Repository navigation
feat(roles/curaline): add role and playbook - #448
Merged
Merged
Conversation
Install and configure the curaLINE Client of Swisscom as cdr-client.service. The client is downloaded on the controller, runs as an own system account, and its connectors are a combined list variable that also drives the folders the role creates.
Runs on all eight targets of COMPATIBILITY.md. verify.yml asks the running client for its health, version, schedule delay and watched folder, and on the RHEL family checks that SELinux is enforcing and the client runs in unconfined_service_t.
…t with the Debian package Add `curaline__user` and `curaline__group`, so the client can run under the `hnet` account of an existing H-Net SecureClient installation. An existing user is taken over unchanged, and existing connector folders keep their owner and mode. The systemd unit now follows the one of the Debian package (name, directories, HOME), but with a static user instead of `DynamicUser=yes` and explicit sandboxing.
Move the existing scenario to `curaline/install` and add `curaline/hnet`, which prepares a host like an H-Net SecureClient installation and verifies that the role takes it over without changing the account or the existing folders.
# Conflicts: # CHANGELOG.md
…that hosts with the Debian package are not supported
…s, the effect of renew_credential and the SELinux label of downloads
…n values and name the failing check The single assert is split so the abort names the failing condition and the actual value. Comments are wrapped and the unit template comment no longer contradicts the unsupported Debian package.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the
curalinerole and playbook, which install and configure the curaLINE Client (cdr-client) of Swisscom asswisscom-schweiz-ag-cdr-client.service, plus two Molecule scenarios.curaline__user/curaline__group, by defaultswisscom-schweiz-ag-cdr-clientlike the Debian package. A missing account is created as a system user; an existing one, such ashnetof an H-Net SecureClient installation, is taken over unchanged. Existing connector folders keep their owner and mode.$HOMEin/var/lib/swisscom-schweiz-ag/cdr-client), but with a static user instead ofDynamicUser=yesand the implied sandboxing set explicitly (ProtectSystem=strict,ReadWritePaths=for the installation, configuration and connector folders).curaline__connectors__*_var, merged onconnector-id+mode). The folders the role creates are derived from it.curaline__renew_credentialdefaults tofalse(upstream:true),curaline__local_folderto/data/cdr-inflight(upstream:${java.io.tmpdir}, which is emptied on every restart because ofPrivateTmp=yes). Both deviations are documented.bin_tfile context on the client'sbindirectory (community.general.sefcontextplusrestorecon), also on--tags curaline:update.COMPATIBILITY.md: all eight OS columns arex. The client is only published forx86_64.Test plan:
molecule test --scenario-name curaline/installandcuraline/hneton Debian 12 and 13, Rocky 8, 9 and 10, Ubuntu 22.04, 24.04 and 26.04: converge, verify, idempotence and verify again pass.verify.ymlasks the running client for its health, version, schedule delay and watched folder, checks the process user, and on Rocky checks that SELinux is enforcing and the client runs inunconfined_service_t. Thehnetscenario also checks that the existing account, folder modes anduser_home_tlabels stay untouched.--tags curaline:updateon its own (Rocky 9, SELinux enforcing).renew_credential, missing folders, reboot,--check --diff(secret not shown),curaline__service_state: 'stopped'.ansible-lint,yamllint,tests/unit/test_playbooks.py