name: certificates
tasks_from: upload_root_ca.yml
vars:
- certificates_local_dir: certs
+ certificates_local_dir: "{{ playbook_dir }}/certs"
--- /dev/null
+extends: default
+
+rules:
+ braces:
+ max-spaces-inside: 1
+ level: error
+ brackets:
+ max-spaces-inside: 1
+ level: error
+ line-length: disable
+# truthy: disable
---
# Generate certs to local current dir where ansible in run (= playbook_dir)
# After ansible run, dir can be deleted but idempotence is lost and certs are re-generated in next run
-certificates_local_dir: certs
+certificates_local_dir: "{{ playbook_dir }}/certs"
--- /dev/null
+---
+certificates:
+ organization_name: MoleculeTesters
+ state_or_province_name: Poland
+ country_name: PL
+ locality_name: Krakow
+app_data_path: /opt/moleculetestapp
--- /dev/null
+---
+cluster_ip: 1.2.3.4
--- /dev/null
+---
+dependency:
+ name: galaxy
+driver:
+ name: docker
+lint:
+ name: yamllint
+platforms:
+ - name: infrastructure-server
+ image: molecule-${PREBUILD_PLATFORM_DISTRO:-centos}:${PREBUILD_DISTRO_VERSION:-centos7.6}
+ pre_build_image: true
+ privileged: true
+ command: ${MOLECULE_DOCKER_COMMAND:-""}
+ env:
+ container: docker
+ groups:
+ - infrastructure
+
+ - name: kubernetes-node-1
+ image: molecule-${PREBUILD_PLATFORM_DISTRO:-centos}:${PREBUILD_DISTRO_VERSION:-centos7.6}
+ pre_build_image: true
+ privileged: true
+ command: ${MOLECULE_DOCKER_COMMAND:-""}
+ env:
+ container: docker
+ groups:
+ - kubernetes
+provisioner:
+ name: ansible
+ log: true
+ lint:
+ name: ansible-lint
+ env:
+ ANSIBLE_ROLES_PATH: ../../../../test/roles
+ ANSIBLE_LIBRARY: ../../../../library
+ inventory:
+ links:
+ group_vars: ../../../../group_vars/
+scenario:
+ name: default
+ test_sequence:
+ - lint
+ - cleanup
+ - destroy
+ - dependency
+ - syntax
+ - create
+ - prepare
+ - converge
+ # - idempotence
+ # --> Action: 'idempotence'
+ # ERROR: Idempotence test failed because of the following tasks:
+ # * [infrastructure-server -> localhost] => certificates : Generate an OpenSSL CSR.
+ # * [infrastructure-server -> localhost] => certificates : Generate root CA certificate
+ # * [infrastructure-server] => certificates : Upload certificates to infrastructure server
+ # * [infrastructure-server] => certificates : Copy root certificate
+ # * [infrastructure-server] => certificates : Extract root certificate
+ # * [infrastructure-server] => docker : Setup docker dns settings
+ # * [kubernetes-node-1] => certificates : Copy root certificate
+ # * [kubernetes-node-1] => certificates : Extract root certificate
+ # * [kubernetes-node-1] => certificates : Extract root certificate
+ - side_effect
+ - verify
+ - cleanup
+ - destroy
+verifier:
+ name: testinfra
+ options:
+ verbose: true
+ lint:
+ name: flake8
--- /dev/null
+---
+- name: Infra
+ hosts: infrastructure
+ roles:
+ - certificates
+ - docker # docker role needed here just because of docker restart handler
+
+- name: Kube
+ hosts: kubernetes
+ roles:
+ - docker # docker role needed here just because of docker restart handler
+ tasks:
+ - include_role:
+ name: certificates
+ tasks_from: upload_root_ca.yml
+ vars:
+ certificates_local_dir: certs
--- /dev/null
+---
+- name: Prepare infra
+ hosts: all
+ roles:
+ - prepare-docker
--- /dev/null
+import os
+import pytest
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+ os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+@pytest.mark.parametrize('cert_file', [
+ 'rootCA.crt'
+])
+def test_cert_file_installed(host, cert_file):
+ os = host.system_info.distribution
+ if os == "centos":
+ f = host.file('/etc/pki/ca-trust/source/anchors/' + cert_file)
+
+ assert f.exists
+ assert f.user == 'root'
+ assert f.group == 'root'
--- /dev/null
+import os
+import pytest
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+ os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('infrastructure')
+
+
+@pytest.fixture
+def group_vars(host):
+ all_file = "file=group_vars/all.yml name=all"
+ return host.ansible("include_vars", all_file)["ansible_facts"]["all"]
+
+
+@pytest.mark.parametrize('cert_file', [
+ 'nexus_server.crt',
+ 'nexus_server.csr',
+ 'nexus_server.key',
+ 'rootCA.crt',
+ 'rootCA.csr',
+ 'rootCA.key'
+])
+def test_generated_cert_files_copied_to_infra(host, cert_file, group_vars):
+ f = host.file(group_vars["app_data_path"] + '/certs/' + cert_file)
+ assert f.exists
+ assert f.user == 'root'
+ assert f.group == 'root'
+
+ # Verify cert files content locally is as in node
+ with open("certs/" + cert_file) as local_cert_file:
+ local_content = local_cert_file.read().strip()
+ assert local_content == f.content_string
body:
name: configure
type: groovy
- content: "{{ lookup('file', 'files/configure.groovy') }}"
+ content: "{{ lookup('file', '{{ role_path }}/files/configure.groovy') }}"
status_code: [204]
- name: "execute configuration script"
uri: