Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tests: Run cleanup on failures as well #47

Merged
merged 1 commit into from
Nov 16, 2021
Merged

tests: Run cleanup on failures as well #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 45 additions & 42 deletions tests/tests_certificate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,54 +28,57 @@
- name: Generate self-signed certmonger certificate
hosts: all
tasks:
- name: Collect installed package versions
package_facts:

- name: Check if cockpit is new enough (at least 211) to support certmonger
when: ansible_facts.packages['cockpit-ws'][0].version | int >= 211
- name: tests
block:
# Fixed in cockpit 255 (https://github.com/cockpit-project/cockpit/commit/6ec4881856e)
- name: Allow certmonger to write into Cockpit's certificate directory
file:
path: /etc/cockpit/ws-certs.d/
state: directory
setype: cert_t
- name: Collect installed package versions
package_facts:

- name: Check if cockpit is new enough (at least 211) to support certmonger
when: ansible_facts.packages['cockpit-ws'][0].version | int >= 211
block:
# Fixed in cockpit 255 (https://github.com/cockpit-project/cockpit/commit/6ec4881856e)
- name: Allow certmonger to write into Cockpit's certificate directory
file:
path: /etc/cockpit/ws-certs.d/
state: directory
setype: cert_t

# has to be done dynamically, as the first step checks it out
- name: Generate certificate with linux-system-roles.certificate
include_role:
name: linux-system-roles.certificate
vars:
certificate_requests:
- name: /etc/cockpit/ws-certs.d/monger-cockpit
dns: ['localhost', 'www.example.com']
ca: self-sign
group: cockpit-ws
# has to be done dynamically, as the first step checks it out
- name: Generate certificate with linux-system-roles.certificate
include_role:
name: linux-system-roles.certificate
vars:
certificate_requests:
- name: /etc/cockpit/ws-certs.d/monger-cockpit
dns: ['localhost', 'www.example.com']
ca: self-sign
group: cockpit-ws

#
# Validate installation
#
#
# Validate installation
#

- name: test - cockpit works with TLS and expected certificate
command:
cmd: curl --cacert /etc/cockpit/ws-certs.d/monger-cockpit.crt https://localhost:9090
# ansible 2.11's uri module has ca_path, but that's still too new for us
warn: false
changed_when: false
- name: test - cockpit works with TLS and expected certificate
command:
cmd: curl --cacert /etc/cockpit/ws-certs.d/monger-cockpit.crt https://localhost:9090
# ansible 2.11's uri module has ca_path, but that's still too new for us
warn: false
changed_when: false

- name: test - get certmonger tracking status
command: getcert list --tracking-only -f /etc/cockpit/ws-certs.d/monger-cockpit.crt
register: result
changed_when: false
- name: test - get certmonger tracking status
command: getcert list --tracking-only -f /etc/cockpit/ws-certs.d/monger-cockpit.crt
register: result
changed_when: false

- name: test - ensure certificate generation succeeded
assert:
that: "'status: MONITORING' in result.stdout"
- name: test - ensure certificate generation succeeded
assert:
that: "'status: MONITORING' in result.stdout"

- name: test - clean up tracked certificate
command: getcert stop-tracking -f /etc/cockpit/ws-certs.d/monger-cockpit.crt
changed_when: false
- name: test - clean up tracked certificate
command: getcert stop-tracking -f /etc/cockpit/ws-certs.d/monger-cockpit.crt
changed_when: false

always:
- name: test - clean up generated certificate
file:
path: /etc/cockpit/ws-certs.d/monger-cockpit.crt
Expand All @@ -86,5 +89,5 @@
path: /etc/cockpit/ws-certs.d/monger-cockpit.key
state: absent

- name: test - generic cleanup
include_tasks: tasks/cleanup.yml
- name: test - generic cleanup
include_tasks: tasks/cleanup.yml
85 changes: 44 additions & 41 deletions tests/tests_certificate_runafter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,52 +62,55 @@
- name: Validate installation
hosts: all
tasks:
# ugh, is there really no better way to do that?
- name: Get PEM of certmonger's local CA
command:
cmd: >
openssl pkcs12 -in /var/lib/certmonger/local/creds -out /var/lib/certmonger/local/ca.pem
-nokeys -nodes -passin pass:""
creates: /var/lib/certmonger/local/ca.pem
- name: tests
block:
# ugh, is there really no better way to do that?
- name: Get PEM of certmonger's local CA
command:
cmd: >
openssl pkcs12 -in /var/lib/certmonger/local/creds -out /var/lib/certmonger/local/ca.pem
-nokeys -nodes -passin pass:""
creates: /var/lib/certmonger/local/ca.pem

- name: test - cockpit works with TLS and expected certificate
command:
cmd: curl --cacert /var/lib/certmonger/local/ca.pem https://localhost:9090
# ansible 2.11's uri module has ca_path, but that's still too new for us
warn: false
changed_when: false
- name: test - cockpit works with TLS and expected certificate
command:
cmd: curl --cacert /var/lib/certmonger/local/ca.pem https://localhost:9090
# ansible 2.11's uri module has ca_path, but that's still too new for us
warn: false
changed_when: false

- name: test - get certmonger tracking status
command: >
getcert list --tracking-only -f
{{ __certificate_default_directory }}/certs/monger-cockpit.crt
register: result
changed_when: false
- name: test - get certmonger tracking status
command: >
getcert list --tracking-only -f
{{ __certificate_default_directory }}/certs/monger-cockpit.crt
register: result
changed_when: false

