Downloaded 67 times
Uploaded byNathen Harvey
Effective Testing with Ansible and InSpec
The document outlines effective testing strategies using Ansible and InSpec, highlighting the importance of testing for fast development cycles, confidence, and regression prevention. It details workflows involving Test Kitchen, Ansible playbooks, and InSpec for infrastructure testing and compliance, emphasizing the need to automate tests and adhere to compliance checks. The document provides links to video tutorials and resources for implementing these testing practices in various environments.
More Related Content
Similar to Effective Testing with Ansible and InSpec
Effective Testing with Ansible and InSpec
- 1. Effective Testing withAnsible and InSpec Nathen Harvey
- 2.
- 3. @nathenharvey Today’s Journey • TestKitchen • InSpec • dev-sec.io
- 4. @nathenharvey Why Testing? • Movefast with a safety net • Decrease feedback cycles • Increase confidence • Prevent regressions • Scale
- 5. @nathenharvey Types of Testing •Static analysis • Unit testing • Integration testing • Compliance testing
- 6. @nathenharvey Testing Playbooks • Writethe playbook • Execute the playbook on a system • Verify results
- 7. @nathenharvey The Playbook - name:Updates apt cache - name: Installs necessary packages - name: Push future default virtual host configuration - name: Deploy the configuration management camp website - name: Activates the virtualhost - name: Check that the config is valid - name: Deactivates the default virtualhost - name: Deactivates the default ssl virtualhost https://github.com/turkenh/ansible-interactive-tutorial
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14. @nathenharvey The Test Kitchen driver: name:vagrant platforms: - name: ubuntu-16.04 suites: - name: default kitchen create driver
- 15.
- 16.
- 17.
- 18.
- 19. @nathenharvey Workflow • kitchen create •ansible-playbook -i hosts sites.yml • Manually verify the application kitchen create kitchen destroy driver ansible-playbook
- 20. @nathenharvey kitchen create kitchen converge kitchendestroy driver provisioner Test Kitchen
- 21. @nathenharvey Kitchen Provisioner provisioner: hosts: test-kitchen name:ansible_playbook roles_path: roles require_ansible_repo: true ansible_verbose: true ansible_version: latest require_chef_for_busser: false playbook: site.yml
- 22.
- 23.
- 24. @nathenharvey Workflow • kitchen converge •Manually verify the application kitchen create kitchen destroy driver kitchen converge provisioner
- 26. @nathenharvey InSpec • Open-source framework •Infrastructure testing • Make assertions about state of resources in the infrastructure
- 27. @nathenharvey Verify the Sitewith InSpec describe service('apache2') do it {should be_running } end describe port(80) do it { should be_listening } end describe http('http://localhost', enable_remote_worker: true) do its('status') { should cmp 200 } its('body') { should match /Configuration Management Camp/ } end
- 28. Test Locally $ inspecexec /path/to/profile
- 29. Test Remotely $ inspecexec /path/to/profile -i ssh.key -t ssh://me@myhost
- 30.
- 31. Test Remotely $ inspecexec /path/to/profile -t winrm://me@myhost --password secret
- 32. Test Remotely $ inspecexec /path/to/profile -t docker://3cc8837bb6a8
- 33.
- 34. @nathenharvey InSpec in TestKitchen
- 35.
- 36. @nathenharvey Workflow • kitchen verifykitchen create kitchen destroy driver kitchen converge provisioner kitchen verify verifier
- 37.
- 38.
- 39. @nathenharvey InSpec to DetectPolicy Violations • InSpec is great for integration testing • But it can also be used for security or compliance checks
- 40.
- 41. Map Documentation toControls control 'sox-404.3.5' do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 42. Share Context control 'sox-404.3.5'do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 43. Automate Test Execution control'sox-404.3.5' do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 44.
- 45. @nathenharvey Add Linux Baselineto Test Kitchen suites: - name: default verifier: inspec_tests: - test/integration/default - https://github.com/dev-sec/linux-baseline
- 46.
- 47. @nathenharvey So many failures •Stop when the build breaks • We need to get to green • What is the best way to get the build green?
- 48. @nathenharvey Wrap it up •Create a TODO list • One measure of technical debt • Get to green by commenting out tests?!
