ansible-collections/community.docker
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.docker.git synced 2026-03-23 14:36:10 +00:00
Code Packages Projects Releases Wiki Activity
ec4c17efef
community.docker/tests/integration/targets/docker_swarm_service/tasks/tests/secrets.yml
András Maróy b481fa4801
Add support for rotating docker secrets (#293) 
* Add parameters for rolling updates to `docker_secret`

* Extract `remove_secrets` to its own function in `docker_secret`

* Store existing secrets in a list instead of a single secret

With this change `docker_secret` now supports the case where we store
multiple versions of a secret with the `_v123` postfix.

`absent` state implicitly handles removing these this way.

* When using `rolling_versions` don't automatically remove current secret

To make rolling updates actually work instead of failing on trying to
remove a secret that is attached to a service, use the
`versions_to_keep` parameter to remove old versions of the secret after
creating the new one. This way the secret with the new data is created
with a different name and can be attached to the service by its ID
without having to delete the previous one first which would fail if it
is already attached to a service.

* Add version numbers to newly created secrets

Attach the incremental version number to the secret name as a `_v123`
postfix where `123` is replaced with an incremental counter starting
from 1.
A label with the numeric version is also attached to the secret to ease
calculating the new version number upon change with the name
`ansible_version`.

* Return `secret_name` for docker secrets as well

* Add integration test for rolling secrets

* Update `docker_secret` documentation as per review comments

* Correctly return `docker_secret` version number as int

* Use template string for naming `docker_secrets` instead of concatenation

* Return the correct secret name on deletion failure

* Simplify `docker_secret` creation

* Add missing comma for `docker_secret` schema

* Only remove old docker secrets if `rolling_versions` is set

* Add check in `docker_secret` version parsing to handle NaNs

* Add newly created `docker_secret` to internal secret list to avoid additional deletions

