aboutsummaryrefslogtreecommitdiffstats
path: root/spec/classes
diff options
context:
space:
mode:
authorOliver Walsh <owalsh@redhat.com>2017-05-04 20:21:51 +0100
committerOliver Walsh <owalsh@redhat.com>2017-05-05 12:36:05 +0100
commitfe8edab1f4c761dcd6bad8eb6ccadd62627b077a (patch)
tree48c07e3f595e600c0beed8dc52b588ec698c8b12 /spec/classes
parentf8ca94a5b7c7658631f5b0a9b010251ebbcff65e (diff)
Disable SSH login for nova_migration user when migration over ssh is disabled.
If migration over ssh is enabled, and then later disabled, the ssh config for the nova_migration user remains intact. This change clobbers the migration SSH key to disable login when it is not necessary. Change-Id: Icc6d5d4f4671b3525a731d334ca6fa7c5419dac3 Closes-Bug: #1688321
Diffstat (limited to 'spec/classes')
-rw-r--r--spec/classes/tripleo_profile_base_nova_spec.rb60
1 files changed, 49 insertions, 11 deletions
diff --git a/spec/classes/tripleo_profile_base_nova_spec.rb b/spec/classes/tripleo_profile_base_nova_spec.rb
index d77ba1b..a48c94f 100644
--- a/spec/classes/tripleo_profile_base_nova_spec.rb
+++ b/spec/classes/tripleo_profile_base_nova_spec.rb
@@ -95,9 +95,8 @@ describe 'tripleo::profile::base::nova' do
is_expected.to contain_class('nova::cache')
is_expected.to contain_class('nova::placement')
is_expected.to_not contain_class('nova::migration::libvirt')
- is_expected.to contain_package('openstack-nova-migration').with(
- :ensure => 'absent'
- )
+ is_expected.to_not contain_file('/etc/nova/migration/authorized_keys')
+ is_expected.to_not contain_file('/etc/nova/migration/identity')
}
end
@@ -132,7 +131,22 @@ describe 'tripleo::profile::base::nova' do
:configure_nova => params[:nova_compute_enabled]
)
is_expected.to contain_package('openstack-nova-migration').with(
- :ensure => 'absent'
+ :ensure => 'present'
+ )
+ is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
+ :content => '# Migration over SSH disabled by TripleO',
+ :mode => '0640',
+ :owner => 'root',
+ :group => 'nova_migration',
+ )
+ is_expected.to contain_file('/etc/nova/migration/identity').with(
+ :content => '# Migration over SSH disabled by TripleO',
+ :mode => '0600',
+ :owner => 'nova',
+ :group => 'nova',
+ )
+ is_expected.to contain_user('nova_migration').with(
+ :shell => '/sbin/nologin'
)
}
end
@@ -169,7 +183,22 @@ describe 'tripleo::profile::base::nova' do
:configure_nova => params[:nova_compute_enabled],
)
is_expected.to contain_package('openstack-nova-migration').with(
- :ensure => 'absent'
+ :ensure => 'present'
+ )
+ is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
+ :content => '# Migration over SSH disabled by TripleO',
+ :mode => '0640',
+ :owner => 'root',
+ :group => 'nova_migration',
+ )
+ is_expected.to contain_file('/etc/nova/migration/identity').with(
+ :content => '# Migration over SSH disabled by TripleO',
+ :mode => '0600',
+ :owner => 'nova',
+ :group => 'nova',
+ )
+ is_expected.to contain_user('nova_migration').with(
+ :shell => '/sbin/nologin'
)
}
end
@@ -223,6 +252,9 @@ describe 'tripleo::profile::base::nova' do
}
)
is_expected.to_not contain_ssh__server__match_block('nova_migration deny')
+ is_expected.to contain_package('openstack-nova-migration').with(
+ :ensure => 'present'
+ )
is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
:content => 'ssh-rsa bar',
:mode => '0640',
@@ -235,8 +267,8 @@ describe 'tripleo::profile::base::nova' do
:owner => 'nova',
:group => 'nova',
)
- is_expected.to contain_package('openstack-nova-migration').with(
- :ensure => 'installed'
+ is_expected.to contain_user('nova_migration').with(
+ :shell => '/bin/bash'
)
}
end
@@ -297,6 +329,9 @@ describe 'tripleo::profile::base::nova' do
'DenyUsers' => 'nova_migration'
}
)
+ is_expected.to contain_package('openstack-nova-migration').with(
+ :ensure => 'present'
+ )
is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
:content => 'ssh-rsa bar',
:mode => '0640',
@@ -309,8 +344,8 @@ describe 'tripleo::profile::base::nova' do
:owner => 'nova',
:group => 'nova',
)
- is_expected.to contain_package('openstack-nova-migration').with(
- :ensure => 'installed'
+ is_expected.to contain_user('nova_migration').with(
+ :shell => '/bin/bash'
)
}
end
@@ -365,6 +400,9 @@ describe 'tripleo::profile::base::nova' do
}
)
is_expected.to_not contain_ssh__server__match_block('nova_migration deny')
+ is_expected.to contain_package('openstack-nova-migration').with(
+ :ensure => 'present'
+ )
is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
:content => 'ssh-rsa bar',
:mode => '0640',
@@ -377,8 +415,8 @@ describe 'tripleo::profile::base::nova' do
:owner => 'nova',
:group => 'nova',
)
- is_expected.to contain_package('openstack-nova-migration').with(
- :ensure => 'installed'
+ is_expected.to contain_user('nova_migration').with(
+ :shell => '/bin/bash'
)
}
end