mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-03-26 21:33:05 +00:00
7a23531047
Without this change the "Import variables specific to distribution" tasks fail with "Could not find file on the Ansible Controller..." on environments with inject facts disabled. This changes the tests to run with ansible with inject_facts_as_vars = false and fixes other roles and playbooks.
303 lines
9.6 KiB
YAML
303 lines
9.6 KiB
YAML
---
|
|
- name: Test vault
|
|
hosts: ipaserver
|
|
become: true
|
|
# Need to gather facts for ansible_env.
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Setup testing environment.
|
|
import_tasks: env_setup.yml
|
|
|
|
- name: Ensure asymmetric vault is present
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key: "{{ lookup('file', 'A_public.b64') }}"
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure asymmetric vault is present, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key: "{{ lookup('file', 'A_public.b64') }}"
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Archive data to asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_data: SomeValue
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault using key A.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'A_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'SomeValue'
|
|
|
|
- name: Change asymmetric vault key to B.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key: "{{ lookup('file', 'B_public.b64') }}"
|
|
private_key: "{{ lookup('file', 'A_private.b64') }}"
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault using key B.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'SomeValue'
|
|
|
|
- name: Change asymmetric vault key to A, using key_file
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key_file: "{{ ansible_facts['env'].HOME }}/A_public.pem"
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault using key A, with key_file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key_file: "{{ ansible_facts['env'].HOME }}/A_private.pem"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'SomeValue'
|
|
|
|
- name: Change asymmetric vault key to B key, using key_files
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key_file: "{{ ansible_facts['env'].HOME }}/B_public.pem"
|
|
private_key_file: "{{ ansible_facts['env'].HOME }}/A_private.pem"
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault, using key B.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'SomeValue'
|
|
|
|
- name: Change asymmetric vault key to A, without specifying vault_type.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key: "{{ lookup('file', 'A_public.b64') }}"
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Change asymmetric vault key to B, with key files, without specifying vault_type.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
public_key_file: "{{ ansible_facts['env'].HOME }}/B_public.pem"
|
|
private_key_file: "{{ ansible_facts['env'].HOME }}/A_private.pem"
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Archive data to asymmetric vault, matching `no_log` field.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_data: SomeADMINpassword
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'SomeADMINpassword' or result.changed
|
|
|
|
- name: Change data in asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: Hello World.
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve changed data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Hello World.' or result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault into file {{ ansible_facts['env'].HOME }}/data.txt.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
out: "{{ ansible_facts['env'].HOME }}/data.txt"
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or (result.vault.data | default(false))
|
|
|
|
- name: Verify retrieved data.
|
|
slurp:
|
|
src: "{{ ansible_facts['env'].HOME }}/data.txt"
|
|
register: slurpfile
|
|
failed_when: slurpfile['content'] | b64decode != 'Hello World.'
|
|
|
|
- name: Archive data with non-ASCII characters to asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: The world of π is half rounded.
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'The world of π is half rounded.' or result.changed
|
|
|
|
- name: Archive data in asymmetric vault, from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
in: "{{ ansible_facts['env'].HOME }}/in.txt"
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Another World.' or result.changed
|
|
|
|
- name: Archive data with single character to asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: c
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'c' or result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Ensure asymmetric vault is present, with public key from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
public_key_file: "{{ ansible_facts['env'].HOME }}/B_public.pem"
|
|
vault_type: asymmetric
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure asymmetric vault is present, with password from file, again.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
public_key_file: "{{ ansible_facts['env'].HOME }}/B_public.pem"
|
|
vault_type: asymmetric
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Archive data to asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: Hello World.
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'B_private.b64') }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Hello World.' or result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault, with password file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key_file: "{{ ansible_facts['env'].HOME }}/B_private.pem"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Hello World.' or result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Cleanup testing environment.
|
|
import_tasks: env_cleanup.yml
|