4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
90 lines
2.6 KiB
YAML
90 lines
2.6 KiB
YAML
---
|
|
# Role: goss
|
|
# Installs the Goss binary, deploys test files, runs assertions, fetches results.
|
|
|
|
- name: Set Goss version and paths
|
|
ansible.builtin.set_fact:
|
|
goss_version: "0.4.9"
|
|
goss_bin: /usr/local/bin/goss
|
|
goss_dir: /etc/goss
|
|
|
|
- name: Create Goss config directory
|
|
ansible.builtin.file:
|
|
path: "{{ goss_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Download Goss binary
|
|
ansible.builtin.get_url:
|
|
url: "https://github.com/goss-org/goss/releases/download/v{{ goss_version }}/goss-linux-amd64"
|
|
dest: "{{ goss_bin }}"
|
|
mode: "0755"
|
|
checksum: "sha256:https://github.com/goss-org/goss/releases/download/v{{ goss_version }}/goss-linux-amd64.sha256"
|
|
register: goss_download
|
|
|
|
- name: Render baseline test file from the same declaration that converges the host
|
|
ansible.builtin.template:
|
|
src: "{{ playbook_dir }}/../../goss/baseline.yaml.j2"
|
|
dest: "{{ goss_dir }}/baseline.yaml"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Install recurring Goss check wrapper
|
|
ansible.builtin.copy:
|
|
src: goss-baseline-check.sh
|
|
dest: /usr/local/sbin/goss-baseline-check
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Install Goss baseline systemd service
|
|
ansible.builtin.template:
|
|
src: railiance-goss-baseline.service.j2
|
|
dest: /etc/systemd/system/railiance-goss-baseline.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload systemd daemon
|
|
|
|
- name: Install Goss baseline systemd timer
|
|
ansible.builtin.template:
|
|
src: railiance-goss-baseline.timer.j2
|
|
dest: /etc/systemd/system/railiance-goss-baseline.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload systemd daemon
|
|
|
|
- name: Enable hourly Goss baseline timer
|
|
ansible.builtin.systemd:
|
|
name: railiance-goss-baseline.timer
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
- name: Run Goss assertions (TAP output)
|
|
ansible.builtin.command:
|
|
cmd: "{{ goss_bin }} -g {{ goss_dir }}/baseline.yaml validate --format tap"
|
|
register: goss_result
|
|
failed_when: goss_result.rc != 0
|
|
changed_when: false
|
|
|
|
- name: Ensure local reports directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ playbook_dir }}/../../reports"
|
|
state: directory
|
|
mode: "0755"
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Write TAP report locally
|
|
ansible.builtin.copy:
|
|
content: "{{ goss_result.stdout }}"
|
|
dest: "{{ playbook_dir }}/../../reports/goss-{{ inventory_hostname }}-{{ ansible_date_time.date }}T{{ ansible_date_time.hour }}{{ ansible_date_time.minute }}{{ ansible_date_time.second }}Z.tap"
|
|
mode: "0644"
|
|
delegate_to: localhost
|
|
become: false
|
|
changed_when: false
|