Fix collection compatibility and preserve LDAP URI between roles

.github/workflows/tests.yml

@@ -15,10 +15,22 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      # Molecule's Docker driver needs a running daemon. Do not rely on the
+      # implementation detail that GitHub-hosted Linux runners normally start one.
+      - name: Set up Docker
+        uses: docker/setup-docker-action@v5
+        with:
+          set-host: true
+
+      - name: Verify Docker daemon
+        run: docker info
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.x'
+          # Keep the controller on the Python version used by the pinned
+          # Ansible and Molecule dependencies.
+          python-version: '3.10'
 
       - name: Install dependencies
         run: |

README.md

@@ -640,9 +640,7 @@ There's [another role](https://github.com/lvps/389ds-replication) for that.
 
 ## Tests
 
-> Tests make use of the [docker systemctl replacement](https://github.com/gdraheim/docker-systemctl-replacement) script created and distributed by [gdraheim](https://github.com/gdraheim) under the EUPL license. This script gets downloaded and copied to a local container to allow for the tests to execute correctly. Such distribution happens under the same license and terms upon which gdraheim created and published their work. The script is downloaded as-is and no alteration to it is made whatsoever. By running the tests on their machines the end user agrees to handle the downloaded script under the same terms of the EUPL as intended by its author. Note that the tests themselves (and the role overall) are still licensed under the Apache 2 license.
-
-This role uses molecule for its tests. Install it with pip probably and test all the scenarios:
+This role uses molecule for its tests. Install it with pip (or any other method of your choice) and test all the scenarios:
 
 ```shell
 python -m venv venv
@@ -663,7 +661,6 @@ Or to test a single scenario: `molecule test -s tls`
 ## License
 
 Apache 2.0 for the role and and associated tests  
-EUPL v 1.2 for the "docker systemctl replacement" script by gdraheim (not included but downloaded when running tests)
 
 ## Author Information
 

molecule/backwards_compatibility/Dockerfile.j2

@@ -6,9 +6,57 @@ FROM {{ item.registry.url }}/{{ item.image }}
 FROM {{ item.image }}
 {% endif %}
 
+# CentOS Linux 7 and 8 are EOL. Configure their fixed vault releases before
+# the package-manager selection below; CentOS 8 selects DNF rather than YUM.
+RUN if [ -f /etc/centos-release ]; then \
+            major_version=$(rpm -E %{rhel}); \
+            rm -f /etc/yum.repos.d/*.repo; \
+            if [ "$major_version" = "7" ]; then \
+                printf '%s\n' \
+                    '[base]' \
+                    'name=CentOS-7.9.2009 - Base' \
+                    'baseurl=http://vault.centos.org/7.9.2009/os/$basearch/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[updates]' \
+                    'name=CentOS-7.9.2009 - Updates' \
+                    'baseurl=http://vault.centos.org/7.9.2009/updates/$basearch/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[extras]' \
+                    'name=CentOS-7.9.2009 - Extras' \
+                    'baseurl=http://vault.centos.org/7.9.2009/extras/$basearch/' \
+                    'enabled=1' \
+                    'gpgcheck=0' > /etc/yum.repos.d/CentOS-Vault.repo; \
+            elif [ "$major_version" = "8" ]; then \
+                printf '%s\n' \
+                    '[baseos]' \
+                    'name=CentOS-8.5.2111 - BaseOS' \
+                    'baseurl=http://vault.centos.org/8.5.2111/BaseOS/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[appstream]' \
+                    'name=CentOS-8.5.2111 - AppStream' \
+                    'baseurl=http://vault.centos.org/8.5.2111/AppStream/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[extras]' \
+                    'name=CentOS-8.5.2111 - Extras' \
+                    'baseurl=http://vault.centos.org/8.5.2111/extras/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[powertools]' \
+                    'name=CentOS-8.5.2111 - PowerTools' \
+                    'baseurl=http://vault.centos.org/8.5.2111/PowerTools/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' > /etc/yum.repos.d/CentOS-Vault.repo; \
+            fi; \
+            if command -v dnf >/dev/null; then dnf clean all; else yum clean all; fi; \
+        fi
+
 RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y {{ item.python_package }} sudo bash ca-certificates iproute && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install {{ item.python_package }} sudo {{ item.python_devel_package }} python*-dnf bash iproute {% if item.install_epel %}epel-release{% endif %} && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y {{ item.python_package }} sudo yum-plugin-ovl bash iproute && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install {{ item.python_package }} python3 sudo {{ item.python_devel_package }} python*-dnf bash iproute libselinux-utils policycoreutils policycoreutils-python-utils selinux-policy-targeted {% if item.install_epel %}epel-release{% endif %} && dnf clean all; \
