feat: add vagrant tests for later, add become: true to not depend on ansible.cfg
Some checks failed
test / Linting (push) Failing after 11s
test / Molecule tests (default, debian11) (push) Has been skipped
test / Molecule tests (default, debian12) (push) Has been skipped
test / Molecule tests (default, ubuntu2004) (push) Has been skipped
test / Molecule tests (default, ubuntu2204) (push) Has been skipped
test / Molecule tests (with_ssh_keys, debian11) (push) Has been skipped
test / Molecule tests (with_ssh_keys, debian12) (push) Has been skipped
test / Molecule tests (with_ssh_keys, ubuntu2004) (push) Has been skipped
test / Molecule tests (with_ssh_keys, ubuntu2204) (push) Has been skipped

This commit is contained in:
Bertrand Lanson 2023-11-30 20:51:21 +01:00
parent a73d17a4e6
commit edf6d4b74e
15 changed files with 285 additions and 0 deletions

View File

@ -4,4 +4,5 @@
ansible.builtin.service: ansible.builtin.service:
name: sshd name: sshd
state: restarted state: restarted
become: true
listen: "systemctl-restart-sshd" listen: "systemctl-restart-sshd"

View File

@ -48,6 +48,7 @@
ansible.builtin.stat: ansible.builtin.stat:
path: "/etc/sudoers.d/ubuntu" path: "/etc/sudoers.d/ubuntu"
register: stat_etc_sudoers_d_ubuntu register: stat_etc_sudoers_d_ubuntu
become: true
- name: "Verify file /etc/sudoers.d/ubuntu" - name: "Verify file /etc/sudoers.d/ubuntu"
ansible.builtin.assert: ansible.builtin.assert:
@ -60,6 +61,7 @@
ansible.builtin.stat: ansible.builtin.stat:
path: "/home/ubuntu/.ssh/authorized_keys" path: "/home/ubuntu/.ssh/authorized_keys"
register: stat_home_ubuntu_ssh_authorized_keys register: stat_home_ubuntu_ssh_authorized_keys
become: true
- name: "Verify file /home/ubuntu/.ssh/authorized_keys" - name: "Verify file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.assert: ansible.builtin.assert:

View File

@ -0,0 +1,7 @@
---
- name: Converge
hosts: all
tasks:
- name: "Include ednxzu.provision_management_user"
ansible.builtin.include_role:
name: "ednxzu.provision_management_user"

View File

@ -0,0 +1,35 @@
---
dependency:
name: galaxy
options:
requirements-file: ./requirements.yml
driver:
name: vagrant
provider:
name: libvirt
platforms:
- name: instance
box: generic/${MOLECULE_TEST_OS}
cpus: 4
memory: 4096
provisioner:
name: ansible
config_options:
defaults:
remote_tmp: /tmp/.ansible
verifier:
name: ansible
scenario:
name: default_vagrant
test_sequence:
- dependency
- cleanup
- destroy
- syntax
- create
- prepare
- converge
- idempotence
- verify
- cleanup
- destroy

View File

@ -0,0 +1,3 @@
---
# requirements file for molecule
roles: []

View File

@ -0,0 +1,73 @@
---
- name: Verify
hosts: all
gather_facts: true
tasks:
- name: "Test: file /etc/hosts"
block:
- name: "Stat file /etc/hosts"
ansible.builtin.stat:
path: "/etc/hosts"
register: stat_etc_hosts
- name: "Verify file /etc/hosts"
vars:
etc_hosts_group:
ubuntu: "adm"
debian: "root"
ansible.builtin.assert:
that:
- stat_etc_hosts.stat.exists
- stat_etc_hosts.stat.isreg
- stat_etc_hosts.stat.pw_name == 'root'
- stat_etc_hosts.stat.gr_name == etc_hosts_group[(ansible_distribution|lower)]
- name: "Test: ubuntu user and group"
block:
- name: "Getent user ansible"
ansible.builtin.getent:
database: passwd
key: ubuntu
register: ednxzu_management_user
- name: "Getent group ubuntu"
ansible.builtin.getent:
database: group
key: ubuntu
register: ednxzu_management_group
- name: "Verify ubuntu user and group"
ansible.builtin.assert:
that:
- not ednxzu_management_user.failed
- not ednxzu_management_group.failed
- "'ubuntu' in ednxzu_management_user.ansible_facts.getent_passwd.keys()"
- "'/home/ubuntu' in ednxzu_management_user.ansible_facts.getent_passwd['ubuntu']"
- "'/bin/bash' in ednxzu_management_user.ansible_facts.getent_passwd['ubuntu']"
- "'ubuntu' in ednxzu_management_group.ansible_facts.getent_group.keys()"
- name: "Test: ubuntu sudo permissions"
block:
- name: "Stat file /etc/sudoers.d/ubuntu"
ansible.builtin.stat:
path: "/etc/sudoers.d/ubuntu"
register: stat_etc_sudoers_d_ubuntu
become: true
- name: "Verify file /etc/sudoers.d/ubuntu"
ansible.builtin.assert:
that:
- not stat_etc_sudoers_d_ubuntu.stat.exists
- name: "Test: ubuntu authorized_keys"
block:
- name: "Stat file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.stat:
path: "/home/ubuntu/.ssh/authorized_keys"
register: stat_home_ubuntu_ssh_authorized_keys
become: true
- name: "Verify file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.assert:
that:
- not stat_home_ubuntu_ssh_authorized_keys.stat.exists

