Skip to content

Commit 8a32600

Browse files
jackhodgkissjackhodgkiss
committed
feat: add test for OpenBao high availability
1 parent e31772e commit 8a32600

File tree

4 files changed

+184
-0
lines changed

4 files changed

+184
-0
lines changed

‎.ansible-lint‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@ skip_list:
88
- meta-no-info
99
warn_list:
1010
- yaml[line-length]
11+
- run-once[task]

‎.github/workflows/pull_request.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ jobs:
2424
ansible_version: "2.18"
2525
type:
2626
- openbao
27+
- openbao_ha
2728
- vault
2829
steps:
2930
- name: Github Checkout 🛎

‎tests/inventory‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,8 @@ localhost ansible_connection=local
33

44
[openbao]
55
localhost ansible_connection=local
6+
7+
[openbao_ha]
8+
raft_01 ansible_connection=local openbao_bind_addr=127.0.0.1 openbao_docker_name=bao_01 openbao_config_dir=/etc/bao_01
9+
raft_02 ansible_connection=local openbao_bind_addr=127.0.0.2 openbao_docker_name=bao_02 openbao_config_dir=/etc/bao_02
10+
raft_03 ansible_connection=local openbao_bind_addr=127.0.0.3 openbao_docker_name=bao_03 openbao_config_dir=/etc/bao_03

