95e3361598
The conformance checker existed but had not run since 2026-03-09, and its firewall assertion matched /6443\/tcp.*ALLOW/ - asserting the port was allowed but not from whom. It passed identically whether the API was restricted to one operator address or open to the entire internet, which is precisely the drift that went undetected. goss/baseline.yaml is now a template rendered per host from the same inventory declaration that converges the host, so the assertion cannot drift from what it checks. It asserts each declared source is present, that no revoked source retains access, and that 6443 is never ALLOW Anywhere. verify.yaml gained the vars_files the bootstrap play already had - without it the firewall assertions rendered empty and silently asserted nothing, which is worse than no check. Result on Railiance01: 32 assertions, 31 pass. The one failure is a real find and is recorded as T06 - Flannel VXLAN is declared open to Anywhere with no source restriction, the same defect pattern as the k3s rule. It is currently absent from the host, so converging would INTRODUCE the exposure rather than fix drift. Must be resolved before RAIL-BS-WP-0007 multi-node HA needs working VXLAN. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
17 lines
495 B
YAML
17 lines
495 B
YAML
---
|
|
# verify.yaml — Deploy Goss, run baseline assertions, fetch TAP results.
|
|
# Exit code mirrors Goss: 0 = all pass, non-zero = failures.
|
|
#
|
|
# Usage:
|
|
# ansible-playbook ansible/playbooks/verify.yaml -u admin
|
|
# make verify
|
|
|
|
- hosts: all
|
|
become: true
|
|
gather_facts: true
|
|
# Same declaration the bootstrap play converges from. Without this the
|
|
# firewall assertions render empty and silently assert nothing.
|
|
vars_files:
|
|
- ../inventory/group_vars/all.yaml
|
|
roles:
|
|
- role: goss
|