Skip to content

Commit a643385

Browse files
myiimyii
committed
refactor(map): use top-level values: key in map.jinja dumps
* Semi-automated using myii/ssf-formula#284
1 parent 63e82c4 commit a643385

File tree

17 files changed

+955
-898
lines changed

17 files changed

+955
-898
lines changed

‎sudoers/_mapdata/_mapdata.jinja‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# yamllint disable rule:indentation rule:line-length
2-
# {{ grains.get('osfinger', grains.os) }}
2+
# {{ grains.get("osfinger", grains.os) }}
33
---
44
{#- use salt.slsutil.serialize to avoid encoding errors on some platforms #}
5-
{{ salt['slsutil.serialize'](
6-
'yaml',
5+
{{ salt["slsutil.serialize"](
6+
"yaml",
77
map,
88
default_flow_style=False,
99
allow_unicode=True,

‎sudoers/_mapdata/init.sls‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,23 @@
22
# vim: ft=sls
33
---
44
{#- Get the `tplroot` from `tpldir` #}
5-
{%- set tplroot = tpldir.split('/')[0] %}
6-
{%- from tplroot ~ "/map.jinja" import sudoers as mapdata with context %}
5+
{%- set tplroot = tpldir.split("/")[0] %}
6+
{%- from tplroot ~ "/map.jinja" import sudoers with context %}
77
8-
{%- do salt['log.debug']('### MAP.JINJA DUMP ###\n' ~ mapdata | yaml(False)) %}
8+
{%- set _mapdata = {
9+
"values": {
10+
"sudoers": sudoers,
11+
}
12+
} %}
13+
{%- do salt["log.debug"]("### MAP.JINJA DUMP ###\n" ~ _mapdata | yaml(False)) %}
914
10-
{%- set output_dir = '/temp' if grains.os_family == 'Windows' else '/tmp' %}
11-
{%- set output_file = output_dir ~ '/salt_mapdata_dump.yaml' %}
15+
{%- set output_dir = "/temp" if grains.os_family == "Windows" else "/tmp" %}
16+
{%- set output_file = output_dir ~ "/salt_mapdata_dump.yaml" %}
1217
1318
{{ tplroot }}-mapdata-dump:
1419
file.managed:
1520
- name: {{ output_file }}
1621
- source: salt://{{ tplroot }}/_mapdata/_mapdata.jinja
1722
- template: jinja
1823
- context:
19-
map: {{ mapdata | yaml }}
24+
map: {{ _mapdata | yaml }}

‎test/integration/default/controls/_mapdata_spec.rb‎

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,43 @@
55
control '`map.jinja` YAML dump' do
66
title 'should match the comparison file'
77

8-
# Strip the `platform[:finger]` version number down to the "OS major release"
9-
mapdata_file = "_mapdata/#{system.platform[:finger].split('.').first}.yaml"
8+
### Method
9+
# The steps below for each file appear convoluted but they are both required
10+
# and similar in nature:
11+
# 1. The earliest method was to simply compare the files textually but this often
12+
# led to false positives due to inconsistencies (e.g. spacing, ordering)
13+
# 2. The next method was to load the files back into YAML structures and then
14+
# compare but InSpec provided block diffs this way, unusable by end users
15+
# 3. The final step was to dump the YAML structures back into a string to use
16+
# for the comparison; this both worked and provided human-friendly diffs
1017

11-
# Load the mapdata from profile https://docs.chef.io/inspec/profiles/#profile-files
12-
mapdata_dump = YAML.safe_load(inspec.profile.file(mapdata_file))
18+
### Comparison file for the specific platform
19+
### Static, adjusted as part of code contributions, as map data is changed
20+
# Strip the `platform[:finger]` version number down to the "OS major release"
21+
platform_finger = system.platform[:finger].split('.').first.to_s
22+
# Use that to set the path to the file (relative to the InSpec suite directory)
23+
mapdata_file_path = "_mapdata/#{platform_finger}.yaml"
24+
# Load the mapdata from profile, into a YAML structure
25+
# https://docs.chef.io/inspec/profiles/#profile-files
26+
mapdata_file_yaml = YAML.safe_load(inspec.profile.file(mapdata_file_path))
27+
# Dump the YAML back into a string for comparison
28+
mapdata_file_dump = YAML.dump(mapdata_file_yaml)
1329

