mirror of https://github.com/ansible/ansible.git
Fix EC2 test suite to work with testing policies (#44387)
* Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytespull/58737/head
Will Thames
5 years ago
committed by
Sloane Hertel
parent
6cf722fed6
commit
60fb9fc208
@ -1,29 +0,0 @@
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowCloudfrontUsage",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"cloudfront:CreateDistribution",
|
||||
"cloudfront:CreateDistributionWithTags",
|
||||
"cloudfront:CreateCloudFrontOriginAccessIdentity",
|
||||
"cloudfront:DeleteDistribution",
|
||||
"cloudfront:GetDistribution",
|
||||
"cloudfront:GetStreamingDistribution",
|
||||
"cloudfront:GetDistributionConfig",
|
||||
"cloudfront:GetStreamingDistributionConfig",
|
||||
"cloudfront:GetInvalidation",
|
||||
"cloudfront:ListDistributions",
|
||||
"cloudfront:ListDistributionsByWebACLId",
|
||||
"cloudfront:ListInvalidations",
|
||||
"cloudfront:ListStreamingDistributions",
|
||||
"cloudfront:ListTagsForResource",
|
||||
"cloudfront:TagResource",
|
||||
"cloudfront:UntagResource",
|
||||
"cloudfront:UpdateDistribution"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,17 +0,0 @@
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowAccessToServerCertificates",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:ListServerCertificates",
|
||||
"iam:UploadServerCertificate",
|
||||
"iam:UpdateServerCertificate",
|
||||
"iam:DeleteServerCertificate",
|
||||
"iam:GetServerCertificate"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,3 +1,4 @@
|
||||
dependencies:
|
||||
- prepare_tests
|
||||
- setup_ec2
|
||||
- setup_remote_tmp_dir
|
||||
|
||||
@ -1,6 +0,0 @@
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
environment: "{{ ansible_test.environment }}"
|
||||
|
||||
roles:
|
||||
- ec2_instance
|
||||
@ -1,47 +0,0 @@
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
environment: "{{ ansible_test.environment }}"
|
||||
vars:
|
||||
resource_prefix: 'ansible-testing'
|
||||
|
||||
tasks:
|
||||
- block:
|
||||
- name: set up aws connection info
|
||||
set_fact:
|
||||
aws_connection_info: &aws_connection_info
|
||||
aws_access_key: "{{ aws_access_key }}"
|
||||
aws_secret_key: "{{ aws_secret_key }}"
|
||||
security_token: "{{ security_token }}"
|
||||
region: "{{ aws_region }}"
|
||||
no_log: True
|
||||
|
||||
- name: Include vars file in {{ playbook_dir }}../defaults/main.yml
|
||||
include_vars:
|
||||
file: '{{ playbook_dir }}/../defaults/main.yml'
|
||||
|
||||
- name: create t3.nano with cpu options (fails gracefully)
|
||||
ec2_instance:
|
||||
state: present
|
||||
name: "ansible-test-{{ resource_prefix | regex_search('([0-9]+)$') }}-ec2"
|
||||
image_id: "{{ ec2_ami_image[aws_region] }}"
|
||||
instance_type: t3.nano
|
||||
cpu_options:
|
||||
core_count: 1
|
||||
threads_per_core: 1
|
||||
<<: *aws_connection_info
|
||||
register: ec2_instance_cpu_options_creation
|
||||
ignore_errors: yes
|
||||
|
||||
- name: check that graceful error message is returned when creation with cpu_options and old botocore
|
||||
assert:
|
||||
that:
|
||||
- ec2_instance_cpu_options_creation.failed
|
||||
- 'ec2_instance_cpu_options_creation.msg == "cpu_options is only supported with botocore >= 1.10.16"'
|
||||
|
||||
always:
|
||||
- name: cleanup c4.large in case graceful failure was in fact a graceful success
|
||||
ec2_instance:
|
||||
state: absent
|
||||
name: "ansible-test-{{ resource_prefix | regex_search('([0-9]+)$') }}-ec2"
|
||||
<<: *aws_connection_info
|
||||
ignore_errors: yes
|
||||
@ -1,15 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -eux
|
||||
|
||||
export ANSIBLE_ROLES_PATH=../../targets/
|
||||
|
||||
# Test graceful failure for older versions of botocore
|
||||
source virtualenv.sh
|
||||
pip install 'botocore<1.10.16' 'boto3<1.7.16'
|
||||
ansible-playbook -v playbooks/version_fail.yml "$@"
|
||||
|
||||
# Run full test suite
|
||||
source virtualenv.sh
|
||||
pip install 'botocore>=1.10.16' boto3
|
||||
ansible-playbook -v playbooks/full_test.yml "$@"
|
||||
@ -0,0 +1,36 @@
|
||||
- block:
|
||||
- name: set up aws connection info
|
||||
set_fact:
|
||||
aws_connection_info: &aws_connection_info
|
||||
aws_access_key: "{{ aws_access_key }}"
|
||||
aws_secret_key: "{{ aws_secret_key }}"
|
||||
security_token: "{{ security_token }}"
|
||||
region: "{{ aws_region }}"
|
||||
no_log: True
|
||||
|
||||
- name: create t3.nano with cpu options (fails gracefully)
|
||||
ec2_instance:
|
||||
state: present
|
||||
name: "ansible-test-{{ resource_prefix | regex_search('([0-9]+)$') }}-ec2"
|
||||
image_id: "{{ ec2_ami_image[aws_region] }}"
|
||||
instance_type: t3.nano
|
||||
cpu_options:
|
||||
core_count: 1
|
||||
threads_per_core: 1
|
||||
<<: *aws_connection_info
|
||||
register: ec2_instance_cpu_options_creation
|
||||
ignore_errors: yes
|
||||
|
||||
- name: check that graceful error message is returned when creation with cpu_options and old botocore
|
||||
assert:
|
||||
that:
|
||||
- ec2_instance_cpu_options_creation.failed
|
||||
- 'ec2_instance_cpu_options_creation.msg == "cpu_options is only supported with botocore >= 1.10.16"'
|
||||
|
||||
always:
|
||||
- name: cleanup t3.nano in case graceful failure was in fact a graceful success
|
||||
ec2_instance:
|
||||
state: absent
|
||||
name: "ansible-test-{{ resource_prefix | regex_search('([0-9]+)$') }}-ec2"
|
||||
<<: *aws_connection_info
|
||||
ignore_errors: yes
|
||||
Loading…
Reference in New Issue