mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-07-29 10:54:44 +00:00
New servicedelegationrule management module
There is a new servicedelegationrule management module placed in the plugins
folder:
plugins/modules/ipaservicedelegationrule.py
The servicedelegationrule module allows to ensure presence and absence of
servicedelegationrules and servicedelegationrule members.
Here is the documentation of the module:
README-servicedelegationrule.md
New example playbooks have been added:
playbooks/servicedelegationrule/servicedelegationrule-absent.yml
playbooks/servicedelegationrule/servicedelegationrule-principal-member-absent.yml
playbooks/servicedelegationrule/servicedelegationrule-principal-member-present.yml
playbooks/servicedelegationrule/servicedelegationrule-target-member-absent.yml
playbooks/servicedelegationrule/servicedelegationrule-target-member-present.yml
playbooks/servicedelegationrule/servicedelegationrule-present.yml
New tests for the module:
tests/servicedelegationrule/test_servicedelegationrule.yml
tests/servicedelegationrule/test_servicedelegationrule_client_context.yml
tests/servicedelegationrule/test_servicedelegationrule_hostprincipal.yml
This commit is contained in:
Thomas Woerner
188
tests/servicedelegationrule/test_servicedelegationrule.yml
Normal file
188
tests/servicedelegationrule/test_servicedelegationrule.yml
Normal file
@@ -0,0 +1,188 @@
|
||||
---
|
||||
- name: Test servicedelegationrule
|
||||
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
||||
# Change "become" or "gather_facts" to "yes",
|
||||
# if you test playbook requires any.
|
||||
become: no
|
||||
gather_facts: yes
|
||||
|
||||
tasks:
|
||||
|
||||
# CLEANUP TEST ITEMS
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
state: absent
|
||||
|
||||
- name: Ensure service is absent
|
||||
ipaservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: "{{ 'test-service/' + ansible_facts['fqdn'] }}"
|
||||
state: absent
|
||||
continue: yes
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-target is absent
|
||||
ipaservicedelegationtarget:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-target
|
||||
state: absent
|
||||
|
||||
# CREATE TEST ITEMS
|
||||
|
||||
- name: Ensure service test-sevice is present
|
||||
ipaservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: "{{ 'test-service/' + ansible_facts['fqdn'] }}"
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-target is present
|
||||
ipaservicedelegationtarget:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-target
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
# TESTS
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is present
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is present again
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member target test-delegation-target is present
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
target: test-delegation-target
|
||||
action: member
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member target test-delegation-target is present, again
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
target: test-delegation-target
|
||||
action: member
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member principal "{{ 'test-service/' + ansible_facts['fqdn'] }}" is present
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ 'test-service/' + ansible_facts['fqdn'] }}"
|
||||
action: member
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member principal "{{ 'test-service/' + ansible_facts['fqdn'] }}" is present again
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ 'test-service/' + ansible_facts['fqdn'] }}"
|
||||
action: member
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member principal "{{ 'test-service/' + ansible_facts['fqdn'] }}" is absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ 'test-service/' + ansible_facts['fqdn'] }}"
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member principal "{{ 'test-service/' + ansible_facts['fqdn'] }}" is present absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ 'test-service/' + ansible_facts['fqdn'] }}"
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member target test-delegation-target is absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
target: test-delegation-target
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member target test-delegation-target is absent, again
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
target: test-delegation-target
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is absent again
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
# CLEANUP TEST ITEMS
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-target is absent
|
||||
ipaservicedelegationtarget:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-target
|
||||
state: absent
|
||||
|
||||
- name: Ensure service is absent
|
||||
ipaservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: "{{ 'test-service/' + ansible_facts['fqdn'] }}"
|
||||
state: absent
|
||||
continue: yes
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
- name: Test servicedelegationrule
|
||||
hosts: ipaclients, ipaserver
|
||||
# Change "become" or "gather_facts" to "yes",
|
||||
# if you test playbook requires any.
|
||||
become: no
|
||||
gather_facts: no
|
||||
|
||||
tasks:
|
||||
- name: Include FreeIPA facts.
|
||||
include_tasks: ../env_freeipa_facts.yml
|
||||
|
||||
# Test will only be executed if host is not a server.
|
||||
- name: Execute with server context in the client.