* Add changelog fragment for `docker_secret` `rolling_versions` feature

* Update changelogs/fragments/270-rolling-secrets.yml

Co-authored-by: Felix Fontein <felix@fontein.de>

Co-authored-by: Felix Fontein <felix@fontein.de>
2022-02-12 08:29:49 +01:00

459 lines
14 KiB
YAML
Raw Blame History

---
- name: Registering container name
set_fact:
service_name: "{{ name_prefix ~ '-secrets' }}"
secret_name_1: "{{ name_prefix ~ '-secret-1' }}"
secret_name_2: "{{ name_prefix ~ '-secret-2' }}"
secret_name_3: "{{ name_prefix ~ '-secret-3' }}"
- name: Registering container name
set_fact:
secret_names: "{{ secret_names + [secret_name_1, secret_name_2] }}"
- docker_secret:
name: "{{ secret_name_1 }}"
data: "secret1"
state: "present"
register: "secret_result_1"
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
- docker_secret:
name: "{{ secret_name_2 }}"
data: "secret2"
state: "present"
register: "secret_result_2"
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
- docker_secret:
name: "{{ secret_name_3 }}"
data: "secret3"
state: "present"
rolling_versions: true
register: "secret_result_3"
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
####################################################################
## secrets #########################################################
####################################################################
- name: secrets
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
filename: "/run/secrets/{{ secret_name_1 }}.txt"
register: secrets_1
ignore_errors: yes
- name: secrets (idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_name: "{{ secret_name_1 }}"
filename: "/run/secrets/{{ secret_name_1 }}.txt"
register: secrets_2
ignore_errors: yes
- name: secrets (add)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
filename: "/run/secrets/{{ secret_name_1 }}.txt"
- secret_name: "{{ secret_name_2 }}"
filename: "/run/secrets/{{ secret_name_2 }}.txt"
register: secrets_3
ignore_errors: yes
- name: secrets (add idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_name: "{{ secret_name_1 }}"
filename: "/run/secrets/{{ secret_name_1 }}.txt"
- secret_id: "{{ secret_result_2.secret_id|default('') }}"
secret_name: "{{ secret_name_2 }}"
filename: "/run/secrets/{{ secret_name_2 }}.txt"
register: secrets_4
ignore_errors: yes
- name: secrets (add idempotency no id)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_name: "{{ secret_name_1 }}"
filename: "/run/secrets/{{ secret_name_1 }}.txt"
- secret_name: "{{ secret_name_2 }}"
filename: "/run/secrets/{{ secret_name_2 }}.txt"
register: secrets_5
ignore_errors: yes
- name: secrets (order idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_name: "{{ secret_name_2 }}"
filename: "/run/secrets/{{ secret_name_2 }}.txt"
- secret_name: "{{ secret_name_1 }}"
filename: "/run/secrets/{{ secret_name_1 }}.txt"
register: secrets_6
ignore_errors: yes
- name: secrets (empty)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets: []
register: secrets_7
ignore_errors: yes
- name: secrets (empty idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets: []
register: secrets_8
ignore_errors: yes
- name: rolling secrets
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_name: "{{ secret_name_3 }}_v1"
filename: "/run/secrets/{{ secret_name_3 }}.txt"
register: secrets_9
ignore_errors: yes
- name: update rolling secret
docker_secret:
name: "{{ secret_name_3 }}"
data: "newsecret3"
state: "present"
rolling_versions: true
register: secrets_10
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
ignore_errors: yes
- name: rolling secrets service update
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_name: "{{ secret_name_3 }}_v2"
filename: "/run/secrets/{{ secret_name_3 }}.txt"
register: secrets_11
ignore_errors: yes
- name: cleanup
docker_swarm_service:
name: "{{ service_name }}"
state: absent
diff: no
- assert:
that:
- secrets_1 is changed
- secrets_2 is not changed
- secrets_3 is changed
- secrets_4 is not changed
- secrets_5 is not changed
- secrets_6 is not changed
- secrets_7 is changed
- secrets_8 is not changed
- secrets_9 is changed
- secrets_10 is not failed
- secrets_11 is changed
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.4.0', '>=')
- assert:
that:
- secrets_1 is failed
- "'Minimum version required' in secrets_1.msg"
when: docker_api_version is version('1.25', '<') or docker_py_version is version('2.4.0', '<')
####################################################################
## secrets (uid) ###################################################
####################################################################
- name: secrets (uid int)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
uid: 1000
register: secrets_1
ignore_errors: yes
- name: secrets (uid int idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
uid: 1000
register: secrets_2
ignore_errors: yes
- name: secrets (uid int change)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
uid: 1002
register: secrets_3
ignore_errors: yes
- name: secrets (uid str)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
uid: "1001"
register: secrets_4
ignore_errors: yes
- name: secrets (uid str idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
uid: "1001"
register: secrets_5
ignore_errors: yes
- name: cleanup
docker_swarm_service:
name: "{{ service_name }}"
state: absent
diff: no
- assert:
that:
- secrets_1 is changed
- secrets_2 is not changed
- secrets_3 is changed
- secrets_4 is changed
- secrets_5 is not changed
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.4.0', '>=')
- assert:
that:
- secrets_1 is failed
- "'Minimum version required' in secrets_1.msg"
when: docker_api_version is version('1.25', '<') or docker_py_version is version('2.4.0', '<')
####################################################################
## secrets (gid) ###################################################
####################################################################
- name: secrets (gid int)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
gid: 1001
register: secrets_1
ignore_errors: yes
- name: secrets (gid int idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
gid: 1001
register: secrets_2
ignore_errors: yes
- name: secrets (gid int change)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
gid: 1002
register: secrets_3
ignore_errors: yes
- name: secrets (gid str)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
gid: "1003"
register: secrets_4
ignore_errors: yes
- name: secrets (gid str idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
gid: "1003"
register: secrets_5
ignore_errors: yes
- name: cleanup
docker_swarm_service:
name: "{{ service_name }}"
state: absent
diff: no
- assert:
that:
- secrets_1 is changed
- secrets_2 is not changed
- secrets_3 is changed
- secrets_4 is changed
- secrets_5 is not changed
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.4.0', '>=')
- assert:
that:
- secrets_1 is failed
- "'Minimum version required' in secrets_1.msg"
when: docker_api_version is version('1.25', '<') or docker_py_version is version('2.4.0', '<')
####################################################################
## secrets (mode) ##################################################
####################################################################
- name: secrets (mode)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
mode: 0600
register: secrets_1
ignore_errors: yes
- name: secrets (mode idempotency)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
mode: 0600
register: secrets_2
ignore_errors: yes
- name: secrets (mode change)
docker_swarm_service:
name: "{{ service_name }}"
image: "{{ docker_test_image_alpine }}"
resolve_image: no
command: '/bin/sh -v -c "sleep 10m"'
secrets:
- secret_id: "{{ secret_result_1.secret_id|default('') }}"
secret_name: "{{ secret_name_1 }}"
mode: 0777
register: secrets_3
ignore_errors: yes
- name: cleanup
docker_swarm_service:
name: "{{ service_name }}"
state: absent
diff: no
- assert:
that:
- secrets_1 is changed
- secrets_2 is not changed
- secrets_3 is changed
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.4.0', '>=')
- assert:
that:
- secrets_1 is failed
- "'Minimum version required' in secrets_1.msg"
when: docker_api_version is version('1.25', '<') or docker_py_version is version('2.4.0', '<')
####################################################################
####################################################################
####################################################################
- name: Delete secrets
docker_secret:
name: "{{ secret_name }}"
state: absent
force: yes
loop:
- "{{ secret_name_1 }}"
- "{{ secret_name_2 }}"
- "{{ secret_name_3 }}"
loop_control:
loop_var: secret_name
ignore_errors: yes
when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
View Git Blame Copy Permalink