mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-06-11 11:15:55 +00:00
ipasudorule: Add support for batch mode and multiple sudorules
Currently, ipasudorule must add or modify a single sudorule at a time,
incurring in more load in the server if there are many rules to be
processed.
This patch adds suport for adding multiple sudorules in one playbook
task by using the parameter 'sudorules' and defining a list of sudorules
configurations to be ensured.
As multiple sudorules will be processed, the patch also enables batch
mode processing of sudorules, trying to reduce the load on the server.
Test 'tests/sudorule/test_sudorule_client_context.yml' was modified to
include tasks with 'sudorules' to be executed both on the server or on
the client context.
New tests were added to the sudorule test suite:
tests/sudorule/test_sudorules.yml
tests/sudorule/test_sudorules_member_case_insensitive.yml
This commit is contained in:
Rafael Guterres Jeffman
382
tests/sudorule/test_sudorules.yml
Normal file
382
tests/sudorule/test_sudorules.yml
Normal file
@@ -0,0 +1,382 @@
|
||||
---
|
||||
- name: Test sudorule
|
||||
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
||||
become: false
|
||||
gather_facts: true # required for ansible_facts['fqdn']
|
||||
|
||||
module_defaults:
|
||||
ipauser:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
ipagroup:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
ipahostgroup:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
ipasudocmdgroup:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
ipasudocmd:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
ipasudorule:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||||
|
||||
tasks:
|
||||
|
||||
# setup
|
||||
- name: Ensure ansible facts for DNS are available
|
||||
ansible.builtin.setup:
|
||||
gather_subset: dns
|
||||
|
||||
- name: Ensure test users are absent
|
||||
ipauser:
|
||||
name:
|
||||
- user01
|
||||
- user02
|
||||
state: absent
|
||||
|
||||
- name: Ensure test groups are absent
|
||||
ipagroup:
|
||||
name:
|
||||
- group01
|
||||
- group02
|
||||
state: absent
|
||||
|
||||
- name: Ensure test hostgroup is absent
|
||||
ipahostgroup:
|
||||
name: cluster
|
||||
state: absent
|
||||
|
||||
- name: Ensure test users are present
|
||||
ipauser:
|
||||
users:
|
||||
- name: user01
|
||||
first: user
|
||||
last: zeroone
|
||||
- name: user02
|
||||
first: user
|
||||
last: zerotwo
|
||||
|
||||
- name: Ensure groups are present
|
||||
ipagroup:
|
||||
groups:
|
||||
- name: group01
|
||||
user: user01
|
||||
- name: group02
|
||||
|
||||
- name: Ensure sudocmdgroup is absent
|
||||
ipasudocmdgroup:
|
||||
name: test_sudorule_cmdgroup
|
||||
state: absent
|
||||
|
||||
- name: Ensure hostgroup is present, with a host.
|
||||
ipahostgroup:
|
||||
name: cluster
|
||||
host: "{{ ansible_facts['fqdn'] }}"
|
||||
|
||||
- name: Ensure some sudocmds are available
|
||||
ipasudocmd:
|
||||
name:
|
||||
- /sbin/ifconfig
|
||||
- /usr/bin/vim
|
||||
- /usr/bin/emacs
|
||||
state: present
|
||||
|
||||
- name: Ensure sudocmdgroup is available
|
||||
ipasudocmdgroup:
|
||||
name: test_sudorule_cmdgroup
|
||||
sudocmd: /usr/bin/vim
|
||||
state: present
|
||||
|
||||
- name: Ensure another sudocmdgroup is available
|
||||
ipasudocmdgroup:
|
||||
name: test_sudorule_cmdgroup_2
|
||||
sudocmd: /usr/bin/emacs
|
||||
state: present
|
||||
|
||||
- name: Ensure sudorules are absent
|
||||
ipasudorule:
|
||||
name:
|
||||
- testrule1
|
||||
- testrule2
|
||||
- allusers
|
||||
- allhosts
|
||||
- allcommands
|
||||
state: absent
|
||||
|
||||
# tests
|
||||
- name: Run sudorules tests.
