volker.raschekandCopilot
b72fba0924
The role was only linted statically so far, which is why every bug of the recent analysis passed the ci unnoticed. The scenario converges the role in podman containers of Archlinux, Debian and Fedora, checks idempotence and then verifies the result. Verification covers the chain via openssl verify, the file modes of keys, certificates and directories, the number of certificates in the fullchain of the client, its subject alternative names and the anchor in the systems trust store. Root and intermediate use a passphrase so the protected code paths are exercised as well. Molecule ships only the default driver, so create and destroy are provided as playbooks. Three details were needed to make it work. The connection has to be declared in the instance config, since molecule ignores ansible_connection_options of the driver. Raw commands are passed through sh explicitly, because the podman connection plugin splits them instead of using a shell. And the roles path has to point at the parent of the project directory, which is the role itself. Co-authored-by: Copilot <copilot@github.com>
20 lines
795 B
YAML
20 lines
795 B
YAML
---
|
|
|
|
- name: Converge
|
|
hosts: all
|
|
# Passphrases are fixtures, they exercise the protected code paths of the role.
|
|
vars:
|
|
certificate_authority_root_ca_common_name: "Molecule Root CA"
|
|
certificate_authority_root_ca_tls_key_passphrase: "molecule-root-ca"
|
|
certificate_authority_intermediate_ca_common_name: "Molecule Intermediate CA"
|
|
certificate_authority_intermediate_ca_tls_key_passphrase: "molecule-intermediate-ca"
|
|
certificate_authority_client_skip: false
|
|
certificate_authority_client_common_name: "molecule.example.local"
|
|
certificate_authority_client_subject_alternative_names:
|
|
- "DNS:molecule.example.local"
|
|
- "IP:10.11.12.13"
|
|
tasks:
|
|
- name: Include the role certificate_authority
|
|
ansible.builtin.include_role:
|
|
name: certificate_authority
|