Skip to content

Commit 5eacb7c

Browse files
abikouoabikouo
authored
Merge pull request #139 from redhat-cop/patchback/backports/stable-3/c6d1a7c70097b6b2d0c80199d97e50102ebc6723/pr-121
[PR #121/c6d1a7c7 backport][stable-3] Add new ec2_networking_resources role
2 parents aaab9d7 + bfca0e6 commit 5eacb7c

File tree

8 files changed

+275
-0
lines changed

8 files changed

+275
-0
lines changed

‎roles/ec2_networking_resources/README.md

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
ec2_networking_resources
2+
====================
3+
4+
The `ec2_networking_resources` role allows you to create a basic set of networking resources in which you can run EC2 instances. By default, the subnet that is created is set to allow SSH access from within the VPC.
5+
6+
Requirements
7+
------------
8+
9+
An AWS account with the following permissions:
10+
11+
* ec2:AssociateRouteTable
12+
* ec2:AuthorizeSecurityGroupIngress
13+
* ec2:CreateRouteTable
14+
* ec2:CreateSecurityGroup
15+
* ec2:CreateSubnet
16+
* ec2:CreateVpc
17+
* ec2:DescribeRouteTables
18+
* ec2:DescribeSecurityGroups
19+
* ec2:DescribeSubnets
20+
* ec2:DescribeTags
21+
* ec2:DescribeVpcAttribute
22+
* ec2:DescribeVpcs
23+
* ec2:ModifyVpcAttribute
24+
* sts:GetCallerIdentity
25+
26+
Role Variables
27+
--------------
28+
29+
* **ec2_networking_resources_vpc_name**: (Required) The name of the VPC to create.
30+
* **ec2_networking_resources_vpc_cidr_block**: (Required) The CIDR block to use for the VPC being created.
31+
* **ec2_networking_resources_subnet_cidr_block**: (Required) The CIDR block to use for subnet being created.
32+
* **ec2_networking_resources_sg_internal_name**: (Required) The name of the security group to create.
33+
* **ec2_networking_resources_sg_internal_description**: (Required) The description of the security group being created.
34+
* **ec2_networking_resources_sg_internal_rules**: (Optional) List of rules to apply to the security group being created. By default, a rule allowing SSH access from within the VPC will be added. A rule should contain the following keys:
35+
* **proto** (str): The IP protocol name.
36+
* **ports** (str): A list of ports traffic is going to. Can be a single port, or a range of ports, for example, 8000-8010.
37+
* **cidr_ip** (str): The CIDR block traffic is coming from.
38+
39+
Dependencies
40+
------------
41+
42+
- role: [aws_setup_credentials](../aws_setup_credentials/README.md)
43+
44+
Example Playbook
45+
----------------
46+
47+
```yaml
48+
- hosts: localhost
49+
roles:
50+
- role: cloud.aws_ops.ec2_networking_resources
51+
vars:
52+
ec2_networking_resources_vpc_name: my-vpn
53+
ec2_networking_resources_vpc_cidr_block: 10.0.1.0/16
54+
ec2_networking_resources_subnet_cidr_block: 10.0.1.0/26
55+
ec2_networking_resources_sg_internal_name: my-sg
56+
ec2_networking_resources_sg_internal_description: My internal security group
57+
ec2_networking_resources_sg_internal_rules:
58+
- proto: tcp
59+
ports: 22
60+
cidr_ip: 10.0.1.0/16
61+
- ports: tcp
62+
ports: 8000-8010
63+
cidr_ip: 10.0.1.0/16
64+
```
65+
66+
License
67+
-------
68+
69+
GNU General Public License v3.0 or later
70+
71+
See [LICENSE](../../LICENSE) to see the full text.
72+
73+
Author Information
74+
------------------
75+
76+
- Ansible Cloud Content Team

‎roles/ec2_networking_resources/defaults/main.yml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
ec2_networking_resources_sg_internal_rules:
3+
- proto: tcp
4+
ports: 22
5+
cidr_ip: "{{ ec2_networking_resources_vpc_cidr_block }}"

