id: "{{ (project.user_domain in os_projects_domain_to_id.values()) | ternary(project.user_domain, os_projects_domain_to_id[project.user_domain]) }}"
+    project_domain_id: "{{ (project.project_domain in os_projects_domain_to_id.values()) | ternary(project.project_domain, os_projects_domain_to_id[project.project_domain]) }}"
+  loop_control:
+    label: "{{ item.0.name }}: {{ item.1.name }}"
+
+# This task is to ensure we don't miss users that have ``create_user`` set to false
+- name: Look up users
+  openstack.cloud.identity_user_info:
+    auth_type: "{{ os_projects_auth_type }}"
+    auth: "{{ os_projects_admin_auth }}"
+    region_name: "{{ os_projects_region | default(omit) }}"
+    cacert: "{{ os_projects_cacert | default(omit) }}"
+    cloud: "{{ os_projects_cloud | default(omit) }}"
+    interface: "{{ os_projects_interface | default(omit, true) }}"
+    domain: "{{ user_domain_id }}"
+    name: "{{ item.1.name }}"
+  with_subelements:
+    - "{{ project.groups }}"
+    - users
+    - skip_missing: true
+  when:
+    - project.groups is defined
+  environment: "{{ os_projects_environment }}"
+  vars:
+    user_domain_id: "{{ (project.user_domain in os_projects_domain_to_id.values()) | ternary(project.user_domain, os_projects_domain_to_id[project.user_domain]) }}"
+    project_domain_id: "{{ (project.project_domain in os_projects_domain_to_id.values()) | ternary(project.project_domain, os_projects_domain_to_id[project.project_domain]) }}"
+  loop_control:
+    label: "{{ item.0.name }}: {{ item.1.name }}"
+    index_var: idx
+  register: os_projects_fetched_users
+
+- name: Assert that all users exist
+  ansible.builtin.assert:
+    quiet: true
+    that:
+      - os_projects_fetched_users.results[idx].users is defined
+      - os_projects_fetched_users.results[idx].users | length > 0
+    fail_msg: "The user '{{ item.1.name }}' does not exist in the '{{ project.user_domain }}' domain"
+  with_subelements:
+    - "{{ project.groups }}"
+    - users
+    - skip_missing: true
+  when:
+    - project.groups is defined
+  loop_control:
+    label: "{{ item.0.name }}: {{ item.1.name }}"
+    index_var: idx
+
+- name: Ensure users are added to the group
+  openstack.cloud.group_assignment:
+    auth_type: "{{ os_projects_auth_type }}"
+    auth: "{{ os_projects_admin_auth }}"
+    region_name: "{{ os_projects_region | default(omit) }}"
+    cacert: "{{ os_projects_cacert | default(omit) }}"
+    cloud: "{{ os_projects_cloud | default(omit) }}"
+    interface: "{{ os_projects_interface | default(omit, true) }}"
+    user: "{{ user_id }}"
+    group: "{{ group_id }}"
+    state: present
+    wait: true
+  with_subelements:
+    - "{{ project.groups }}"
+    - users
+    - skip_missing: true
+  when: project.groups is defined
+  environment: "{{ os_projects_environment }}"
+  vars:
+    user_id: "{{ os_projects_fetched_users.results[idx].users[0].id }}"
+    group_domain_id: "{{ (item.0.domain in os_projects_domain_to_id.values()) | ternary(item.0.domain, os_projects_domain_to_id[item.0.domain]) }}"
+    group_id: "{{ os_projects_group_to_id[group_domain_id][item.0.name] }}"
+  loop_control:
+    label: "{{ item.0.name }}: {{ item.1.name }}"
+    index_var: idx

roles/os_projects/tasks/groups.yml

@@ -0,0 +1,108 @@
+---
+- name: Ensure the groups exist
+  openstack.cloud.identity_group:
+    auth_type: "{{ os_projects_auth_type }}"
+    auth: "{{ os_projects_admin_auth }}"
+    region_name: "{{ os_projects_region | default(omit) }}"
+    cacert: "{{ os_projects_cacert | default(omit) }}"
+    cloud: "{{ os_projects_cloud | default(omit) }}"
+    interface: "{{ os_projects_interface | default(omit, true) }}"
+    name: "{{ item.name }}"
+    description: "{{ item.description | default(omit) }}"
+    domain_id: "{{ group_domain_id }}"
+    state: present
+    wait: true
+  with_items: "{{ project.groups }}"
+  when: item.create_group | default(true) | bool
+  environment: "{{ os_projects_environment }}"
