Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add nbde_client role #3

Merged
merged 48 commits into from Jun 12, 2020

Conversation

sergio-correia
Copy link
Member

No description provided.

@sergio-correia sergio-correia force-pushed the add-nbde-client-role branch 2 times, most recently from 9adac40 to da6ceb6 Compare June 2, 2020 05:28
@sergio-correia sergio-correia marked this pull request as draft June 2, 2020 15:47
Copy link
Contributor

@richm richm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in general, looks good - would like to get another reviewer from the system roles team (@pcahyna , @nhosoi), and someone familiar with the clevis cli tools

library/nbde_client_clevis.py Show resolved Hide resolved
library/nbde_client_clevis.py Outdated Show resolved Hide resolved
library/nbde_client_clevis.py Outdated Show resolved Hide resolved
@richm
Copy link
Contributor

richm commented Jun 2, 2020

Also, please review the travis CI test failures

@sergio-correia
Copy link
Member Author

Also, please review the travis CI test failures

Yeah, this seems more complex to get running correctly. I would appreciate help here.

@sergio-correia
Copy link
Member Author

Thanks for the first review, @richm; I will update this shortly.

@richm
Copy link
Contributor

richm commented Jun 3, 2020

Also, please review the travis CI test failures

Yeah, this seems more complex to get running correctly. I would appreciate help here.

If you just want to skip black and flake8 and pylint for now - see https://github.com/linux-system-roles/nbde_client/blob/master/.travis/config.sh - e.g. edit the file to set

export RUN_PYLINT_DISABLED=true
export RUN_BLACK_DISABLED=true
export RUN_FLAKE8_DISABLED=true

For black - if you want black to format your code - edit tox.ini like this:

commands =
#    bash {toxinidir}/.travis/runblack.sh --check --diff .
    bash {toxinidir}/.travis/runblack.sh .

then run tox -e black - black will reformat your python code to be conformant. Then revert tox.ini.

You can also review the linter issues - you can edit the various config files to completely disable that particular issue (e.g. disabling line length checking is probably the biggest one). The config.sh variables such as RUN_BLACK_EXTRA_ARGS and RUN_FLAKE8_EXTRA_ARGS can be used to pass suppressions on the command line to those programs.

You can also use code comments to suppress specific occurrences.

@sergio-correia sergio-correia marked this pull request as ready for review June 5, 2020 02:38
@sergio-correia
Copy link
Member Author

@richm: I have removed the pytest test for now and added playbook-based tests. I will work on pytest next week. I believe this should be ready for review now.

README.md Outdated Show resolved Hide resolved
handlers/main.yml Outdated Show resolved Hide resolved
tasks/main-clevis.yml Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
Also updates documentation/examples/tests accordingly.
Update documentation/examples/tests accordingly.
README.md Outdated
`nbde_client_bindings` is a list of dictionaries that support the following keys:
| **Name** | **Default/Choices** | **Description** |
|----------|-------------|------|
| `device` | | specifies the path of the backing of an encrypted device in the managed host. This device must be already configured as a LUKS device before using the role (**REQUIRED**). |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"of the backing" - backing what? shouldn't it read "of the backing device"?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dwlehman what do you think?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated this to use "of the backing device"

README.md Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
defaults/main.yml Outdated Show resolved Hide resolved
defaults/main.yml Outdated Show resolved Hide resolved
tasks/main-clevis.yml Outdated Show resolved Hide resolved
tasks/main-clevis.yml Outdated Show resolved Hide resolved
tasks/main-clevis.yml Outdated Show resolved Hide resolved
To be consistent across our other system roles (e.g. storage)
It now refers to the README, which is the actual documentation.
No need to have __nbde_client_managed_dir anymore.
---
- name: Include general tests variables
include_vars: main.yml

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

prefer only 1 empty line between tasks instead of 2

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a way to enforce this in yamllint?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a way to enforce this in yamllint?

not sure - will investigate

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm - I don't think this is a yaml thing, I think it is an ansible thing - https://docs.ansible.com/ansible-lint/ doesn't seem to have a check for that @pcahyna @tyll do you know if there is a linter for this? OTOH, I don't recall if 'one blank line between tasks' is in any of the best practices, but it is a common convention.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I hear about this for the first time. Would be great to have a linter or actually formatter for this.

Remove extra new lines
state: present


- name: Prepare key files, perform clevis operations and dispose of key files
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this role idempotent? If you run the role again with the same nbde_client_bindings, will it do all of these steps again, and report that something changed? If so, I'm not sure how to prevent that from happening - how would you know ahead of time that you have already brought the managed hosts to the desired state? I realize it may be a little late for this particular PR, and I apologize for not noticing this sooner, so perhaps we can address this in a subsequent PR if necessary.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not fully. We discovered an issue with at least passphrase_temporary, which will be addressed after the initial merge.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pcahyna opened #4 to track this issue.

README.md Outdated Show resolved Hide resolved
passphrase_etmporary -> passphrase_temporary
README.md Outdated Show resolved Hide resolved
@richm richm merged commit 01db689 into linux-system-roles:master Jun 12, 2020
@sergio-correia sergio-correia deleted the add-nbde-client-role branch June 23, 2020 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs-ci trigger CI testing
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants