feat: improve firewall resources management (#324)

##### SUMMARY

  - firewall - Return resources the firewall is `applied_to`.
- firewall_info - Add new `firewall_info` module to gather firewalls
info.
- firewall_resource - Add new `firewall_resource` module to manage
firewalls resources.

Fixes #111

##### ISSUE TYPE

- Feature Pull Request


##### COMPONENT NAME

firewall
firewall_info
firewall_resource

---------

Co-authored-by: Julian Tölle <julian.toelle97@gmail.com>

tests/integration/targets/firewall/tasks/test.yml

@@ -51,6 +51,7 @@
       - result.hcloud_firewall.rules[0].protocol == "icmp"
       - result.hcloud_firewall.rules[0].source_ips == ["0.0.0.0/0", "::/0"]
       - result.hcloud_firewall.labels.key == "value"
+      - result.hcloud_firewall.applied_to | list | count == 0
 
 - name: Test create idempotency
   hetzner.hcloud.firewall:

tests/integration/targets/firewall_info/aliases

@@ -0,0 +1,2 @@
+cloud/hcloud
+shippable/hcloud/group2

tests/integration/targets/firewall_info/defaults/main/common.yml

@@ -0,0 +1,12 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+# Azure Pipelines will configure this value to something similar to
+# "azp-84824-1-hetzner-2-13-test-2-13-hcloud-3-9-1-default-i"
+hcloud_prefix: "tests"
+
+# Used to namespace resources created by concurrent test pipelines/targets
+hcloud_run_ns: "{{ hcloud_prefix | md5 }}"
+hcloud_role_ns: "{{ role_name | split('_') | map('first') | join() }}"
+hcloud_ns: "ansible-{{ hcloud_run_ns }}-{{ hcloud_role_ns }}"

tests/integration/targets/firewall_info/defaults/main/main.yml

@@ -0,0 +1,5 @@
+# Copyright: (c) 2019, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+hcloud_server_name: "{{ hcloud_ns }}"
+hcloud_firewall_name: "{{ hcloud_ns }}"

tests/integration/targets/firewall_info/tasks/cleanup.yml

@@ -0,0 +1,10 @@
+---
+- name: Cleanup test_server
+  hetzner.hcloud.server:
+    name: "{{ hcloud_server_name }}"
+    state: absent
+
+- name: Cleanup test_firewall
+  hetzner.hcloud.firewall:
+    name: "{{ hcloud_firewall_name }}"
+    state: absent

tests/integration/targets/firewall_info/tasks/main.yml

@@ -0,0 +1,31 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+- name: Check if cleanup.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/cleanup.yml"
+  register: cleanup_file
+
+- name: Check if prepare.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/prepare.yml"
+  register: prepare_file
+
+- name: Include cleanup tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+  when: cleanup_file.stat.exists
+
+- name: Include prepare tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/prepare.yml"
+  when: prepare_file.stat.exists
+
+- name: Run tests
+  block:
+    - name: Include test tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/test.yml"
+
+  always:
+    - name: Include cleanup tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+      when: cleanup_file.stat.exists

tests/integration/targets/firewall_info/tasks/prepare.yml

@@ -0,0 +1,35 @@
+---
+- name: Create test_server
+  hetzner.hcloud.server:
+    name: "{{ hcloud_server_name }}"
+    server_type: cx11
+    image: ubuntu-22.04
+    labels:
+      firewall: "{{ hcloud_firewall_name }}"
+    state: stopped
+  register: test_server
+
+- name: Create test_firewall
+  hetzner.hcloud.firewall:
+    name: "{{ hcloud_firewall_name }}"
+    labels:
+      key: value
+    rules:
+      - description: allow icmp from anywhere
+        direction: in
+        protocol: icmp
+        source_ips:
+          - 0.0.0.0/0
+          - ::/0
+    state: present
+  register: test_firewall
+
+- name: Create test_firewall_resource
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    servers:
+      - "{{ hcloud_server_name }}"
+    label_selectors:
+      - firewall={{ hcloud_firewall_name }}
+    state: present
+  register: test_firewall_resource