- name: test - ensure certificate generation succeeded
assert:
that: "'status: MONITORING' in result.stdout"
- name: test - ensure certificate generation succeeded
assert:
that: "'status: MONITORING' in result.stdout"

- name: test - clean up tracked certificate
command: >
getcert stop-tracking -f
{{ __certificate_default_directory }}/certs/monger-cockpit.crt
changed_when: false
- name: test - clean up tracked certificate
command: >
getcert stop-tracking -f
{{ __certificate_default_directory }}/certs/monger-cockpit.crt
changed_when: false

- name: test - clean up generated certificate
file:
path: "{{ __certificate_default_directory }}/certs/monger-cockpit.crt"
state: absent
always:
- name: test - clean up generated certificate
file:
path: "{{ __certificate_default_directory }}/certs/monger-cockpit.crt"
state: absent

- name: test - clean up generated private key
file:
path: "{{ __certificate_default_directory }}/private/monger-cockpit.key"
state: absent
- name: test - clean up generated private key
file:
path: "{{ __certificate_default_directory }}/private/monger-cockpit.key"
state: absent

- name: test - clean up copied certificate
file:
path: /etc/cockpit/ws-certs.d/monger-cockpit.cert
state: absent
- name: test - clean up copied certificate
file:
path: /etc/cockpit/ws-certs.d/monger-cockpit.cert
state: absent

- name: test - generic cleanup
include_tasks: tasks/cleanup.yml
- name: test - generic cleanup
include_tasks: tasks/cleanup.yml
89 changes: 46 additions & 43 deletions tests/tests_config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,46 +14,49 @@
IdleTimeout: 60

tasks:
- meta: flush_handlers

- name: test - socket is enabled # noqa 303 command-instead-of-module
command: systemctl is-enabled {{ __cockpit_daemon }}
changed_when: false

- name: test - socket is not active # noqa 303 command-instead-of-module
command: systemctl is-active {{ __cockpit_daemon }}
register: result
failed_when: result is succeeded
changed_when: false

- package_facts:

- name: test - cockpit-bridge is installed
fail:
msg: cockpit-bridge is not installed
when: "'cockpit-bridge' not in ansible_facts.packages"

- name: test - cockpit metapackage is not installed
fail:
msg: cockpit is unexpectedly installed
when: "'cockpit' in ansible_facts.packages"

- name: test - write expected configuration file
copy:
content: |+
#
# Ansible managed
#
[Session]
IdleTimeout = 60

[WebService]
LoginTitle = hello world

dest: /run/cockpit.conf.expected

- name: test - compare generated with expected configuration file
command: diff -u /run/cockpit.conf.expected /etc/cockpit/cockpit.conf
changed_when: false

- include_tasks: tasks/cleanup.yml
- name: tests
block:
- meta: flush_handlers

- name: test - socket is enabled # noqa 303 command-instead-of-module
command: systemctl is-enabled {{ __cockpit_daemon }}
changed_when: false

- name: test - socket is not active # noqa 303 command-instead-of-module
command: systemctl is-active {{ __cockpit_daemon }}
register: result
failed_when: result is succeeded
changed_when: false

- package_facts:

- name: test - cockpit-bridge is installed
fail:
msg: cockpit-bridge is not installed
when: "'cockpit-bridge' not in ansible_facts.packages"

- name: test - cockpit metapackage is not installed
fail:
msg: cockpit is unexpectedly installed
when: "'cockpit' in ansible_facts.packages"

- name: test - write expected configuration file
copy:
content: |+
#
# Ansible managed
#
[Session]
IdleTimeout = 60

[WebService]
LoginTitle = hello world

dest: /run/cockpit.conf.expected

- name: test - compare generated with expected configuration file
command: diff -u /run/cockpit.conf.expected /etc/cockpit/cockpit.conf
changed_when: false

always:
- include_tasks: tasks/cleanup.yml
37 changes: 20 additions & 17 deletions tests/tests_default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,24 +5,27 @@
- linux-system-roles.cockpit

tasks:
- name: test - socket is active # noqa 303 command-instead-of-module
command: systemctl is-active {{ __cockpit_daemon }}
changed_when: false
- name: tests
block:
- name: test - socket is active # noqa 303 command-instead-of-module
command: systemctl is-active {{ __cockpit_daemon }}
changed_when: false

- name: test - socket is enabled # noqa 303 command-instead-of-module
command: systemctl is-enabled {{ __cockpit_daemon }}
changed_when: false
- name: test - socket is enabled # noqa 303 command-instead-of-module
command: systemctl is-enabled {{ __cockpit_daemon }}
changed_when: false

- name: test - cockpit works with TLS
get_url:
dest: /run/out
url: https://localhost:9090
validate_certs: no
- name: test - cockpit works with TLS
get_url:
dest: /run/out
url: https://localhost:9090
validate_certs: no

- name: test - no configuration file
stat:
path: /etc/cockpit/cockpit.conf
register: result
failed_when: result.stat.exists
- name: test - no configuration file
stat:
path: /etc/cockpit/cockpit.conf
register: result
failed_when: result.stat.exists

- include_tasks: tasks/cleanup.yml
always:
- include_tasks: tasks/cleanup.yml