Add unit test for newly added file_mode option.

tests/conjur_variable/policy/root.yml

@@ -12,6 +12,7 @@
 
   - &variables
     - !variable test-secret
+    - !variable test-secret-in-file
     - !variable var with spaces
 
   - !permit

tests/conjur_variable/test.sh

@@ -66,6 +66,7 @@ function setup_conjur {
   docker-compose exec -T conjur_cli bash -c '
     conjur policy load root /policy/root.yml
     conjur variable values add ansible/test-secret test_secret_password
+    conjur variable values add ansible/test-secret-in-file test_secret_in_file_password
     conjur variable values add "ansible/var with spaces" var_with_spaces_secret_password
   '
 }

tests/conjur_variable/test_cases/retrieve-variable-into-file/env

@@ -0,0 +1 @@
+export CONJUR_CERT_FILE=./conjur.pem

tests/conjur_variable/test_cases/retrieve-variable-into-file/playbook.yml

@@ -0,0 +1,14 @@
+---
+- name: Retrieve Conjur variable into file
+  hosts: localhost
+  connection: local
+  tasks:
+    - name: Clean artifact path
+      file:
+        state: absent
+        path: /conjur_secret_path.txt
+
+    - name: Retrieve Conjur variable into file using file_mode option
+      vars:
+        secret_path: "{{lookup('conjur_variable', 'ansible/test-secret-in-file', file_mode=True)}}"
+      shell: echo "{{secret_path}}" > /conjur_secret_path.txt

tests/conjur_variable/test_cases/retrieve-variable-into-file/tests/test_default.py

@@ -0,0 +1,21 @@
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
+import os
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = [os.environ['COMPOSE_PROJECT_NAME'] + '_ansible_1']
+
+
+def test_retrieved_secret(host):
+    secret_path_file = host.file('/conjur_secret_path.txt')
+    assert secret_path_file.exists
+
+    secret_path = host.check_output("cat /conjur_secret_path.txt", shell=True)
+    secret_file = host.file(secret_path)
+    assert secret_file.exists
+    assert secret_file.mode == 0o600
+
+    secret = host.check_output("cat {0}".format(secret_path), shell=True)
+    assert secret == "test_secret_in_file_password"