14-
# Derive the location of the dumped mapdata
30+
### Output file produced by running the `_mapdata` state
31+
### Dynamic, generated during Kitchen's `converge` phase
32+
# Derive the location of the dumped mapdata (differs for Windows)
1533
output_dir = platform[:family] == 'windows' ? '/temp' : '/tmp'
16-
output_file = "#{output_dir}/salt_mapdata_dump.yaml"
34+
# Use that to set the path to the file (absolute path, i.e. within the container)
35+
output_file_path = "#{output_dir}/salt_mapdata_dump.yaml"
36+
# Load the output into a YAML structure using InSpec's `yaml` resource
37+
# https://github.com/inspec/inspec/blob/49b7d10/lib/inspec/resources/yaml.rb#L29
38+
output_file_yaml = yaml(output_file_path).params
39+
# Dump the YAML back into a string for comparison
40+
output_file_dump = YAML.dump(output_file_yaml)
1741

1842
describe 'File content' do
1943
it 'should match profile map data exactly' do
20-
expect(yaml(output_file).params).to eq(mapdata_dump)
44+
expect(output_file_dump).to eq(mapdata_file_dump)
2145
end
2246
end
2347
end

‎test/integration/default/files/_mapdata/amazonlinux-1.yaml‎

Lines changed: 65 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,71 @@
11
# yamllint disable rule:indentation rule:line-length
22
# Amazon Linux AMI-2018
33
---
4-
aliases:
5-
commands:
6-
PROCESSES:
7-
- /usr/bin/nice
8-
- /bin/kill
9-
- /usr/bin/renice
10-
- /usr/bin/pkill
11-
- /usr/bin/top
12-
hosts:
13-
WEBSERVERS:
14-
- www1
15-
- www2
16-
- www3
17-
users:
18-
ADMINS:
19-
- millert
20-
- dowdy
21-
- mikef
22-
arch: amd64
23-
configpath: /etc
24-
defaults:
25-
command_list:
26-
PROCESSES: noexec
27-
generic:
28-
- env_reset
29-
- mail_badpass
30-
- secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
31-
host_list:
32-
www1: log_year, logfile=/var/log/sudo.log
33-
runas_list:
34-
root: '!set_logname'
35-
user_list:
36-
ADMINS: '!lecture'
37-
johndoe: '!requiretty'
38-
execprefix: /usr/sbin
39-
group: root
40-
groups:
41-
sudo:
42-
- ALL=(ALL) ALL
43-
- 'ALL=(nodejs) NOPASSWD: ALL'
44-
included_files:
45-
/etc/sudoers.d/extra-file:
46-
users:
47-
foo:
48-
- ALL=(ALL) ALL
49-
extra-file-2:
4+
values:
5+
sudoers:
6+
aliases:
7+
commands:
8+
PROCESSES:
9+
- /usr/bin/nice
10+
- /bin/kill
11+
- /usr/bin/renice
12+
- /usr/bin/pkill
13+
- /usr/bin/top
14+
hosts:
15+
WEBSERVERS:
16+
- www1
17+
- www2
18+
- www3
19+
users:
20+
ADMINS:
21+
- millert
22+
- dowdy
23+
- mikef
24+
arch: amd64
25+
configpath: /etc
26+
defaults:
27+
command_list:
28+
PROCESSES: noexec
29+
generic:
30+
- env_reset
31+
- mail_badpass
32+
- secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
33+
host_list:
34+
www1: log_year, logfile=/var/log/sudo.log
35+
runas_list:
36+
root: '!set_logname'
37+
user_list:
38+
ADMINS: '!lecture'
39+
johndoe: '!requiretty'
40+
execprefix: /usr/sbin
41+
group: root
5042
groups:
51-
bargroup:
52-
- 'ALL=(ALL) NOPASSWD: ALL'
53-
extra-file-3:
43+
sudo:
44+
- ALL=(ALL) ALL
45+
- 'ALL=(nodejs) NOPASSWD: ALL'
46+
included_files:
47+
/etc/sudoers.d/extra-file:
48+
users:
49+
foo:
50+
- ALL=(ALL) ALL
51+
extra-file-2:
52+
groups:
53+
bargroup:
54+
- 'ALL=(ALL) NOPASSWD: ALL'
55+
extra-file-3:
56+
netgroups:
57+
other_netgroup:
58+
- ALL=(ALL) ALL
59+
includedir: /etc/sudoers.d
60+
manage_main_config: true
5461
netgroups:
55-
other_netgroup:
62+
sysadmins:
63+
- ALL=(ALL) ALL
64+
pkg: sudo
65+
purge_includedir: false
66+
users:
67+
johndoe:
5668
- ALL=(ALL) ALL
57-
includedir: /etc/sudoers.d
58-
manage_main_config: true
59-
netgroups:
60-
sysadmins:
61-
- ALL=(ALL) ALL
62-
pkg: sudo
63-
purge_includedir: false
64-
users:
65-
johndoe:
66-
- ALL=(ALL) ALL
67-
- 'ALL=(root) NOPASSWD: /etc/init.d/httpd'
68-
kitchen:
69-
- 'ALL=(root) NOPASSWD: ALL'
69+
- 'ALL=(root) NOPASSWD: /etc/init.d/httpd'
70+
kitchen:
71+
- 'ALL=(root) NOPASSWD: ALL'

