AnsibleByExample

Google.Cloud Collection 1.15.0 - New Binary Authorization and Container Analysis Modules, Inventory Plugin Fixes

Beginner
2024-01-014By Luca Berton

Lesson 1 of 25 in AWS Automation

AWS with Ansible — full curriculum
  1. 1. AWS Basics for Ansible
  2. 2. Installing the amazon.aws Collection and boto3
  3. 3. AWS Credentials and Profiles: Safe Configuration
  4. 4. Your First AWS Playbook: Regions, Tags and Idempotency
  5. 5. AWS Dynamic Inventory with the aws_ec2 Plugin
  6. 6. Grouping and Filtering Hosts with keyed_groups and Filters
  7. 7. Provisioning EC2 Instances
  8. 8. AMIs and Launch Templates
  9. 9. Building VPC Networks with Ansible
  10. 10. Security Groups and Network Access Control
  11. 11. Elastic IPs and Load Balancers
  12. 12. S3 Buckets and Object Management
  13. 13. IAM Users, Roles and Policies
  14. 14. RDS Databases with Ansible
  15. 15. Route 53 DNS Automation
  16. 16. CloudWatch Monitoring and Alarms
  17. 17. Managing Secrets: Secrets Manager, SSM Parameter Store and Ansible Vault
  18. 18. Post-Provisioning Configuration with Roles
  19. 19. Bridging Provisioning and Configuration: add_host and wait_for
  20. 20. Auto Scaling Groups and Rolling Updates
  21. 21. Validating Infrastructure with Assertions and Health Checks
  22. 22. Error Handling and Rollback in AWS Playbooks
  23. 23. Structuring a Reusable AWS Automation Project
  24. 24. Cost Control and Teardown Playbooks
  25. 25. Capstone: Provision and Configure a Multi-Tier AWS Application
View path overview →

Introduction

google.cloud is the Ansible Content Collection that provides modules, inventory plugins, and module utilities for managing Google Cloud Platform resources: Compute Engine, Cloud SQL, AlloyDB, Cloud Build, Vertex AI, IAM, and more, all driven from Ansible playbooks against the GCP APIs. Version 1.15.0 has just landed, replacing 1.14.0, and it brings two new module families plus a round of fixes to the gcp_compute dynamic inventory plugin, particularly around folder-based project resolution.

Whats New

Minor Changes

  • gcp_alloydb_* - updated to the most recent version generated from MMv1.
  • gcp_binaryauthorization_* - four new modules added for attestor/policy management plus accompanying info modules (PR #782).
  • gcp_cloudbuild_trigger - updated to the most recent version generated from MMv1.
  • gcp_cloudbuildv2_* - updated to the most recent version generated from MMv1.
  • gcp_colab_* - updated to the most recent version generated from MMv1.
  • gcp_compute inventory plugin - now prints an aggregate warning at the end of a sync when folders: is used and one or more resolved projects were skipped, summarizing how many out of the total were affected.
  • gcp_containeranalysis_* - two new modules added, a container analysis module and its matching info module (PR #782).
  • gcp_vertexai_* - updated to the most recent version generated from MMv1.

Bugfixes

  • gcp_compute inventory plugin - deduplicates resolved projects when folders: lists both a folder and one of its descendants. Previously, the descendant's projects (and therefore its hosts) were resolved twice.
  • gcp_compute inventory plugin - resolves subfolders recursively when using folders:, instead of only the projects that are direct children of the given folder. On hierarchies where the given folder only contains subfolders with no projects directly attached, the plugin previously always returned zero hosts.
  • gcp_compute inventory plugin - skips a project instead of failing the entire inventory sync when a project resolved via folders: cannot be queried, for example when the Compute Engine API is disabled or access is blocked by a VPC Service Controls perimeter. Any other error still fails the sync as before.
  • module_utils.gcp_v2 - fixed a premature encoding bug by moving the encoding step to right before the payload is sent to the API (PR #782).
  • module_utils.gcp_v2 - fixed a double decoding bug where async operations were passed through the custom decoder (if any) twice (PR #782).

Affected Components

ComponentTypeChange
gcp_alloydb_*ModulesRegenerated from MMv1
gcp_binaryauthorization_*Modules4 new modules (attestor/policy + info)
gcp_cloudbuild_triggerModuleRegenerated from MMv1
gcp_cloudbuildv2_*ModulesRegenerated from MMv1
gcp_colab_*ModulesRegenerated from MMv1
gcp_containeranalysis_*Modules2 new modules (analysis + info)
gcp_vertexai_*ModulesRegenerated from MMv1
gcp_computeInventory pluginFolder resolution fixes + aggregate skip warning
module_utils.gcp_v2Module utilEncoding and double-decoding fixes

Installing and Verifying google.cloud 1.15.0

# Install or upgrade the collection from Ansible Galaxy
ansible-galaxy collection install google.cloud --upgrade

# Verify the installed version
ansible-galaxy collection list google.cloud

# Alternatively, pin the version explicitly in requirements.yml
cat > requirements.yml <<'EOF'
collections:
  - name: google.cloud
    version: 1.15.0
EOF

ansible-galaxy collection install -r requirements.yml

# Quick sanity check against the new binauthz module
ansible-doc google.cloud.gcp_binaryauthorization_policy

Testing the gcp_compute Inventory Fixes

Anyone relying on folders: in gcp_compute.yml inventory configs should re-run a sync after upgrading, especially if the folder hierarchy has subfolders without directly attached projects, or if any project in scope has the Compute Engine API disabled or sits behind a VPC Service Controls perimeter.

# Refresh inventory cache and list resolved hosts
ansible-inventory -i gcp_compute.yml --list --playbook-dir=.

# Run with verbosity to see the new aggregate skip warning, if any
ansible-inventory -i gcp_compute.yml --graph -vvv

Review the warning output for the count of skipped projects out of the total resolved, and check that hosts from previously empty subfolder-only hierarchies now appear as expected.

All Tutorials