volker.raschekandCopilot
a343205fd3
The role changed a lot and none of it was verified against a real system so far. The scenario starts one container per supported distribution family, applies the role and asserts afterwards that the users and groups exist as declared, that the managed files carry the documented mode, owner and content, that a user without optional settings does not receive any of the optional files and that a user declared as absent is gone again. The idempotence step is the actual reason for the scenario. The deterministic password salt and the btrfs device lookup were changed to stop reporting a change on every run, and only a second converge proves that. A btrfs home is not covered, because a container has no btrfs filesystem to create a subvolume on. The ssh key pair the scenario feeds into the role is generated during create and removed again during destroy, so no private key material ends up in the repository. The generated files are ignored for the case that a destroy never runs. Co-authored-by: Copilot <copilot@github.com>
50 lines
1.5 KiB
YAML
50 lines
1.5 KiB
YAML
---
|
|
|
|
- name: Create
|
|
hosts: localhost
|
|
gather_facts: false
|
|
vars:
|
|
_private_key: "{{ molecule_scenario_directory }}/files/ssh/private_keys/molecule.ed25519.key"
|
|
_authorized_key: "{{ molecule_scenario_directory }}/files/ssh/authorized_keys/molecule.pub"
|
|
tasks:
|
|
- name: Start a container per platform
|
|
community.docker.docker_container:
|
|
name: "{{ item.name }}"
|
|
image: "{{ item.image }}"
|
|
command: "sleep infinity"
|
|
state: started
|
|
loop: "{{ molecule_yml.platforms }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
|
|
- name: Write the instance config
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{% for platform in molecule_yml.platforms %}
|
|
- instance: {{ platform.name }}
|
|
connection: community.docker.docker
|
|
{% endfor %}
|
|
dest: "{{ molecule_instance_config }}"
|
|
mode: "0600"
|
|
|
|
- name: Create the fixture directories
|
|
ansible.builtin.file:
|
|
path: "{{ item | dirname }}"
|
|
state: directory
|
|
mode: "0700"
|
|
loop:
|
|
- "{{ _private_key }}"
|
|
- "{{ _authorized_key }}"
|
|
|
|
# The key pair is generated instead of committed, private key material does not belong into a repository.
|
|
- name: Generate the ssh key pair the role is fed with
|
|
ansible.builtin.command:
|
|
cmd: "ssh-keygen -t ed25519 -N '' -C molecule -f {{ _private_key }}"
|
|
creates: "{{ _private_key }}"
|
|
|
|
- name: Offer the public key as authorized key fixture
|
|
ansible.builtin.copy:
|
|
src: "{{ _private_key }}.pub"
|
|
dest: "{{ _authorized_key }}"
|
|
mode: "0644"
|