+  vars:
+    group_domain_id: "{{ (item.domain in os_projects_domain_to_id.values()) | ternary(item.domain, os_projects_domain_to_id[item.domain]) }}"
+  loop_control:
+    label: "{{ project.name }}: {{ item.name }}"
+
+# This task is to ensure we don't miss groups that have ``create_group`` set to false
+- name: Look up groups
+  openstack.cloud.identity_group_info:
+    auth_type: "{{ os_projects_auth_type }}"
+    auth: "{{ os_projects_admin_auth }}"
+    region_name: "{{ os_projects_region | default(omit) }}"
+    cacert: "{{ os_projects_cacert | default(omit) }}"
+    cloud: "{{ os_projects_cloud | default(omit) }}"
+    interface: "{{ os_projects_interface | default(omit, true) }}"
+    name: "{{ item.name }}"
+    domain: "{{ group_domain_id }}"
+  with_items: "{{ project.groups }}"
+  environment: "{{ os_projects_environment }}"
+  vars:
+    group_domain_id: "{{ (item.domain in os_projects_domain_to_id.values()) | ternary(item.domain, os_projects_domain_to_id[item.domain]) }}"
+  loop_control:
+    label: "{{ project.name }}: {{ item.name }}"
+    index_var: idx
+  register: os_projects_fetched_groups
+
+- name: Assert that all groups exist
+  ansible.builtin.assert:
+    quiet: true
+    that:
+      - os_projects_fetched_groups.results[idx].groups is defined
+      - os_projects_fetched_groups.results[idx].groups | length > 0
+    fail_msg: "The group '{{ item.name }}' does not exist in the '{{ item.domain }}' domain"
+  with_items: "{{ project.groups }}"
+  loop_control:
+    label: "{{ project.name }}: {{ item.name }}"
+    index_var: idx
+
+- name: Populate domain ID - group name - group ID mapping
+  ansible.builtin.set_fact:
+    os_projects_group_to_id: "{{ os_projects_group_to_id | combine(sub_map, recursive=true) }}"
+  with_items: "{{ project.groups }}"
+  vars:
+    group_domain_id: "{{ (item.domain in os_projects_domain_to_id.values()) | ternary(item.domain, os_projects_domain_to_id[item.domain]) }}"
+    sub_map: "{{ {group_domain_id: {item.name: os_projects_fetched_groups.results[idx].groups[0].id}} }}"
+  loop_control:
+    index_var: idx
+    label: "Domain: {{ item.domain }} - Group: {{ item.name }}"
+
+- name: Ensure groups have required project roles
+  openstack.cloud.role_assignment:
+    auth_type: "{{ os_projects_auth_type }}"
+    auth: "{{ os_projects_admin_auth }}"
+    region_name: "{{ os_projects_region | default(omit) }}"
+    cacert: "{{ os_projects_cacert | default(omit) }}"
+    cloud: "{{ os_projects_cloud | default(omit) }}"
+    interface: "{{ os_projects_interface | default(omit, true) }}"
+    group: "{{ item.0.name }}"
+    project: "{{ project.name }}"
+    role: "{{ item.1 }}"
+    group_domain: "{{ item.0.domain | default(omit, true) }}"
+    project_domain: "{{ project.project_domain | default(omit, true) }}"
+    state: present
+  with_subelements:
+    - "{{ project.groups }}"
+    - roles
+    - skip_missing: true
+  environment: "{{ os_projects_environment }}"
+  loop_control:
+    label: "{{ project.name }}: {{ item.0.name }}: {{ item.1 }}"
+
+- name: Ensure groups have required domain roles
+  openstack.cloud.role_assignment:
+    auth_type: "{{ os_projects_auth_type }}"
+    auth: "{{ os_projects_admin_auth }}"
+    region_name: "{{ os_projects_region | default(omit) }}"
+    cacert: "{{ os_projects_cacert | default(omit) }}"
+    cloud: "{{ os_projects_cloud | default(omit) }}"
+    interface: "{{ os_projects_interface | default(omit, true) }}"
+    group: "{{ item.0.name }}"
+    domain: "{{ domain_is_id | ternary(item.0.domain, os_projects_domain_to_id[item.0.domain]) }}"
+    role: "{{ item.1 }}"
+    state: present
+  with_subelements:
+    - "{{ project.groups }}"
+    - domain_roles
+    - skip_missing: true
+  environment: "{{ os_projects_environment }}"
+  vars:
+    domain_is_id: "{{ item.0.domain in os_projects_domain_to_id.values() }}"
+  loop_control:
+    label: "{{ item.0.domain }}: {{ item.0.name }}: {{ item.1 }}"