62 lines
2.1 KiB
YAML
62 lines
2.1 KiB
YAML
---
|
|
- name: Inspect Matrix bootstrap directory without reading secrets
|
|
ansible.builtin.stat:
|
|
path: "{{ matrix_bootstrap_dir }}"
|
|
register: matrix_secret_bootstrap_dir
|
|
|
|
- name: Assert Matrix bootstrap directory is root-only
|
|
ansible.builtin.assert:
|
|
that:
|
|
- matrix_secret_bootstrap_dir.stat.exists
|
|
- matrix_secret_bootstrap_dir.stat.isdir
|
|
- matrix_secret_bootstrap_dir.stat.pw_name == 'root'
|
|
- matrix_secret_bootstrap_dir.stat.gr_name == 'root'
|
|
- matrix_secret_bootstrap_dir.stat.mode == '0700'
|
|
fail_msg: "{{ matrix_bootstrap_dir }} must be a root:root 0700 directory."
|
|
|
|
- name: Inspect required individual bootstrap secret files without reading them
|
|
ansible.builtin.stat:
|
|
path: "{{ matrix_bootstrap_dir }}/{{ item }}"
|
|
loop: "{{ matrix_required_bootstrap_files }}"
|
|
register: matrix_secret_bootstrap_files
|
|
no_log: true
|
|
|
|
- name: Assert required bootstrap secret file permissions
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.stat.exists
|
|
- item.stat.isreg
|
|
- item.stat.pw_name == 'root'
|
|
- item.stat.gr_name == 'root'
|
|
- item.stat.mode == '0600'
|
|
fail_msg: A required root-only Matrix bootstrap file is missing or has unsafe permissions.
|
|
loop: "{{ matrix_secret_bootstrap_files.results }}"
|
|
no_log: true
|
|
|
|
- name: Inspect Kubernetes Secret metadata without retrieving values
|
|
ansible.builtin.command:
|
|
argv:
|
|
- k3s
|
|
- kubectl
|
|
- describe
|
|
- secret
|
|
- "{{ item.name }}"
|
|
- --namespace={{ matrix_namespace }}
|
|
changed_when: false
|
|
loop: "{{ matrix_required_kubernetes_secrets }}"
|
|
register: matrix_secret_kubernetes_metadata
|
|
no_log: true
|
|
|
|
- name: Assert required Kubernetes Secret keys exist
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.stdout is search('(?m)^' ~ key ~ ':')
|
|
fail_msg: Required Matrix Kubernetes Secret key is missing.
|
|
loop: "{{ matrix_secret_kubernetes_metadata.results | subelements('item.keys') }}"
|
|
loop_control:
|
|
loop_var: matrix_secret_key_check
|
|
vars:
|
|
item: "{{ matrix_secret_key_check.0 }}"
|
|
key: "{{ matrix_secret_key_check.1 }}"
|
|
no_log: true
|