1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2024-09-14 20:13:21 +02:00
community.general/tests/integration/targets/java_keystore/tasks/tests.yml
quidame 199ead85d0
java_keystore: fix keystore type (#2516)
* fix keystore type; update unit tests

* add changelog fragment

* document new param 'keystore_type'

* add keystore_type support (backward compatible)

* check JKS format with magic bytes
* update integration tests
* revert first changes in unit tests
* update changelog fragment

* fix magic bytes for python2/python3

* fix integration tests (irrelevant check_mode)

* fix unit test (keystore removed before failure => changed=true)

* fix typo

* fix spelling

* shorten a branch

* mock is_jks_or_pkcs12

* fix function path in unit tests

* Apply suggestions from code review (spelling)

Co-authored-by: Ajpantuso <ajpantuso@gmail.com>

* rename a method (module + unit tests)

* move ArgumentSpec class content to main()

* refactor create() to not loose existing keystore in case of error

* update unit tests

* add integration test (error handling)

* fix keystore backup cleanup

Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
2021-06-27 14:56:43 +02:00

235 lines
8.2 KiB
YAML

---
- name: Create test directory
ansible.builtin.file:
path: "{{ output_dir }}"
state: directory
- name: Ensure the Java keystore does not exist (cleanup between tests)
ansible.builtin.file:
path: "{{ output_dir ~ '/' ~ item.name ~ '.jks' }}"
state: absent
loop: "{{ java_keystore_certs }}"
loop_control:
label: "{{ output_dir ~ '/' ~ item.name ~ '.jks' }}"
- name: Create a Java keystore for the given ({{ 'remote' if remote_cert else 'local' }}) certificates (check mode)
community.general.java_keystore: &java_keystore_params
name: example
dest: "{{ output_dir ~ '/' ~ (item.keyname | d(item.name)) ~ '.jks' }}"
certificate: "{{ omit if remote_cert else lookup('file', output_dir ~ '/' ~ item.name ~ '.pem') }}"
private_key: "{{ omit if remote_cert else lookup('file', output_dir ~ '/' ~ (item.keyname | d(item.name)) ~ '.key') }}"
certificate_path: "{{ omit if not remote_cert else output_dir ~ '/' ~ item.name ~ '.pem' }}"
private_key_path: "{{ omit if not remote_cert else output_dir ~ '/' ~ (item.keyname | d(item.name)) ~ '.key' }}"
private_key_passphrase: "{{ item.passphrase | d(omit) }}"
password: changeit
ssl_backend: "{{ ssl_backend }}"
keystore_type: "{{ item.keystore_type | d(omit) }}"
loop: "{{ java_keystore_certs }}"
check_mode: yes
register: result_check
- name: Create a Java keystore for the given certificates
community.general.java_keystore: *java_keystore_params
loop: "{{ java_keystore_certs }}"
register: result
- name: Create a Java keystore for the given certificates (idempotency, check mode)
community.general.java_keystore: *java_keystore_params
loop: "{{ java_keystore_certs }}"
check_mode: yes
register: result_idem_check
- name: Create a Java keystore for the given certificates (idempotency)
community.general.java_keystore: *java_keystore_params
loop: "{{ java_keystore_certs }}"
register: result_idem
- name: Create a Java keystore for the given certificates (certificate changed, check mode)
community.general.java_keystore: *java_keystore_params
loop: "{{ java_keystore_new_certs }}"
check_mode: yes
register: result_change_check
- name: Create a Java keystore for the given certificates (certificate changed)
community.general.java_keystore: *java_keystore_params
loop: "{{ java_keystore_new_certs }}"
register: result_change
- name: Create a Java keystore for the given certificates (alias changed, check mode)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
loop: "{{ java_keystore_new_certs }}"
check_mode: yes
register: result_alias_change_check
- name: Create a Java keystore for the given certificates (alias changed)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
loop: "{{ java_keystore_new_certs }}"
register: result_alias_change
- name: Create a Java keystore for the given certificates (password changed, check mode)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
loop: "{{ java_keystore_new_certs }}"
check_mode: yes
register: result_pw_change_check
- name: Create a Java keystore for the given certificates (password changed)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
loop: "{{ java_keystore_new_certs }}"
register: result_pw_change
