Skip to content

Commit 5e2fa1a

Browse files
myiimyii
authored
Merge pull request #187 from baby-gnu/ci/validate_map.jinja
Ci/validate map.jinja
2 parents 6a88202 + e4ab335 commit 5e2fa1a

23 files changed

Lines changed: 2458 additions & 0 deletions

‎docs/README.rst‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,13 @@ To completely disable adding IP addresses::
230230

231231
Manages the system wide ``/etc/ssh/moduli`` file.
232232

233+
``openssh._mapdata``
234+
^^^^^^^^^^^^^^^^^^
235+
236+
Testing state which dumps the ``map.jinja`` values in ``/tmp/salt_mapdata_dump.yaml``.
237+
This state is not called by any include but is mostly used by kitchen and Inspec infrastructure to validate ``map.jinja``.
238+
239+
233240
Testing
234241
-------
235242

‎kitchen.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ suites:
153153
state_top:
154154
base:
155155
'*':
156+
- openssh._mapdata
156157
- openssh.config
157158
- openssh.known_hosts
158159
pillars:

‎openssh/_mapdata/_mapdata.jinja‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# yamllint disable rule:indentation rule:line-length
2+
# {{ grains.get('osfinger', grains.os) }}
3+
---
4+
{#- use salt.slsutil.serialize to avoid encoding errors on some platforms #}
5+
{{ salt['slsutil.serialize'](
6+
'yaml',
7+
map,
8+
default_flow_style=False,
9+
allow_unicode=True,
10+
)
11+
| regex_replace("^\s+'$", "'", multiline=True)
12+
| trim
13+
}}

‎openssh/_mapdata/init.sls‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# -*- coding: utf-8 -*-
2+
# vim: ft=sls
3+
---
4+
{#- Get the `tplroot` from `tpldir` #}
5+
{%- set tplroot = tpldir.split('/')[0] %}
6+
{%- from tplroot ~ "/map.jinja" import openssh with context %}
7+
{%- from tplroot ~ "/map.jinja" import ssh_config with context %}
8+
{%- from tplroot ~ "/map.jinja" import sshd_config with context %}
9+
10+
{%- set output_file = '/tmp/salt_mapdata_dump.yaml' %}
11+
{%- set map = {
12+
'openssh': openssh,
13+
'ssh_config': ssh_config,
14+
'sshd_config': sshd_config,
15+
} %}
16+
17+
{%- do salt['log.debug']( map | yaml(False) ) %}
18+
19+
{{ tplroot }}-mapdata-dump:
20+
file.managed:
21+
- name: {{ output_file }}
22+
- source: salt://{{ tplroot }}/_mapdata/_mapdata.jinja
23+
- template: jinja
24+
- context:
25+
map: {{ map | yaml }}

‎test/integration/default/controls/_mapdata_spec.rb‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# frozen_string_literal: true
2+
3+
# Replace per minion strings
4+
replacement = {
5+
hostname: system.hostname
6+
}
7+
8+
mapdata_file = "mapdata/#{system.platform[:finger].split('.').first}.yaml"
9+
mapdata_dump = inspec.profile.file(mapdata_file) % replacement
10+
11+
control '`map.jinja` YAML dump' do
12+
title 'should contain the lines'
13+
14+
describe file('/tmp/salt_mapdata_dump.yaml') do
15+
it { should exist }
16+
its('content') { should include mapdata_dump }
17+
end
18+
end

