diff --git a/molecule/custom-config-dir/molecule.yml b/molecule/custom-config-dir/molecule.yml new file mode 100644 index 0000000..858e2e8 --- /dev/null +++ b/molecule/custom-config-dir/molecule.yml @@ -0,0 +1,23 @@ +--- +dependency: + name: galaxy +driver: + name: docker +lint: + name: yamllint +platforms: + - name: instance + image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + privileged: true + pre_build_image: true +provisioner: + name: ansible + lint: + name: ansible-lint +verifier: + name: testinfra + lint: + name: flake8 diff --git a/molecule/custom-config-dir/playbook.yml b/molecule/custom-config-dir/playbook.yml new file mode 100644 index 0000000..06b4efc --- /dev/null +++ b/molecule/custom-config-dir/playbook.yml @@ -0,0 +1,30 @@ +--- +- name: Converge + hosts: all + vars: + - theo_url: https://theo.example.com + - theo_client_token: zdOPNza4jjtceH5F2rU0iOkIJ2xlV4hGUauKT4cNe8HAp+AMnzYEzSc0EIBGM+MJuqL7gLd6bwIP + - theo_agent_config_dir: /var/lib/theo + - theo_agent_verify_signature: true + - theo_agent_public_key: | + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwVhHEBTVqEpBOpguARtg + //WyDBEoCT2F2OjnHB6fxJ9oopYJZB2Y4jj5cxo1O41r65XmMRT4lqeHWS6Iovde + kzlJ0bH91gl7/iNziUMN4ONiIR0SU3PiBGQ0XKq6rUxpsOhe+tFPfBQYhkkAiQeG + WC1GYQynYjZ/MTEDIPnd5YjSl0agzm7BMRujEcjWyYqEBuZjtDqP6AICz8nkFo9i + CWBONYbCujDl+1sei3WUfeGcUdGiPNwQGU/TW4sfcRWQzayw3XQEl3ERNRMihVsb + in2529O4+JMKdKn22mzTmWsraP/ZakVeti0VtpGZEe1YSTW8+SCz7DnTadnuUZAO + 5JFVTmFcbF7/d/H0atKVVAeTC5nqYNeDrW4jtIQalUZeaHrBkWK7i/yxDYFlC2AW + ZEu4IQZtGfNJCaZFuYSiN96yzlnMWRp1nUGaBxoax4K8rBwX8EWxT4EAyN1mtan0 + ZQITjiZTqDvnhr8iSIvn9hy3942GYi3upOsBeqfb90vzS7BAmoplyWPS0D+UWweB + +sjv96Gtb4BFpc96qwptLCnVFFOVlq0bq0u1FN6sZ4RApl2IaSJV9JGsJjeeJowh + GCK9sSDVI5XY3wy6UYMo9SZQGIglyRPrnd3R82O277lAyOVC/NNp1vq5WH/Mi1Mu + JK85kX7Atut+tgWgwuwT5vcCAwEAAQ== + -----END PUBLIC KEY----- + pre_tasks: + - name: Import common tasks + import_tasks: ../resources/playbooks/pre-tasks.yml + + + roles: + - role: ansible-theo-agent diff --git a/molecule/custom-config-dir/tests/test_default.py b/molecule/custom-config-dir/tests/test_default.py new file mode 100644 index 0000000..660b851 --- /dev/null +++ b/molecule/custom-config-dir/tests/test_default.py @@ -0,0 +1,95 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_theo_binary_file(host): + f = host.file('/usr/sbin/theo-agent') + assert f.exists + assert f.user == 'root' + assert f.group == 'root' + + +def test_theo_config_file(host): + f = host.file('/var/lib/theo/config.yml') + assert f.exists + assert f.user == 'root' + assert f.group == 'root' + conf = f.content + ''' + url: https://theo.example.com + token: \ + zdOPNza4jjtceH5F2rU0iOkIJ2xlV4hGUauKT4cNe8HAp+AMnzYEzSc0EIBGM+MJuqL7gLd6bwIP + cachedir: /var/cache/theo-agent + verify: True + public_key: /var/lib/theo/public.pem + ''' + expected = [ + b'url: https://theo.example.com', + b'token: zdOPNza4jjtceH5F2rU0iOkIJ2xlV4hGUauKT4cNe8HAp' + b'+AMnzYEzSc0EIBGM+MJuqL7gLd6bwIP', + b'cachedir: /var/cache/theo-agent', + b'verify: True', + b'public_key: /var/lib/theo/public.pem' + ] + for line in expected: + assert line in conf + + +def test_theo_public_key_file(host): + f = host.file('/var/lib/theo/public.pem') + assert f.exists + assert f.user == 'root' + assert f.group == 'root' + + +def test_sshd_config(host): + distro = os.getenv('MOLECULE_DISTRO', 'centos7') + if distro == 'debian8': + expected = get_sshd_config_pre_v69() + elif distro == 'ubuntu1404': + expected = get_sshd_config_pre_v69() + else: + expected = get_sshd_config_v69() + f = host.file('/etc/ssh/sshd_config') + config = f.content + configlines = [] + for line in config.splitlines(): + if not line.startswith(b'#'): + configlines.append(line) + ''' + I don't want to use something like: + assert set(expected).issubset(configlines) + Because there's no detail of the missing line(s) + ''' + errors = [] + for line in expected: + if line not in configlines: + errors.append(line) + + if len(errors): + print('Failed test_sshd_config, missing line(s)') + for error in errors: + print(error) + assert False + + +def get_sshd_config_pre_v69(): + return [ + b'AuthorizedKeysCommandUser theo-agent', + b'AuthorizedKeysCommand /usr/sbin/theo-agent ' + b'-config-file /var/lib/theo/config.yml %u', + b'AuthorizedKeysFile /var/cache/theo-agent/%u' + ] + + +def get_sshd_config_v69(): + return [ + b'AuthorizedKeysCommandUser theo-agent', + b'AuthorizedKeysCommand /usr/sbin/theo-agent ' + b'-config-file /var/lib/theo/config.yml -fingerprint %f %u', + b'AuthorizedKeysFile /var/cache/theo-agent/%u' + ] diff --git a/runMolecule.sh b/runMolecule.sh index 99507b5..1f421f2 100755 --- a/runMolecule.sh +++ b/runMolecule.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash -SCENARIOS="default signature custom-bin-file custom-config-file" +SCENARIOS="default signature custom-bin-file custom-config-file custom-config-dir" -MUST_FAIL="centos6:custom-config-file" +MUST_FAIL="centos6:custom-config-file centos6:custom-config-dir" function has_right_to_fail { for i in ${MUST_FAIL}; do