mirror of
https://github.com/linux-system-roles/network.git
synced 2026-01-23 02:15:17 +00:00
0c590cdf5a
The dependency on `ansible.utils.update_fact` is causing issue with
some users who now must install that collection in order to run
the role, even if they do not care about ostree.
The fix is to stop trying to set `ansible_facts.pkg_mgr`, and instead
force the use of the ostree package manager with the `package:` module
`use:` option. The strategy is - on ostree systems, set the flag
`__$ROLENAME_is_ostree` if the system is an ostree system. The flag
will either be undefined or `false` on non-ostree systems.
Then, change every invocation of the `package:` module like this:
```yaml
- name: Ensure required packages are present
package:
name: "{{ __$ROLENAME_packages }}"
state: present
use: "{{ (__$ROLENAME_is_ostree | d(false)) |
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
```
This should ensure that the `use:` parameter is not used if the system
is non-ostree. The goal is to make the ostree support as unobtrusive
as possible for non-ostree systems.
The user can also set `__$ROLENAME_is_ostree: true` in the inventory or play
if the user knows that ostree is being used and wants to skip the check.
Or, the user is concerned about the performance hit for ostree detection
on non-ostree systems, and sets `__$ROLENAME_is_ostree: false` to skip
the check.
The flag `__$ROLENAME_is_ostree` can also be used in the role or tests to
include or exclude tasks from being run on ostree systems.
This fix also improves error reporting in the `get_ostree_data.sh` script
when included roles cannot be found.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
124 lines
3.8 KiB
YAML
124 lines
3.8 KiB
YAML
---
|
|
- name: >-
|
|
TEST: 802.1x profile with unencrypted private key and ca_path
|
|
debug:
|
|
msg: "##################################################"
|
|
- name: Set __NM_capath_ignored_NVRs
|
|
set_fact:
|
|
# Fixed versions/NVRs:
|
|
# 1.25.2
|
|
# NetworkManager-1.24.2-1.fc33
|
|
# NetworkManager-1.22.14-1.fc32
|
|
# NetworkManager-1.20.12-1.fc31
|
|
# 1.18.8
|
|
__NM_capath_ignored_NVRs:
|
|
- NetworkManager-1.18.0-5.el7.x86_64
|
|
- NetworkManager-1.18.4-3.el7.x86_64
|
|
- NetworkManager-1.20.0-3.el8.x86_64
|
|
- NetworkManager-1.22.8-4.el8.x86_64
|
|
- NetworkManager-1.20.4-1.fc31.x86_64
|
|
- NetworkManager-1.22.10-1.fc32.x86_64
|
|
- NetworkManager-1.22.12-1.fc32.x86_64
|
|
- name: Create directory for ca_path test
|
|
file:
|
|
path: "/etc/pki/tls/my_ca_certs"
|
|
state: directory
|
|
mode: "0755"
|
|
- name: Copy cacert to ca_path
|
|
copy:
|
|
src: "cacert.pem"
|
|
dest: "/etc/pki/tls/my_ca_certs/cacert.pem"
|
|
mode: "0644"
|
|
- name: Install openssl (test dependency)
|
|
package:
|
|
name: openssl
|
|
state: present
|
|
use: "{{ (__network_is_ostree | d(false)) |
|
|
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
|
|
- name: Hash cacert
|
|
command: openssl x509 -hash -noout
|
|
-in /etc/pki/tls/my_ca_certs/cacert.pem
|
|
register: cacert_hash
|
|
changed_when: false
|
|
- name: Add symlink for cacert
|
|
file:
|
|
state: link
|
|
path: "/etc/pki/tls/my_ca_certs/{{ cacert_hash.stdout }}.0"
|
|
src: cacert.pem
|
|
- name: Get NetworkManager version
|
|
command:
|
|
cmd: rpm -qa NetworkManager
|
|
# noqa command-instead-of-module
|
|
register: __network_nm_nvr
|
|
changed_when: false
|
|
- name: Test configuring 802.1x authentication
|
|
block:
|
|
- name: Import network role
|
|
import_role:
|
|
name: linux-system-roles.network
|
|
vars:
|
|
network_connections:
|
|
- name: "{{ interface | default('802-1x-test') }}"
|
|
interface_name: veth2
|
|
state: up
|
|
type: ethernet
|
|
ip:
|
|
address:
|
|
- 203.0.113.2/24
|
|
dhcp4: "no"
|
|
auto6: "no"
|
|
ieee802_1x:
|
|
identity: myhost_capath
|
|
eap: tls
|
|
private_key: /etc/pki/tls/client.key.nocrypt
|
|
client_cert: /etc/pki/tls/client.pem
|
|
private_key_password_flags:
|
|
- not-required
|
|
ca_path: /etc/pki/tls/my_ca_certs
|
|
- name: Ensure ping command is present
|
|
package:
|
|
name: iputils
|
|
state: present
|
|
use: "{{ (__network_is_ostree | d(false)) |
|
|
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
|
|
- name: "TEST: I can ping the EAP server"
|
|
command: ping -c1 203.0.113.1
|
|
changed_when: false
|
|
- name: Trigger failure in case the role did not fail
|
|
fail:
|
|
msg: after test
|
|
rescue:
|
|
- name: Show failed item
|
|
debug:
|
|
var: "{{ item }}"
|
|
with_items:
|
|
- ansible_failed_result
|
|
- ansible_failed_task
|
|
- __network_nm_nvr.stdout
|
|
- __NM_capath_ignored_NVRs
|
|
changed_when: false
|
|
|
|
- name: Assert role behavior
|
|
vars:
|
|
expected_failure: __network_nm_nvr.stdout in __NM_capath_ignored_NVRs
|
|
failure: __network_connections_result.failed
|
|
assert:
|
|
that: (failure and expected_failure) or
|
|
(not failure and not expected_failure)
|
|
msg: "Role {{ failure and 'failed' or 'did not fail' }} but was expected
|
|
{{ expected_failure and '' or 'not' }} to fail.
|
|
NM NVR: {{ __network_nm_nvr.stdout }}"
|
|
- name: Assert role failure
|
|
assert:
|
|
that: "
|
|
'ieee802_1x.ca_path specified but not supported by NetworkManager'
|
|
in __network_connections_result.stderr"
|
|
when:
|
|
- __network_connections_result.failed
|
|
|
|
|
|
- name: Assert ping succeeded
|
|
assert:
|
|
that:
|
|
- "not 'cmd' in ansible_failed_result"
|
|
...
|