‎roles/ec2_networking_resources/meta/argument_specs.yml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
argument_specs:
3+
main:
4+
short_description: A role to create a basic networking environment for an EC2 instance.
5+
description:
6+
- A role to create a basic networking environment for an EC2 instance.
7+
- Creates a VPC, subnet, route table and security groups.
8+
options:
9+
ec2_networking_resources_vpc_name:
10+
description:
11+
- The name of the VPC to create.
12+
required: true
13+
ec2_networking_resources_vpc_cidr_block:
14+
description:
15+
- The CIDR block for the VPC being created.
16+
required: true
17+
ec2_networking_resources_subnet_cidr_block:
18+
description:
19+
- The CIDR block for the subnet being created.
20+
required: true
21+
ec2_networking_resources_sg_internal_name:
22+
description:
23+
- The name of the security group to create for internal access to the EC2 instance.
24+
required: true
25+
ec2_networking_resources_sg_internal_description:
26+
description:
27+
- The description of the security group for internal access to the EC2 instance.
28+
required: true
29+
ec2_networking_resources_sg_internal_rules:
30+
description:
31+
- A list of security group rules to apply to the security group for internal access.
32+
- By default, will add a rule to allow SSH access from within the VPC created by the role.
33+
required: false
34+
type: list
35+
elements: dict
36+
default:
37+
- proto: tcp
38+
ports: 22
39+
cidr_ip: "{{ ec2_networking_resources_vpc_cidr_block }}"
40+
options:
41+
proto:
42+
description: The IP protocol name.
43+
default: tcp
44+
ports:
45+
description:
46+
- A list of ports the traffic is going to.
47+
- Elements can be a single port, or a range of ports (for example, 8000-8100).
48+
type: list
49+
elements: str
50+
cidr_ip:
51+
description: The CIDR range traffic is coming from.

‎roles/ec2_networking_resources/meta/main.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
dependencies:
3+
- role: cloud.aws_ops.aws_setup_credentials

‎roles/ec2_networking_resources/tasks/main.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
- name: Create VPC
3+
amazon.aws.ec2_vpc_net:
4+
name: "{{ ec2_networking_resources_vpc_name }}"
5+
cidr_block: "{{ ec2_networking_resources_vpc_cidr_block }}"
6+
register: ec2_networking_resources_vpc_result
7+
8+
- name: Create VPC subnet
9+
amazon.aws.ec2_vpc_subnet:
10+
vpc_id: "{{ ec2_networking_resources_vpc_result.vpc.id }}"
11+
cidr: "{{ ec2_networking_resources_subnet_cidr_block }}"
12+
register: ec2_networking_resources_subnet_result
13+
14+
- name: Create route table
15+
amazon.aws.ec2_vpc_route_table:
16+
vpc_id: "{{ ec2_networking_resources_vpc_result.vpc.id }}"
17+
subnets:
18+
- "{{ ec2_networking_resources_subnet_result.subnet.id }}"
19+
20+
- name: Create security group for internal access
21+
amazon.aws.ec2_security_group:
22+
vpc_id: "{{ ec2_networking_resources_vpc_result.vpc.id }}"
23+
name: "{{ ec2_networking_resources_sg_internal_name }}"
24+
description: "{{ ec2_networking_resources_sg_internal_description }}"
25+
rules: "{{ ec2_networking_resources_sg_internal_rules }}"

‎tests/integration/targets/test_ec2_networking_resources/aliases

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
cloud/aws
2+
role/ec2_networking_resources

‎tests/integration/targets/test_ec2_networking_resources/defaults/main.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
aws_security_token: "{{ security_token | default(omit) }}"
3+
4+
vpc_name: "{{ resource_prefix }}-vpc"
5+
vpc_cidr_block: "10.0.1.0/24"
6+
subnet_cidr_block: "10.0.1.0/26"
7+
sg_name: "{{ resource_prefix }}-sg"