‎test/integration/default/files/_mapdata/amazonlinux-2.yaml‎

Lines changed: 65 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,71 @@
11
# yamllint disable rule:indentation rule:line-length
22
# Amazon Linux-2
33
---
4-
aliases:
5-
commands:
6-
PROCESSES:
7-
- /usr/bin/nice
8-
- /bin/kill
9-
- /usr/bin/renice
10-
- /usr/bin/pkill
11-
- /usr/bin/top
12-
hosts:
13-
WEBSERVERS:
14-
- www1
15-
- www2
16-
- www3
17-
users:
18-
ADMINS:
19-
- millert
20-
- dowdy
21-
- mikef
22-
arch: amd64
23-
configpath: /etc
24-
defaults:
25-
command_list:
26-
PROCESSES: noexec
27-
generic:
28-
- env_reset
29-
- mail_badpass
30-
- secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
31-
host_list:
32-
www1: log_year, logfile=/var/log/sudo.log
33-
runas_list:
34-
root: '!set_logname'
35-
user_list:
36-
ADMINS: '!lecture'
37-
johndoe: '!requiretty'
38-
execprefix: /usr/sbin
39-
group: root
40-
groups:
41-
sudo:
42-
- ALL=(ALL) ALL
43-
- 'ALL=(nodejs) NOPASSWD: ALL'
44-
included_files:
45-
/etc/sudoers.d/extra-file:
46-
users:
47-
foo:
48-
- ALL=(ALL) ALL
49-
extra-file-2:
4+
values:
5+
sudoers:
6+
aliases:
7+
commands:
8+
PROCESSES:
9+
- /usr/bin/nice
10+
- /bin/kill
11+
- /usr/bin/renice
12+
- /usr/bin/pkill
13+
- /usr/bin/top
14+
hosts:
15+
WEBSERVERS:
16+
- www1
17+
- www2
18+
- www3
19+
users:
20+
ADMINS:
21+
- millert
22+
- dowdy
23+
- mikef
24+
arch: amd64
25+
configpath: /etc
26+
defaults:
27+
command_list:
28+
PROCESSES: noexec
29+
generic:
30+
- env_reset
31+
- mail_badpass
32+
- secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
33+
host_list:
34+
www1: log_year, logfile=/var/log/sudo.log
35+
runas_list:
36+
root: '!set_logname'
37+
user_list:
38+
ADMINS: '!lecture'
39+
johndoe: '!requiretty'
40+
execprefix: /usr/sbin
41+
group: root
5042
groups:
51-
bargroup:
52-
- 'ALL=(ALL) NOPASSWD: ALL'
53-
extra-file-3:
43+
sudo:
44+
- ALL=(ALL) ALL
45+
- 'ALL=(nodejs) NOPASSWD: ALL'
46+
included_files:
47+
/etc/sudoers.d/extra-file:
48+
users:
49+
foo:
50+
- ALL=(ALL) ALL
51+
extra-file-2:
52+
groups:
53+
bargroup:
54+
- 'ALL=(ALL) NOPASSWD: ALL'
55+
extra-file-3:
56+
netgroups:
57+
other_netgroup:
58+
- ALL=(ALL) ALL
59+
includedir: /etc/sudoers.d
60+
manage_main_config: true
5461
netgroups:
55-
other_netgroup:
62+
sysadmins:
63+
- ALL=(ALL) ALL
64+
pkg: sudo
65+
purge_includedir: false
66+
users:
67+
johndoe:
5668
- ALL=(ALL) ALL
57-
includedir: /etc/sudoers.d
58-
manage_main_config: true
59-
netgroups:
60-
sysadmins:
61-
- ALL=(ALL) ALL
62-
pkg: sudo
63-
purge_includedir: false
64-
users:
65-
johndoe:
66-
- ALL=(ALL) ALL
67-
- 'ALL=(root) NOPASSWD: /etc/init.d/httpd'
68-
kitchen:
69-
- 'ALL=(root) NOPASSWD: ALL'
69+
- 'ALL=(root) NOPASSWD: /etc/init.d/httpd'
70+
kitchen:
71+
- 'ALL=(root) NOPASSWD: ALL'

0 commit comments

Comments
 (0)