tests/integration/targets/firewall_info/tasks/test.yml

@@ -0,0 +1,93 @@
+# Copyright: (c) 2019, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+- name: Gather hcloud_firewall_info
+  hetzner.hcloud.firewall_info:
+  register: result
+- name: Verify hcloud_firewall_info
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_firewall_info | list | count >= 1
+
+- name: Gather hcloud_firewall_info in check mode
+  hetzner.hcloud.firewall_info:
+  check_mode: true
+  register: result
+- name: Verify hcloud_firewall_info in check mode
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_firewall_info | list | count >= 1
+
+- name: Gather hcloud_firewall_info with correct id
+  hetzner.hcloud.firewall_info:
+    id: "{{ test_firewall.hcloud_firewall.id }}"
+  register: result
+- name: Verify hcloud_firewall_info with correct id
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_firewall_info | list | count == 1
+      - result.hcloud_firewall_info[0].name == hcloud_firewall_name
+      - result.hcloud_firewall_info[0].labels.key == "value"
+      - result.hcloud_firewall_info[0].rules | list | count == 1
+      - result.hcloud_firewall_info[0].rules[0].description == "allow icmp from anywhere"
+      - result.hcloud_firewall_info[0].rules[0].direction == "in"
+      - result.hcloud_firewall_info[0].rules[0].protocol == "icmp"
+      - result.hcloud_firewall_info[0].rules[0].source_ips == ["0.0.0.0/0", "::/0"]
+      - result.hcloud_firewall_info[0].applied_to | list | count == 2
+      - >
+        result.hcloud_firewall_info[0].applied_to
+        | selectattr('type', 'equalto', 'label_selector')
+        | list | count == 1
+      - >
+        result.hcloud_firewall_info[0].applied_to
+        | selectattr('type', 'equalto', 'server')
+        | list | count == 1
+
+- name: Gather hcloud_firewall_info with wrong id
+  hetzner.hcloud.firewall_info:
+    id: "{{ test_firewall.hcloud_firewall.id }}4321"
+  ignore_errors: true
+  register: result
+- name: Verify hcloud_firewall_info with wrong id
+  ansible.builtin.assert:
+    that:
+      - result is failed
+
+- name: Gather hcloud_firewall_info with correct name
+  hetzner.hcloud.firewall_info:
+    name: "{{ hcloud_firewall_name }}"
+  register: result
+- name: Verify hcloud_firewall_info with correct name
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_firewall_info | list | count == 1
+
+- name: Gather hcloud_firewall_info with wrong name
+  hetzner.hcloud.firewall_info:
+    name: "{{ hcloud_firewall_name }}-invalid"
+  register: result
+- name: Verify hcloud_firewall_info with wrong name
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_firewall_info | list | count == 0
+
+- name: Gather hcloud_firewall_info with correct label selector
+  hetzner.hcloud.firewall_info:
+    label_selector: "key=value"
+  register: result
+- name: Verify hcloud_firewall_info with correct label selector
+  ansible.builtin.assert:
+    that:
+      - >
+        result.hcloud_firewall_info
+        | selectattr('name', 'equalto', hcloud_firewall_name)
+        | list | count == 1
+
+- name: Gather hcloud_firewall_info with wrong label selector
+  hetzner.hcloud.firewall_info:
+    label_selector: "key!=value"
+  register: result
+- name: Verify hcloud_firewall_info with wrong label selector
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_firewall_info | list | count == 0

tests/integration/targets/firewall_resource/aliases

@@ -0,0 +1,2 @@
+cloud/hcloud
+azp/group2

tests/integration/targets/firewall_resource/defaults/main/common.yml

@@ -0,0 +1,12 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+# Azure Pipelines will configure this value to something similar to
+# "azp-84824-1-hetzner-2-13-test-2-13-hcloud-3-9-1-default-i"
+hcloud_prefix: "tests"
+
+# Used to namespace resources created by concurrent test pipelines/targets
+hcloud_run_ns: "{{ hcloud_prefix | md5 }}"
+hcloud_role_ns: "{{ role_name | split('_') | map('first') | join() }}"
+hcloud_ns: "ansible-{{ hcloud_run_ns }}-{{ hcloud_role_ns }}"

tests/integration/targets/firewall_resource/defaults/main/main.yml

@@ -0,0 +1,5 @@
+# Copyright: (c) 2019, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+hcloud_server_name: "{{ hcloud_ns }}"
+hcloud_firewall_name: "{{ hcloud_ns }}"

tests/integration/targets/firewall_resource/tasks/cleanup.yml

@@ -0,0 +1,10 @@
+---
+- name: Cleanup test_server
+  hetzner.hcloud.server:
+    name: "{{ hcloud_server_name }}"
+    state: absent
+
+- name: Cleanup test_firewall
+  hetzner.hcloud.firewall:
+    name: "{{ hcloud_firewall_name }}"
+    state: absent

tests/integration/targets/firewall_resource/tasks/main.yml

@@ -0,0 +1,31 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+- name: Check if cleanup.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/cleanup.yml"
+  register: cleanup_file
+
+- name: Check if prepare.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/prepare.yml"
+  register: prepare_file
+
+- name: Include cleanup tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+  when: cleanup_file.stat.exists
+
+- name: Include prepare tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/prepare.yml"
+  when: prepare_file.stat.exists
+
+- name: Run tests
+  block:
+    - name: Include test tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/test.yml"
+
+  always:
+    - name: Include cleanup tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+      when: cleanup_file.stat.exists

