Skip to content

Commit 8fcc54f

Browse files
jackhodgkissjackhodgkiss
committed
feat: add test for OpenBao high availability
1 parent e31772e commit 8fcc54f

File tree

5 files changed

+187
-1
lines changed

5 files changed

+187
-1
lines changed

‎.ansible-lint‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@ skip_list:
88
- meta-no-info
99
warn_list:
1010
- yaml[line-length]
11+
- run-once[task]

‎.github/workflows/pull_request.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ jobs:
2424
ansible_version: "2.18"
2525
type:
2626
- openbao
27+
- openbao_ha
2728
- vault
2829
steps:
2930
- name: Github Checkout 🛎

‎roles/openbao/defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ openbao_config: >
4646
}],
4747
"storage": {
4848
"raft": {
49-
"node_id": "raft_{{ ansible_facts.nodename }}",
49+
"node_id": "raft_{{ inventory_hostname }}",
5050
"path": "/openbao/file",
5151
{% if openbao_raft_leaders | length > 0 %}
5252
"retry_join": {

‎tests/inventory‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,8 @@ localhost ansible_connection=local
33

44
[openbao]
55
localhost ansible_connection=local
6+
7+
[openbao_ha]
8+
raft_01 ansible_connection=local openbao_bind_addr=127.0.0.1 openbao_docker_name=bao_01 openbao_config_dir=/etc/bao_01
9+
raft_02 ansible_connection=local openbao_bind_addr=127.0.0.2 openbao_docker_name=bao_02 openbao_config_dir=/etc/bao_02
10+
raft_03 ansible_connection=local openbao_bind_addr=127.0.0.3 openbao_docker_name=bao_03 openbao_config_dir=/etc/bao_03

‎tests/test_openbao_ha.yml‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
---
2+
- name: Deploy HA OpenBao
3+
gather_facts: true
4+
hosts: openbao_ha
5+
vars:
6+
openbao_log_keys: true
7+
openbao_api_addr: "{{ 'http' ~ '://' ~ openbao_bind_addr ~ ':8200' }}"
8+
openbao_set_keys_fact: true
9+
openbao_write_keys_file: true
10+
openbao_raft_leaders:
11+
- "127.0.0.1"
12+
_openbao_default_volumes:
13+
- "{{ openbao_config_dir }}/config:/openbao/config"
14+
- "{{ openbao_config_dir }}/openbao_file:/openbao/file"
15+
- "{{ openbao_config_dir }}/openbao_logs:/openbao/logs"
16+
tasks:
17+
- name: Debug
18+
ansible.builtin.debug:
19+
var: openbao_api_addr
20+
21+
- name: Ensure /etc/openbao exists
22+
ansible.builtin.file:
23+
path: /etc/openbao
24+
state: directory
25+
mode: "0700"
26+
become: true
27+
28+
- name: Include openbao role
29+
ansible.builtin.include_role:
30+
name: openbao
31+
32+
- name: Include openbao role (idemoptence test)
33+
ansible.builtin.include_role:
34+
name: openbao
35+
36+
# As this test is evaluating OpenBao configured for high availability backed
37+
# by `Raft` we must first ensure that the primary or leader instance is unsealed
38+
# before attempting to unseal the other members.
39+
- name: Unseal vault
40+
ansible.builtin.include_role:
41+
name: vault_unseal
42+
vars:
43+
vault_api_addr: "{{ openbao_api_addr }}"
44+
vault_unseal_keys: "{{ openbao_keys.keys_base64 }}"
45+
run_once: true
46+
47+
# As the first instance is now unsealed the other instances will now need some
48+
# time to connect before we can proceed.
49+
- name: Wait for OpenBao Raft peers to connect
50+
ansible.builtin.wait_for:
51+
timeout: 30
52+
delegate_to: localhost
53+
54+
# Raft peers take few seconds before they report an unsealed state therefore
55+
# we must wait.
56+
- name: Unseal vault
57+
ansible.builtin.include_role:
58+
name: vault_unseal
59+
vars:
60+
vault_api_addr: "{{ openbao_api_addr }}"
61+
vault_unseal_keys: "{{ openbao_keys.keys_base64 }}"
62+
vault_unseal_timeout: 10
63+
64+
- name: Deploy HA OpenBao
65+
gather_facts: true
66+
hosts: openbao_ha
67+
run_once: true
68+
vars:
69+
openbao_log_keys: true
70+
openbao_api_addr: "{{ 'http' ~ '://' ~ openbao_bind_addr ~ ':8200' }}"
71+
openbao_set_keys_fact: true
72+
openbao_write_keys_file: true
73+
tasks:
74+
- name: Include OpenBao keys
75+
ansible.builtin.include_vars:
76+
file: "bao-keys.json"
77+
name: openbao_keys
78+
79+
- name: Configure PKI - create root/intermediate and generate certificates
80+
vars:
81+
vault_pki_certificate_subject:
82+
- role: 'ServerCert'
83+
common_name: "OS-CERT-TEST"
84+
extra_params:
85+
ttl: "8760h"
86+
ip_sans: "127.0.0.1"
87+
alt_names: "example.com"
88+
exclude_cn_from_sans: true
89+
vault_pki_certificates_directory: "/tmp/"
90+
vault_pki_generate_certificates: true
91+
vault_pki_intermediate_ca_name: "OS-TLS-INT"
92+
vault_pki_intermediate_create: true
93+
vault_pki_intermediate_roles:
94+
- name: "ServerCert"
95+
config:
96+
max_ttl: 8760h
97+
ttl: 8760h
98+
allow_any_name: true
99+
allow_ip_sans: true
100+
require_cn: false
101+
server_flag: true
102+
key_type: rsa
103+
key_bits: 4096
104+
country: ["UK"]
105+
locality: ["Bristol"]
106+
organization: ["StackHPC"]
107+
ou: ["HPC"]
108+
vault_pki_root_ca_name: "OS-TLS-ROOT"
109+
vault_pki_root_create: true
110+
vault_pki_write_certificate_files: true
111+
vault_pki_write_int_ca_to_file: true
112+
vault_pki_write_pem_bundle: false
113+
vault_pki_write_root_ca_to_file: true
114+
vault_api_addr: "{{ openbao_api_addr }}"
115+
vault_token: "{{ openbao_keys.root_token }}"
116+
block:
117+
- name: Configure PKI - create root/intermediate and generate certificates
118+
ansible.builtin.include_role:
119+
name: vault_pki
120+
121+
- name: Configure PKI - create root/intermediate and generate certificates (idempotence test)
122+
ansible.builtin.include_role:
123+
name: vault_pki
124+
125+
- name: Configure PKI - generate certificate pem bundle
126+
vars:
127+
vault_pki_certificate_subject:
128+
- role: 'ServerCert'
129+
common_name: "OS-CERT-TEST2"
130+
extra_params:
131+
ttl: "8760h"
132+
ip_sans: "192.168.38.72"
133+
exclude_cn_from_sans: true
134+
vault_pki_certificates_directory: "/tmp/"
135+
vault_pki_generate_certificates: true
136+
vault_pki_intermediate_ca_name: "OS-TLS-INT"
137+
vault_pki_intermediate_create: false
138+
vault_pki_root_ca_name: "OS-TLS-ROOT"
139+
vault_pki_root_create: false
140+
vault_pki_write_certificate_files: true
141+
vault_pki_write_pem_bundle: true
142+
vault_api_addr: "{{ openbao_api_addr }}"
143+
vault_token: "{{ openbao_keys.root_token }}"
144+
block:
145+
- name: Configure PKI - generate certificate pem bundle
146+
ansible.builtin.include_role:
147+
name: vault_pki
148+
149+
- name: Configure PKI - generate certificate pem bundle (idempotence test)
150+
ansible.builtin.include_role:
151+
name: vault_pki
152+
153+
- name: Validate if certificates exist
154+
ansible.builtin.stat:
155+
path: "/tmp/{{ item }}"
156+
register: stat_result
157+
failed_when: not stat_result.stat.exists
158+
loop:
159+
- OS-CERT-TEST.crt
160+
- OS-CERT-TEST2.pem
161+
162+
- name: Concatenate CAs
163+
ansible.builtin.shell: |
164+
cat /tmp/OS-TLS-ROOT.pem /tmp/OS-TLS-INT.crt > /tmp/CA-CHAIN.pem
165+
args:
166+
executable: /bin/bash
167+
become: true
168+
changed_when: true
169+
170+
- name: Verify certificate chain
171+
ansible.builtin.command: |
172+
openssl verify -CAfile /tmp/CA-CHAIN.pem
173+
/tmp/{{ item }}
174+
register: verify_result
175+
failed_when: verify_result.rc != 0
176+
loop:
177+
- OS-CERT-TEST.crt
178+
- OS-CERT-TEST2.pem
179+
changed_when: false

0 commit comments

Comments
 (0)