Skip to content
This repository was archived by the owner on Nov 17, 2020. It is now read-only.

Commit 619aed0

Browse files
author
Sebastian Gumprich
committed
use docker for testing
1 parent a58e5bf commit 619aed0

File tree

6 files changed

+253
-66
lines changed

6 files changed

+253
-66
lines changed

‎.kitchen.vagrant.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
driver:
3+
name: vagrant
4+
5+
provisioner:
6+
name: ansible_playbook
7+
hosts: all
8+
require_ansible_repo: false
9+
require_ansible_omnibus: true
10+
require_chef_for_busser: false
11+
require_ruby_for_busser: false
12+
ansible_verbose: true
13+
roles_path: ../ansible-mysql-hardening/
14+
playbook: default.yml
15+
requirements_path: requirements.yml
16+
sudo_command: 'sudo -E -H'
17+
18+
transport:
19+
max_ssh_sessions: 5
20+
21+
platforms:
22+
- name: ubuntu-12.04
23+
driver_config:
24+
box: opscode-ubuntu-12.04
25+
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-12.04_chef-provisionerless.box
26+
- name: ubuntu-14.04
27+
driver_config:
28+
box: opscode-ubuntu-14.04
29+
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
30+
- name: ubuntu-16.04
31+
driver_config:
32+
box: opscode-ubuntu-16.04
33+
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-16.04_chef-provisionerless.box
34+
- name: centos-6.4
35+
driver_config:
36+
box: opscode-centos-6.4
37+
box_url: https://opscode-vm.s3.amazonaws.com/vagrant/opscode_centos-6.4_provisionerless.box
38+
- name: centos-6.5
39+
driver_config:
40+
box: opscode-centos-6.5
41+
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
42+
- name: centos-6.8
43+
driver_config:
44+
box: bento/centos-6.8
45+
- name: centos-7
46+
driver_config:
47+
box: bento/centos-7.2
48+
- name: oracle-6.4
49+
driver_config:
50+
box: oracle-6.4
51+
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
52+
- name: oracle-6.5
53+
driver_config:
54+
box: oracle-6.5
55+
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
56+
- name: oracle-7
57+
driver_config:
58+
box: boxcutter/ol72
59+
- name: debian-7
60+
driver_config:
61+
box: debian-7
62+
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
63+
- name: debian-8
64+
driver_config:
65+
box: debian-8
66+
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
67+
68+
verifier:
69+
name: inspec
70+
sudo: true
71+
inspec_tests:
72+
- https://github.com/dev-sec/mysql-baseline/
73+
74+
suites:
75+
- name: mysql

‎.kitchen.yml‎

Lines changed: 68 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,62 +1,82 @@
11
---
22
driver:
3-
name: vagrant
3+
name: docker
4+
privileged: true
5+
use_sudo: false
6+
7+
transport:
8+
max_ssh_sessions: 5
9+
410
provisioner:
511
name: ansible_playbook
6-
test_repo_uri: https://github.com/hardening-io/tests-mysql-hardening.git
712
hosts: all
8-
playbook: default.yml
913
require_ansible_repo: false
1014
require_ansible_omnibus: true
11-
requirements_path: requirements.yml
15+
require_chef_for_busser: false
16+
require_ruby_for_busser: false
1217
ansible_verbose: true
1318
ansible_diff: true
19+
hosts: all
1420
roles_path: ../ansible-mysql-hardening/
21+
playbook: default.yml
22+
requirements_path: requirements.yml
1523
sudo_command: 'sudo -E -H'
1624