tests/integration/targets/firewall_resource/tasks/prepare.yml

@@ -0,0 +1,25 @@
+---
+- name: Create test_server
+  hetzner.hcloud.server:
+    name: "{{ hcloud_server_name }}"
+    server_type: cx11
+    image: ubuntu-22.04
+    labels:
+      key: value
+    state: stopped
+  register: test_server
+
+- name: Create test_firewall
+  hetzner.hcloud.firewall:
+    name: "{{ hcloud_firewall_name }}"
+    labels:
+      key: value
+    rules:
+      - description: allow icmp from anywhere
+        direction: in
+        protocol: icmp
+        source_ips:
+          - 0.0.0.0/0
+          - ::/0
+    state: present
+  register: test_firewall

tests/integration/targets/firewall_resource/tasks/test.yml

@@ -0,0 +1,95 @@
+# Copyright: (c) 2020, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+- name: Test missing required parameters
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    state: present
+  ignore_errors: true
+  register: result
+- name: Verify missing required parameters
+  ansible.builtin.assert:
+    that:
+      - result is failed
+      - 'result.msg == "one of the following is required: servers, label_selectors"'
+
+- name: Test create with check mode
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    servers: ["{{ hcloud_server_name }}"]
+  check_mode: true
+  register: result
+- name: Verify create with check mode
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Test create
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    servers: ["{{ hcloud_server_name }}"]
+  register: result
+- name: Verify create
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_firewall_resource.firewall == hcloud_firewall_name
+      - result.hcloud_firewall_resource.servers | list | count == 1
+      - result.hcloud_firewall_resource.servers[0] == hcloud_server_name
+      - result.hcloud_firewall_resource.label_selectors | list | count == 0
+
+- name: Test create idempotency
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    servers: ["{{ hcloud_server_name }}"]
+  register: result
+- name: Verify create idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test update
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    label_selectors:
+      - key=value
+  register: result
+- name: Verify update
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_firewall_resource.label_selectors | list | count == 1
+      - result.hcloud_firewall_resource.label_selectors[0] == "key=value"
+
+- name: Test update idempotency
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    label_selectors:
+      - key=value
+  register: result
+- name: Verify update idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test delete servers
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    servers: ["{{ hcloud_server_name }}"]
+    state: absent
+  register: result
+- name: Verify delete
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Test delete label_selectors
+  hetzner.hcloud.firewall_resource:
+    firewall: "{{ hcloud_firewall_name }}"
+    label_selectors: ["key=value"]
+    state: absent
+  register: result
+- name: Verify delete
+  ansible.builtin.assert:
+    that:
+      - result is changed

tests/sanity/ignore-2.13.txt

@@ -7,6 +7,10 @@ plugins/modules/certificate.py validate-modules:illegal-future-imports
 plugins/modules/certificate.py validate-modules:import-before-documentation
 plugins/modules/datacenter_info.py validate-modules:illegal-future-imports
 plugins/modules/datacenter_info.py validate-modules:import-before-documentation
+plugins/modules/firewall_info.py validate-modules:illegal-future-imports
+plugins/modules/firewall_info.py validate-modules:import-before-documentation
+plugins/modules/firewall_resource.py validate-modules:illegal-future-imports
+plugins/modules/firewall_resource.py validate-modules:import-before-documentation
 plugins/modules/firewall.py validate-modules:illegal-future-imports
 plugins/modules/firewall.py validate-modules:import-before-documentation
 plugins/modules/floating_ip_info.py validate-modules:illegal-future-imports

tests/sanity/ignore-2.14.txt

@@ -6,6 +6,10 @@ plugins/modules/certificate.py validate-modules:illegal-future-imports
 plugins/modules/certificate.py validate-modules:import-before-documentation
 plugins/modules/datacenter_info.py validate-modules:illegal-future-imports
 plugins/modules/datacenter_info.py validate-modules:import-before-documentation
+plugins/modules/firewall_info.py validate-modules:illegal-future-imports
+plugins/modules/firewall_info.py validate-modules:import-before-documentation
+plugins/modules/firewall_resource.py validate-modules:illegal-future-imports
+plugins/modules/firewall_resource.py validate-modules:import-before-documentation
 plugins/modules/firewall.py validate-modules:illegal-future-imports
 plugins/modules/firewall.py validate-modules:import-before-documentation
 plugins/modules/floating_ip_info.py validate-modules:illegal-future-imports