Skip to content

Commit 449acb8

Browse files
ehelmsevgeni
ehelms
authored and
evgeni
committed
Add support for cleaning up mosquitto when switching to SSH
1 parent ce271fa commit 449acb8

File tree

5 files changed

+255
-68
lines changed

5 files changed

+255
-68
lines changed

‎manifests/plugin/remote_execution/mosquitto.pp‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,16 @@
1212
#
1313
# === Advanced parameters:
1414
#
15+
# $ensure:: Enable or disable mosquitto configuration and presence
16+
#
1517
# $port:: Port mosquitto will run on
1618
#
1719
# $require_certificate:: When true the client must provide a valid certificate in order to connect successfully
1820
#
1921
# $use_identity_as_username:: Use the CN value from the client certificate as a username
2022
#
2123
class foreman_proxy::plugin::remote_execution::mosquitto (
24+
Enum['absent', 'present'] $ensure = 'present',
2225
Stdlib::Port $port = 1883,
2326
Stdlib::Absolutepath $ssl_ca = undef,
2427
Stdlib::Absolutepath $ssl_cert = undef,
@@ -31,8 +34,11 @@
3134
$broker = $facts['networking']['fqdn']
3235

3336
class { 'mosquitto':
34-
package_name => 'mosquitto',
35-
config => [
37+
package_name => 'mosquitto',
38+
package_ensure => $ensure,
39+
service_ensure => bool2str($ensure == 'present', 'running', 'stopped'),
40+
service_enable => $ensure == 'present',
41+
config => [
3642
"listener ${port}",
3743
"acl_file ${mosquitto_config_dir}/foreman.acl",
3844
"cafile ${mosquitto_ssl_dir}/ssl_ca.pem",
@@ -43,16 +49,8 @@
4349
],
4450
}
4551

46-
file { $mosquitto_config_dir:
47-
ensure => directory,
48-
owner => 'root',
49-
group => 'mosquitto',
50-
mode => '0755',
51-
require => Package['mosquitto'],
52-
}
53-
5452
file { "${mosquitto_config_dir}/foreman.acl":
55-
ensure => 'file',
53+
ensure => $ensure,
5654
content => epp(
5755
"${module_name}/plugin/foreman.acl.epp",
5856
{ user => $facts['networking']['fqdn'] }
@@ -63,30 +61,31 @@
6361
}
6462

6563
file { $mosquitto_ssl_dir:
66-
ensure => directory,
64+
ensure => bool2str($ensure == 'present', 'directory', 'absent'),
65+
force => true,
6766
owner => 'root',
6867
group => 'mosquitto',
6968
mode => '0755',
7069
}
7170

7271
file { "${mosquitto_ssl_dir}/ssl_cert.pem":
73-
ensure => 'file',
72+
ensure => $ensure,
7473
source => $ssl_cert,
7574
owner => 'root',
7675
group => 'mosquitto',
7776
mode => '0440',
7877
}
7978

8079
file { "${mosquitto_ssl_dir}/ssl_key.pem":
81-
ensure => 'file',
80+
ensure => $ensure,
8281
source => $ssl_key,
8382
owner => 'root',
8483
group => 'mosquitto',
8584
mode => '0440',
8685
}
8786

8887
file { "${mosquitto_ssl_dir}/ssl_ca.pem":
89-
ensure => 'file',
88+
ensure => $ensure,
9089
source => $ssl_ca,
9190
owner => 'root',
9291
group => 'mosquitto',

‎manifests/plugin/remote_execution/script.pp‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,12 +71,11 @@
7171
}
7272
}
7373

74-
if $mode == 'pull-mqtt' {
75-
class { 'foreman_proxy::plugin::remote_execution::mosquitto':
76-
ssl_ca => $foreman_proxy::ssl_ca,
77-
ssl_cert => $foreman_proxy::ssl_cert,
78-
ssl_key => $foreman_proxy::ssl_key,
79-
}
74+
class { 'foreman_proxy::plugin::remote_execution::mosquitto':
75+
ensure => bool2str($mode == 'pull-mqtt' and $enabled, 'present', 'absent'),
76+
ssl_ca => $foreman_proxy::ssl_ca,
77+
ssl_cert => $foreman_proxy::ssl_cert,
78+
ssl_key => $foreman_proxy::ssl_key,
8079
}
8180

