From ca1c050cbeb09d1ca6a40d87cb20f82abf04d590 Mon Sep 17 00:00:00 2001 From: Kevin Carter Date: Wed, 17 Oct 2018 20:31:26 -0500 Subject: [PATCH] Add kolide cluster tests Change-Id: I4452b5f42eb9c09da48e657d20144f09fe785878 Signed-off-by: Kevin Carter --- osquery/installOSquery.yml | 31 ++++++++---- osquery/roles/fleet/tasks/createFleetDB.yml | 2 + osquery/roles/fleet/tasks/fleetConfig.yml | 28 ----------- .../fleet/tasks/fleetGetEnrollmentToken.yml | 23 --------- .../roles/fleet/tasks/fleetRegisterAdmin.yml | 10 ++-- .../roles/fleet/tasks/fleetRequirements.yml | 29 ------------ osquery/roles/fleet/tasks/fleetSSL.yml | 42 ++++++++++++++--- .../roles/fleet/tasks/fleetSSLkeyCreate.yml | 6 +-- .../fleet/tasks/fleetSSLuserProvided.yml | 47 ------------------- .../roles/fleet/tasks/fleetServerInstall.yml | 18 +++++++ osquery/roles/fleet/tasks/main.yml | 14 ++---- .../inventory/test-container-inventory.yml | 14 +++++- zuul.d/jobs.yaml | 9 +++- zuul.d/project.yaml | 2 + 14 files changed, 112 insertions(+), 163 deletions(-) delete mode 100644 osquery/roles/fleet/tasks/fleetConfig.yml delete mode 100644 osquery/roles/fleet/tasks/fleetGetEnrollmentToken.yml delete mode 100644 osquery/roles/fleet/tasks/fleetRequirements.yml delete mode 100644 osquery/roles/fleet/tasks/fleetSSLuserProvided.yml diff --git a/osquery/installOSquery.yml b/osquery/installOSquery.yml index 1d13ae29..1a555626 100644 --- a/osquery/installOSquery.yml +++ b/osquery/installOSquery.yml @@ -26,16 +26,12 @@ gather_facts: "{{ osa_gather_facts | default(True) }}" tasks: - - name: Fetch Certificates - fetch: - flat: yes - src: "{{ item.src }}" - dest: "{{ item.dest }}" + - name: create osquery dir + file: + path: "{{ item }}" + state: directory with_items: - - src: "{{ kolide_fleet_ssl_cert }}" - dest: "/tmp/{{ kolide_fleet_ssl_cert | basename }}" - - src: "{{ kolide_fleet_ssl_key }}" - dest: "/tmp/{{ kolide_fleet_ssl_key | basename }}" + - /etc/osquery - name: Retrieve Enrollment Token command: /usr/local/bin/fleetctl get enroll-secret @@ -48,10 +44,24 @@ - name: Write enroll secret copy: - dest: "/tmp/{{ osquery_enroll_secret_file | basename }}" + dest: "{{ osquery_enroll_secret_file }}" content: "{{ kolide_fleet_enroll_secret }}" mode: "0640" + - name: Fetch Certificates + fetch: + flat: yes + src: "{{ item.src }}" + dest: "{{ item.dest }}" + mode: "0600" + with_items: + - src: "{{ kolide_fleet_ssl_cert }}" + dest: "/tmp/{{ kolide_fleet_ssl_cert | basename }}" + - src: "{{ kolide_fleet_ssl_key }}" + dest: "/tmp/{{ kolide_fleet_ssl_key | basename }}" + - src: "{{ osquery_enroll_secret_file }}" + dest: "/tmp/{{ osquery_enroll_secret_file | basename }}" + - name: Install osquery hosts: "hosts:all_containers" @@ -76,6 +86,7 @@ copy: src: "{{ item.src }}" dest: "{{ item.dest }}" + mode: "0640" with_items: - dest: "{{ kolide_fleet_ssl_cert }}" src: "/tmp/{{ kolide_fleet_ssl_cert | basename }}" diff --git a/osquery/roles/fleet/tasks/createFleetDB.yml b/osquery/roles/fleet/tasks/createFleetDB.yml index 54c5b359..3c2a740a 100644 --- a/osquery/roles/fleet/tasks/createFleetDB.yml +++ b/osquery/roles/fleet/tasks/createFleetDB.yml @@ -22,6 +22,7 @@ state: "present" delegate_to: "{{ groups['mariadb_all'][0] }}" no_log: False + run_once: true tags: - fleet_db_install @@ -39,5 +40,6 @@ delegate_to: "{{ groups['mariadb_all'][0] }}" with_items: "{{ grant_list | default(['localhost', '%']) }}" no_log: False + run_once: true tags: - fleet_db_install diff --git a/osquery/roles/fleet/tasks/fleetConfig.yml b/osquery/roles/fleet/tasks/fleetConfig.yml deleted file mode 100644 index e3704a3a..00000000 --- a/osquery/roles/fleet/tasks/fleetConfig.