Add new consul modules and reuse code between them. (#7878)

Refactored consul modules and added new roles.
2025-07-23 05:10:22 -07:00 · 2024-01-27 10:22:44 +01:00 · 2024-01-27 10:22:44 +01:00 · 29f9865497
commit 29f9865497
parent 5c72ab34bf
17 changed files with 1508 additions and 568 deletions
--- a/tests/integration/targets/consul/tasks/consul_auth_method.yml
+++ b/tests/integration/targets/consul/tasks/consul_auth_method.yml
@ -0,0 +1,79 @@
+---
+# Copyright (c) 2024, Florian Apolloner (@apollo13)
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+- name: Create an auth method
+  community.general.consul_auth_method:
+    name: test
+    type: jwt
+    config:
+      jwt_validation_pubkeys:
+        - |
+          -----BEGIN PUBLIC KEY-----
+          MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
+          4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
+          +qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh
+          kd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ
+          0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg
+          cKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc
+          mwIDAQAB
+          -----END PUBLIC KEY-----
+    token: "{{ consul_management_token }}"
+  register: result
+
+- assert:
+    that:
+      - result is changed
+      - result.auth_method.Type == 'jwt'
+      - result.operation == 'create'
+
+- name: Update auth method
+  community.general.consul_auth_method:
+    name: test
+    max_token_ttl: 30m80s
+    token: "{{ consul_management_token }}"
+  register: result
+
+- assert:
+    that:
+      - result is changed
+      - result.auth_method.Type == 'jwt'
+      - result.operation == 'update'
+
+- name: Update auth method (noop)
+  community.general.consul_auth_method:
+    name: test
+    max_token_ttl: 30m80s
+    token: "{{ consul_management_token }}"
+  register: result
+
+- assert:
+    that:
+      - result is not changed
+      - result.auth_method.Type == 'jwt'
+      - result.operation is not defined
+
+- name: Delete auth method
+  community.general.consul_auth_method:
+    name: test
+    state: absent
+    token: "{{ consul_management_token }}"
+  register: result
+
+- assert:
+    that:
+      - result is changed
+      - result.operation == 'remove'
+
+- name: Delete auth method (noop)
+  community.general.consul_auth_method:
+    name: test
+    state: absent
+    token: "{{ consul_management_token }}"
+  register: result
+
+- assert:
+    that:
+      - result is not changed
+      - result.operation is not defined
--- a/tests/integration/targets/consul/tasks/consul_binding_rule.yml
+++ b/tests/integration/targets/consul/tasks/consul_binding_rule.yml
@ -0,0 +1,78 @@
+---
+# Copyright (c) 2024, Florian Apolloner (@apollo13)
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+- name: Create an auth method
+  community.general.consul_auth_method:
+    name: test
+    type: jwt
+    config:
+      jwt_validation_pubkeys:
+        - |
+          -----BEGIN PUBLIC KEY-----
+          MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
+          4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
+          +qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh
+          kd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ
+          0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg
+          cKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc
+          mwIDAQAB
+          -----END PUBLIC KEY-----      
+    token: "{{ consul_management_token }}"
+
+- name: Create a binding rule
+  community.general.consul_binding_rule:
+    name: test-binding
+    description: my description
+    auth_method: test
+    token: "{{ consul_management_token }}"
+    bind_type: service
+    bind_name: yolo
+  register: result
+
+- assert:
+    that:
+      - result is changed
+      - result.binding_rule.AuthMethod == 'test'
+      - result.binding.Description == 'test-binding: my description'
+      - result.operation == 'create'
+
+- name: Update a binding rule
+  community.general.consul_binding_rule:
+    name: test-binding
+    auth_method: test
+    token: "{{ consul_management_token }}"
+    bind_name: yolo2
+  register: result
+
+- assert:
+    that:
+      - result is changed
+      - result.binding.Description == 'test-binding: my description'
+      - result.operation == 'update'
+
+- name: Update a binding rule (noop)
+  community.general.consul_binding_rule:
+    name: test-binding
+    auth_method: test
+    token: "{{ consul_management_token }}"
+  register: result
+
+- assert:
+    that:
+      - result is not changed
+      - result.binding.Description == 'test-binding: my description'
+      - result.operation is not defined
+
+- name: Delete a binding rule
+  community.general.consul_binding_rule:
+    name: test-binding
+    auth_method: test
+    state: absent
+    token: "{{ consul_management_token }}"
+  register: result
+- assert:
+    that:
+      - result is changed
+      - result.operation == 'remove'
--- a/tests/integration/targets/consul/tasks/consul_policy.yml
+++ b/tests/integration/targets/consul/tasks/consul_policy.yml
@ -19,7 +19,9 @@
 - assert:
    that:
      - result is changed
-      - result['policy']['Name'] == 'foo-access'
+      - result.policy.Name == 'foo-access'
+      - result.operation == 'create'
+
 - name: Update the rules associated to a policy
  consul_policy:
    name: foo-access
@ -35,9 +37,12 @@
        }
    token: "{{ consul_management_token }}"
  register: result
+
 - assert:
    that:
      - result is changed
+      - result.operation == 'update'
+
 - name: Update reports not changed when updating again without changes
  consul_policy:
    name: foo-access
@ -53,9 +58,12 @@
        }
    token: "{{ consul_management_token }}"
  register: result
+
 - assert:
    that:
      - result is not changed
+      - result.operation is not defined
+
 - name: Remove a policy
  consul_policy:
    name: foo-access
@ -64,4 +72,5 @@
  register: result
 - assert:
    that:
-      - result is changed
+      - result is changed
+      - result.operation == 'remove'
--- a/tests/integration/targets/consul/tasks/consul_role.yml
+++ b/tests/integration/targets/consul/tasks/consul_role.yml
@ -40,7 +40,8 @@
 - assert:
    that:
      - result is changed
-      - result['role']['Name'] == 'foo-role-with-policy'
+      - result.role.Name == 'foo-role-with-policy'
+      - result.operation == 'create'