8281
}

‎spec/acceptance/remote_execution_script_pull_mqtt_spec.rb‎

Lines changed: 81 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -3,64 +3,98 @@
33
describe 'Scenario: install foreman-proxy with remote_execution script plugin with pull-mqtt' do
44
before(:context) { purge_installed_packages }
55

6-
include_examples 'the example', 'remote_execution_script_pull_mqtt.pp'
6+
context 'with default params' do
7+
include_examples 'the example', 'remote_execution_script_pull_mqtt.pp'
78

8-
it_behaves_like 'the default foreman proxy application'
9+
it_behaves_like 'the default foreman proxy application'
910

10-
describe port(1883) do
11-
it { is_expected.to be_listening }
12-
end
11+
describe port(1883) do
12+
it { is_expected.to be_listening }
13+
end
1314

14-
describe file('/etc/foreman-proxy/settings.d/remote_execution_ssh.yml') do
15-
it { should be_file }
16-
its(:content) { should match(%r{:mqtt_port: 1883}) }
17-
its(:content) { should match(%r{:mqtt_broker: #{host_inventory['fqdn']}}) }
18-
end
15+
describe file('/etc/foreman-proxy/settings.d/remote_execution_ssh.yml') do
16+
it { should be_file }
17+
its(:content) { should match(%r{:mqtt_port: 1883}) }
18+
its(:content) { should match(%r{:mqtt_broker: #{host_inventory['fqdn']}}) }
19+
end
1920

20-
describe file('/etc/mosquitto/foreman.acl') do
21-
it { should be_file }
22-
its(:content) { should match(%r{pattern read yggdrasil\/%u\/data\/in}) }
23-
its(:content) { should match(%r{pattern write yggdrasil\/%u\/control\/out}) }
24-
its(:content) { should match(%r{user #{host_inventory['fqdn']}}) }
25-
its(:content) { should match(%r{topic write yggdrasil\/\+\/data\/in}) }
26-
its(:content) { should match(%r{topic read yggdrasil\/\+\/control\/out}) }
27-
end
21+
describe file('/etc/mosquitto/foreman.acl') do
22+
it { should be_file }
23+
its(:content) { should match(%r{pattern read yggdrasil\/%u\/data\/in}) }
24+
its(:content) { should match(%r{pattern write yggdrasil\/%u\/control\/out}) }
25+
its(:content) { should match(%r{user #{host_inventory['fqdn']}}) }
26+
its(:content) { should match(%r{topic write yggdrasil\/\+\/data\/in}) }
27+
its(:content) { should match(%r{topic read yggdrasil\/\+\/control\/out}) }
28+
end
2829

29-
describe x509_certificate('/etc/mosquitto/ssl/ssl_cert.pem') do
30-
it { should be_certificate }
31-
it { should be_valid }
32-
end
30+
describe x509_certificate('/etc/mosquitto/ssl/ssl_cert.pem') do
31+
it { should be_certificate }
32+
it { should be_valid }
33+
end
3334

34-
describe file('/etc/mosquitto/ssl/ssl_cert.pem') do
35-
it { should be_file }
36-
it { should be_mode 440 }
37-
it { should be_owned_by 'root' }
38-
it { should be_grouped_into 'mosquitto' }
39-
end
35+
describe file('/etc/mosquitto/ssl/ssl_cert.pem') do
36+
it { should be_file }
37+
it { should be_mode 440 }
38+
it { should be_owned_by 'root' }
39+
it { should be_grouped_into 'mosquitto' }
40+
end
4041