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# Copyright 2016, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -- name: create fleet dir - file: - path: /etc/fleet - state: directory - -- name: Drop fleet conf file - template: - src: templates/fleet_config.yml.j2 - dest: /etc/fleet/fleet_config.yml - notify: - - Restart kolide (systemd) - tags: - - fleet_config diff --git a/osquery/roles/fleet/tasks/fleetGetEnrollmentToken.yml b/osquery/roles/fleet/tasks/fleetGetEnrollmentToken.yml deleted file mode 100644 index 89f9dabd..00000000 --- a/osquery/roles/fleet/tasks/fleetGetEnrollmentToken.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# Copyright 2016, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -- name: retrieve Enrollment Token - command: /usr/local/bin/fleetctl get enroll-secret - changed_when: false - register: _enrollment_token - -- name: Set kolide fleet enrollment token fact - set_fact: - kolide_fleet_enroll_secret: "{{ _enrollment_token.stdout }}" diff --git a/osquery/roles/fleet/tasks/fleetRegisterAdmin.yml b/osquery/roles/fleet/tasks/fleetRegisterAdmin.yml index 492595c9..ac871359 100644 --- a/osquery/roles/fleet/tasks/fleetRegisterAdmin.yml +++ b/osquery/roles/fleet/tasks/fleetRegisterAdmin.yml @@ -14,17 +14,17 @@ # limitations under the License. - name: set fleetctl default context - command: /usr/local/bin/fleetctl config set --address https://localhost:{{ kolide_fleet_port }} --tls-skip-verify + command: /usr/local/bin/fleetctl config set --address https://127.0.0.1:{{ kolide_fleet_port }} --tls-skip-verify changed_when: false - name: register admin account command: /usr/local/bin/fleetctl setup --email {{ kolide_fleet_admin_email }} --password {{ kolide_fleet_admin_password }} - changed_when: false - failed_when: false register: fleet_register_admin + changed_when: + - fleet_register_admin.rc == 0 + failed_when: + - fleet_register_admin.rc not in [0, 1] - name: login admin account command: /usr/local/bin/fleetctl login --email {{ kolide_fleet_admin_email }} --password {{ kolide_fleet_admin_password }} changed_when: false - when: - - fleet_register_admin['stderr'] == "Kolide Fleet has already been setup" diff --git a/osquery/roles/fleet/tasks/fleetRequirements.yml b/osquery/roles/fleet/tasks/fleetRequirements.yml deleted file mode 100644 index 4e7a3ae8..00000000 --- a/osquery/roles/fleet/tasks/fleetRequirements.yml +++ /dev/null @@ -1,29 +0,0 @@ ---- -# Copyright 2016, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -- name: Run the systemd service role - include_role: - name: redis - private: true - -- name: create fleet dir - file: - path: /etc/fleet/ssl - state: directory - -- name: Drop fleet conf file - template: - src: templates/fleet_config.yml.j2 - dest: /etc/fleet/fleet_config.yml diff --git a/osquery/roles/fleet/tasks/fleetSSL.yml b/osquery/roles/fleet/tasks/fleetSSL.yml index dfd0ee73..f65bc164 100644 --- a/osquery/roles/fleet/tasks/fleetSSL.yml +++ b/osquery/roles/fleet/tasks/fleetSSL.yml @@ -13,15 +13,43 @@ # See the License for the specific language governing permissions and # limitations under the License. -- name: Ensure the private ssl directory exists - file: - dest: "/etc/ssl/private" - state: "directory" +- include_tasks: fleetSSLkeyCreate.yml + when: + - kolide_fleet_user_ssl_cert is not defined or + kolide_fleet_user_ssl_key is not defined + +- name: Drop user provided ssl cert + copy: + src: "{{ kolide_fleet_user_ssl_cert }}" + dest: "{{ kolide_fleet_ssl_cert }}" + owner: "root" + group: "root" + mode: "0644" + when: + - kolide_fleet_user_ssl_cert is defined tags: - fleet-ssl -- include_tasks: fleetSSLkeyCreate.yml +- name: Drop user provided ssl key + copy: + src: "{{ kolide_fleet_user_ssl_key }}" + dest: "{{ kolide_fleet_ssl_key }}" + owner: "root" + group: "root" + mode: "0640" when: - - kolide_fleet_user_ssl_cert is not defined or kolide_fleet_user_ssl_key is not defined + - kolide_fleet_user_ssl_key is defined + tags: + - fleet-ssl -- include_tasks: fleetSSLuserProvided.yml +- name: Drop user provided ssl CA cert + copy: + src: "{{ kolide_fleet_user_ssl_ca_cert }}" + dest: "{{ kolide_fleet_ssl_ca_cert }}" + owner: "root" + group: "root" + mode: "0644" + when: + - kolide_fleet_user_ssl_ca_cert is defined + tags: + - fleet-ssl diff --git a/osquery/roles/fleet/tasks/fleetSSLkeyCreate.yml b/osquery/roles/fleet/tasks/fleetSSLkeyCreate.yml index 2d5cd043..96dbeac5 100644 --- a/osquery/roles/fleet/tasks/fleetSSLkeyCreate.yml +++ b/osquery/roles/fleet/tasks/fleetSSLkeyCreate.yml @@ -52,9 +52,9 @@ issuer: O: OpenStack-Ansible-OPS - - name: Synchronize certifactes back - synchronize: - mode: pull + - name: Fetch Certificates + fetch: + flat: yes src: "{{ item.src }}" dest: "{{ item.dest }}" with_items: diff --git a/osquery/roles/fleet/tasks/fleetSSLuserProvided.yml b/osquery/roles/fleet/tasks/fleetSSLuserProvided.yml deleted file mode 100644 index 5f8350ec..00000000 --- a/osquery/roles/fleet/tasks/fleetSSLuserProvided.yml +++ /dev/null @@ -1,47 +0,0 @@ ---- -# Copyright 2015, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -- name: Drop user provided ssl cert - copy: - src: "{{ kolide_fleet_user_ssl_cert }}" - dest: "{{ kolide_fleet_ssl_cert }}" - owner: "root" - group: "root" - mode: "0644" - when: kolide_fleet_user_ssl_cert is defined - tags: - - fleet-ssl - -- name: Drop user provided ssl key - copy: - src: "{{ kolide_fleet_user_ssl_key }}" - dest: "{{ kolide_fleet_ssl_key }}" - owner: "root" - group: "root" - mode: "0640" - when: kolide_fleet_user_ssl_key is defined - tags: - - fleet-ssl - -- name: Drop user provided ssl CA cert - copy: - src: "{{ kolide_fleet_user_ssl_ca_cert }}" - dest: "{{ kolide_fleet_ssl_ca_cert }}" - owner: "root" - group: "root" - mode: "0644" - when: kolide_fleet_user_ssl_ca_cert is defined - tags: - - fleet-ssl diff --git a/osquery/roles/fleet/tasks/fleetServerInstall.yml b/osquery/roles/fleet/tasks/fleetServerInstall.yml index 7ec25d4c..bba7a43b 100644 --- a/osquery/roles/fleet/tasks/fleetServerInstall.yml +++ b/osquery/roles/fleet/tasks/fleetServerInstall.yml @@ -13,6 +13,24 @@ # See the License for the specific language governing permissions and # limitations under the License. +- name: create fleet dir + file: + path: "{{ item }}" + state: directory + with_items: + - /etc/fleet + - /etc/fleet/ssl + - /etc/ssl/private + +- name: Drop fleet conf file + template: + src: templates/fleet_config.yml.j2 + dest: /etc/fleet/fleet_config.yml + notify: + - Restart kolide (systemd) + tags: + - fleet_config + - name: Ensure required disto packages are installed package: name: "{{ kolide_fleet_distro_packages }}" diff --git a/osquery/roles/fleet/tasks/main.yml b/osquery/roles/fleet/tasks/main.yml index bc0cdeeb..d40ac2a2 100644 --- a/osquery/roles/fleet/tasks/main.yml +++ b/osquery/roles/fleet/tasks/main.yml @@ -25,21 +25,20 @@ tags: - always +- name: Run the systemd service role + include_role: + name: redis + private: true + # install kolide fleet server - include_tasks: fleetServerInstall.yml -# install software requirements -- include_tasks: fleetRequirements.yml - # install SSL certs - include_tasks: createFleetDB.yml # install SSL certs - include_tasks: fleetSSL.yml -# drop the configuration -- include_tasks: fleetConfig.yml - # add files for systemd - include_tasks: fleetService.yml @@ -51,6 +50,3 @@ # configure kolide fleet & set admin account - include_tasks: fleetRegisterAdmin.yml - -# retrieve and set enrollment token -- include_tasks: fleetGetEnrollmentToken.yml diff --git a/osquery/tests/inventory/test-container-inventory.yml b/osquery/tests/inventory/test-container-inventory.yml index 4007b6db..1bcadca4 100644 --- a/osquery/tests/inventory/test-container-inventory.yml +++ b/osquery/tests/inventory/test-container-inventory.yml @@ -7,10 +7,18 @@ all: ansible_host: 127.0.0.1 ansible_user: root - kolide-fleet1: + kolide-fleet0: ansible_host: 172.29.236.100 ansible_user: root + kolide-fleet1: + ansible_host: 172.29.236.101 + ansible_user: root + + kolide-fleet2: + ansible_host: 172.29.236.102 + ansible_user: root + hosts: vars: @@ -41,7 +49,9 @@ all_containers: children: mariadb: hosts: + kolide-fleet0: {} kolide-fleet1: {} + kolide-fleet2: {} fleet_all: children: @@ -49,4 +59,6 @@ all_containers: children: kolide-fleet: hosts: + kolide-fleet0: {} kolide-fleet1: {} + kolide-fleet2: {} diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index 19b5828b..5662d6c7 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -94,6 +94,14 @@ files: - ^osquery/.* +- job: + name: "openstack-ansible-ops:osquery-ubuntu-xenial-clustered" + parent: "openstack-ansible-ops:osquery-ubuntu-xenial" + nodeset: ubuntu-bionic + vars: + osa_test_repo: "openstack/openstack-ansible-ops" + test_clustered_kolide: true + - job: name: "openstack-ansible-ops:osquery-ubuntu-bionic" parent: "openstack-ansible-ops:osquery-ubuntu-xenial" @@ -103,7 +111,6 @@ name: "openstack-ansible-ops:osquery-ubuntu-bionic-clustered" parent: "openstack-ansible-ops:osquery-ubuntu-xenial" nodeset: ubuntu-bionic - voting: true vars: osa_test_repo: "openstack/openstack-ansible-ops" test_clustered_kolide: true diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml index 41d5e342..a1e89ac5 100644 --- a/zuul.d/project.yaml +++ b/zuul.d/project.yaml @@ -30,7 +30,9 @@ - openstack-ansible-ops:elk_metrics_6x-ubuntu-xenial-clustered - openstack-ansible-ops:elk_metrics_6x-ubuntu-bionic-clustered - openstack-ansible-ops:osquery-ubuntu-xenial + - openstack-ansible-ops:osquery-ubuntu-xenial-clustered - openstack-ansible-ops:osquery-ubuntu-bionic + - openstack-ansible-ops:osquery-ubuntu-bionic-clustered gate: jobs: - openstack-ansible-ops:elk_metrics_6x-ubuntu-bionic