Repository: ansible/ansible

Issue:
cs_cloudstack invocation failure due to assumed over-restrictive policies
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and master branch are affected too.
-->

##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bug Report


##### COMPONENT NAME
cs_template

##### ANSIBLE VERSION
<!--- Paste verbatim output from “ansible --version” between quotes below -->
```
ansible 2.3.0.0
  config file = /home/drose/ansible/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.5 (default, Nov  6 2016, 00:28:07) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]

```

##### CONFIGURATION
<!---
Mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

##### OS / ENVIRONMENT
<!---
CentOS Linux release 7.3.1611 (Core)
-->

##### SUMMARY
<!--- Explain the problem briefly -->
My user account in Cloudstack installation is able to register templates, both by the web interface as well as by API commands, but not by the cs_template module..

Here is an example API registration of a template using Cloudstack-CLI by NIWO (Nik Wolfgram on Github).
~~~
cs command registerTemplate displaytext="API Test Text" format="OVA" hypervisor="VMware" name="API Test" ostypeid="781fe20e-43d5-11e4-b12f-005056b050c9" url="http://75.124.ccc.ddd/CentOs7_Cloudstack_Template.ova" zoneid="f236c7e1-58fa-468b-9978-247670615f24"
---
- id: ddd83b58-d9b1-4638-b49b-d31daaaafeef
  name: API Test
  displaytext: API Test Text
  ispublic: false
  created: '2017-06-29T12:52:35+0000'
  isready: false
  passwordenabled: false
  format: OVA
  isfeatured: false
  crossZones: false
  ostypeid: 781fe20e-43d5-11e4-b12f-005056b050c9
  ostypename: Ubuntu 12.04 (64-bit)
  account: XXX_Cloud_Compute_USD_xxx.rose@xxx.com
  zoneid: f236c7e1-58fa-468b-9978-247670615f24
  zonename: US-NEW-NUT-G-V-A-R-S-001
  status: Active
  templatetype: USER
  hypervisor: VMware
  domain: 1182949295-YYYSQE - US Exhib SRII
  domainid: fa975f0e-f572-46c7-a1c2-ebf88f1551b3
  isextractable: false
  sshkeyenabled: false
  isdynamicallyscalable: false
  tags: []
~~~
It seems when using the Ansible module cs_template, the module is issuing an 'isrouting=no'  by default.  It seems that parameter is being locked down by my current installation of Cloudstack, meaning I am forced to use other methods to register a template.  

It would seem a great fix would be to allow a 'suppress=isrouting' tag in the module invocation, allowing a user to specify a key/value NOT to be sent by cs_template (Maybe others, too, but let's localize to this module for my use-case.)

##### STEPS TO REPRODUCE
<!---
attempt to register a template hosted on a URL by Ansible cs_template module
-->

<!--- Paste example playbooks or commands between quotes below -->
```
$ ansible localhost -m cs_template -a "api_region=Dave_CMS4 zone='US-NEW-NUT-G-V-A-R-S-001'  name='TemplateTest' display_text='TemplateTestText' url='http://75.124.aaa.bbb/CentOs7_Cloudstack_Template.ova' hypervisor=VMware format=OVA os_type='CentOS 7.2' password_enabled='yes' state='present'"
localhost | FAILED! => {
    "changed": false,
    "failed": true,
    "msg": "CloudStackException: ('HTTP 531 response from CloudStack', <Response [531]>, {u'errorcode': 531, u'uuidList': [], u'cserrorcode': 4365, u'errortext': u'Parameter isrouting can only be specified by a Root Admin, permission denied'})"
}
```

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- I expected to be able to register a template  -->

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```
Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/site-packages/ansible/plugins/callbac[13/2253]
_.pyc
META: ran handlers
Using module file /usr/lib/python2.7/site-packages/ansible/modules/cloud/cloudstack/cs_template.py
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: drose
<127.0.0.1> EXEC /bin/sh -c 'echo ~ && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/drose/.ansible/tmp/ansible-tmp-1498743071.7-868135382206$
7 `" && echo ansible-tmp-1498743071.7-86813538220677="` echo /home/drose/.ansible/tmp/ansible-tmp-1498743071.7-86813538220$
77 `" ) && sleep 0'
<127.0.0.1> PUT /tmp/tmpgMlykk TO /home/drose/.ansible/tmp/ansible-tmp-1498743071.7-86813538220677/cs_template.py
<127.0.0.1> EXEC /bin/sh -c 'chmod u+x /home/drose/.ansible/tmp/ansible-tmp-1498743071.7-86813538220677/ /home/drose/.ansi$
le/tmp/ansible-tmp-1498743071.7-86813538220677/cs_template.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '/usr/bin/python2 /home/drose/.ansible/tmp/ansible-tmp-1498743071.7-86813538220677/cs_template$
py; rm -rf "/home/drose/.ansible/tmp/ansible-tmp-1498743071.7-86813538220677/" > /dev/null 2>&1 && sleep 0'
localhost | FAILED! => {
    "changed": false,
    "failed": true,
    "invocation": {
        "module_args": {
            "account": null,
            "api_http_method": "get",
            "api_key": null,
            "api_region": "Dave_CMS4",
            "api_secret": null,
            "api_timeout": 10,
            "api_url": null,
            "bits": 64,
            "checksum": null,
            "cross_zones": false,
            "details": null,
            "display_text": "TemplateTestText",
            "domain": null,
            "format": "OVA",
            "hypervisor": "VMware",
            "is_dynamically_scalable": false,
            "is_extractable": false,
            "is_featured": false,
            "is_public": true,
            "is_ready": false,
            "is_routing": false,
            "mode": "http_download",
            "name": "TemplateTest",
            "os_type": "CentOS 7.2",
            "password_enabled": true,
            "poll_async": true,
            "project": null,
            "requires_hvm": false,
            "snapshot": null,
            "sshkey_enabled": false,
            "state": "present",
            "template_filter": "self",
            "template_tag": null,
            "url": "http://75.124.xxx.xxx/CentOs7_Cloudstack_Template.ova",
            "vm": null,
            "zone": "US-NEW-NUT-G-V-A-R-S-001"
        }
    },
    "msg": "CloudStackException: ('HTTP 531 response from CloudStack', <Response [531]>, {u'errorcode': 531, u'uuidList': [], u'cserrorcode': 4365, u'errortext': u'Parameter isrouting can only be specified by a Root Admin, permission denied'})"
}
```



Discussion:
cc @resmo
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
@sdrose Thanks for the report, I see the problem. fixing.

Resolving patch:
diff --git a/lib/ansible/modules/cloud/cloudstack/cs_template.py b/lib/ansible/modules/cloud/cloudstack/cs_template.py
--- a/lib/ansible/modules/cloud/cloudstack/cs_template.py
+++ b/lib/ansible/modules/cloud/cloudstack/cs_template.py
@@ -164,7 +164,7 @@
       - True if the template type is routing i.e., if template is used to deploy router.
       - Only considered if C(url) is used.
     required: false
-    default: false
+    default: null
   format:
     description:
       - The format for the template.
@@ -622,7 +622,7 @@ def main():
         is_featured = dict(type='bool', default=False),
         is_dynamically_scalable = dict(type='bool', default=False),
         is_extractable = dict(type='bool', default=False),
-        is_routing = dict(type='bool', default=False),
+        is_routing = dict(type='bool', default=None),
         checksum = dict(default=None),
         template_filter = dict(default='self', choices=['featured', 'self', 'selfexecutable', 'sharedexecutable', 'executable', 'community']),
         hypervisor = dict(choices=CS_HYPERVISORS, default=None),


Test patch: