volker.raschekandCopilot
e2f248e28d
The role was not covered by any automated test, so regressions in the drop-in file handling only surfaced on real hosts. The scenario starts one container per supported distribution family and covers all four conditional branches of tasks/main.yaml: a user, a user acting as another user, a group and a group acting as another user. Beside the created rules the verification asserts that a rule declared as absent is removed again, that the drop-in directory is included exactly once and that visudo accepts the resulting configuration, because a rejected drop-in file invalidates every rule of the directory. Co-authored-by: Copilot <copilot@github.com>
60 lines
1.8 KiB
YAML
60 lines
1.8 KiB
YAML
---
|
|
|
|
- name: Prepare
|
|
hosts: all
|
|
gather_facts: false
|
|
vars:
|
|
# The base images ship neither a python interpreter for ansible nor the package manager bindings the role relies on.
|
|
_bootstrap: |
|
|
set -eu
|
|
if command -v pacman > /dev/null; then
|
|
pacman --sync --refresh --noconfirm python shadow
|
|
elif command -v apt-get > /dev/null; then
|
|
apt-get update
|
|
apt-get install --yes passwd python3 python3-apt
|
|
else
|
|
dnf install --assumeyes python3 python3-libdnf5 shadow-utils
|
|
fi
|
|
tasks:
|
|
# The raw command is wrapped explicitly, because the bootstrap relies on shell builtins.
|
|
- name: Bootstrap the python interpreter and the package manager bindings
|
|
ansible.builtin.raw: "/bin/sh -c {{ _bootstrap | quote }}"
|
|
changed_when: true
|
|
|
|
- name: Seed the objects the converge refers to
|
|
hosts: all
|
|
tasks:
|
|
- name: Create the groups the converge grants permissions to
|
|
ansible.builtin.group:
|
|
name: "{{ item }}"
|
|
state: present
|
|
loop:
|
|
- molecule-admins
|
|
- molecule-ops
|
|
|
|
- name: Create the users the converge grants permissions to
|
|
ansible.builtin.user:
|
|
name: "{{ item }}"
|
|
group: users
|
|
state: present
|
|
loop:
|
|
- molecule-alice
|
|
- molecule-bob
|
|
|
|
# The removal path of the role can only be observed on a drop-in file that exists before the role runs.
|
|
- name: Create the drop-in directory the seeded file lives in
|
|
ansible.builtin.file:
|
|
path: /etc/sudoers.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
|
|
- name: Seed the drop-in file that the converge removes again
|
|
ansible.builtin.copy:
|
|
content: "molecule-alice ALL=NOPASSWD: /usr/bin/true\n"
|
|
dest: /etc/sudoers.d/molecule-obsolete
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|