View File

@ -48,11 +48,13 @@
ansible.builtin.stat: ansible.builtin.stat:
path: "/etc/sudoers.d/ubuntu" path: "/etc/sudoers.d/ubuntu"
register: stat_etc_sudoers_d_ubuntu register: stat_etc_sudoers_d_ubuntu
become: true
- name: "Slurp file /etc/sudoers.d/ubuntu" - name: "Slurp file /etc/sudoers.d/ubuntu"
ansible.builtin.slurp: ansible.builtin.slurp:
src: "/etc/sudoers.d/ubuntu" src: "/etc/sudoers.d/ubuntu"
register: slurp_etc_sudoers_d_ubuntu register: slurp_etc_sudoers_d_ubuntu
become: true
- name: "Verify file /etc/sudoers.d/ubuntu" - name: "Verify file /etc/sudoers.d/ubuntu"
ansible.builtin.assert: ansible.builtin.assert:
@ -70,11 +72,13 @@
ansible.builtin.stat: ansible.builtin.stat:
path: "/home/ubuntu/.ssh/authorized_keys" path: "/home/ubuntu/.ssh/authorized_keys"
register: stat_home_ubuntu_ssh_authorized_keys register: stat_home_ubuntu_ssh_authorized_keys
become: true
- name: "Slurp file /home/ubuntu/.ssh/authorized_keys" - name: "Slurp file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.slurp: ansible.builtin.slurp:
src: "/home/ubuntu/.ssh/authorized_keys" src: "/home/ubuntu/.ssh/authorized_keys"
register: slurp_home_ubuntu_ssh_authorized_keys register: slurp_home_ubuntu_ssh_authorized_keys
become: true
- name: "Verify file /home/ubuntu/.ssh/authorized_keys" - name: "Verify file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.assert: ansible.builtin.assert:

View File

@ -0,0 +1,7 @@
---
- name: Converge
hosts: all
tasks:
- name: "Include ednxzu.provision_management_user"
ansible.builtin.include_role:
name: "ednxzu.provision_management_user"

View File

@ -0,0 +1,14 @@
---
provision_management_user_name: ubuntu
provision_management_user_group: ubuntu
provision_management_user_password: "*"
provision_management_user_is_system: true
provision_management_user_home: /home/{{ provision_management_user_name }}
provision_management_user_shell: /bin/bash
provision_management_user_sudoer: true
provision_management_user_disable_root_login: false
provision_management_user_disable_root_password_auth: false
provision_management_user_add_ssh_key: true
provision_management_user_ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClfmTk73wNNL2jwvhRUmUuy80JRrz3P7cEgXUqlc5O9"
provision_management_user_ssh_key_options: ""
provision_management_user_ssh_key_exclusive: true

View File

@ -0,0 +1,35 @@
---
dependency:
name: galaxy
options:
requirements-file: ./requirements.yml
driver:
name: vagrant
provider:
name: libvirt
platforms:
- name: instance
box: generic/${MOLECULE_TEST_OS}
cpus: 4
memory: 4096
provisioner:
name: ansible
config_options:
defaults:
remote_tmp: /tmp/.ansible
verifier:
name: ansible
scenario:
name: with_ssh_keys_vagrant
test_sequence:
- dependency
- cleanup
- destroy
- syntax
- create
- prepare
- converge
- idempotence
- verify
- cleanup
- destroy

View File

@ -0,0 +1,3 @@
---
# requirements file for molecule
roles: []

