Downloaded 20 times
Uploaded byNathen Harvey
Effective Testing with Ansible and InSpec
The document discusses effective testing methodologies using Ansible and InSpec, emphasizing the benefits of testing for safety, confidence, and regression prevention. It covers various types of testing, workflows with Test Kitchen, and integration of InSpec for infrastructure compliance testing. The document also provides examples of playbooks, testing scenarios, and resources for further learning in the field of infrastructure testing and compliance.
More Related Content
Similar to Effective Testing with Ansible and InSpec
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Effective Testing with Ansible and InSpec
- 1. Effective Testing withAnsible and InSpec Nathen Harvey
- 2.
- 3.
- 4.
- 5. @nathenharvey Why Testing? • Movefast with a safety net • Decrease feedback cycles • Increase confidence • Prevent regressions • Scale
- 6. @nathenharvey Types of Testing •Static analysis - https://github.com/willthames/ansible-lint • Unit testing • Integration testing • Compliance testing
- 7. @nathenharvey Testing Playbooks • Writethe playbook • Execute the playbook on a system • Verify results
- 8. @nathenharvey The Playbook - name:Updates apt cache - name: Installs necessary packages - name: Push future default virtual host configuration - name: Deploy the configuration management camp website - name: Activates the virtualhost - name: Check that the config is valid - name: Deactivates the default virtualhost - name: Deactivates the default ssl virtualhost https://github.com/turkenh/ansible-interactive-tutorial
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15. @nathenharvey The Test Kitchen driver: name:vagrant platforms: - name: ubuntu-16.04 suites: - name: default kitchen create driver
- 16.
- 17.
- 18.
- 19.
- 20. @nathenharvey Workflow • kitchen create •ansible-playbook -i hosts sites.yml • Manually verify the application kitchen create kitchen destroy driver ansible-playbook
- 21. @nathenharvey kitchen create kitchen converge kitchendestroy driver provisioner Test Kitchen
- 22. @nathenharvey Kitchen Provisioner provisioner: hosts: test-kitchen name:ansible_playbook roles_path: roles require_ansible_repo: true ansible_verbose: true ansible_version: latest require_chef_for_busser: false playbook: site.yml
- 23.
- 24.
- 25. @nathenharvey Workflow • kitchen converge •Manually verify the application kitchen create kitchen destroy driver kitchen converge provisioner
- 27. @nathenharvey InSpec • Open-source framework •Infrastructure testing • Make assertions about state of resources in the infrastructure
- 28. @nathenharvey Verify the Sitewith InSpec describe service('apache2') do it { should be_running } end describe port(80) do it { should be_listening } end describe http('http://localhost', enable_remote_worker: true) do its('status') { should cmp 200 } its('body') { should match /Configuration Management Camp/ } end
- 29. Test Locally $ inspecexec /path/to/profile
- 30. Test Remotely $ inspecexec /path/to/profile -i ssh.key -t ssh://me@myhost
- 31.
- 32. Test Remotely $ inspecexec /path/to/profile -t winrm://me@myhost --password secret
- 33. Test Remotely $ inspecexec /path/to/profile -t docker://3cc8837bb6a8
- 34.
- 35. @nathenharvey InSpec in TestKitchen
- 36.
- 37. @nathenharvey Workflow • kitchen verifykitchen create kitchen destroy driver kitchen converge provisioner kitchen verify verifier
- 38.
- 39.
- 40. @nathenharvey InSpec to DetectPolicy Violations • InSpec is great for integration testing • But it can also be used for security or compliance checks
- 41.
- 42. Map Documentation toControls control 'sox-404.3.5' do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 43. Share Context control 'sox-404.3.5'do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 44. Automate Test Execution control'sox-404.3.5' do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 45.
- 46. @nathenharvey Add Linux Baselineto Test Kitchen suites: - name: default verifier: inspec_tests: - test/integration/default - https://github.com/dev-sec/linux-baseline
- 47.
- 48. @nathenharvey So many failures •Stop when the build breaks • We need to get to green • What is the best way to get the build green?
- 49. @nathenharvey Wrap it up •Create a TODO list • One measure of technical debt • Get to green by commenting out tests?!
- 50. @nathenharvey Wrapper Profile name: my-linux-baseline title:InSpec Profile maintainer: The Authors copyright: The Authors copyright_email: you@example.com license: Apache-2.0 summary: An InSpec Compliance Profile version: 0.1.0 depends: - name: linux-baseline url: https://github.com/dev-sec/linux-baseline/archive/master.tar.gz
- 51. @nathenharvey Wrapper Profile include_controls 'linux-baseline'do skip_control 'os-05' skip_control 'package-08' skip_control 'sysctl-05' ... end
- 52.