|
||||
block:
|
||||
- name: Ensure sudorules are present
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
- name: allhosts
|
||||
- name: allcommands
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules are present, again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
- name: allhosts
|
||||
- name: allcommands
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure testrule1 and testrule2 are absent
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure testrule1 and testrule2 are absent, again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure allhosts and allcommands sudorules are still present
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: allhosts
|
||||
- name: allcomands
|
||||
state: absent
|
||||
check_mode: true
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules with parameters are present
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user01
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group01
|
||||
state: present
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules with parameters are present, again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user01
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group01
|
||||
state: present
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules with parameters are modified
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user02
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group02
|
||||
state: present
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules with parameters are modified again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user02
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group02
|
||||
state: present
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules members can be modified
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user01
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group01
|
||||
action: member
|
||||
state: present
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules members can modified, again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user01
|
||||
- user02
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group01
|
||||
- group02
|
||||
action: member
|
||||
state: present
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules members are absent
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user01
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group02
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure sudorules members are absent, again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user01
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group02
|
||||
action: member
|
||||
state: absent
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure testrule1 and testrule2 are present, with proper attributes
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser:
|
||||
- user02
|
||||
- name: testrule2
|
||||
runasuser_group:
|
||||
- group01
|
||||
state: present
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure testrule1 and testrule2 are disabled
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
state: disabled
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure testrule1 and testrule2 are disabled, again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
state: disabled
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure testrule1 and testrule2 are enabled
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
state: enabled
|
||||
register: result
|
||||
failed_when: not result.changed or result.failed
|
||||
|
||||
- name: Ensure testrule1 and testrule2 are enabled, again
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
- name: testrule2
|
||||
state: enabled
|
||||
register: result
|
||||
failed_when: result.changed or result.failed
|
||||
|
||||
- name: Ensure multiple sudorules cannot be enabled with invalid parameters
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser: user01
|
||||
- name: testrule2
|
||||
runasuser: user01
|
||||
state: enabled
|
||||
register: result
|
||||
failed_when: not result.failed and "Argument 'runasuser' can not be used with action 'sudorule' and state 'enabled'" not in result.msg
|
||||
|
||||
- name: Ensure multiple sudorules cannot be disabled with invalid parameters
|
||||
ipasudorule:
|
||||
sudorules:
|
||||
- name: testrule1
|
||||
runasuser: user01
|
||||
- name: testrule2
|
||||
runasuser: user01
|
||||
state: disabled
|
||||
register: result
|
||||
failed_when: not result.failed and "Argument 'runasuser' can not be used with action 'sudorule' and state 'disabled'" not in result.msg
|
||||
|
||||
# cleanup
|
||||
always:
|
||||
- name: Cleanup sudorules
|
||||
ipasudorule:
|
||||
name:
|
||||
- testrule1
|
||||
- testrule2
|
||||
- allusers
|
||||
- allhosts
|
||||
- allcommands
|
||||
state: absent
|
||||
|
||||
- name: Ensure sudocmdgroup is absent
|
||||
ipasudocmdgroup:
|
||||
name:
|
||||
- test_sudorule_cmdgroup
|
||||
- test_sudorule_cmdgroup_2
|
||||
state: absent
|
||||
|
||||
- name: Ensure sudocmds are absent
|
||||
ipasudocmd:
|
||||
name:
|
||||
- /sbin/ifconfig
|
||||
- /usr/bin/vim
|
||||
- /usr/bin/emacs
|
||||
state: absent
|
||||
|
||||
- name: Ensure hostgroup is absent.
|
||||
ipahostgroup:
|
||||
name: cluster
|
||||
state: absent
|
||||
|
||||
- name: Ensure groups are absent
|
||||
ipagroup:
|
||||
name: group01,group02
|
||||
state: absent
|
||||
|
||||
- name: Ensure user is absent
|
||||
ipauser:
|
||||
name: user01,user02
|
||||
state: absent
|
||||
Reference in New Issue
Block a user