1725
platforms:
18-
- name: ubuntu-12.04
19-
driver_config:
20-
box: opscode-ubuntu-12.04
21-
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-12.04_chef-provisionerless.box
22-
- name: ubuntu-14.04
23-
driver_config:
24-
box: opscode-ubuntu-14.04
25-
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box
26-
- name: centos-6.4
27-
driver_config:
28-
box: opscode-centos-6.4
29-
box_url: https://opscode-vm.s3.amazonaws.com/vagrant/opscode_centos-6.4_provisionerless.box
30-
- name: centos-6.5
31-
driver_config:
32-
box: opscode-centos-6.5
33-
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
34-
- name: centos-7.2
35-
driver_config:
36-
box: opscode-centos-7.2
37-
box_url: http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-7.2_chef-provisionerless.box
38-
- name: oracle-6.4
39-
driver_config:
40-
box: oracle-6.4
41-
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
42-
- name: oracle-6.5
43-
driver_config:
44-
box: oracle-6.5
45-
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
46-
- name: debian-6
47-
driver_config:
48-
box: debian-6
49-
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-6.0.10_chef-provisionerless.box
50-
- name: debian-7
51-
driver_config:
52-
box: debian-7
53-
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-7.8_chef-provisionerless.box
54-
- name: debian-8
55-
driver_config:
56-
box: debian-8
57-
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
26+
- name: centos6-ansible-latest
27+
driver:
28+
image: rndmh3ro/docker-centos6-ansible:latest
29+
platform: centos
30+
- name: centos7-ansible-latest
31+
driver:
32+
image: rndmh3ro/docker-centos7-ansible:latest
33+
platform: centos
34+
- name: oracle6-ansible-latest
35+
driver:
36+
image: rndmh3ro/docker-oracle6-ansible:latest
37+
platform: centos
38+
- name: oracle7-ansible-latest
39+
driver:
40+
image: rndmh3ro/docker-oracle7-ansible:latest
41+
platform: centos
42+
- name: ubuntu1204-ansible-latest
43+
driver:
44+
image: rndmh3ro/docker-ubuntu1204-ansible:latest
45+
platform: ubuntu
46+
run_command: /sbin/init
47+
- name: ubuntu1404-ansible-latest
48+
driver:
49+
image: rndmh3ro/docker-ubuntu1404-ansible:latest
50+
platform: ubuntu
51+
- name: ubuntu1604-ansible-latest
52+
driver:
53+
image: rndmh3ro/docker-ubuntu1604-ansible:latest
54+
platform: ubuntu
55+
- name: debian7-ansible-latest
56+
driver:
57+
image: rndmh3ro/docker-debian7-ansible:latest
58+
platform: debian
59+
intermediate_instructions:
60+
- RUN /usr/bin/apt-get update
61+
- RUN /usr/bin/apt-get install -y procps
62+
- name: debian8-ansible-latest
63+
driver:
64+
image: rndmh3ro/docker-debian8-ansible:latest
65+
platform: debian
66+
intermediate_instructions:
67+
- RUN /usr/bin/apt-get update
68+
- RUN /usr/bin/apt-get install -y procps
69+
pid_one_command: /bin/systemd
70+
- name: debian9-ansible-latest
71+
driver:
72+
image: rndmh3ro/docker-debian9-ansible:latest
73+
platform: debian
74+
75+
verifier:
76+
name: inspec
77+
sudo: true
78+
inspec_tests:
79+
- https://github.com/dev-sec/mysql-baseline
80+
5881
suites:
59-
- name: ansible_1.9
60-
provisioner:
61-
ansible_version: 1.9.4
62-
- name: ansible_latest
82+
- name: mysql

‎.travis.yml‎

Lines changed: 68 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,75 @@
11
---
2-
notifications:
3-
webhooks: https://galaxy.ansible.com/api/v1/notifications/
4-
language: python
5-
python: "2.7"
2+
services: docker
63

74
env:
8-
- ANSIBLE_VERSION=latest
9-
- ANSIBLE_VERSION=1.9.4
5+
- distro: centos6
6+
version: latest
7+
run_opts: "--privileged"
8+
init: /sbin/init
9+
10+
- distro: centos7
11+
init: /usr/lib/systemd/systemd
12+
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
13+
version: latest
14+
15+
- distro: oracle6
16+
version: latest
17+
run_opts: "--privileged"
18+
init: /sbin/init
19+
20+
- distro: oracle7
21+
init: /usr/lib/systemd/systemd
22+
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
23+
version: latest
24+
25+
# see https://github.com/dev-sec/mysql-baseline/issues/35
26+
# - distro: ubuntu1604
27+
# version: latest
28+
# init: /lib/systemd/systemd
29+
# run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
30+
31+
# - distro: ubuntu1404
32+
# version: latest
33+
# run_opts: "--privileged"
34+
# init: /sbin/init
35+
36+
- distro: debian7
37+
version: latest
38+
run_opts: "--privileged"
39+
init: /sbin/init
40+
41+
# - distro: debian8
42+
# version: latest
43+
# init: /bin/systemd
44+
# run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
45+
46+
# - distro: debian9
47+
# version: latest
48+
# init: /lib/systemd/systemd
49+
# run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
1050