 - name: Update policy description, in check mode
  consul_role:
@ -53,8 +54,9 @@
 - assert:
    that:
      - result is changed
-      - result['role']['Description'] == "Testing updating description"
-      - result['role']['Policies'][0]['Name'] == 'foo-access-for-role'
+      - result.role.Description == "Testing updating description"
+      - result.role.Policies.0.Name == 'foo-access-for-role'
+      - result.operation == 'update'

 - name: Update policy to add the description
  consul_role:
@ -66,8 +68,9 @@
 - assert:
    that:
      - result is changed
-      - result['role']['Description'] == "Role for testing policies"
-      - result['role']['Policies'][0]['Name'] == 'foo-access-for-role'
+      - result.role.Description == "Role for testing policies"
+      - result.role.Policies.0.Name == 'foo-access-for-role'
+      - result.operation == 'update'

 - name: Update the role with another policy, also testing leaving description blank
  consul_role:
@ -81,9 +84,10 @@
 - assert:
    that:
      - result is changed
-      - result['role']['Policies'][0]['Name'] == 'foo-access-for-role'
-      - result['role']['Policies'][1]['Name'] == 'bar-access-for-role'
-      - result['role']['Description'] == "Role for testing policies"
+      - result.role.Policies.0.Name == 'foo-access-for-role'
+      - result.role.Policies.1.Name == 'bar-access-for-role'
+      - result.role.Description == "Role for testing policies"
+      - result.operation == 'update'

 - name: Create a role with service identity
  consul_role:
@ -98,8 +102,8 @@
 - assert:
    that:
      - result is changed
-      - result['role']['ServiceIdentities'][0]['ServiceName'] == "web"
-      - result['role']['ServiceIdentities'][0]['Datacenters'][0] == "dc1"
+      - result.role.ServiceIdentities.0.ServiceName == "web"
+      - result.role.ServiceIdentities.0.Datacenters.0 == "dc1"

 - name: Update the role with service identity in check mode
  consul_role:
@ -115,8 +119,8 @@
 - assert:
    that:
      - result is changed
-      - result['role']['ServiceIdentities'][0]['ServiceName'] == "web"
-      - result['role']['ServiceIdentities'][0]['Datacenters'][0] == "dc2"
+      - result.role.ServiceIdentities.0.ServiceName == "web"
+      - result.role.ServiceIdentities.0.Datacenters.0 == "dc2"

 - name: Update the role with service identity to add a policy, leaving the service id unchanged
  consul_role:
@ -129,9 +133,9 @@
 - assert:
    that:
      - result is changed
-      - result['role']['ServiceIdentities'][0]['ServiceName'] == "web"
-      - result['role']['ServiceIdentities'][0]['Datacenters'][0] == "dc1"
-      - result['role']['Policies'][0]['Name'] == 'foo-access-for-role'
+      - result.role.ServiceIdentities.0.ServiceName == "web"
+      - result.role.ServiceIdentities.0.Datacenters.0 == "dc1"
+      - result.role.Policies.0.Name == 'foo-access-for-role'

 - name: Update the role with service identity to remove the policies
  consul_role:
@ -143,9 +147,9 @@
 - assert:
    that:
      - result is changed
-      - result['role']['ServiceIdentities'][0]['ServiceName'] == "web"
-      - result['role']['ServiceIdentities'][0]['Datacenters'][0] == "dc1"
-      - result['role']['Policies'] is not defined
+      - result.role.ServiceIdentities.0.ServiceName == "web"
+      - result.role.ServiceIdentities.0.Datacenters.0 == "dc1"
+      - result.role.Policies is not defined

 - name: Update the role with service identity to remove the node identities, in check mode
  consul_role:
@ -158,10 +162,10 @@
 - assert:
    that:
      - result is changed
-      - result['role']['ServiceIdentities'][0]['ServiceName'] == "web"
-      - result['role']['ServiceIdentities'][0]['Datacenters'][0] == "dc1"
-      - result['role']['Policies'] is not defined
-      - result['role']['NodeIdentities'] == [] # in check mode the cleared field is returned as an empty array
+      - result.role.ServiceIdentities.0.ServiceName == "web"
+      - result.role.ServiceIdentities.0.Datacenters.0 == "dc1"
+      - result.role.Policies is not defined
+      - result.role.NodeIdentities == [] # in check mode the cleared field is returned as an empty array