- 53.
- 54.
- 55. @nathenharvey Add to thePlaybook - hosts: all become: true become_user: root become_method: sudo roles: - { role: apache } - { role: dev-sec.os-hardening }
- 56.
- 57.
- 58. @nathenharvey https://youtu.be/eMUuODXOymw How about thoseskipped controls?
- 59.
- 60.
- 61. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test
- 62. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy
- 63. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create
- 64. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge
- 65. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge kitchen verify
- 66. @nathenharvey kitchen create kitchen converge kitchenverify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge kitchen verify kitchen destroy
- 67.
- 68. PART OF APROCESS OF CONTINUOUS COMPLIANCE Scan for Compliance Build & Test Locally Build & Test CI/CD Remediate Verify A SIMPLE EXAMPLE OF AN INSPEC CIS RULE InSpec ▪ Translate compliance into Code ▪ Clearly express statements of policy ▪ Move risk to build/test from runtime ▪ Find issues early ▪ Write code quickly ▪ Run code anywhere ▪ Inspect machines, data, and APIs Turn security and compliance into code control 'cis-1.4.1' do title '1.4.1 Enable SELinux in /etc/grub.conf’ desc ' Do not disable SELinux and enforcing in your GRUB configuration. These are important security features that prevent attackers from escalating their access to your systems. For reference see … ' impact 1.0 expect(grub_conf.param 'selinux').to_not eq '0' expect(grub_conf.param 'enforcing').to_not eq '0' end
- 69.
- 70. @nathenharvey Get Started withInSpec • Install Chef Development Kit - https://downloads.chef.io/chefdk Test Kitchen InSpec • Install Ansible Provisioner chef gem install kitchen-ansible • Install Driver Requirements Vagrant – VirtualBox & Vagrant Docker – Docker EC2 – None, but you need an AWS account
- 71. @nathenharvey Use, Share, Contribute! •dev-sec.io - https://github.com/dev-sec/ • InSpec – https://github.com/chef/inspec • Supermarket - https://supermarket.chef.io/tools?type=compliance_profile • Test Kitchen - https://github.com/test-kitchen • Test Kitchen Ansible Provisioner - https://github.com/neillturner/kitchen-ansible • Code from this presentation - https://github.com/nathenharvey/testing-ansible- with-inspec
- 72. Join us onSlack • http://community-slack.chef.io • #general (for Chef stuff) • #inspec • #test-kitchen The Chef community believes that diversity is one of our biggest strengths! Ansible users are more than welcome here!
- 73.
- 74.
- 75.
- 76. @nathenharvey kitchen-dokken • The onlyTest Kitchen plugin that enables multi-host test suites. • Ansible support?
- 77. @nathenharvey kitchen-dokken • The onlyTest Kitchen plugin that enables multi-host test suites. • Ansible support?
- 78.
- 79.
- 80.
- 81.
- 82. @nathenharvey TODO • Rewrite thistalk – Molecule now supports InSpec! • https://github.com/metacloud/molecule/issues/1072
- 83. Thank You! Nathen Harvey VP,Community Development Chef @nathenharvey
Editor's Notes
- #17 https://youtu.be/Warn6p28spA
- #18 https://youtu.be/d14Ma-S78QE
- #19 https://youtu.be/CeJ0egGdQe8 ansible-playbook -i hosts site.yml
- #20 https://youtu.be/pIbLYLp4z68
- #24 https://youtu.be/PRJi4uR2UJI
- #25 https://youtu.be/pIbLYLp4z68
- #32 https://youtu.be/TKQTEhhwS4c
- #35 https://youtu.be/6u4j57ksmSU
- #37 https://youtu.be/v8_e9l4p1K8
- #42 https://youtu.be/udomS3XyxQg
- #48 https://youtu.be/jP704Io0ikU
- #53 https://youtu.be/fp7y3Qj7vMk
- #55 https://youtu.be/eosqOmXde-8
- #57 https://youtu.be/RU4T4wIt76g
- #58 https://youtu.be/ZVn6i8Kqq_c
- #59 https://youtu.be/eMUuODXOymw
- #60 https://youtu.be/WDImV9oYQI4
- #68 https://youtu.be/BbB7lrihWtM
- #70 Let’s look at all of this in practice… This is a screen shot from a customer. We cannot say who the customer is. Never mention their name even if you think you know who they are. I’m not telling you who they are.