From 81e7bb6e0c0473eadb4f442af4d95234771daed3 Mon Sep 17 00:00:00 2001 From: Rich Megginson Date: Thu, 12 Oct 2023 15:42:02 -0600 Subject: [PATCH] feat: support for ostree systems Feature: Allow running and testing the role with ostree managed nodes. Reason: We have users who want to use the role to manage ostree systems. Result: Users can use the role to manage ostree managed nodes. Signed-off-by: Rich Megginson --- .ansible-lint | 2 + .ostree/README.md | 3 + .ostree/get_ostree_data.sh | 113 ++++++++++++ .ostree/packages-runtime-CentOS-7.txt | 3 + .ostree/packages-runtime-CentOS-8.txt | 3 + .ostree/packages-runtime-CentOS-9.txt | 3 + .ostree/packages-runtime-Fedora.txt | 3 + .ostree/packages-runtime-RedHat-7.txt | 3 + .ostree/packages-runtime-RedHat-8.txt | 3 + .ostree/packages-runtime-RedHat-9.txt | 3 + .ostree/packages-runtime.txt | 1 + .ostree/packages-testing-CentOS-7.txt | 1 + .ostree/packages-testing-CentOS-8.txt | 2 + .ostree/packages-testing-CentOS-9.txt | 2 + .ostree/packages-testing-Fedora.txt | 2 + .ostree/packages-testing-RedHat-7.txt | 1 + .ostree/packages-testing-RedHat-8.txt | 2 + .ostree/packages-testing-RedHat-9.txt | 2 + .ostree/packages-testing.txt | 2 + .sanity-ansible-ignore-2.10.txt | 1 + .sanity-ansible-ignore-2.11.txt | 1 + .sanity-ansible-ignore-2.12.txt | 1 + .sanity-ansible-ignore-2.13.txt | 1 + .sanity-ansible-ignore-2.14.txt | 1 + .sanity-ansible-ignore-2.15.txt | 1 + .sanity-ansible-ignore-2.9.txt | 1 + README-ostree.md | 66 +++++++ README.md | 16 +- meta/collection-requirements.yml | 4 + tasks/set_vars.yml | 18 ++ tests/tasks/assert_certificate_parameters.yml | 18 ++ tests/tasks/setup_ipa.yml | 18 ++ tests/tests_basic_ipa.yml | 161 +++++++++--------- 33 files changed, 382 insertions(+), 80 deletions(-) create mode 100644 .ostree/README.md create mode 100755 .ostree/get_ostree_data.sh create mode 100644 .ostree/packages-runtime-CentOS-7.txt create mode 100644 .ostree/packages-runtime-CentOS-8.txt create mode 100644 .ostree/packages-runtime-CentOS-9.txt create mode 100644 .ostree/packages-runtime-Fedora.txt create mode 100644 .ostree/packages-runtime-RedHat-7.txt create mode 100644 .ostree/packages-runtime-RedHat-8.txt create mode 100644 .ostree/packages-runtime-RedHat-9.txt create mode 100644 .ostree/packages-runtime.txt create mode 100644 .ostree/packages-testing-CentOS-7.txt create mode 100644 .ostree/packages-testing-CentOS-8.txt create mode 100644 .ostree/packages-testing-CentOS-9.txt create mode 100644 .ostree/packages-testing-Fedora.txt create mode 100644 .ostree/packages-testing-RedHat-7.txt create mode 100644 .ostree/packages-testing-RedHat-8.txt create mode 100644 .ostree/packages-testing-RedHat-9.txt create mode 100644 .ostree/packages-testing.txt create mode 100644 README-ostree.md create mode 100644 meta/collection-requirements.yml diff --git a/.ansible-lint b/.ansible-lint index 5ca70221..4ac1196d 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -22,3 +22,5 @@ exclude_paths: - examples/roles/ mock_roles: - linux-system-roles.certificate +mock_modules: + - ansible.utils.update_fact diff --git a/.ostree/README.md b/.ostree/README.md new file mode 100644 index 00000000..f5e6931b --- /dev/null +++ b/.ostree/README.md @@ -0,0 +1,3 @@ +*NOTE*: The `*.txt` files are used by `get_ostree_data.sh` to create the lists +of packages, and to find other system roles used by this role. DO NOT use them +directly. diff --git a/.ostree/get_ostree_data.sh b/.ostree/get_ostree_data.sh new file mode 100755 index 00000000..d0a03a3d --- /dev/null +++ b/.ostree/get_ostree_data.sh @@ -0,0 +1,113 @@ +#!