Projet

Général

Profil

Paste
Télécharger au format
Statistiques
| Branche: | Révision:

root / spec / acceptance / all_rules_spec.rb @ 771b3256

Historique | Voir | Annoter | Télécharger (4,07 ko)

1
require 'spec_helper_acceptance'
2

    
3
describe 'nftables class' do
4
  context 'configure all nftables rules' do
5
    it 'works idempotently with no errors' do
6
      pp = <<-EOS
7
      # default mask of firewalld service fails if service is not installed.
8
      # https://tickets.puppetlabs.com/browse/PUP-10814
9
      # Disable all default rules and include below explicitly
10
      class { 'nftables':
11
        firewalld_enable => false,
12
        out_ntp          => false,
13
        out_http         => false,
14
        out_https        => false,
15
        out_icmp         => false,
16
        in_ssh           => false,
17
        in_icmp          => false,
18
      }
19
      include nftables::rules::icmp
20
      include nftables::rules::dns
21
      include nftables::rules::node_exporter
22
      include nftables::rules::nfs3
23
      include nftables::rules::ssh
24
      include nftables::rules::dhcpv6_client
25
      include nftables::rules::afs3_callback
26
      include nftables::rules::ospf
27
      include nftables::rules::http
28
      include nftables::rules::puppet
29
      include nftables::rules::icinga2
30
      include nftables::rules::tor
31
      include nftables::rules::ospf3
32
      include nftables::rules::ceph_mon
33
      include nftables::rules::smtp_submission
34
      include nftables::rules::https
35
      include nftables::rules::nfs
36
      include nftables::rules::smtps
37
      include nftables::rules::smtp
38
      include nftables::rules::ceph
39
      include nftables::rules::samba
40
      include nftables::rules::activemq
41
      include nftables::rules::out::postgres
42
      include nftables::rules::out::icmp
43
      include nftables::rules::out::dns
44
      include nftables::rules::out::nfs3
45
      include nftables::rules::out::ssh
46
      include nftables::rules::out::kerberos
47
      include nftables::rules::out::dhcpv6_client
48
      include nftables::rules::out::ospf
49
      include nftables::rules::out::openafs_client
50
      include nftables::rules::out::http
51
      include nftables::rules::out::ssh::remove
52
      class{'nftables::rules::out::puppet':
53
        puppetserver => '127.0.0.1',
54
      }
55
      include nftables::rules::out::all
56
      include nftables::rules::out::tor
57
      include nftables::rules::out::ospf3
58
      include nftables::rules::out::mysql
59
      include nftables::rules::out::ceph_client
60
      include nftables::rules::out::https
61
      include nftables::rules::out::dhcp
62
      include nftables::rules::out::nfs
63
      include nftables::rules::out::smtp
64
      include nftables::rules::out::smtp_client
65
      include nftables::rules::out::imap
66
      include nftables::rules::out::pop3
67
      include nftables::rules::out::chrony
68
      include nftables::rules::out::wireguard
69
      include nftables::rules::wireguard
70
      include nftables::services::dhcpv6_client
71
      include nftables::services::openafs_client
72
      # nftables cannot be started in docker so replace service with a validation only.
73
      systemd::dropin_file{"zzz_docker_nft.conf":
74
        ensure  => present,
75
        unit    => "nftables.service",
76
        content => [
77
          "[Service]",
78
          "ExecStart=",
79
          "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
80
          "ExecReload=",
81
          "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
82
          "",
83
          ].join("\n"),
84
        notify  => Service["nftables"],
85
      }
86
      # Puppet 5 only to ensure ordering.
87
      Class['systemd::systemctl::daemon_reload'] -> Service['nftables']
88
      EOS
89
      # Run it twice and test for idempotency
90
      apply_manifest(pp, catch_failures: true)
91
      apply_manifest(pp, catch_changes: true)
92
    end
93

    
94
    describe package('nftables') do
95
      it { is_expected.to be_installed }
96
    end
97

    
98
    describe service('nftables') do
99
      it { is_expected.to be_running }
100
      it { is_expected.to be_enabled }
101
    end
102

    
103
    describe file('/etc/nftables/puppet.nft') do
104
      it { is_expected.to be_file }
105
    end
106

    
107
    describe file('/etc/systemd/system/nftables.service.d/puppet_nft.conf') do
108
      it { is_expected.to be_file }
109
    end
110

    
111
    describe file('/etc/nftables/puppet') do
112
      it { is_expected.to be_directory }
113
    end
114
  end
115
end