mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-06-10 02:35:54 +00:00
b175c78c95
Use Fully Qualified Collection Name (FQCN) for ansible builtins. This is ansible.builtin.set_fact instead of set_fact for example and aplies for all actions that are part of ansible.builtin. All the replaced ansible.builtins: assert, command, copy, debug, fail, fetch, file, import_playbook, import_tasks, include_role, include_tasks, include_vars, package, set_fact, shell, slurp, stat, systemd
355 lines
11 KiB
YAML
355 lines
11 KiB
YAML
---
|
|
- name: Test vault
|
|
hosts: ipaserver
|
|
become: true
|
|
# Need to gather facts for ansible_env.
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Setup testing environment.
|
|
ansible.builtin.import_tasks: env_setup.yml
|
|
|
|
- name: Ensure symmetric vault is present
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_type: symmetric
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure symmetric vault is present, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_type: symmetric
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Archive data to symmetric vault, matching `no_log` field.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_data: SomeADMINpassword
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or result.vault.data != 'SomeADMINpassword'
|
|
|
|
- name: Archive data to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_data: Hello World.
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault into file {{ ansible_facts['env'].HOME }}/data.txt.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
out: "{{ ansible_facts['env'].HOME }}/data.txt"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or (result.vault.data | default(false))
|
|
|
|
- name: Verify retrieved data.
|
|
ansible.builtin.slurp:
|
|
src: "{{ ansible_facts['env'].HOME }}/data.txt"
|
|
register: slurpfile
|
|
failed_when: slurpfile['content'] | b64decode != 'Hello World.'
|
|
|
|
- name: Archive data with non-ASCII characters to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
vault_data: The world of π is half rounded.
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'The world of π is half rounded.'
|
|
|
|
- name: Archive data in symmetric vault, from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
in: "{{ ansible_facts['env'].HOME }}/in.txt"
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Another World.'
|
|
|
|
- name: Archive data with single character to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
vault_data: c
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'c'
|
|
|
|
- name: Ensure symmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure symmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Ensure symmetric vault is present, with password from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
username: user01
|
|
password_file: "{{ ansible_facts['env'].HOME }}/password.txt"
|
|
vault_type: symmetric
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure symmetric vault is present, with password from file, again.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
username: user01
|
|
password_file: "{{ ansible_facts['env'].HOME }}/password.txt"
|
|
vault_type: symmetric
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Archive data to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_data: Hello World.
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault, with password file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password_file: "{{ ansible_facts['env'].HOME }}/password.txt"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault, with wrong password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeWRONGpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or not result.failed or "Invalid credentials" not in result.msg
|
|
|
|
- name: Change vault password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
new_password: SomeNEWpassword
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault, with new password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeNEWpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault, with old password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: not result.failed or "Invalid credentials" not in result.msg
|
|
|
|
- name: Change symmetric vault salt, changing password
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeNEWpassword
|
|
new_password: SomeVAULTpassword
|
|
salt: AAAAAAAAAAAAAAAAAAAAAAA=
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Change symmetric vault salt, without changing password
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
new_password: SomeVAULTpassword
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Try to change symmetric vault salt, without providing any password
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
register: result
|
|
failed_when: not result.failed and "Vault `salt` can only change when changing the password." not in result.msg
|
|
|
|
- name: Try to change symmetric vault salt, without providing `password`
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
new_password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.failed and "Vault `salt` can only change when changing the password." not in result.msg
|
|
|
|
- name: Try to change symmetric vault salt, without providing `new_password`
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.failed and "Vault `salt` can only change when changing the password." not in result.msg
|
|
|
|
- name: Try to change symmetric vault salt, using wrong password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeWRONGpassword
|
|
new_password: SomeWRONGpassword
|
|
salt: MDEyMzQ1Njc4OTAxMjM0NQo=
|
|
register: result
|
|
failed_when: not result.failed
|
|
|
|
- name: Ensure symmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure symmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Try to change password of inexistent vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: inexistentvault
|
|
password: SomeVAULTpassword
|
|
new_password: SomeNEWpassword
|
|
register: result
|
|
failed_when: not result.failed or "Cannot modify password of inexistent vault" not in result.msg
|
|
|
|
- name: Ensure symmetric vault is present
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_type: symmetric
|
|
password: APasswordToChange
|
|
vault_data: Hello World.
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Change symmetric vault password, using password file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: APasswordToChange
|
|
new_password_file: "{{ ansible_facts['env'].HOME }}/password.txt"
|
|
vault_type: symmetric
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Ensure symmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Cleanup testing environment.
|
|
ansible.builtin.import_tasks: env_cleanup.yml
|