41-
describe x509_private_key('/etc/mosquitto/ssl/ssl_key.pem') do
42-
it { should_not be_encrypted }
43-
it { should be_valid }
44-
it { should have_matching_certificate('/etc/mosquitto/ssl/ssl_cert.pem') }
45-
end
42+
describe x509_private_key('/etc/mosquitto/ssl/ssl_key.pem') do
43+
it { should_not be_encrypted }
44+
it { should be_valid }
45+
it { should have_matching_certificate('/etc/mosquitto/ssl/ssl_cert.pem') }
46+
end
4647

47-
describe file('/etc/mosquitto/ssl/ssl_key.pem') do
48-
it { should be_file }
49-
it { should be_mode 440 }
50-
it { should be_owned_by 'root' }
51-
it { should be_grouped_into 'mosquitto' }
52-
end
48+
describe file('/etc/mosquitto/ssl/ssl_key.pem') do
49+
it { should be_file }
50+
it { should be_mode 440 }
51+
it { should be_owned_by 'root' }
52+
it { should be_grouped_into 'mosquitto' }
53+
end
54+
55+
describe x509_certificate('/etc/mosquitto/ssl/ssl_ca.pem') do
56+
it { should be_certificate }
57+
it { should be_valid }
58+
end
5359

54-
describe x509_certificate('/etc/mosquitto/ssl/ssl_ca.pem') do
55-
it { should be_certificate }
56-
it { should be_valid }
60+
describe file('/etc/mosquitto/ssl/ssl_ca.pem') do
61+
it { should be_file }
62+
it { should be_mode 440 }
63+
it { should be_owned_by 'root' }
64+
it { should be_grouped_into 'mosquitto' }
65+
end
5766
end
5867

59-
describe file('/etc/mosquitto/ssl/ssl_ca.pem') do
60-
it { should be_file }
61-
it { should be_mode 440 }
62-
it { should be_owned_by 'root' }
63-
it { should be_grouped_into 'mosquitto' }
68+
context 'with default mode (SSH) after enabling pull-mqtt' do
69+
include_examples 'the example', 'remote_execution_script.pp'
70+
71+
it_behaves_like 'the default foreman proxy application'
72+
73+
describe port(1883) do
74+
it { is_expected.not_to be_listening }
75+
end
76+
77+
describe file('/etc/foreman-proxy/settings.d/remote_execution_ssh.yml') do
78+
it { should be_file }
79+
its(:content) { should_not match(%r{:mqtt_port: 1883}) }
80+
its(:content) { should_not match(%r{:mqtt_broker: #{host_inventory['fqdn']}}) }
81+
end
82+
83+
describe file('/etc/mosquitto/foreman.acl') do
84+
it { should_not exist }
85+
end
86+
87+
describe file('/etc/mosquitto/ssl/ssl_cert.pem') do
88+
it { should_not exist }
89+
end
90+
91+
describe file('/etc/mosquitto/ssl/ssl_key.pem') do
92+
it { should_not exist }
93+
end
94+
95+
describe file('/etc/mosquitto/ssl/ssl_ca.pem') do
96+
it { should_not exist }
97+
end
6498
end
6599

66100
end

‎spec/classes/foreman_proxy__plugin__remote_execution__mosquitto_spec.rb‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
require 'spec_helper'
2+
3+
describe 'foreman_proxy::plugin::remote_execution::mosquitto' do
4+
on_plugin_os.each do |os, os_facts|
5+
context "on #{os}" do
6+
let(:facts) { os_facts }
7+
let :params do {
8+
:ssl_cert => '/etc/foreman-proxy/ssl_cert.pem',
9+
:ssl_key => '/etc/foreman-proxy/ssl_key.pem',
10+
:ssl_ca => '/etc/foreman-proxy/ssl_ca.pem'
11+
} end
12+
13+
describe 'with default settings' do
14+
it 'should configure mosquitto' do
15+
should contain_class('mosquitto').
16+
with({
17+
:package_name => 'mosquitto',
18+
:package_ensure => 'present',
19+
:service_ensure => 'running',
20+
:service_enable => true,
21+
:config => [
22+
'listener 1883',
23+
'acl_file /etc/mosquitto/foreman.acl',
24+
'cafile /etc/mosquitto/ssl/ssl_ca.pem',
25+
'certfile /etc/mosquitto/ssl/ssl_cert.pem',
26+
'keyfile /etc/mosquitto/ssl/ssl_key.pem',
27+
'require_certificate true',
28+
'use_identity_as_username true'
29+
]
30+
})
31+
end
32+
33+
it 'should configure an ACL file' do
34+
should contain_file('/etc/mosquitto/foreman.acl').
35+
with_content(%r{pattern read yggdrasil/%u/data/in}).
36+
with_content(%r{pattern write yggdrasil/%u/control/out}).
37+
with_content(%r{user #{facts['fqdn']}}).
38+
with_content(%r{topic write yggdrasil/\+/data/in}).
39+
with_content(%r{topic read yggdrasil/\+/control/out}).
40+
with({
41+
:ensure => 'present',
42+
:owner => 'root',
43+
:group => 'mosquitto',
44+
:mode => '0640'
45+
})
46+
end
47+
48+
it 'should configure a SSL directory' do
49+
should contain_file('/etc/mosquitto/ssl').
50+
with({
51+
:ensure => 'directory',
52+
:owner => 'root',
53+
:group => 'mosquitto',
54+
:mode => '0755'
55+
})
56+
end
57+
58+
it 'should configure an ssl_cert' do
59+
should contain_file('/etc/mosquitto/ssl/ssl_cert.pem').
60+
with({
61+
:ensure => 'present',
62+
:source => '/etc/foreman-proxy/ssl_cert.pem',
63+
:owner => 'root',
64+
:group => 'mosquitto',
65+
:mode => '0440'
66+
})
67+
end
68+
69+
it 'should configure an ssl_key' do
70+
should contain_file('/etc/mosquitto/ssl/ssl_key.pem').
71+
with({
72+
:ensure => 'present',
73+
:source => '/etc/foreman-proxy/ssl_key.pem',
74+
:owner => 'root',
75+
:group => 'mosquitto',
76+
:mode => '0440'
77+
})
78+
end
79+
80+
it 'should configure an ssl_ca' do
81+
should contain_file('/etc/mosquitto/ssl/ssl_ca.pem').
82+
with({
83+
:ensure => 'present',
84+
:source => '/etc/foreman-proxy/ssl_ca.pem',
85+
:owner => 'root',
86+
:group => 'mosquitto',
87+
:mode => '0440'
88+
})
89+
end
90+
end
91+
92+
describe '' do
93+
let(:params) { super().merge(:ensure => 'absent') }
94+
95+
it 'should configure mosquitto' do
96+
should contain_class('mosquitto').
97+
with({
98+
:package_ensure => 'absent',
99+
:service_ensure => 'stopped',
100+
:service_enable => false,
101+
})
102+
end
103+
104+
it 'should configure an ACL file' do
105+
should contain_file('/etc/mosquitto/foreman.acl').
106+
with({
107+
:ensure => 'absent',
108+
})
109+
end
110+
111+
it 'should configure a SSL directory' do
112+
should contain_file('/etc/mosquitto/ssl').
113+
with({
114+
:ensure => 'absent',
115+
})
116+
end
117+
118+
it 'should configure an ssl_cert' do
119+
should contain_file('/etc/mosquitto/ssl/ssl_cert.pem').
120+
with({
121+
:ensure => 'absent',
122+
})
123+
end
124+
125+
it 'should configure an ssl_key' do
126+
should contain_file('/etc/mosquitto/ssl/ssl_key.pem').
127+
with({
128+
:ensure => 'absent',
129+
})
130+
end
131+
132+
it 'should configure an ssl_ca' do
133+
should contain_file('/etc/mosquitto/ssl/ssl_ca.pem').
134+
with({
135+
:ensure => 'absent',
136+
})
137+
end
138+
end
139+
end
140+
end
141+
end

0 commit comments

Comments
 (0)