mirror of
https://github.com/ansible-collections/community.mysql.git
synced 2025-04-07 11:10:32 -07:00
85a63511b6
* Sync GHA workflow w/ the collection template (#452) * Sync GHA workflow w/ the collection template * Drop the trailing pre-cmd semicolon * Recover missing `-e` flag of `sed` * Use relative paths for version configs * Unquote `env.connector_version_file` * Use string formatting to fix the substitution problem (cherry picked from commit8107530744) (cherry picked from commit704a0cea6a) * Backport mysql_version_parts variable assignation (cherry picked from commit79046a88cb) (cherry picked from commita59d95501e) * Add changelog fragment (cherry picked from commit26ecd68801) * Backport flags and variables to differentiate MariaDB from MySQL setup (cherry picked from commitb4303511d5) * Backport issue-28 check for tls support (cherry picked from commitefde607d25) * Backport tls_requirements simplified and deduplified tests (cherry picked from commitac5a339644) Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>
90 lines
2.6 KiB
YAML
90 lines
2.6 KiB
YAML
---
|
|
- name: set fact tls_enabled
|
|
command: "{{ mysql_command }} \"-e SHOW VARIABLES LIKE 'have_ssl';\""
|
|
register: result
|
|
- set_fact:
|
|
tls_enabled: "{{ 'YES' in result.stdout | bool | default('false', true) }}"
|
|
|
|
- vars:
|
|
mysql_parameters: &mysql_params
|
|
login_user: '{{ mysql_user }}'
|
|
login_password: '{{ mysql_password }}'
|
|
login_host: 127.0.0.1
|
|
login_port: '{{ mysql_primary_port }}'
|
|
when: tls_enabled
|
|
block:
|
|
|
|
# ============================================================
|
|
|
|
- name: get server certificate
|
|
copy:
|
|
content: "{{ lookup('pipe', \"openssl s_client -starttls mysql -connect localhost:3307 -showcerts 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'\") }}"
|
|
dest: /tmp/cert.pem
|
|
delegate_to: localhost
|
|
|
|
- name: Drop mysql user if exists
|
|
mysql_user:
|
|
<<: *mysql_params
|
|
name: '{{ user_name_1 }}'
|
|
state: absent
|
|
ignore_errors: yes
|
|
|
|
- name: create user with ssl requirement
|
|
mysql_user:
|
|
<<: *mysql_params
|
|
name: "{{ user_name_1 }}"
|
|
password: "{{ user_password_1 }}"
|
|
priv: '*.*:ALL,GRANT'
|
|
tls_requires:
|
|
SSL:
|
|
|
|
- name: attempt connection with newly created user (expect failure)
|
|
mysql_user:
|
|
name: "{{ user_name_2 }}"
|
|
password: "{{ user_password_2 }}"
|
|
host: 127.0.0.1
|
|
login_user: '{{ user_name_1 }}'
|
|
login_password: '{{ user_password_1 }}'
|
|
login_host: 127.0.0.1
|
|
login_port: '{{ mysql_primary_port }}'
|
|
ca_cert: /tmp/cert.pem
|
|
register: result
|
|
ignore_errors: yes
|
|
|
|
- assert:
|
|
that:
|
|
- result is failed
|
|
when: connector_name is search('pymysql')
|
|
|
|
- assert:
|
|
that:
|
|
- result is succeeded
|
|
when: connector_name is not search('pymysql')
|
|
|
|
- name: attempt connection with newly created user ignoring hostname
|
|
mysql_user:
|
|
name: "{{ user_name_2 }}"
|
|
password: "{{ user_password_2 }}"
|
|
host: 127.0.0.1
|
|
login_user: '{{ user_name_1 }}'
|
|
login_password: '{{ user_password_1 }}'
|
|
login_host: 127.0.0.1
|
|
login_port: '{{ mysql_primary_port }}'
|
|
ca_cert: /tmp/cert.pem
|
|
check_hostname: no
|
|
register: result
|
|
ignore_errors: yes
|
|
|
|
- assert:
|
|
that:
|
|
- result is succeeded or 'pymysql >= 0.7.11 is required' in result.msg
|
|
|
|
- name: Drop mysql user
|
|
mysql_user:
|
|
<<: *mysql_params
|
|
name: '{{ item }}'
|
|
host: 127.0.0.1
|
|
state: absent
|
|
with_items:
|
|
- "{{ user_name_1 }}"
|
|
- "{{ user_name_2 }}"
|