Implement use_agent option to get signing key from ssh-agent. (#117)

tests/integration/targets/openssh_cert/meta/main.yml

@@ -1,2 +1,3 @@
 dependencies:
   - setup_ssh_keygen
+  - setup_ssh_agent

tests/integration/targets/openssh_cert/tasks/main.yml

@@ -411,3 +411,83 @@
       path: '{{ output_dir }}/id_key'
       state: absent
     check_mode: yes
+
+- name: openssh_cert integration tests that require ssh-agent
+  when: openssh_version is version("7.6",">=")
+  environment:
+    SSH_AUTH_SOCK: "{{ openssh_agent_sock }}"
+  block:
+  - name: Generate keypair for agent tests
+    openssh_keypair:
+      path: '{{ output_dir }}/id_key'
+      type: rsa
+  - name: Generate always valid cert using agent without key in agent (should fail)
+    openssh_cert:
+      type: user
+      signing_key: '{{ output_dir }}/id_key'
+      public_key: '{{ output_dir }}/id_key.pub'
+      path: '{{ output_dir }}/id_cert_with_agent'
+      use_agent: yes
+      valid_from: always
+      valid_to: forever
+    register: rc_no_key_in_agent
+    ignore_errors: yes
+  - name: Make sure cert creation with agent fails if key not in agent
+    assert:
+      that:
+        - rc_no_key_in_agent is failed
+        - "'agent contains no identities' in rc_no_key_in_agent.msg or 'not found in agent' in rc_no_key_in_agent.msg"
+  - name: Add key to agent
+    command: 'ssh-add {{ output_dir }}/id_key'
+  - name: Generate always valid cert with agent (check mode)
+    openssh_cert:
+      type: user
+      signing_key: '{{ output_dir }}/id_key'
+      public_key: '{{ output_dir }}/id_key.pub'
+      path: '{{ output_dir }}/id_cert_with_agent'
+      use_agent: yes
+      valid_from: always
+      valid_to: forever
+    check_mode: yes
+  - name: Generate always valid cert with agent
+    openssh_cert:
+      type: user
+      signing_key: '{{ output_dir }}/id_key'
+      public_key: '{{ output_dir }}/id_key.pub'
+      path: '{{ output_dir }}/id_cert_with_agent'
+      use_agent: yes
+      valid_from: always
+      valid_to: forever
+  - name: Generate always valid cert with agent (idempotent)
+    openssh_cert:
+      type: user
+      signing_key: '{{ output_dir }}/id_key'
+      public_key: '{{ output_dir }}/id_key.pub'
+      path: '{{ output_dir }}/id_cert_with_agent'
+      use_agent: yes
+      valid_from: always
+      valid_to: forever
+    register: rc_cert_with_agent_idempotent
+  - name: Check agent idempotency
+    assert:
+      that:
+        - rc_cert_with_agent_idempotent is not changed
+      msg: OpenSSH certificate generation without serial number is idempotent.
+  - name: Generate always valid cert with agent (idempotent, check mode)
+    openssh_cert:
+      type: user
+      signing_key: '{{ output_dir }}/id_key'
+      public_key: '{{ output_dir }}/id_key.pub'
+      path: '{{ output_dir }}/id_cert_with_agent'
+      use_agent: yes
+      valid_from: always
+      valid_to: forever
+    check_mode: yes
+  - name: Remove keypair for agent tests
+    openssh_keypair:
+      path: '{{ output_dir }}/id_key'
+      state: absent
+  - name: Remove certificate
+    openssh_cert:
+      state: absent
+      path: '{{ output_dir }}/id_cert_with_agent'