Skip to content

Commit 47bc38a

Browse files
jackhodgkissjackhodgkiss
committed
feat: add test for OpenBao high availability
1 parent e31772e commit 47bc38a

File tree

4 files changed

+180
-0
lines changed

4 files changed

+180
-0
lines changed

‎.ansible-lint‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@ skip_list:
88
- meta-no-info
99
warn_list:
1010
- yaml[line-length]
11+
- run-once[task]

‎.github/workflows/pull_request.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ jobs:
2424
ansible_version: "2.18"
2525
type:
2626
- openbao
27+
- openbao_ha
2728
- vault
2829
steps:
2930
- name: Github Checkout 🛎

‎tests/inventory‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,8 @@ localhost ansible_connection=local
33

44
[openbao]
55
localhost ansible_connection=local
6+
7+
[openbao_ha]
8+
raft_01 ansible_connection=local openbao_bind_addr=127.0.0.1 openbao_docker_name=bao_01 openbao_config_dir=/etc/bao_01
9+
raft_02 ansible_connection=local openbao_bind_addr=127.0.0.2 openbao_docker_name=bao_02 openbao_config_dir=/etc/bao_02
10+
raft_03 ansible_connection=local openbao_bind_addr=127.0.0.3 openbao_docker_name=bao_03 openbao_config_dir=/etc/bao_03