/bin/bash + +set -euo pipefail + +role_collection_dir="${ROLE_COLLECTION_DIR:-fedora/linux_system_roles}" +ostree_dir="${OSTREE_DIR:-"$(dirname "$(realpath "$0")")"}" + +if [ -z "${4:-}" ] || [ "${1:-}" = help ] || [ "${1:-}" = -h ]; then + cat < 0 +- name: Ensure correct package manager for ostree systems + vars: + ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree + ostree_booted_file: /run/ostree-booted + when: ansible_facts.pkg_mgr | d("") != ostree_pkg_mgr + block: + - name: Check if system is ostree + stat: + path: "{{ ostree_booted_file }}" + register: __ostree_booted_stat + + - name: Set package manager to use for ostree + ansible.utils.update_fact: + updates: + - path: ansible_facts.pkg_mgr + value: "{{ ostree_pkg_mgr }}" + when: __ostree_booted_stat.stat.exists + - name: Set platform/version specific variables include_vars: "{{ __vars_file }}" loop: diff --git a/tests/tasks/assert_certificate_parameters.yml b/tests/tasks/assert_certificate_parameters.yml index fd944708..c87105fa 100644 --- a/tests/tasks/assert_certificate_parameters.yml +++ b/tests/tasks/assert_certificate_parameters.yml @@ -3,6 +3,24 @@ set_fact: __virtualenv_path: /tmp/certificate-tests-venv +- name: Ensure correct package manager for ostree systems + vars: + ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree + ostree_booted_file: /run/ostree-booted + when: ansible_facts.pkg_mgr | d("") != ostree_pkg_mgr + block: + - name: Check if system is ostree + stat: + path: "{{ ostree_booted_file }}" + register: __ostree_booted_stat + + - name: Set package manager to use for ostree + ansible.utils.update_fact: + updates: + - path: ansible_facts.pkg_mgr + value: "{{ ostree_pkg_mgr }}" + when: __ostree_booted_stat.stat.exists + - name: Ensure python3 is installed package: name: diff --git a/tests/tasks/setup_ipa.yml b/tests/tasks/setup_ipa.yml index 56ed3497..b24f37f4 100644 --- a/tests/tasks/setup_ipa.yml +++ b/tests/tasks/setup_ipa.yml @@ -3,6 +3,24 @@ set_fact: __is_beaker_env: "{{ lookup('env', 'BEAKERLIB') | length > 0 }}" +- name: Ensure correct package manager for ostree systems + vars: + ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree + ostree_booted_file: /run/ostree-booted + when: ansible_facts.pkg_mgr | d("") != ostree_pkg_mgr + block: + - name: Check if system is ostree + stat: + path: "{{ ostree_booted_file }}" + register: __ostree_booted_stat + + - name: Set package manager to use for ostree + ansible.utils.update_fact: + updates: + - path: ansible_facts.pkg_mgr + value: "{{ ostree_pkg_mgr }}" + when: __ostree_booted_stat.stat.exists + - name: Install ansible-freeipa package: name: ansible-freeipa diff --git a/tests/tests_basic_ipa.yml b/tests/tests_basic_ipa.yml index 10c6b8e7..b0bd021c 100644 --- a/tests/tests_basic_ipa.yml +++ b/tests/tests_basic_ipa.yml @@ -1,95 +1,98 @@ --- -- name: Install IPA server +- name: Test using IPA to issue certs hosts: all gather_facts: true become: true tags: - tests::slow tasks: + - name: Check if test is supported + vars: + ostree_booted_file: /run/ostree-booted + block: + - name: Check if system is ostree + stat: + path: "{{ ostree_booted_file }}" + register: __ostree_booted_stat + + - name: Skip if not supported + meta: end_host + when: __ostree_booted_stat.stat.exists + - name: Setup IPA import_tasks: tasks/setup_ipa.yml -- name: Issue IPA signed certificates - hosts: all - become: true - tags: - - tests::slow - vars: - certificate_requests: - - name: mycert_basic_ipa - dns: ipaserver.test.local - principal: HTTP/ipaserver.test.local@TEST.LOCAL - ca: ipa + - name: Issue IPA signed certificates + include_role: + name: linux-system-roles.certificate + vars: + certificate_requests: + - name: mycert_basic_ipa + dns: ipaserver.test.local + principal: HTTP/ipaserver.test.local@TEST.LOCAL + ca: ipa - - name: groupcert - dns: ipaserver.test.local - principal: HTTP/ipaserver.test.local@TEST.LOCAL - ca: ipa - group: ftp - roles: - - linux-system-roles.certificate + - name: groupcert + dns: ipaserver.test.local + principal: HTTP/ipaserver.test.local@TEST.LOCAL + ca: ipa + group: ftp -- name: Verify certificates - hosts: all - become: true - tags: - - tests::slow - vars: - certificates: - - path: /etc/pki/tls/certs/mycert_basic_ipa.crt - key_path: /etc/pki/tls/private/mycert_basic_ipa.key - subject: - - name: commonName - oid: 2.5.4.3 - value: ipaserver.test.local - - name: organizationName - oid: 2.5.4.10 - value: TEST.LOCAL - subject_alt_name: - - name: DNS - value: ipaserver.test.local - - name: Universal Principal Name (UPN) - oid: 1.3.6.1.4.1.311.20.2.3 - value: HTTP/ipaserver.test.local@TEST.LOCAL - - name: Kerberos principalname - oid: 1.3.6.1.5.2.2 - value: HTTP/ipaserver.test.local@TEST.LOCAL - # IPA CA doesn't respect the requested key_usage (and that's ok) - key_usage: - - digital_signature - - content_commitment - - key_encipherment - - data_encipherment - - - path: /etc/pki/tls/certs/groupcert.crt - key_path: /etc/pki/tls/private/groupcert.key - owner: root - group: ftp - mode: "0640" - subject: - - name: commonName - oid: 2.5.4.3 - value: ipaserver.test.local - - name: organizationName - oid: 2.5.4.10 - value: TEST.LOCAL - subject_alt_name: - - name: DNS - value: ipaserver.test.local - - name: Universal Principal Name (UPN) - oid: 1.3.6.1.4.1.311.20.2.3 - value: HTTP/ipaserver.test.local@TEST.LOCAL - - name: Kerberos principalname - oid: 1.3.6.1.5.2.2 - value: HTTP/ipaserver.test.local@TEST.LOCAL - key_usage: - - digital_signature - - content_commitment - - key_encipherment - - data_encipherment - tasks: - - name: Verify each certificate + - name: Verify certificates include_tasks: tasks/assert_certificate_parameters.yml loop: "{{ certificates }}" loop_control: loop_var: cert + vars: + certificates: + - path: /etc/pki/tls/certs/mycert_basic_ipa.crt + key_path: /etc/pki/tls/private/mycert_basic_ipa.key + subject: + - name: commonName + oid: 2.5.4.3 + value: ipaserver.test.local + - name: organizationName + oid: 2.5.4.10 + value: TEST.LOCAL + subject_alt_name: + - name: DNS + value: ipaserver.test.local + - name: Universal Principal Name (UPN) + oid: 1.3.6.1.4.1.311.20.2.3 + value: HTTP/ipaserver.test.local@TEST.LOCAL + - name: Kerberos principalname + oid: 1.3.6.1.5.2.2 + value: HTTP/ipaserver.test.local@TEST.LOCAL + # IPA CA doesn't respect the requested key_usage (and that's ok) + key_usage: + - digital_signature + - content_commitment + - key_encipherment + - data_encipherment + + - path: /etc/pki/tls/certs/groupcert.crt + key_path: /etc/pki/tls/private/groupcert.key + owner: root + group: ftp + mode: "0640" + subject: + - name: commonName + oid: 2.5.4.3 + value: ipaserver.test.local + - name: organizationName + oid: 2.5.4.10 + value: TEST.LOCAL + subject_alt_name: + - name: DNS + value: ipaserver.test.local + - name: Universal Principal Name (UPN) + oid: 1.3.6.1.4.1.311.20.2.3 + value: HTTP/ipaserver.test.local@TEST.LOCAL + - name: Kerberos principalname + oid: 1.3.6.1.5.2.2 + value: HTTP/ipaserver.test.local@TEST.LOCAL + key_usage: + - digital_signature + - content_commitment + - key_encipherment + - data_encipherment