Merge pull request #1168 from moreati/issue1083-become_pass

tests: Re-enable become/sudo tests, fix them on macOS runners

docs/changelog.rst

@@ -23,6 +23,7 @@ In progress (unreleased)
 
 * :gh:issue:`905` :mod:`ansible_mitogen`: Support templated SSH command
   arguments (e.g. ``ansible_ssh_args``, ``ansible_ssh_extra_args``).
+* :gh:issue:`692` tests: Fix and re-enable several sudo tests
 
 
 v0.3.14 (2024-10-16)

tests/ansible/integration/action/make_tmp_path.yml

@@ -142,17 +142,16 @@
     # readonly homedir
     #
 
-    # TODO: https://github.com/dw/mitogen/issues/692
+    - name: Try writing to temp directory for the readonly_homedir user
-    # - name: "Try writing to temp directory for the readonly_homedir user"
+      become: true
-    #   become: true
+      become_user: mitogen__readonly_homedir
-    #   become_user: mitogen__readonly_homedir
+      custom_python_run_script:
-    #   custom_python_run_script:
+        script: |
-    #     script: |
+          from ansible.module_utils.basic import get_module_path
-    #       from ansible.module_utils.basic import get_module_path
+          path = get_module_path() + '/foo.txt'
-    #       path = get_module_path() + '/foo.txt'
+          result['path'] = path
-    #       result['path'] = path
+          open(path, 'w').write("bar")
-    #       open(path, 'w').write("bar")
+      register: tmp_path
-    #   register: tmp_path
 
     #
     # modules get the same base dir

tests/ansible/integration/action/synchronize.yml

@@ -40,11 +40,11 @@
       delegate_to: localhost
       run_once: true
 
-    # TODO: https://github.com/dw/mitogen/issues/692
+    - name: Ensure clean slate
-    # - file:
+      become: true
-    #     path: /tmp/sync-test.out
+      file:
-    #     state: absent
+        path: /tmp/sync-test.out
-    #   become: true
+        state: absent
 
     # exception:   File "/tmp/venv/lib/python2.7/site-packages/ansible/plugins/action/__init__.py", line 129, in cleanup
     # exception:     self._remove_tmp_path(self._connection._shell.tmpdir)
@@ -70,14 +70,14 @@
               outout={{ outout }}
       when: False
 
-    # TODO: https://github.com/dw/mitogen/issues/692
+    - name: Cleanup
-    # - file:
+      become: true
-    #     path: "{{item}}"
+      file:
-    #     state: absent
+        path: "{{ item }}"
-    #   become: true
+        state: absent
-    #   with_items:
+      with_items:
-    #   - /tmp/synchronize-action-key
+        - /tmp/synchronize-action-key
-    #   - /tmp/sync-test
+        - /tmp/sync-test
-    #   - /tmp/sync-test.out
+        - /tmp/sync-test.out
   tags:
     - synchronize

tests/ansible/integration/become/sudo_password.yml

@@ -5,10 +5,12 @@
   tasks:
 
     - name: Ensure sudo password absent but required.
-      shell: whoami
       become: true
       become_user: mitogen__pw_required
+      command:
+        cmd: whoami
       register: out
+      changed_when: false
       ignore_errors: true
       when:
         # https://github.com/ansible/ansible/pull/70785
@@ -32,10 +34,12 @@
           or is_mitogen
 
     - name: Ensure password sudo incorrect.
-      shell: whoami
       become: true
       become_user: mitogen__pw_required
+      command:
+        cmd: whoami
       register: out
+      changed_when: false
       vars:
         ansible_become_pass: nopes
       ignore_errors: true
@@ -59,18 +63,27 @@
           or ansible_version.full is version("2.11", ">=", strict=True)
           or is_mitogen
 
-    # TODO: https://github.com/dw/mitogen/issues/692
+    - block:
-    # - name: Ensure password sudo succeeds.
+        - name: Ensure password sudo succeeds
-    #   shell: whoami
+          become: true
-    #   become: true
+          become_user: mitogen__pw_required
-    #   become_user: mitogen__pw_required
+          vars:
-    #   register: out
+            ansible_become_pass: pw_required_password
-    #   vars:
+          command:
-    #     ansible_become_pass: pw_required_password
+            cmd: whoami
+          register: sudo_password_success_whoami
+          changed_when: false
 
-    # - assert:
+        - assert:
-    #     that:
+            that:
-    #       - out.stdout == 'mitogen__pw_required'
+              - sudo_password_success_whoami.stdout == 'mitogen__pw_required'
+            fail_msg: |
+              sudo_password_success_whoami={{ sudo_password_success_whoami }}
+      when:
+        # https://github.com/ansible/ansible/pull/70785
+        - ansible_facts.distribution not in ["MacOSX"]
+          or ansible_version.full is version("2.11", ">=", strict=True)
+          or is_mitogen
   tags:
     - sudo
     - sudo_password

tests/ansible/integration/become/sudo_requiretty.yml

@@ -3,34 +3,38 @@
 - name: integration/become/sudo_requiretty.yml
   hosts: test-targets
   tasks:
-    # - include_tasks: ../_mitogen_only.yml
+    # AIUI Vanilla Ansible cannot do sudo when requiretty configured
+    - include_tasks: ../_mitogen_only.yml
 