‎tests/test_openbao_ha.yml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
---
2+
- name: Deploy HA OpenBao
3+
gather_facts: true
4+
hosts: openbao_ha
5+
vars:
6+
openbao_log_keys: true
7+
openbao_api_addr: "{{ 'http' ~ '://' ~ openbao_bind_addr ~ ':8200' }}"
8+
openbao_set_keys_fact: true
9+
openbao_write_keys_file: true
10+
tasks:
11+
- name: Debug
12+
ansible.builtin.debug:
13+
var: openbao_api_addr
14+
15+
- name: Ensure /etc/openbao exists
16+
ansible.builtin.file:
17+
path: /etc/openbao
18+
state: directory
19+
mode: "0700"
20+
become: true
21+
22+
- name: Include openbao role
23+
ansible.builtin.include_role:
24+
name: openbao
25+
26+
- name: Include openbao role (idemoptence test)
27+
ansible.builtin.include_role:
28+
name: openbao
29+
30+
# As this test is evaluating OpenBao configured for high availability backed
31+
# by `Raft` we must first ensure that the primary or leader instance is unsealed
32+
# before attempting to unseal the other members.
33+
- name: Unseal vault
34+
ansible.builtin.include_role:
35+
name: vault_unseal
36+
vars:
37+
vault_api_addr: "{{ openbao_api_addr }}"
38+
vault_unseal_keys: "{{ openbao_keys.keys_base64 }}"
39+
run_once: true
40+
41+
# As the first instance is now unsealed the other instances will now need some
42+
# time to connect before we can proceed.
43+
- name: Wait for OpenBao Raft peers to connect
44+
ansible.builtin.wait_for:
45+
timeout: 30
46+
delegate_to: localhost
47+
48+
# Raft peers take few seconds before they report an unsealed state therefore
49+
# we must wait.
50+
- name: Unseal vault
51+
ansible.builtin.include_role:
52+
name: vault_unseal
53+
vars:
54+
vault_api_addr: "{{ openbao_api_addr }}"
55+
vault_unseal_keys: "{{ openbao_keys.keys_base64 }}"
56+
vault_unseal_timeout: 10
57+
58+
- name: Deploy HA OpenBao
59+
gather_facts: true
60+
hosts: openbao_ha
61+
run_once: true
62+
vars:
63+
openbao_log_keys: true
64+
openbao_api_addr: "{{ 'http' ~ '://' ~ openbao_bind_addr ~ ':8200' }}"
65+
openbao_set_keys_fact: true
66+
openbao_write_keys_file: true
67+
tasks:
68+
- name: Include OpenBao keys
69+
ansible.builtin.include_vars:
70+
file: "bao-keys.json"
71+
name: openbao_keys
72+
73+
- name: Configure PKI - create root/intermediate and generate certificates
74+
vars:
75+
vault_pki_certificate_subject:
76+
- role: 'ServerCert'
77+
common_name: "OS-CERT-TEST"
78+
extra_params:
79+
ttl: "8760h"
80+
ip_sans: "127.0.0.1"
81+
alt_names: "example.com"
82+
exclude_cn_from_sans: true
83+
vault_pki_certificates_directory: "/tmp/"
84+
vault_pki_generate_certificates: true
85+
vault_pki_intermediate_ca_name: "OS-TLS-INT"
86+
vault_pki_intermediate_create: true
87+
vault_pki_intermediate_roles:
88+
- name: "ServerCert"
89+
config:
90+
max_ttl: 8760h
91+
ttl: 8760h
92+
allow_any_name: true
93+
allow_ip_sans: true
94+
require_cn: false
95+
server_flag: true
96+
key_type: rsa
97+
key_bits: 4096
98+
country: ["UK"]
99+
locality: ["Bristol"]
100+
organization: ["StackHPC"]
101+
ou: ["HPC"]
102+
vault_pki_root_ca_name: "OS-TLS-ROOT"
103+
vault_pki_root_create: true
104+
vault_pki_write_certificate_files: true
105+
vault_pki_write_int_ca_to_file: true
106+
vault_pki_write_pem_bundle: false
107+
vault_pki_write_root_ca_to_file: true
108+
vault_api_addr: "{{ openbao_api_addr }}"
109+
vault_token: "{{ openbao_keys.root_token }}"
110+
block:
111+
- name: Configure PKI - create root/intermediate and generate certificates
112+
ansible.builtin.include_role:
113+
name: vault_pki
114+
115+
- name: Configure PKI - create root/intermediate and generate certificates (idempotence test)
116+
ansible.builtin.include_role:
117+
name: vault_pki
118+
119+
- name: Configure PKI - generate certificate pem bundle
120+
vars:
121+
vault_pki_certificate_subject:
122+
- role: 'ServerCert'
123+
common_name: "OS-CERT-TEST2"
124+
extra_params:
125+
ttl: "8760h"
126+
ip_sans: "192.168.38.72"
127+
exclude_cn_from_sans: true
128+
vault_pki_certificates_directory: "/tmp/"
129+
vault_pki_generate_certificates: true
130+
vault_pki_intermediate_ca_name: "OS-TLS-INT"
131+
vault_pki_intermediate_create: false
132+
vault_pki_root_ca_name: "OS-TLS-ROOT"
133+
vault_pki_root_create: false
134+
vault_pki_write_certificate_files: true
135+
vault_pki_write_pem_bundle: true
136+
vault_api_addr: "{{ openbao_api_addr }}"
137+
vault_token: "{{ openbao_keys.root_token }}"
138+
block:
139+
- name: Configure PKI - generate certificate pem bundle
140+
ansible.builtin.include_role:
141+
name: vault_pki
142+
143+
- name: Configure PKI - generate certificate pem bundle (idempotence test)
144+
ansible.builtin.include_role:
145+
name: vault_pki
146+
147+
- name: Validate if certificates exist
148+
ansible.builtin.stat:
149+
path: "/tmp/{{ item }}"
150+
register: stat_result
151+
failed_when: not stat_result.stat.exists
152+
loop:
153+
- OS-CERT-TEST.crt
154+
- OS-CERT-TEST2.pem
155+
156+
- name: Concatenate CAs
157+
ansible.builtin.shell: |
158+
cat /tmp/OS-TLS-ROOT.pem /tmp/OS-TLS-INT.crt > /tmp/CA-CHAIN.pem
159+
args:
160+
executable: /bin/bash
161+
become: true
162+
changed_when: true
163+
164+
- name: Verify certificate chain
165+
ansible.builtin.command: |
166+
openssl verify -CAfile /tmp/CA-CHAIN.pem
167+
/tmp/{{ item }}
168+
register: verify_result
169+
failed_when: verify_result.rc != 0
170+
loop:
171+
- OS-CERT-TEST.crt
172+
- OS-CERT-TEST2.pem
173+
changed_when: false

0 commit comments

Comments
 (0)