‎test/integration/default/files/mapdata/amazonlinux-1.yaml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
# yamllint disable rule:indentation rule:line-length
2+
# Amazon Linux AMI-2018
3+
---
4+
openssh:
5+
absent_dsa_keys: false
6+
absent_ecdsa_keys: false
7+
absent_ed25519_keys: false
8+
absent_rsa_keys: false
9+
auth:
10+
joe-non-valid-ssh-key:
11+
- comment: obsolete key - removed
12+
enc: ssh-rsa
13+
present: false
14+
source: salt://ssh_keys/joe.no-valid.pub
15+
user: joe
16+
joe-valid-ssh-key-desktop:
17+
- comment: main key - desktop
18+
enc: ssh-rsa
19+
present: true
20+
source: salt://ssh_keys/joe.desktop.pub
21+
user: joe
22+
joe-valid-ssh-key-notebook:
23+
- comment: main key - notebook
24+
enc: ssh-rsa
25+
present: true
26+
source: salt://ssh_keys/joe.netbook.pub
27+
user: joe
28+
auth_map:
29+
personal_keys:
30+
source: salt://ssh_keys
31+
users:
32+
joe:
33+
joe.desktop: {}
34+
joe.netbook:
35+
options: []
36+
joe.no-valid:
37+
present: false
38+
banner: /etc/ssh/banner
39+
banner_src: banner
40+
banner_string: 'Welcome to %{hostname}!
41+
'
42+
client: openssh-clients
43+
client_version: latest
44+
dig_pkg: bind-utils
45+
dsa:
46+
private_key: '-----BEGIN DSA PRIVATE KEY-----
47+
48+
NOT_DEFINED
49+
50+
-----END DSA PRIVATE KEY-----
51+
'
52+
public_key: 'ssh-dss NOT_DEFINED
53+
'
54+
ecdsa:
55+
private_key: '-----BEGIN EC PRIVATE KEY-----
56+
57+
NOT_DEFINED
58+
59+
-----END EC PRIVATE KEY-----
60+
'
61+
public_key: 'ecdsa-sha2-nistp256 NOT_DEFINED
62+
'
63+
ed25519:
64+
private_key: '-----BEGIN OPENSSH PRIVATE KEY-----
65+
66+
NOT_DEFINED
67+
68+
-----END OPENSSH PRIVATE KEY-----
69+
'
70+
public_key: 'ssh-ed25519 NOT_DEFINED
71+
'
72+
enforce_rsa_size: false
73+
generate_dsa_keys: false
74+
generate_ecdsa_keys: false
75+
generate_ed25519_keys: false
76+
generate_rsa_keys: false
77+
generate_rsa_size: 4096
78+
host_key_algos: ecdsa,ed25519,rsa
79+
known_hosts:
80+
aliases:
81+
- cname-to-minion.example.org
82+
- alias.example.org
83+
hostnames: false
84+
include_localhost: false
85+
mine_hostname_function: public_ssh_hostname
86+
mine_keys_function: public_ssh_host_keys
87+
omit_ip_address:
88+
- github.com
89+
salt_ssh:
90+
public_ssh_host_keys:
91+
minion.id: 'ssh-rsa [...]
92+
93+
ssh-ed25519 [...]
94+
'
95+
public_ssh_host_names:
96+
minion.id:
97+
- minion.id
98+
- alias.of.minion.id
99+
user: salt-master
100+
static:
101+
github.com: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGm[...]
102+
gitlab.com: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bN[...]
103+
target: '*'
104+
tgt_type: glob
105+
moduli: '# Time Type Tests Tries Size Generator Modulus
106+
107+
20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63
108+
109+
20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB
110+
111+
20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53
112+
113+
20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F
114+
'
115+
provide_dsa_keys: false
116+
provide_ecdsa_keys: false
117+
provide_ed25519_keys: false
118+
provide_rsa_keys: false
119+
root_group: root
120+
rsa:
121+
private_key: '-----BEGIN RSA PRIVATE KEY-----
122+
123+
NOT_DEFINED
124+
125+
-----END RSA PRIVATE KEY-----
126+
'
127+
public_key: 'ssh-rsa NOT_DEFINED
128+
'
129+
server: openssh-server
130+
server_version: latest
131+
service: sshd
132+
ssh_config: /etc/ssh/ssh_config
133+
ssh_config_backup: true
134+
ssh_config_group: root
135+
ssh_config_mode: '644'
136+
ssh_config_src: ssh_config
137+
ssh_config_user: root
138+
ssh_known_hosts: /etc/ssh/ssh_known_hosts
139+
ssh_known_hosts_src: ssh_known_hosts
140+
ssh_moduli: /etc/ssh/moduli
141+
sshd_binary: /usr/sbin/sshd
142+
sshd_config: /etc/ssh/sshd_config
143+
sshd_config_backup: true
144+
sshd_config_group: root
145+
sshd_config_mode: '644'
146+
sshd_config_src: sshd_config
147+
sshd_config_user: root
148+
sshd_enable: true
149+
ssh_config:
150+
Hosts:
151+
'*':
152+
GSSAPIAuthentication: 'yes'
153+
HashKnownHosts: 'yes'
154+
SendEnv: LANG LC_*
155+
sshd_config:
156+
AcceptEnv: LANG LC_*
157+
ChallengeResponseAuthentication: 'no'
158+
PrintMotd: 'no'
159+
Subsystem: sftp /usr/lib/openssh/sftp-server
160+
UsePAM: 'yes'
161+
X11Forwarding: 'yes'

0 commit comments

Comments
 (0)