View File

@ -0,0 +1,95 @@
---
- name: Verify
hosts: all
gather_facts: true
tasks:
- name: "Test: file /etc/hosts"
block:
- name: "Stat file /etc/hosts"
ansible.builtin.stat:
path: "/etc/hosts"
register: stat_etc_hosts
- name: "Verify file /etc/hosts"
vars:
etc_hosts_group:
ubuntu: "adm"
debian: "root"
ansible.builtin.assert:
that:
- stat_etc_hosts.stat.exists
- stat_etc_hosts.stat.isreg
- stat_etc_hosts.stat.pw_name == 'root'
- stat_etc_hosts.stat.gr_name == etc_hosts_group[(ansible_distribution|lower)]
- name: "Test: ubuntu user and group"
block:
- name: "Getent user ansible"
ansible.builtin.getent:
database: passwd
key: ubuntu
register: ednxzu_management_user
- name: "Getent group ubuntu"
ansible.builtin.getent:
database: group
key: ubuntu
register: ednxzu_management_group
- name: "Verify ubuntu user and group"
ansible.builtin.assert:
that:
- not ednxzu_management_user.failed
- not ednxzu_management_group.failed
- "'ubuntu' in ednxzu_management_user.ansible_facts.getent_passwd.keys()"
- "'/home/ubuntu' in ednxzu_management_user.ansible_facts.getent_passwd['ubuntu']"
- "'/bin/bash' in ednxzu_management_user.ansible_facts.getent_passwd['ubuntu']"
- "'ubuntu' in ednxzu_management_group.ansible_facts.getent_group.keys()"
- name: "Test: ubuntu sudo permissions"
block:
- name: "Stat file /etc/sudoers.d/ubuntu"
ansible.builtin.stat:
path: "/etc/sudoers.d/ubuntu"
register: stat_etc_sudoers_d_ubuntu
become: true
- name: "Slurp file /etc/sudoers.d/ubuntu"
ansible.builtin.slurp:
src: "/etc/sudoers.d/ubuntu"
register: slurp_etc_sudoers_d_ubuntu
become: true
- name: "Verify file /etc/sudoers.d/ubuntu"
ansible.builtin.assert:
that:
- stat_etc_sudoers_d_ubuntu.stat.exists
- stat_etc_sudoers_d_ubuntu.stat.isreg
- stat_etc_sudoers_d_ubuntu.stat.pw_name == 'root'
- stat_etc_sudoers_d_ubuntu.stat.gr_name == 'root'
- stat_etc_sudoers_d_ubuntu.stat.mode == '0440'
- "'ubuntu ALL=NOPASSWD:SETENV: ALL' in (slurp_etc_sudoers_d_ubuntu.content|b64decode)"
- name: "Test: ubuntu authorized_keys"
block:
- name: "Stat file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.stat:
path: "/home/ubuntu/.ssh/authorized_keys"
register: stat_home_ubuntu_ssh_authorized_keys
become: true
- name: "Slurp file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.slurp:
src: "/home/ubuntu/.ssh/authorized_keys"
register: slurp_home_ubuntu_ssh_authorized_keys
become: true
- name: "Verify file /home/ubuntu/.ssh/authorized_keys"
ansible.builtin.assert:
that:
- stat_home_ubuntu_ssh_authorized_keys.stat.exists
- stat_home_ubuntu_ssh_authorized_keys.stat.isreg
- stat_home_ubuntu_ssh_authorized_keys.stat.pw_name == 'ubuntu'
- stat_home_ubuntu_ssh_authorized_keys.stat.gr_name == 'ubuntu'
- stat_home_ubuntu_ssh_authorized_keys.stat.mode == '0600'
- "'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClfmTk73wNNL2jwvhRUmUuy80JRrz3P7cEgXUqlc5O9 ubuntu@instance' in (slurp_home_ubuntu_ssh_authorized_keys.content|b64decode)"

View File

@ -7,3 +7,4 @@
comment: "{{ provision_management_user_name }}@{{ ansible_hostname }}" comment: "{{ provision_management_user_name }}@{{ ansible_hostname }}"
key_options: "{{ provision_management_user_ssh_key_options }}" key_options: "{{ provision_management_user_ssh_key_options }}"
exclusive: "{{ provision_management_user_ssh_key_exclusive }}" exclusive: "{{ provision_management_user_ssh_key_exclusive }}"
become: true

View File

@ -10,6 +10,7 @@
notify: notify:
- systemctl-restart-sshd - systemctl-restart-sshd
when: provision_management_user_disable_root_password_auth when: provision_management_user_disable_root_password_auth
become: true
- name: "Lock root authentication" - name: "Lock root authentication"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -21,3 +22,4 @@
notify: notify:
- systemctl-restart-sshd - systemctl-restart-sshd
when: provision_management_user_disable_root_login when: provision_management_user_disable_root_login
become: true

View File

@ -5,6 +5,7 @@
name: "{{ provision_management_user_group }}" name: "{{ provision_management_user_group }}"
state: present state: present
system: "{{ provision_management_user_is_system }}" system: "{{ provision_management_user_is_system }}"
become: true
- name: "Create user {{ provision_management_user_name }}" - name: "Create user {{ provision_management_user_name }}"
ansible.builtin.user: ansible.builtin.user:
@ -16,6 +17,7 @@
shell: "{{ provision_management_user_shell }}" shell: "{{ provision_management_user_shell }}"
system: "{{ provision_management_user_is_system }}" system: "{{ provision_management_user_is_system }}"
create_home: true create_home: true
become: true
- name: "Add user to sudoers" - name: "Add user to sudoers"
community.general.sudoers: community.general.sudoers:
@ -25,3 +27,4 @@
nopassword: true nopassword: true
setenv: true setenv: true
when: provision_management_user_sudoer when: provision_management_user_sudoer
become: true