From 6e3b92bcc4f955348d92b902e5e860c9ee9e1428 Mon Sep 17 00:00:00 2001 From: Werner Dijkerman Date: Tue, 30 Apr 2019 19:17:56 +0200 Subject: [PATCH] Added Molecule test for the Elasticsearch role --- .circleci/config.yml | 5 +- .travis.yml | 2 + Pipfile | 1 + molecule/default/prepare.yml | 10 ++++ molecule/elasticsearch/Dockerfile.j2 | 14 +++++ molecule/elasticsearch/INSTALL.rst | 22 +++++++ molecule/elasticsearch/molecule.yml | 59 +++++++++++++++++++ molecule/elasticsearch/playbook.yml | 6 ++ molecule/elasticsearch/tests/test_default.py | 19 ++++++ .../ansible-elasticsearch/tasks/Debian.yml | 16 ++++- .../ansible-elasticsearch/tasks/RMDebian.yml | 1 + .../ansible-elasticsearch/tasks/RMRedHat.yml | 1 + .../ansible-elasticsearch/tasks/RedHat.yml | 4 ++ .../ansible-elasticsearch/tasks/main.yml | 9 ++- 14 files changed, 163 insertions(+), 6 deletions(-) create mode 100644 molecule/elasticsearch/Dockerfile.j2 create mode 100644 molecule/elasticsearch/INSTALL.rst create mode 100644 molecule/elasticsearch/molecule.yml create mode 100644 molecule/elasticsearch/playbook.yml create mode 100644 molecule/elasticsearch/tests/test_default.py diff --git a/.circleci/config.yml b/.circleci/config.yml index 08b3ff16..d665e8e6 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,3 +1,4 @@ +--- version: 2 jobs: test: @@ -6,7 +7,7 @@ jobs: version: 2.7 services: - docker - working_directory: ~/wazuh-ansible + working_directory: ~/wazuh-ansible steps: - checkout - run: @@ -22,4 +23,4 @@ workflows: version: 2 test_molecule: jobs: - - test \ No newline at end of file + - test diff --git a/.travis.yml b/.travis.yml index 97c0427b..937de0ab 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,3 +1,4 @@ +--- language: python services: docker before_script: @@ -6,3 +7,4 @@ before_script: script: - pipenv run test - pipenv run agent + - pipenv run elasticsearch diff --git a/Pipfile b/Pipfile index 2bc7a896..bf6931c6 100644 --- a/Pipfile +++ b/Pipfile @@ -16,3 +16,4 @@ python_version = "2.7" [scripts] test ="molecule test" agent ="molecule test -s wazuh-agent" +elasticsearch ="molecule test -s elasticsearch" diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml index 1aa45e29..f3dc9aac 100644 --- a/molecule/default/prepare.yml +++ b/molecule/default/prepare.yml @@ -24,3 +24,13 @@ state: latest register: wazuh_manager_dependencies_packages_installed until: wazuh_manager_dependencies_packages_installed is succeeded + + - name: "Install (RedHat) dependencies" + package: + name: + - initscripts + state: latest + register: wazuh_manager_dependencies_packages_installed + until: wazuh_manager_dependencies_packages_installed is succeeded + when: + - ansible_os_family == 'RedHat' diff --git a/molecule/elasticsearch/Dockerfile.j2 b/molecule/elasticsearch/Dockerfile.j2 new file mode 100644 index 00000000..e6aa95d3 --- /dev/null +++ b/molecule/elasticsearch/Dockerfile.j2 @@ -0,0 +1,14 @@ +# Molecule managed + +{% if item.registry is defined %} +FROM {{ item.registry.url }}/{{ item.image }} +{% else %} +FROM {{ item.image }} +{% endif %} + +RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \ + elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \ + elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \ + elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \ + elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \ + elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi diff --git a/molecule/elasticsearch/INSTALL.rst b/molecule/elasticsearch/INSTALL.rst new file mode 100644 index 00000000..6a44bde9 --- /dev/null +++ b/molecule/elasticsearch/INSTALL.rst @@ -0,0 +1,22 @@ +******* +Docker driver installation guide +******* + +Requirements +============ + +* Docker Engine + +Install +======= + +Please refer to the `Virtual environment`_ documentation for installation best +practices. If not using a virtual environment, please consider passing the +widely recommended `'--user' flag`_ when invoking ``pip``. + +.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ +.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site + +.. code-block:: bash + + $ pip install 'molecule[docker]' diff --git a/molecule/elasticsearch/molecule.yml b/molecule/elasticsearch/molecule.yml new file mode 100644 index 00000000..f673f502 --- /dev/null +++ b/molecule/elasticsearch/molecule.yml @@ -0,0 +1,59 @@ +--- +dependency: + name: galaxy +driver: + name: docker +lint: + name: yamllint +platforms: + - name: bionic + image: solita/ubuntu-systemd:bionic + command: /sbin/init + ulimits: + - nofile:262144:262144 + privileged: True + memory_reservation: 1024m + - name: xenial + image: solita/ubuntu-systemd:xenial + privileged: true + memory_reservation: 1024m + command: /sbin/init + ulimits: + - nofile:262144:262144 + - name: trusty + image: ubuntu:trusty + memory_reservation: 1024m + ulimits: + - nofile:262144:262144 + - name: centos6 + image: centos:6 + privileged: true + memory_reservation: 1024m + ulimits: + - nofile:262144:262144 + - name: centos7 + image: milcom/centos7-systemd + memory_reservation: 1024m + privileged: true + ulimits: + - nofile:262144:262144 +provisioner: + name: ansible + playbooks: + docker: + create: ../default/create.yml + destroy: ../default/destroy.yml + prepare: ../default/prepare.yml + env: + ANSIBLE_ROLES_PATH: ../../roles + lint: + name: ansible-lint + enabled: true + inventory: + group_vars: + all: + elasticsearch_jvm_xms: 