+        elif [ $(command -v yum) ]; then yum makecache fast && yum install -y {{ item.python_package }} sudo yum-plugin-ovl bash iproute && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
     elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y {{ item.python_package }} sudo bash python-xml iproute && zypper clean -a; \
     elif [ $(command -v apk) ]; then apk update && apk add --no-cache {{ item.python_package }} sudo bash iproute ca-certificates; \
     elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y {{ item.python_package }} sudo bash ca-certificates iproute && xbps-remove -O; fi

molecule/backwards_compatibility/converge.yml

@@ -3,67 +3,26 @@
   hosts: all
 
   vars:
+    dirsrv_suffix: "dc=test,dc=local"
+    dirsrv_serverid: default
+
+    dirsrv_rootdn: cn=Directory Manager
     dirsrv_rootdn_password: "P455W0RD"
     dirsrv_listen_host: 0.0.0.0
 
+    dirsrv_tls_enabled: false
+
     # BACKWARDS COMPATIBILITY TEST
     # Should guarantee nteroperability between 389DS 1.3.X and 1.4.X
     dirsrv_defaults_version: "001004002"
     dirsrv_selfsigned_cert: False
     dirsrv_create_suffix_entry: True
 
-  pre_tasks:
-    # The following two tasks when executed together are always idempotent (as they replace the same file with the same content) but they register as changed
-    # from Ansible's perspective. Since there is no easy way to determine wether the existing file is the original binary or the replacement script (checksum
-    # matching is not possible as both the systemctl binary and the replacement script might be updated at any time in the future) then the only option is to
-    # force the two tasks to not change.
-    - name: Remove systemctl binary
-      become: true
-      ansible.builtin.file:
-        path: /usr/bin/systemctl
-        state: absent
-      changed_when: false
-      when: ansible_facts["nodename"] is search("SYSCTL")
-
-    # The test suite uses the "docker systemctl replacement" script created and distributed by gdraheim under the EUPL license. The script gets downloaded and
-    # copied to a local container to allow for the tests to execute correctly. Such distribution happens under the same license and terms upon which gdraheim
-    # created and published their work. The script is downloaded as-is and no alteration to it is made whatsoever. By running the tests on their machines the
-    # end users agrees to handle the downloaded script under the terms of the EUPL as intended by its author. Note that this task, and the role overall is
-    # still licensed under the Apache 2 license as opposed as the downloaded asset which is licensed under the EUPL.
-    - name: Implant systemctl replacement
-      become: true
-      ansible.builtin.uri:
-        creates: /usr/local/bin/systemctl
-        dest: /usr/bin/systemctl
-        owner: root
-        group: root
-        mode: u=rwx,g=rx,o=rx
-        url: https://raw.githubusercontent.com/gdraheim/docker-systemctl-replacement/1bb5768abbf68245b7b6a8bd9d6ac4df4d78044f/files/docker/systemctl.py
-      changed_when: false
-      when: ansible_facts["nodename"] is search("SYSCTL")
-
-    - name: Create dirsrv service dropin directory
-      ansible.builtin.file:
-        path: /etc/systemd/system/dirsrv@.service.d/
-        owner: root
-        group: root
-        mode: "u=rwx,g=rx,o=rx"
-        state: directory
-
-    - name: Copy dirsrv service dropin config
-      become: true
-      ansible.builtin.copy:
-        src: dirsrv-dropin.conf
-        dest: /etc/systemd/system/dirsrv@.service.d/custom.conf
-        owner: root
-        group: root
-        mode: "u=rw,g=r,o=r"
-        force: true
-
-  roles:
-    - role: lvps.389ds_server
-
   tasks:
+    - name: Apply local lvps.389ds_server role
+      ansible.builtin.include_role:
+        name: "{{ playbook_dir }}/../.."
+
     - name: Ensure we can access the server, for testing
       community.general.ldap_entry:
         server_uri: "ldap://localhost"
@@ -72,7 +31,7 @@
         dn: "cn=config"
         objectClass: "top"
         start_tls: "{{ dirsrv_tls_enabled }}"
-        validate_certs: "{{ dirsrv_tls_certificate_trusted }}"
+        validate_certs: "{{ dirsrv_tls_certificate_trusted | default(false) }}"
         state: present
 
     - name: Ensure suffix entry exists
@@ -83,7 +42,7 @@
         dn: "{{ dirsrv_suffix }}"
         objectClass: "domain"
         start_tls: "{{ dirsrv_tls_enabled }}"
-        validate_certs: "{{ dirsrv_tls_certificate_trusted }}"
+        validate_certs: "{{ dirsrv_tls_certificate_trusted | default(false) }}"
         state: present
       register: dirsrv_suffix_test
       failed_when: dirsrv_suffix_test.changed
@@ -104,7 +63,7 @@
     - name: Ensure TLS is disabled
       community.general.ldap_attrs:
         server_uri: "ldap://localhost"
-        validate_certs: "{{ dirsrv_tls_certificate_trusted }}"
+        validate_certs: "{{ dirsrv_tls_certificate_trusted | default(false) }}"
         start_tls: "{{ dirsrv_tls_enabled }}"
         bind_dn: "{{ dirsrv_rootdn }}"
         bind_pw: "{{ dirsrv_rootdn_password }}"

molecule/backwards_compatibility/molecule.yml

@@ -5,18 +5,31 @@ driver:
   name: docker
 role_name_check: 1
 platforms:
-  # Images that contain the string "SYSCTL" will be trated with the "docker systemctl replacement" script
-  - name: CentOS8-Backwards-SYSCTL
+  - name: CentOS8-Backwards
     image: centos:8
-    python_package: python2
-    python_devel_package: python2-devel
+    python_package: python3
+    python_devel_package: python3-devel
     install_epel: true
     command: /sbin/init
+    user: root
     capabilities:
       - SYS_ADMIN
+    security_opts:
+      - no-new-privileges
+    cgroupns_mode: host
+    shm_size: 2048M
     volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    tmpfs:
+      - /run
+      - /run/lock
+      - /dev/shm:size=2g
 provisioner:
   name: ansible
+  inventory:
+    host_vars:
+      CentOS8-Backwards:
+        # Use the Python 3 interpreter installed for this CentOS 8 platform.
+        ansible_python_interpreter: /usr/bin/python3
 verifier:
   name: testinfra

molecule/default/Dockerfile.j2

@@ -6,9 +6,57 @@ FROM {{ item.registry.url }}/{{ item.image }}
 FROM {{ item.image }}
 {% endif %}
 
+# CentOS Linux 7 and 8 are EOL. Configure their fixed vault releases before
+# the package-manager selection below; CentOS 8 selects DNF rather than YUM.
+RUN if [ -f /etc/centos-release ]; then \
+            major_version=$(rpm -E %{rhel}); \
+            rm -f /etc/yum.repos.d/*.repo; \
+            if [ "$major_version" = "7" ]; then \
+                printf '%s\n' \
+                    '[base]' \
+                    'name=CentOS-7.9.2009 - Base' \
+                    'baseurl=http://vault.centos.org/7.9.2009/os/$basearch/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[updates]' \
+                    'name=CentOS-7.9.2009 - Updates' \
+                    'baseurl=http://vault.centos.org/7.9.2009/updates/$basearch/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[extras]' \
+                    'name=CentOS-7.9.2009 - Extras' \
+                    'baseurl=http://vault.centos.org/7.9.2009/extras/$basearch/' \
+                    'enabled=1' \
+                    'gpgcheck=0' > /etc/yum.repos.d/CentOS-Vault.repo; \
+            elif [ "$major_version" = "8" ]; then \
+                printf '%s\n' \
+                    '[baseos]' \
+                    'name=CentOS-8.5.2111 - BaseOS' \
+                    'baseurl=http://vault.centos.org/8.5.2111/BaseOS/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[appstream]' \
+                    'name=CentOS-8.5.2111 - AppStream' \
+                    'baseurl=http://vault.centos.org/8.5.2111/AppStream/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[extras]' \
+                    'name=CentOS-8.5.2111 - Extras' \
+                    'baseurl=http://vault.centos.org/8.5.2111/extras/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' \
+                    '[powertools]' \
+                    'name=CentOS-8.5.2111 - PowerTools' \
+                    'baseurl=http://vault.centos.org/8.5.2111/PowerTools/$basearch/os/' \
+                    'enabled=1' \
+                    'gpgcheck=0' > /etc/yum.repos.d/CentOS-Vault.repo; \
+            fi; \
+            if command -v dnf >/dev/null; then dnf clean all; else yum clean all; fi; \
+        fi
+
 RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y {{ item.python_package }} sudo bash ca-certificates iproute && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install {{ item.python_package }} sudo {{ item.python_devel_package }} python*-dnf bash iproute {% if item.install_epel %}epel-release{% endif %} && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y {{ item.python_package }} sudo yum-plugin-ovl bash iproute && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install {{ item.python_package }} python3 sudo {{ item.python_devel_package }} python*-dnf bash iproute libselinux-utils policycoreutils policycoreutils-python-utils selinux-policy-targeted {% if item.install_epel %}epel-release{% endif %} && dnf clean all; \
+        elif [ $(command -v yum) ]; then yum makecache fast && yum install -y {{ item.python_package }} sudo yum-plugin-ovl bash iproute && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
     elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y {{ item.python_package }} sudo bash python-xml iproute && zypper clean -a; \
     elif [ $(command -v apk) ]; then apk update && apk add --no-cache {{ item.python_package }} sudo bash iproute ca-certificates; \
     elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y {{ item.python_package }} sudo bash ca-certificates iproute && xbps-remove -O; fi