 - name: Update the role with service identity to remove the service identities
  consul_role:
@ -173,8 +177,8 @@
 - assert:
    that:
      - result is changed
-      - result['role']['ServiceIdentities'] is not defined # in normal mode the dictionary is removed from the result
-      - result['role']['Policies'] is not defined
+      - result.role.ServiceIdentities is not defined # in normal mode the dictionary is removed from the result
+      - result.role.Policies is not defined

 - name: Create a role with node identity
  consul_role:
@ -188,14 +192,17 @@
 - assert:
    that:
      - result is changed
-      - result['role']['NodeIdentities'][0]['NodeName'] == "node-1"
-      - result['role']['NodeIdentities'][0]['Datacenter'] == "dc2"
+      - result.role.NodeIdentities.0.NodeName == "node-1"
+      - result.role.NodeIdentities.0.Datacenter == "dc2"

 - name: Remove the last role
  consul_role:
    token: "{{ consul_management_token }}"
    name: role-with-node-identity
    state: absent
+  register: result
+
 - assert:
    that:
-      - result is changed
+      - result is changed
+      - result.operation == 'remove'
--- a/tests/integration/targets/consul/tasks/consul_token.yml
+++ b/tests/integration/targets/consul/tasks/consul_token.yml
@ -0,0 +1,82 @@
+---
+# Copyright (c) 2024, Florian Apolloner (@apollo13)
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+- name: Create a policy with rules
+  community.general.consul_policy:
+    name: "{{ item }}"
+    rules: |
+        key "foo" {
+            policy = "read"
+        }
+    token: "{{ consul_management_token }}"
+  loop:
+    - foo-access
+    - foo-access2
+
+- name: Create token
+  community.general.consul_token:
+    state: present
+    accessor_id: 07a7de84-c9c7-448a-99cc-beaf682efd21
+    token: "{{ consul_management_token }}"
+    service_identities:
+      - service_name: test
+        datacenters: [test1, test2]
+    node_identities:
+      - node_name: test
+        datacenter: test
+    policies:
+      - name: foo-access
+      - name: foo-access2
+    expiration_ttl: 1h
+  register: create_result
+
+- assert:
+    that:
+      - create_result is changed
+      - create_result.token.AccessorID == "07a7de84-c9c7-448a-99cc-beaf682efd21"
+      - create_result.operation == 'create'
+
+- name: Update token
+  community.general.consul_token:
+    state: present
+    accessor_id: 07a7de84-c9c7-448a-99cc-beaf682efd21
+    token: "{{ consul_management_token }}"
+    description: Testing
+    policies:
+      - id: "{{ create_result.token.Policies[-1].ID }}"
+    service_identities: []
+  register: result
+
+- assert:
+    that:
+      - result is changed
+      - result.operation == 'update'
+
+- name: Update token (noop)
+  community.general.consul_token:
+    state: present
+    accessor_id: 07a7de84-c9c7-448a-99cc-beaf682efd21
+    token: "{{ consul_management_token }}"
+    policies:
+      - id: "{{ create_result.token.Policies[-1].ID }}"
+  register: result
+
+- assert:
+    that:
+      - result is not changed
+      - result.operation is not defined
+
+- name: Remove token
+  community.general.consul_token:
+    state: absent
+    accessor_id: 07a7de84-c9c7-448a-99cc-beaf682efd21
+    token: "{{ consul_management_token }}"
+  register: result
+
+- assert:
+    that:
+      - result is changed
+      - not result.token
+      - result.operation == 'remove'
--- a/tests/integration/targets/consul/tasks/main.yml
+++ b/tests/integration/targets/consul/tasks/main.yml
@ -77,12 +77,10 @@
    - name: Start Consul (dev mode enabled)
      shell: nohup {{ consul_cmd }} agent -dev -config-file {{ remote_tmp_dir }}/consul_config.hcl </dev/null >/dev/null 2>&1 &
    - name: Bootstrap ACL
-      command: '{{ consul_cmd }} acl bootstrap --format=json'
-      register: consul_bootstrap_result_string
+      consul_acl_bootstrap:
+      register: consul_bootstrap_result
    - set_fact:
-        consul_management_token: '{{ consul_bootstrap_json_result["SecretID"] }}'
-      vars:
-        consul_bootstrap_json_result: '{{ consul_bootstrap_result_string.stdout | from_json }}'
+        consul_management_token: '{{ consul_bootstrap_result.result.SecretID }}'
    - name: Create some data
      command: '{{ consul_cmd }} kv put -token={{consul_management_token}} data/value{{ item }} foo{{ item }}'
      loop:
@ -94,6 +92,9 @@
    - import_tasks: consul_session.yml
    - import_tasks: consul_policy.yml
    - import_tasks: consul_role.yml
+    - import_tasks: consul_token.yml
+    - import_tasks: consul_auth_method.yml
+    - import_tasks: consul_binding_rule.yml
    always:
    - name: Kill consul process
      shell: kill $(cat {{ remote_tmp_dir }}/consul.pid)