- 49. @nathenharvey Wrapper Profile name: my-linux-baseline title:InSpec Profile maintainer: The Authors copyright: The Authors copyright_email: you@example.com license: Apache-2.0 summary: An InSpec Compliance Profile version: 0.1.0 depends: - name: linux-baseline url: https://github.com/dev-sec/linux-baseline/archive/master.tar.gz
- 50. @nathenharvey Wrapper Profile include_controls 'linux-baseline'do skip_control 'os-05' skip_control 'package-08' skip_control 'sysctl-05' ... end
- 51.
- 52.
- 53.
- 54. @nathenharvey Add to thePlaybook - hosts: all become: true become_user: root become_method: sudo roles: - { role: apache } - { role: dev-sec.os-hardening }
- 55.
- 56.
- 57. @nathenharvey https://youtu.be/eMUuODXOymw How about thoseskipped controls?
- 58.
- 59.
- 60. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test
- 61. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy
- 62. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create
- 63. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge
- 64. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge kitchen verify
- 65. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge kitchen verify kitchen destroy
- 66.
- 67. PART OF APROCESS OF CONTINUOUS COMPLIANCE Scan for Compliance Build & Test Locally Build & Test CI/CD Remediate Verify A SIMPLE EXAMPLE OF AN INSPEC CIS RULE InSpec ▪ Translate compliance into Code ▪ Clearly express statements of policy ▪ Move risk to build/test from runtime ▪ Find issues early ▪ Write code quickly ▪ Run code anywhere ▪ Inspect machines, data and APIs Turn security and compliance into code control ‘cis-1.4.1’ do title ‘1.4.1 Enable SELinux in /etc/grub.conf’ desc ‘ Do not disable SELinux and enforcing in your GRUB configuration. These are important security features that prevent attackers from escalating their access to your systems. For reference see … ‘ impact 1.0 expect(grub_conf.param ‘selinux’).to_not eq ‘0’ expect(grub_conf.param ‘enforcing’).to_not eq ‘0’ end
- 68. @nathenharvey Get Started withInSpec • Install Chef Development Kit - https://downloads.chef.io/chefdk Test Kitchen InSpec • Install Ansible Provisioner chef gem install kitchen-ansible • Install Driver Requirements Vagrant – VirtualBox & Vagrant Docker – Docker EC2 – None, but you need an AWS account
- 69. @nathenharvey Use, Share, Contribute! •dev-sec.io - https://github.com/dev-sec/ • InSpec – https://github.com/chef/inspec • Supermarket - https://supermarket.chef.io/tools?type=compliance_profile • Test Kitchen - https://github.com/test-kitchen • Test Kitchen Ansible Provisioner - https://github.com/neillturner/kitchen-ansible • Code from this presentation - https://github.com/nathenharvey/testing-ansible- with-inspec
- 70. Join us onSlack • http://community-slack.chef.io • #general (for Chef stuff) • #inspec • #test-kitchen The Chef community believes that diversity is one of our biggest strengths! Ansible users are more than welcome here!
- 71. @nathenharvey InSpec Hacking -Tomorrow
- 72.
- 73. Thank You! Nathen Harvey VP,Community Development Chef @nathenharvey
Editor's Notes
- #16 https://youtu.be/Warn6p28spA
- #17 https://youtu.be/d14Ma-S78QE
- #18 https://youtu.be/CeJ0egGdQe8
- #19 https://youtu.be/pIbLYLp4z68
- #23 https://youtu.be/PRJi4uR2UJI
- #24 https://youtu.be/pIbLYLp4z68
- #31 https://youtu.be/TKQTEhhwS4c
- #34 https://youtu.be/6u4j57ksmSU
- #36 https://youtu.be/v8_e9l4p1K8
- #41 https://youtu.be/udomS3XyxQg
- #47 https://youtu.be/jP704Io0ikU
- #52 https://youtu.be/fp7y3Qj7vMk
- #54 https://youtu.be/eosqOmXde-8
- #56 https://youtu.be/RU4T4wIt76g
- #57 https://youtu.be/ZVn6i8Kqq_c
- #58 https://youtu.be/eMUuODXOymw
- #59 https://youtu.be/WDImV9oYQI4
- #67 https://youtu.be/BbB7lrihWtM