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: server
|
||||
name: ThisShouldNotWork
|
||||
register: result
|
||||
failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
|
||||
when: ipa_host_is_client
|
||||
|
||||
# Import basic module tests, and execute with ipa_context set to 'client'.
|
||||
# If ipaclients is set, it will be executed using the client, if not,
|
||||
# ipaserver will be used.
|
||||
#
|
||||
# With this setup, tests can be executed against an IPA client, against
|
||||
# an IPA server using "client" context, and ensure that tests are executed
|
||||
# in upstream CI.
|
||||
|
||||
- name: Test servicedelegationrule using client context, in client host.
|
||||
import_playbook: test_servicedelegationrule.yml
|
||||
when: groups['ipaclients']
|
||||
vars:
|
||||
ipa_test_host: ipaclients
|
||||
|
||||
- name: Test servicedelegationrule using client context, in server host.
|
||||
import_playbook: test_servicedelegationrule.yml
|
||||
when: groups['ipaclients'] is not defined or not groups['ipaclients']
|
||||
@@ -0,0 +1,148 @@
|
||||
---
|
||||
- name: Test servicedelegationrule_hostprincipal
|
||||
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
||||
become: no
|
||||
gather_facts: yes
|
||||
|
||||
tasks:
|
||||
# setup
|
||||
- include_tasks: ../env_freeipa_facts.yml
|
||||
|
||||
# host principals are only possible with IPA 4.9.0+
|
||||
- block:
|
||||
|
||||
# SET FACTS
|
||||
|
||||
- name: Get Domain from server name
|
||||
set_fact:
|
||||
ipaserver_domain: "{{ ansible_facts['fqdn'].split('.')[1:] | join ('.') }}"
|
||||
when: ipaserver_domain is not defined
|
||||
|
||||
- name: Get REALM from server name
|
||||
set_fact:
|
||||
ipaserver_realm: "{{ ipaserver_domain | upper }}"
|
||||
when: ipaserver_realm is not defined
|
||||
|
||||
- name: Set test-host fqdn
|
||||
set_fact:
|
||||
test_host_fqdn: "{{ 'test-host.' + ipaserver_domain }}"
|
||||
test_host_fqdn_realm: "{{ 'test-host.' + ipaserver_domain + '@' + ipaserver_realm }}"
|
||||
|
||||
# CLEANUP TEST ITEMS
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
state: absent
|
||||
|
||||
- name: Ensure host is absent
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: "{{ test_host_fqdn }}"
|
||||
state: absent
|
||||
|
||||
# CREATE TEST ITEMS
|
||||
|
||||
- name: Ensure host is present
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: "{{ test_host_fqdn }}"
|
||||
force: yes
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is present
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
# TESTS
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member host principal "{{ test_host_fqdn }}" is present
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ test_host_fqdn }}"
|
||||
action: member
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member host principal "{{ test_host_fqdn }}" is present again
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ test_host_fqdn }}"
|
||||
action: member
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member host principal "{{ test_host_fqdn_realm }}" is present unchanged
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ test_host_fqdn_realm }}"
|
||||
action: member
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member host principal "{{ 'host/' + test_host_fqdn_realm }}" is present unchanged
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ 'host/' + test_host_fqdn_realm }}"
|
||||
action: member
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member host principal "{{ test_host_fqdn_realm }}" is absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ test_host_fqdn_realm }}"
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule member host principal "{{ test_host_fqdn }}" is absent unchanged
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
principal: "{{ test_host_fqdn }}"
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
# CLEANUP TEST ITEMS
|
||||
|
||||
- name: Ensure servicedelegationrule test-delegation-rule is absent
|
||||
ipaservicedelegationrule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: test-delegation-rule
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure host is absent
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
name: "{{ test_host_fqdn }}"
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
when: ipa_version is version('4.9.0', '>=')
|
||||
Reference in New Issue
Block a user