-    # TODO: https://github.com/dw/mitogen/issues/692
+    - name: Verify we can login to a non-passworded requiretty account
-    # - name: Verify we can login to a non-passworded requiretty account
+      become: true
-    #   shell: whoami
+      become_user: mitogen__require_tty
-    #   become: true
+      command:
-    #   become_user: mitogen__require_tty
+        cmd: whoami
-    #   register: out
+      changed_when: false
+      register: sudo_require_tty_whoami
 
-    # - assert:
+    - assert:
-    #     that:
+        that:
-    #       - out.stdout == 'mitogen__require_tty'
+          - sudo_require_tty_whoami.stdout == 'mitogen__require_tty'
+        fail_msg: |
+          sudo_require_tty_whoami={{ sudo_require_tty_whoami }}
 
+    - name: Verify we can login to a passworded requiretty account
+      become: true
+      become_user: mitogen__require_tty_pw_required
+      vars:
+        ansible_become_pass: require_tty_pw_required_password
+      command:
+        cmd: whoami
+      changed_when: false
+      register: sudo_require_tty_password_whoami
 
-    # ---------------
+    - assert:
-
+        that:
-    # TODO: https://github.com/dw/mitogen/issues/692
+          - sudo_require_tty_password_whoami.stdout == 'mitogen__require_tty_pw_required'
-    # - name: Verify we can login to a passworded requiretty account
+        fail_msg: |
-    #   shell: whoami
+          sudo_require_tty_password_whoami={{ sudo_require_tty_password_whoami }}
-    #   become: true
-    #   become_user: mitogen__require_tty_pw_required
-    #   vars:
-    #     ansible_become_pass: require_tty_pw_required_password
-    #   register: out
-
-    # - assert:
-    #     that:
-    #       - out.stdout == 'mitogen__require_tty_pw_required'
   tags:
     - mitogen_only
     - sudo

tests/ansible/integration/playbook_semantics/with_items.yml

@@ -3,30 +3,39 @@
 
 - name: integration/playbook_semantics/with_items.yml
   hosts: test-targets
+  gather_facts: true
   tasks:
+    - block:
+        - name: Spin up a few interpreters
+          become: true
+          vars:
+            ansible_become_user: "mitogen__user{{ item }}"
+          command:
+            cmd: whoami
+          with_sequence: start=1 end=3
+          register: first_run
+          changed_when: false
 
-    # TODO: https://github.com/dw/mitogen/issues/692
+        - name: Reuse them
-    # - name: Spin up a few interpreters
+          become: true
-    #   shell: whoami
+          vars:
-    #   become: true
+            ansible_become_user: "mitogen__user{{ item }}"
-    #   vars:
+          command:
-    #     ansible_become_user: "mitogen__user{{item}}"
+            cmd: whoami
-    #   with_sequence: start=1 end=3
+          with_sequence: start=1 end=3
-    #   register: first_run
+          register: second_run
+          changed_when: false
 
-    # - name: Reuse them
+        - name: Verify first and second run matches expected username.
-    #   shell: whoami
+          vars:
-    #   become: true
+            user_expected: "mitogen__user{{ item | int + 1 }}"
-    #   vars:
+          assert:
-    #     ansible_become_user: "mitogen__user{{item}}"
+            that:
-    #   with_sequence: start=1 end=3
+              - first_run.results[item | int].stdout == user_expected
-    #   register: second_run
+              - second_run.results[item | int].stdout == user_expected
-
+          with_sequence: start=0 end=2
-    # - name: Verify first and second run matches expected username.
+      when:
-    #   assert:
+        # https://github.com/ansible/ansible/pull/70785
-    #     that:
+        - ansible_facts.distribution not in ["MacOSX"]
-    #     - first_run.results[item|int].stdout == ("mitogen__user%d" % (item|int + 1))
+          or ansible_version.full is version("2.11", ">=", strict=True)
-    #     - first_run.results[item|int].stdout == second_run.results[item|int].stdout
+          or is_mitogen
-    #   with_sequence: start=0 end=2
-  tags:
-    - custom_python_new_style_module

tests/image_prep/_user_accounts.yml

@@ -73,6 +73,7 @@
       - user:
           name: "mitogen__{{item}}"
           shell: /bin/bash
+          group: staff
           groups: |
             {{
                 ['com.apple.access_ssh'] +

tests/image_prep/ansible.cfg

@@ -6,6 +6,7 @@ retry_files_enabled = false
 display_args_to_stdout = True
 no_target_syslog = True
 host_key_checking = False
+stdout_callback = yaml
 
 [inventory]
 unparsed_is_fatal = true