tests should now work using ansible
Some checks failed
test / Linting (push) Failing after 26s
test / Molecule tests (default, debian11) (push) Has been skipped
test / Molecule tests (default, debian12) (push) Has been skipped
test / Molecule tests (default, ubuntu2004) (push) Has been skipped
test / Molecule tests (default, ubuntu2204) (push) Has been skipped
test / Molecule tests (with_acl_enabled, debian11) (push) Has been skipped
test / Molecule tests (with_acl_enabled, debian12) (push) Has been skipped
test / Molecule tests (with_acl_enabled, ubuntu2004) (push) Has been skipped
test / Molecule tests (with_acl_enabled, ubuntu2204) (push) Has been skipped

This commit is contained in:
Bertrand Lanson 2023-07-15 00:13:04 +02:00
parent c30e75bdf8
commit 0b2ab74817
5 changed files with 87 additions and 22 deletions

View File

@ -1,3 +0,0 @@
---
provision_ansible_user_name: deploy
provision_ansible_user_group: deploy

View File

@ -23,45 +23,45 @@
- name: "Getent user ansible"
ansible.builtin.getent:
database: passwd
key: deploy
register: ansible_user
key: ansible
register: ednxzu_ansible_user
- name: "Getent group ansible"
ansible.builtin.getent:
database: group
key: deploy
register: ansible_group
key: ansible
register: ednxzu_ansible_group
- name: "Verify ansible user and group"
ansible.builtin.assert:
that:
- not ansible_user.failed
- not ansible_group.failed
- "'deploy' in ansible_user.ansible_facts.getent_passwd.keys()"
- "'/opt/deploy' in ansible_user.ansible_facts.getent_passwd['deploy']"
- "'/bin/bash' in ansible_user.ansible_facts.getent_passwd['deploy']"
- "'deploy' in ansible_group.ansible_facts.getent_group.keys()"
- not ednxzu_ansible_user.failed
- not ednxzu_ansible_group.failed
- "'ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd.keys()"
- "'/opt/ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']"
- "'/bin/bash' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']"
- "'ansible' in ednxzu_ansible_group.ansible_facts.getent_group.keys()"
- name: "Test: ansible sudo permissions"
block:
- name: "Stat file /etc/sudoers.d/deploy"
- name: "Stat file /etc/sudoers.d/ansible"
ansible.builtin.stat:
path: "/etc/sudoers.d"
path: "/etc/sudoers.d/ansible"
register: stat_etc_sudoers_d_ansible
- name: "Verify file /etc/sudoers.d/deploy"
- name: "Verify file /etc/sudoers.d/ansible"
ansible.builtin.assert:
that:
- not stat_etc_sudoers_d_ansible.stat.exists
- name: "Test: ansible authorized_keys"
block:
- name: "Stat file /opt/deploy/.ssh/authorized_keys"
- name: "Stat file /opt/ansible/.ssh/authorized_keys"
ansible.builtin.stat:
path: "/opt/deploy/.ssh/authorized_keys"
path: "/opt/ansible/.ssh/authorized_keys"
register: stat_opt_ansible_ssh_authorized_keys
- name: "Verify file /opt/deploy/.ssh/authorized_keys"
- name: "Verify file /opt/ansible/.ssh/authorized_keys"
ansible.builtin.assert:
that:
- not stat_opt_ansible_ssh_authorized_keys.stat.exists

View File

@ -1,6 +1,6 @@
---
provision_ansible_user_name: deploy
provision_ansible_user_group: deploy
provision_ansible_user_name: ansible
provision_ansible_user_group: ansible
provision_ansible_user_password: "*"
provision_ansible_user_is_system: true
provision_ansible_user_home: /opt/{{ provision_ansible_user_name }}

View File

@ -20,7 +20,7 @@ provisioner:
defaults:
remote_tmp: /tmp/.ansible
verifier:
name: testinfra
name: ansible
scenario:
name: with_ssh_keys
test_sequence:

View File

@ -17,3 +17,71 @@
- stat_etc_hosts.stat.isreg
- stat_etc_hosts.stat.pw_name == 'root'
- stat_etc_hosts.stat.gr_name == 'root'
- name: "Test: ansible user and group"
block:
- name: "Getent user ansible"
ansible.builtin.getent:
database: passwd
key: ansible
register: ednxzu_ansible_user
- name: "Getent group ansible"
ansible.builtin.getent:
database: group
key: ansible
register: ednxzu_ansible_group
- name: "Verify ansible user and group"
ansible.builtin.assert:
that:
- not ednxzu_ansible_user.failed
- not ednxzu_ansible_group.failed
- "'ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd.keys()"
- "'/opt/ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']"
- "'/bin/bash' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']"
- "'ansible' in ednxzu_ansible_group.ansible_facts.getent_group.keys()"
- name: "Test: ansible sudo permissions"
block:
- name: "Stat file /etc/sudoers.d/ansible"
ansible.builtin.stat:
path: "/etc/sudoers.d/ansible"
register: stat_etc_sudoers_d_ansible
- name: "Slurp file /etc/sudoers.d/ansible"
ansible.builtin.slurp:
src: "/etc/sudoers.d/ansible"
register: slurp_etc_sudoers_d_ansible
- name: "Verify file /etc/sudoers.d/ansible"
ansible.builtin.assert:
that:
- stat_etc_sudoers_d_ansible.stat.exists
- stat_etc_sudoers_d_ansible.stat.isreg
- stat_etc_sudoers_d_ansible.stat.pw_name == 'root'
- stat_etc_sudoers_d_ansible.stat.gr_name == 'root'
- stat_etc_sudoers_d_ansible.stat.mode == '0440'
- "'ansible ALL=NOPASSWD:SETENV: ALL' in (slurp_etc_sudoers_d_ansible.content|b64decode)"
- name: "Test: ansible authorized_keys"
block:
- name: "Stat file /opt/ansible/.ssh/authorized_keys"
ansible.builtin.stat:
path: "/opt/ansible/.ssh/authorized_keys"
register: stat_opt_ansible_ssh_authorized_keys
- name: "Slurp file /opt/ansible/.ssh/authorized_keys"
ansible.builtin.slurp:
src: "/opt/ansible/.ssh/authorized_keys"
register: slurp_opt_ansible_ssh_authorized_keys
- name: "Verify file /opt/ansible/.ssh/authorized_keys"
ansible.builtin.assert:
that:
- stat_opt_ansible_ssh_authorized_keys.stat.exists
- stat_opt_ansible_ssh_authorized_keys.stat.isreg
- stat_opt_ansible_ssh_authorized_keys.stat.pw_name == 'ansible'
- stat_opt_ansible_ssh_authorized_keys.stat.gr_name == 'ansible'
- stat_opt_ansible_ssh_authorized_keys.stat.mode == '0600'
- "'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClfmTk73wNNL2jwvhRUmUuy80JRrz3P7cEgXUqlc5O9 ansible@instance' in (slurp_opt_ansible_ssh_authorized_keys.content|b64decode)"