1151
before_install:
12-
- sudo apt-get update -qq
13-
- sudo apt-get install -qq python-apt python-pycurl python-mysqldb
14-
install:
15-
- if [ "$ANSIBLE_VERSION" = "latest" ]; then pip install ansible; else pip install ansible==$ANSIBLE_VERSION; fi
16-
- echo -e 'localhost ansible_connection=local' > spec/inventory
17-
- echo -e '[defaults]\nroles_path = ../\nhostfile = ./spec/inventory' > ansible.cfg
52+
# Pull container
53+
- 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
1854

1955
script:
20-
- ansible-playbook --syntax-check spec/travis.yml
21-
- ansible-playbook --sudo -v --diff spec/travis.yml
56+
- container_id=$(mktemp)
57+
# Run container in detached state.
58+
- 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-mysql-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
59+
60+
# Install ansible galaxy requirements
61+
- 'docker exec "$(cat ${container_id})" ansible-galaxy install -r /etc/ansible/roles/ansible-mysql-hardening/requirements.yml -p /etc/ansible/roles/'
62+
63+
# Test role.
64+
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-mysql-hardening/default.yml'
65+
66+
# Verify role
67+
- 'inspec exec https://github.com/rndmh3ro/mysql-baseline/ -t docker://$(cat ${container_id})'
68+
69+
after_failure:
70+
# Check MySQL settings.
71+
- 'docker exec --tty ${container_id} env TERM=xterm cat /var/log/mysql/error.log'
72+
- 'docker exec --tty ${container_id} env TERM=xterm cat /var/log/mysql.err'
73+
- 'docker exec --tty ${container_id} env TERM=xterm cat /var/log/mysql.log'
74+
notifications:
75+
webhooks: https://galaxy.ansible.com/api/v1/notifications/

‎default.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,26 @@
11
---
2+
23
- name: wrapper playbook for kitchen testing "ansible-mysql-hardening"
34
hosts: localhost
5+
pre_tasks:
6+
- file: path="/etc/mysql" state=directory
7+
- name: Copy initctl_faker into place for Ubuntu 14.04.
8+
copy:
9+
src: initctl_faker
10+
dest: /sbin/initctl
11+
mode: 0755
12+
force: yes
13+
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version == '14.04'
14+
changed_when: false
15+
- name: install procps for debian systems
16+
apt: name=procps state=installed update_cache=yes
17+
when: ansible_distribution == 'Debian'
418
vars:
519
overwrite_global_mycnf: no
6-
mysql_root_password: "root"
20+
mysql_root_password: iloverandompasswordsbutthiswilldo
21+
mysql_user_password: iloverandompasswordsbutthiswilldo
22+
mysql_config_file: /etc/mysql/mariadb.cnf
23+
mysql_root_password_update: yes
724
roles:
825
- geerlingguy.mysql
926
- ansible-mysql-hardening

‎initctl_faker‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/sh
2+
ALIAS_CMD="$(echo ""$0"" | sed -e 's?/sbin/??')"
3+
4+
case "$ALIAS_CMD" in
5+
start|stop|restart|reload|status)
6+
exec service $1 $ALIAS_CMD
7+
;;
8+
esac
9+
10+
case "$1" in
11+
list )
12+
exec service --status-all
13+
;;
14+
reload-configuration )
15+
exec service $2 restart
16+
;;
17+
start|stop|restart|reload|status)
18+
exec service $2 $1
19+
;;
20+
\?)
21+
exit 0
22+
;;
23+
esac
24+

‎spec/travis.yml‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)