- name: Create a Java keystore for the given certificates (force keystore type pkcs12, check mode)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
keystore_type: pkcs12
loop: "{{ java_keystore_new_certs }}"
check_mode: yes
register: result_type_pkcs12_check
- name: Create a Java keystore for the given certificates (force keystore type jks, check mode)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
keystore_type: jks
loop: "{{ java_keystore_new_certs }}"
check_mode: yes
register: result_type_jks_check
- name: Create a Java keystore for the given certificates (force keystore type jks)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
keystore_type: jks
loop: "{{ java_keystore_new_certs }}"
register: result_type_jks
- name: Stat keystore (before failure)
ansible.builtin.stat:
path: "{{ output_dir ~ '/' ~ (item.keyname | d(item.name)) ~ '.jks' }}"
loop: "{{ java_keystore_new_certs }}"
register: result_stat_before
- name: Fail to create a Java keystore for the given certificates (password too short)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: short
keystore_type: jks
loop: "{{ java_keystore_new_certs }}"
register: result_fail_jks
ignore_errors: true
- name: Stat keystore (after failure)
ansible.builtin.stat:
path: "{{ output_dir ~ '/' ~ (item.keyname | d(item.name)) ~ '.jks' }}"
loop: "{{ java_keystore_new_certs }}"
register: result_stat_after
- name: Create a Java keystore for the given certificates (keystore type changed, check mode)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
keystore_type: pkcs12
loop: "{{ java_keystore_new_certs }}"
check_mode: yes
register: result_type_change_check
- name: Create a Java keystore for the given certificates (keystore type changed)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
keystore_type: pkcs12
loop: "{{ java_keystore_new_certs }}"
register: result_type_change
- name: Create a Java keystore for the given certificates (omit keystore type, check mode)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
loop: "{{ java_keystore_new_certs }}"
check_mode: yes
register: result_type_omit_check
- name: Create a Java keystore for the given certificates (omit keystore type)
community.general.java_keystore:
<<: *java_keystore_params
name: foobar
password: hunter2
loop: "{{ java_keystore_new_certs }}"
register: result_type_omit
- name: Check that the remote certificates have not been removed
ansible.builtin.file:
path: "{{ output_dir ~ '/' ~ item.name ~ '.pem' }}"
state: file
loop: "{{ java_keystore_certs + java_keystore_new_certs }}"
when: remote_cert
- name: Check that the remote private keys have not been removed
ansible.builtin.file:
path: "{{ output_dir ~ '/' ~ item.name ~ '.key' }}"
state: file
loop: "{{ java_keystore_certs }}"
when: remote_cert
- name: Validate results
assert:
that:
- result is changed
- result_check is changed
- result_idem is not changed
- result_idem_check is not changed
- result_change is changed
- result_change_check is changed
- result_alias_change is changed
- result_alias_change_check is changed
- result_pw_change is changed
- result_pw_change_check is changed
# We don't know if we start from jks or pkcs12 format, anyway check mode
# and actual mode must return the same 'changed' state, and 'jks' and
# 'pkcs12' must give opposite results on a same host.
- result_type_jks_check.changed != result_type_pkcs12_check.changed
- result_type_jks_check.changed == result_type_jks.changed
- result_type_change is changed
- result_type_change_check is changed
- result_type_omit is not changed
- result_type_omit_check is not changed
# keystore properties must remain the same after failure
- result_fail_jks is failed
- result_stat_before.results[0].stat.uid == result_stat_after.results[0].stat.uid
- result_stat_before.results[1].stat.uid == result_stat_after.results[1].stat.uid
- result_stat_before.results[0].stat.gid == result_stat_after.results[0].stat.gid
- result_stat_before.results[1].stat.gid == result_stat_after.results[1].stat.gid
- result_stat_before.results[0].stat.mode == result_stat_after.results[0].stat.mode
- result_stat_before.results[1].stat.mode == result_stat_after.results[1].stat.mode
- result_stat_before.results[0].stat.checksum == result_stat_after.results[0].stat.checksum
- result_stat_before.results[1].stat.checksum == result_stat_after.results[1].stat.checksum