512 +verifier: + name: testinfra + lint: + name: flake8 diff --git a/molecule/elasticsearch/playbook.yml b/molecule/elasticsearch/playbook.yml new file mode 100644 index 00000000..f6bf45f9 --- /dev/null +++ b/molecule/elasticsearch/playbook.yml @@ -0,0 +1,6 @@ +--- +- name: Converge + hosts: all + roles: + - role: elastic-stack/ansible-elasticsearch + elasticsearch_network_host: 'localhost' diff --git a/molecule/elasticsearch/tests/test_default.py b/molecule/elasticsearch/tests/test_default.py new file mode 100644 index 00000000..f25c299d --- /dev/null +++ b/molecule/elasticsearch/tests/test_default.py @@ -0,0 +1,19 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_elasticsearch_is_installed(host): + elasticsearch = host.package("elasticsearch") + assert elasticsearch.is_installed + assert elasticsearch.version.startswith('6.7.1') + + +def test_elasticsearch_is_running(host): + """Test if the services are enabled and running.""" + elasticsearch = host.service("elasticsearch") + assert elasticsearch.is_enabled + assert elasticsearch.is_running diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml index f786d2a3..f8baac55 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml @@ -1,13 +1,25 @@ --- - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates apt: - name: ['apt-transport-https', 'ca-certificates'] + name: + - apt-transport-https + - ca-certificates state: present + register: elasticsearch_ca_packages_installed + until: elasticsearch_ca_packages_installed is succeeded + +- name: "Install Java Repo for Trusty" + apt_repository: repo='ppa:openjdk-r/ppa' + when: + - ansible_distribution == "Ubuntu" + - ansible_distribution_major_version | int == 14 - when: elasticsearch_install_java block: - name: Debian/Ubuntu | Install OpenJDK 1.8 apt: name=openjdk-8-jre state=present cache_valid_time=3600 + register: elasticsearch_jre_packages_installed + until: elasticsearch_jre_packages_installed is succeeded tags: install - name: Debian/Ubuntu | Add Elasticsearch GPG key. @@ -27,4 +39,6 @@ name: "elasticsearch={{ elastic_stack_version }}" state: present cache_valid_time: 3600 + register: elasticsearch_main_packages_installed + until: elasticsearch_main_packages_installed is succeeded tags: install diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/RMDebian.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/RMDebian.yml index 74c59c37..cf229655 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/RMDebian.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/RMDebian.yml @@ -3,3 +3,4 @@ apt_repository: repo: deb https://artifacts.elastic.co/packages/5.x/apt stable main state: absent + changed_when: false diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/RMRedHat.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/RMRedHat.yml index 8f99b1e5..bdf667bc 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/RMRedHat.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/RMRedHat.yml @@ -3,3 +3,4 @@ yum_repository: name: elastic_repo state: absent + changed_when: false diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/RedHat.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/RedHat.yml index 79632b31..4c25c31b 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/RedHat.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/RedHat.yml @@ -4,6 +4,7 @@ - name: RedHat/CentOS/Fedora | Install OpenJDK 1.8 yum: name=java-1.8.0-openjdk state=present register: oracle_java_task_rpm_installed + until: oracle_java_task_rpm_installed is succeeded tags: install - name: RedHat/CentOS/Fedora | Install Elastic repo @@ -13,8 +14,11 @@ baseurl: https://artifacts.elastic.co/packages/6.x/yum gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch gpgcheck: true + changed_when: false - name: RedHat/CentOS/Fedora | Install Elasticsarch package: name=elasticsearch-{{ elastic_stack_version }} state=present + register: elasticsearch_main_packages_installed + until: elasticsearch_main_packages_installed is succeeded when: not elasticsearch_install_java or oracle_java_task_rpm_installed is defined tags: install diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml index a1f44f88..f0d88581 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml @@ -76,9 +76,9 @@ - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA") - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<')) - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<')) + - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<')) - name: Ensure Elasticsearch started and enabled - ignore_errors: true service: name: elasticsearch enabled: true @@ -92,19 +92,22 @@ - name: Check for Wazuh Alerts template uri: - url: "http://{{elasticsearch_network_host}}:{{elasticsearch_http_port}}/_template/wazuh" + url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh" method: GET status_code: 200, 404 register: wazuh_alerts_template_exits + until: wazuh_alerts_template_exits is succeeded tags: init - name: Installing Wazuh Alerts template uri: - url: "http://{{elasticsearch_network_host}}:{{elasticsearch_http_port}}/_template/wazuh" + url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh" method: PUT status_code: 200 body_format: json body: "{{ lookup('template','wazuh-elastic6-template-alerts.json.j2') }}" + register: installing_wazuh_template + until: installing_wazuh_template is succeeded when: wazuh_alerts_template_exits.status != 200 tags: init