‎tests/integration/targets/test_ec2_networking_resources/tasks/main.yml

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
- name: Integration tests for ec2_networking_resources role
3+
module_defaults:
4+
group/aws:
5+
aws_access_key: "{{ aws_access_key }}"
6+
aws_secret_key: "{{ aws_secret_key }}"
7+
security_token: "{{ security_token | default(omit) }}"
8+
region: "{{ aws_region }}"
9+
10+
block:
11+
- name: Create networking infrastructure
12+
ansible.builtin.include_role:
13+
name: cloud.aws_ops.ec2_networking_resources
14+
vars:
15+
ec2_networking_resources_vpc_name: "{{ vpc_name }}"
16+
ec2_networking_resources_vpc_cidr_block: "{{ vpc_cidr_block }}"
17+
ec2_networking_resources_subnet_cidr_block: "{{ subnet_cidr_block }}"
18+
ec2_networking_resources_sg_internal_name: "{{ sg_name }}"
19+
ec2_networking_resources_sg_internal_description: Test security group
20+
21+
- name: Get the created VPC
22+
amazon.aws.ec2_vpc_net_info:
23+
filters:
24+
"tag:Name": "{{ vpc_name }}"
25+
cidr: "{{ vpc_cidr_block }}"
26+
register: _vpc
27+
28+
- name: Assert the VPC exists
29+
ansible.builtin.assert:
30+
that:
31+
- _vpc.vpcs | length == 1
32+
- _vpc.vpcs[0].cidr_block == vpc_cidr_block
33+
34+
- name: Get the created subnet
35+
amazon.aws.ec2_vpc_subnet_info:
36+
filters:
37+
vpc-id: "{{ _vpc.vpcs[0].id }}"
38+
cidr-block: "{{ subnet_cidr_block }}"
39+
register: _subnet
40+
41+
- name: Assert subnet has been created
42+
ansible.builtin.assert:
43+
that:
44+
- _subnet.subnets | length == 1
45+
- _subnet.subnets[0].cidr_block == subnet_cidr_block
46+
47+
- name: Get security group
48+
amazon.aws.ec2_security_group_info:
49+
filters:
50+
group-name: "{{ sg_name }}"
51+
register: _security_group
52+
53+
- name: Assert default security group has been created
54+
ansible.builtin.assert:
55+
that:
56+
- _security_group.security_groups | length == 1
57+
- _sg_rule.from_port == 22
58+
- _sg_rule.to_port == 22
59+
- _sg_rule.ip_protocol == "tcp"
60+
- _sg_rule.ip_ranges[0].cidr_ip == vpc_cidr_block
61+
vars:
62+
_sg_rule: "{{ _security_group.security_groups[0].ip_permissions[0] }}"
63+
64+
always:
65+
- name: Delete the security group
66+
amazon.aws.ec2_security_group:
67+
state: absent
68+
name: "{{ sg_name }}"
69+
ignore_errors: true
70+
71+
- name: Get the VPC
72+
amazon.aws.ec2_vpc_net_info:
73+
filters:
74+
"tag:Name": "{{ vpc_name }}"
75+
cidr: "{{ vpc_cidr_block }}"
76+
register: vpc
77+
ignore_errors: true
78+
79+
- name: Delete the VPC subnet
80+
amazon.aws.ec2_vpc_subnet:
81+
state: absent
82+
vpc_id: "{{ vpc.vpcs[0].id }}"
83+
cidr: "{{ subnet_cidr_block }}"
84+
ignore_errors: true
85+
86+
- name: Get the route tables
87+
amazon.aws.ec2_vpc_route_table_info:
88+
filters:
89+
vpc-id: "{{ vpc.vpcs[0].id }}"
90+
register: routes
91+
ignore_errors: true
92+
93+
- name: Delete the route tables
94+
amazon.aws.ec2_vpc_route_table:
95+
state: absent
96+
route_table_id: "{{ item.route_table_id }}"
97+
lookup: id
98+
loop: "{{ routes.route_tables }}"
99+
ignore_errors: true
100+
101+
- name: Delete the VPC
102+
amazon.aws.ec2_vpc_net:
103+
state: absent
104+
name: "{{ vpc_name }}"
105+
cidr_block: "{{ vpc_cidr_block }}"
106+
ignore_errors: true

0 commit comments

Comments
 (0)