‎tests/test_openbao_ha.yml‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
---
2+
- name: Deploy HA OpenBao
3+
gather_facts: true
4+
hosts: openbao_ha
5+
vars:
6+
openbao_log_keys: true
7+
openbao_api_addr: "{{ 'http' ~ '://' ~ openbao_bind_addr ~ ':8200' }}"
8+
openbao_set_keys_fact: true
9+
openbao_write_keys_file: true
10+
_openbao_default_volumes:
11+
- "{{ openbao_config_dir }}/config:/openbao/config"
12+
- "{{ openbao_config_dir }}/openbao_file:/openbao/file"
13+
- "{{ openbao_config_dir }}/openbao_logs:/openbao/logs"
14+
tasks:
15+
- name: Debug
16+
ansible.builtin.debug:
17+
var: openbao_api_addr
18+
19+
- name: Ensure /etc/openbao exists
20+
ansible.builtin.file:
21+
path: /etc/openbao
22+
state: directory
23+
mode: "0700"
24+
become: true
25+
26+
- name: Include openbao role
27+
ansible.builtin.include_role:
28+
name: openbao
29+
30+
- name: Include openbao role (idemoptence test)
31+
ansible.builtin.include_role:
32+
name: openbao
33+
34+
# As this test is evaluating OpenBao configured for high availability backed
35+
# by `Raft` we must first ensure that the primary or leader instance is unsealed
36+
# before attempting to unseal the other members.
37+
- name: Unseal vault
38+
ansible.builtin.include_role:
39+
name: vault_unseal
40+
vars:
41+
vault_api_addr: "{{ openbao_api_addr }}"
42+
vault_unseal_keys: "{{ openbao_keys.keys_base64 }}"
43+
run_once: true
44+
45+
# As the first instance is now unsealed the other instances will now need some
46+
# time to connect before we can proceed.
47+
- name: Wait for OpenBao Raft peers to connect
48+
ansible.builtin.wait_for:
49+
timeout: 120
50+
delegate_to: localhost
51+
52+
# Raft peers take few seconds before they report an unsealed state therefore
53+
# we must wait.
54+
- name: Unseal vault
55+
ansible.builtin.include_role:
56+
name: vault_unseal
57+
vars:
58+
vault_api_addr: "{{ openbao_api_addr }}"
59+
vault_unseal_keys: "{{ openbao_keys.keys_base64 }}"
60+
vault_unseal_timeout: 10
61+
62+
- name: Deploy HA OpenBao
63+
gather_facts: true
64+
hosts: openbao_ha
65+
run_once: true
66+
vars:
67+
openbao_log_keys: true
68+
openbao_api_addr: "{{ 'http' ~ '://' ~ openbao_bind_addr ~ ':8200' }}"
69+
openbao_set_keys_fact: true
70+
openbao_write_keys_file: true
71+
tasks:
72+
- name: Include OpenBao keys
73+
ansible.builtin.include_vars:
74+
file: "bao-keys.json"
75+
name: openbao_keys
76+
77+
- name: Configure PKI - create root/intermediate and generate certificates
78+
vars:
79+
vault_pki_certificate_subject:
80+
- role: 'ServerCert'
81+
common_name: "OS-CERT-TEST"
82+
extra_params:
83+
ttl: "8760h"
84+
ip_sans: "127.0.0.1"
85+
alt_names: "example.com"
86+
exclude_cn_from_sans: true
87+
vault_pki_certificates_directory: "/tmp/"
88+
vault_pki_generate_certificates: true
89+
vault_pki_intermediate_ca_name: "OS-TLS-INT"
90+
vault_pki_intermediate_create: true
91+
vault_pki_intermediate_roles:
92+
- name: "ServerCert"
93+
config:
94+
max_ttl: 8760h
95+
ttl: 8760h
96+
allow_any_name: true
97+
allow_ip_sans: true
98+
require_cn: false
99+
server_flag: true
100+
key_type: rsa
101+
key_bits: 4096
102+
country: ["UK"]
103+
locality: ["Bristol"]
104+
organization: ["StackHPC"]
105+
ou: ["HPC"]
106+
vault_pki_root_ca_name: "OS-TLS-ROOT"
107+
vault_pki_root_create: true
108+
vault_pki_write_certificate_files: true
109+
vault_pki_write_int_ca_to_file: true
110+
vault_pki_write_pem_bundle: false
111+
vault_pki_write_root_ca_to_file: true
112+
vault_api_addr: "{{ openbao_api_addr }}"
113+
vault_token: "{{ openbao_keys.root_token }}"
114+
block:
115+
- name: Configure PKI - create root/intermediate and generate certificates
116+
ansible.builtin.include_role:
117+
name: vault_pki
118+
119+
- name: Configure PKI - create root/intermediate and generate certificates (idempotence test)
120+
ansible.builtin.include_role:
121+
name: vault_pki
122+
123+
- name: Configure PKI - generate certificate pem bundle
124+
vars:
125+
vault_pki_certificate_subject:
126+
- role: 'ServerCert'
127+
common_name: "OS-CERT-TEST2"
128+
extra_params:
129+
ttl: "8760h"
130+
ip_sans: "192.168.38.72"
131+
exclude_cn_from_sans: true
132+
vault_pki_certificates_directory: "/tmp/"
133+
vault_pki_generate_certificates: true
134+
vault_pki_intermediate_ca_name: "OS-TLS-INT"
135+
vault_pki_intermediate_create: false
136+
vault_pki_root_ca_name: "OS-TLS-ROOT"
137+
vault_pki_root_create: false
138+
vault_pki_write_certificate_files: true
139+
vault_pki_write_pem_bundle: true
140+
vault_api_addr: "{{ openbao_api_addr }}"
141+
vault_token: "{{ openbao_keys.root_token }}"
142+
block:
143+
- name: Configure PKI - generate certificate pem bundle
144+
ansible.builtin.include_role:
145+
name: vault_pki
146+
147+
- name: Configure PKI - generate certificate pem bundle (idempotence test)
148+
ansible.builtin.include_role:
149+
name: vault_pki
150+
151+
- name: Validate if certificates exist
152+
ansible.builtin.stat:
153+
path: "/tmp/{{ item }}"
154+
register: stat_result
155+
failed_when: not stat_result.stat.exists
156+
loop:
157+
- OS-CERT-TEST.crt
158+
- OS-CERT-TEST2.pem
159+
160+
- name: Concatenate CAs
161+
ansible.builtin.shell: |
162+
cat /tmp/OS-TLS-ROOT.pem /tmp/OS-TLS-INT.crt > /tmp/CA-CHAIN.pem
163+
args:
164+
executable: /bin/bash
165+
become: true
166+
changed_when: true
167+
168+
- name: Verify certificate chain
169+
ansible.builtin.command: |
170+
openssl verify -CAfile /tmp/CA-CHAIN.pem
171+
/tmp/{{ item }}
172+
register: verify_result
173+
failed_when: verify_result.rc != 0
174+
loop:
175+
- OS-CERT-TEST.crt
176+
- OS-CERT-TEST2.pem
177+
changed_when: false

0 commit comments

Comments
 (0)