1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
|
# Copyright: (c) 2020, Hetzner Cloud GmbH <info@hetzner-cloud.de>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
---
- name: Test missing required parameters
hetzner.hcloud.firewall:
state: present
ignore_errors: true
register: result
- name: Verify missing required parameters
ansible.builtin.assert:
that:
- result is failed
- 'result.msg == "one of the following is required: id, name"'
- name: Test create with check mode
hetzner.hcloud.firewall:
name: "{{ hcloud_firewall_name }}"
rules:
- description: allow icmp in
direction: in
protocol: icmp
source_ips: ["0.0.0.0/0", "::/0"]
labels:
key: value
check_mode: true
register: result
- name: Verify create with check mode
ansible.builtin.assert:
that:
- result is changed
- name: Test create
hetzner.hcloud.firewall:
name: "{{ hcloud_firewall_name }}"
rules:
- description: allow icmp in
direction: in
protocol: icmp
source_ips: ["0.0.0.0/0", "::/0"]
labels:
key: value
register: result
- name: Verify create
ansible.builtin.assert:
that:
- result is changed
- result.hcloud_firewall.name == hcloud_firewall_name
- result.hcloud_firewall.rules | list | count == 1
- result.hcloud_firewall.rules[0].description == "allow icmp in"
- result.hcloud_firewall.rules[0].direction == "in"
- result.hcloud_firewall.rules[0].protocol == "icmp"
- result.hcloud_firewall.rules[0].source_ips == ["0.0.0.0/0", "::/0"]
- result.hcloud_firewall.labels.key == "value"
- result.hcloud_firewall.applied_to | list | count == 0
- name: Test create idempotency
hetzner.hcloud.firewall:
name: "{{ hcloud_firewall_name }}"
rules:
- description: allow icmp in
direction: in
protocol: icmp
source_ips: ["0.0.0.0/0", "::/0"]
labels:
key: value
register: result
- name: Verify create idempotency
ansible.builtin.assert:
that:
- result is not changed
- name: Assign firewall to test_server
hetzner.hcloud.firewall_resource:
firewall: "{{ hcloud_firewall_name }}"
servers: ["{{ test_server.hcloud_server.name }}"]
state: present
- name: Test update
hetzner.hcloud.firewall:
name: "{{ hcloud_firewall_name }}"
rules:
- description: allow icmp in
direction: in
protocol: icmp
source_ips: ["0.0.0.0/0", "::/0"]
- description: allow http in
direction: in
protocol: tcp
port: 80
source_ips: ["0.0.0.0/0", "::/0"]
- description: allow http out
direction: out
protocol: tcp
port: 80
destination_ips: ["0.0.0.0/0", "::/0"]
labels:
key: value
label: label
register: result
- name: Verify update
ansible.builtin.assert:
that:
- result is changed
- result.hcloud_firewall.name == hcloud_firewall_name
- result.hcloud_firewall.rules | list | count == 3
- result.hcloud_firewall.rules[0].description == "allow icmp in"
- result.hcloud_firewall.rules[0].direction == "in"
- result.hcloud_firewall.rules[0].protocol == "icmp"
- result.hcloud_firewall.rules[0].source_ips == ["0.0.0.0/0", "::/0"]
- result.hcloud_firewall.rules[1].description == "allow http in"
- result.hcloud_firewall.rules[1].direction == "in"
- result.hcloud_firewall.rules[1].protocol == "tcp"
- result.hcloud_firewall.rules[1].port == "80"
- result.hcloud_firewall.rules[1].source_ips == ["0.0.0.0/0", "::/0"]
- result.hcloud_firewall.rules[2].description == "allow http out"
- result.hcloud_firewall.rules[2].direction == "out"
- result.hcloud_firewall.rules[2].protocol == "tcp"
- result.hcloud_firewall.rules[2].port == "80"
- result.hcloud_firewall.rules[2].destination_ips == ["0.0.0.0/0", "::/0"]
- result.hcloud_firewall.labels.key == "value"
- result.hcloud_firewall.labels.label == "label"
- name: Test update idempotency
hetzner.hcloud.firewall:
name: "{{ hcloud_firewall_name }}"
rules:
- description: allow icmp in
direction: in
protocol: icmp
source_ips: ["0.0.0.0/0", "::/0"]
- description: allow http in
direction: in
protocol: tcp
port: 80
source_ips: ["0.0.0.0/0", "::/0"]
- description: allow http out
direction: out
protocol: tcp
port: 80
destination_ips: ["0.0.0.0/0", "::/0"]
labels:
key: value
label: label
register: result
- name: Verify update idempotency
ansible.builtin.assert:
that:
- result is not changed
- name: Test update name
hetzner.hcloud.firewall:
id: "{{ result.hcloud_firewall.id }}"
name: "changed-{{ hcloud_firewall_name }}"
register: result
- name: Verify update name
ansible.builtin.assert:
that:
- result is changed
- result.hcloud_firewall.name == "changed-" + hcloud_firewall_name
- name: Test update name and labels
hetzner.hcloud.firewall:
id: "{{ result.hcloud_firewall.id }}"
name: "{{ hcloud_firewall_name }}"
labels:
key: value
register: result
- name: Verify update name and labels
ansible.builtin.assert:
that:
- result is changed
- result.hcloud_firewall.name == hcloud_firewall_name
- result.hcloud_firewall.labels.key == "value"
- result.hcloud_firewall.labels.label is not defined
- name: Test delete
hetzner.hcloud.firewall:
name: "{{ hcloud_firewall_name }}"
state: absent
ignore_errors: true
register: result
- name: Verify delete
ansible.builtin.assert:
that:
- result is failed
- result.failure.code == "resource_in_use"
- name: Test delete with force
hetzner.hcloud.firewall:
name: "{{ hcloud_firewall_name }}"
force: true
state: absent
register: result
- name: Verify delete with force
ansible.builtin.assert:
that:
- result is changed
|
