volker.raschekandCopilot
e2f248e28d
The role was not covered by any automated test, so regressions in the drop-in file handling only surfaced on real hosts. The scenario starts one container per supported distribution family and covers all four conditional branches of tasks/main.yaml: a user, a user acting as another user, a group and a group acting as another user. Beside the created rules the verification asserts that a rule declared as absent is removed again, that the drop-in directory is included exactly once and that visudo accepts the resulting configuration, because a rejected drop-in file invalidates every rule of the directory. Co-authored-by: Copilot <copilot@github.com>
34 lines
943 B
YAML
34 lines
943 B
YAML
---
|
|
|
|
- name: Converge
|
|
hosts: all
|
|
vars:
|
|
sudo_users_sudoers:
|
|
# A user without runas, restricted to a single command.
|
|
- user: molecule-alice
|
|
commands:
|
|
- /usr/bin/systemctl restart nginx
|
|
nopassword: true
|
|
# A user that acts as another user and stores its rule under a custom filename.
|
|
- user: molecule-bob
|
|
runas: molecule-alice
|
|
filename: molecule-bob-as-alice
|
|
nopassword: true
|
|
# A group that has to authenticate itself.
|
|
- group: molecule-ops
|
|
commands:
|
|
- /usr/bin/id
|
|
nopassword: false
|
|
# A group that acts as root.
|
|
- group: molecule-admins
|
|
runas: root
|
|
filename: molecule-admins-as-root
|
|
nopassword: true
|
|
- user: molecule-obsolete
|
|
state: absent
|
|
tasks:
|
|
# The role is included by the name of its directory, which molecule put on the roles path.
|
|
- name: Include the role sudo
|
|
ansible.builtin.include_role:
|
|
name: sudo
|