mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-06-10 18:55:53 +00:00
88f84cefee
Due to Ansible filtering out values in the output that might be match values in sensible attributes that have `no_log` set, if a module need to return data to the controller, it cannot rely on `ansible_module.exit_json` if there is a chance that a partial match may occur. See: https://github.com/ansible/ansible/issues/71789 The change provided here uses the same implementation that is used on Ansible's `AnsibleModule.exit_json`, without the data filtering layer, so every attribute with be printed and, therefore, logged by Ansible. This is needed for the Vault module, as we need to return values that are explicit requested by the user and that might, at least partially, match the values in attributes with `no_log` set. Tests that reproduced the issue, and show it was fixed were provided for all Vault types.
210 lines
6.3 KiB
YAML
210 lines
6.3 KiB
YAML
---
|
|
- name: Test vault
|
|
hosts: ipaserver
|
|
become: true
|
|
# Need to gather facts for ansible_env.
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Setup testing environment.
|
|
import_tasks: env_setup.yml
|
|
|
|
- name: Ensure asymmetric vault is present
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key: "{{ lookup('file', 'public.pem') | b64encode }}"
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure asymmetric vault is present, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
public_key: "{{ lookup('file', 'public.pem') | b64encode }}"
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Archive data to asymmetric vault, matching `no_log` field.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_data: SomeADMINpassword
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'private.pem') | b64encode }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'SomeADMINpassword' or result.changed
|
|
|
|
- name: Archive data to asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: Hello World.
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'private.pem') | b64encode }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Hello World.' or result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault into file {{ ansible_env.HOME }}/data.txt.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
out: "{{ ansible_env.HOME }}/data.txt"
|
|
private_key: "{{ lookup('file', 'private.pem') | b64encode }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or (result.vault.data | default(false))
|
|
|
|
- name: Verify retrieved data.
|
|
slurp:
|
|
src: "{{ ansible_env.HOME }}/data.txt"
|
|
register: slurpfile
|
|
failed_when: slurpfile['content'] | b64decode != 'Hello World.'
|
|
|
|
- name: Archive data with non-ASCII characters to asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: The world of π is half rounded.
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'private.pem') | b64encode }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'The world of π is half rounded.' or result.changed
|
|
|
|
- name: Archive data in asymmetric vault, from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
vault_type: asymmetric
|
|
in: "{{ ansible_env.HOME }}/in.txt"
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'private.pem') | b64encode }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Another World.' or result.changed
|
|
|
|
- name: Archive data with single character to asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: c
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'private.pem') | b64encode }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'c' or result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Ensure asymmetric vault is present, with public key from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
public_key_file: "{{ ansible_env.HOME }}/public.pem"
|
|
vault_type: asymmetric
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure asymmetric vault is present, with password from file, again.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
public_key_file: "{{ ansible_env.HOME }}/public.pem"
|
|
vault_type: asymmetric
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Archive data to asymmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
data: Hello World.
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key: "{{ lookup('file', 'private.pem') | b64encode }}"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Hello World.' or result.changed
|
|
|
|
- name: Retrieve data from asymmetric vault, with password file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
private_key_file: "{{ ansible_env.HOME }}/private.pem"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.vault.data != 'Hello World.' or result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure asymmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: asymvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Cleanup testing environment.
|
|
import_tasks: env_setup.yml
|