Effective Testing with Ansible and InSpec
•Download as PPTX, PDF•
13 likes•7,815 views
Ansible is an incredibly easy way to manage infrastructure and configuration. But what's the best way to ensure the changes to your Ansible playbooks have the intended outcome and do not introduce unwanted changes? And how can you verify your your playbook changes do not negatively impact the compliance status of your infrastructure? In this session, we will learn about InSpec and how it's incredibly easy-to-read language allows for integration and compliance requirements to be expressed as code. We will look at how Test Kitchen and InSpec can be used to validate your Ansible playbooks and empower developers to test for compliance earlier in the development cycle. Additionally, we will also explore how to use and modify InSpec profiles created by others.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Effective Testing with Ansible and InSpec
Similar to Effective Testing with Ansible and InSpec (20)
More from Nathen Harvey
More from Nathen Harvey (11)
Recently uploaded
Recently uploaded (20)
Effective Testing with Ansible and InSpec
- 1. Effective Testing with Ansible and InSpec Nathen Harvey
- 3. @nathenharvey Today’s Journey • Test Kitchen • InSpec • dev-sec.io
- 4. @nathenharvey Why Testing? • Move fast with a safety net • Decrease feedback cycles • Increase confidence • Prevent regressions • Scale
- 5. @nathenharvey Types of Testing • Static analysis • Unit testing • Integration testing • Compliance testing
- 6. @nathenharvey Testing Playbooks • Write the playbook • Execute the playbook on a system • Verify results
- 7. @nathenharvey The Playbook - name: Updates apt cache - name: Installs necessary packages - name: Push future default virtual host configuration - name: Deploy the configuration management camp website - name: Activates the virtualhost - name: Check that the config is valid - name: Deactivates the default virtualhost - name: Deactivates the default ssl virtualhost https://github.com/turkenh/ansible-interactive-tutorial
- 14. @nathenharvey The Test Kitchen driver: name: vagrant platforms: - name: ubuntu-16.04 suites: - name: default kitchen create driver
- 19. @nathenharvey Workflow • kitchen create • ansible-playbook -i hosts sites.yml • Manually verify the application kitchen create kitchen destroy driver ansible-playbook
- 20. @nathenharvey kitchen create kitchen converge kitchen destroy driver provisioner Test Kitchen
- 21. @nathenharvey Kitchen Provisioner provisioner: hosts: test-kitchen name: ansible_playbook roles_path: roles require_ansible_repo: true ansible_verbose: true ansible_version: latest require_chef_for_busser: false playbook: site.yml
- 24. @nathenharvey Workflow • kitchen converge • Manually verify the application kitchen create kitchen destroy driver kitchen converge provisioner
- 26. @nathenharvey InSpec • Open-source framework • Infrastructure testing • Make assertions about state of resources in the infrastructure
- 27. @nathenharvey Verify the Site with InSpec describe service('apache2') do it {should be_running } end describe port(80) do it { should be_listening } end describe http('http://localhost', enable_remote_worker: true) do its('status') { should cmp 200 } its('body') { should match /Configuration Management Camp/ } end
- 28. Test Locally $ inspec exec /path/to/profile
- 29. Test Remotely $ inspec exec /path/to/profile -i ssh.key -t ssh://me@myhost
- 30. @nathenharvey https://youtu.be/TKQTEhhwS4c Execute InSpec on Remote Target
- 31. Test Remotely $ inspec exec /path/to/profile -t winrm://me@myhost --password secret
- 32. Test Remotely $ inspec exec /path/to/profile -t docker://3cc8837bb6a8
- 34. @nathenharvey InSpec in Test Kitchen
- 36. @nathenharvey Workflow • kitchen verify kitchen create kitchen destroy driver kitchen converge provisioner kitchen verify verifier
- 38. @nathenharvey
- 39. @nathenharvey InSpec to Detect Policy Violations • InSpec is great for integration testing • But it can also be used for security or compliance checks
- 40. @nathenharvey https://youtu.be/udomS3XyxQg Assert telnetd is not installed
- 41. Map Documentation to Controls control 'sox-404.3.5' do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 42. Share Context control 'sox-404.3.5' do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 43. Automate Test Execution control 'sox-404.3.5' do title 'Network Device to Central Auth Encryption' impact 1.0 desc " All communication between network devices and central auth must be encrypted. Our TACACS+ servers encrypt all the time and the presence of a pre-shared key proves it." describe ini('/etc/tac_plus/tac_plus.conf') do its('key') { should_not be_nil } end end 404.3.5: Communication between network devices and central authentication systems must be encrypted at all times.
- 45. @nathenharvey Add Linux Baseline to Test Kitchen suites: - name: default verifier: inspec_tests: - test/integration/default - https://github.com/dev-sec/linux-baseline
- 47. @nathenharvey So many failures • Stop when the build breaks • We need to get to green • What is the best way to get the build green?
- 48. @nathenharvey Wrap it up • Create a TODO list • One measure of technical debt • Get to green by commenting out tests?!
- 49. @nathenharvey Wrapper Profile name: my-linux-baseline title: InSpec Profile maintainer: The Authors copyright: The Authors copyright_email: you@example.com license: Apache-2.0 summary: An InSpec Compliance Profile version: 0.1.0 depends: - name: linux-baseline url: https://github.com/dev-sec/linux-baseline/archive/master.tar.gz
- 50. @nathenharvey Wrapper Profile include_controls 'linux-baseline' do skip_control 'os-05' skip_control 'package-08' skip_control 'sysctl-05' ... end
- 54. @nathenharvey Add to the Playbook - hosts: all become: true become_user: root become_method: sudo roles: - { role: apache } - { role: dev-sec.os-hardening }
- 57. @nathenharvey https://youtu.be/eMUuODXOymw How about those skipped controls?
- 60. @nathenharvey kitchen create kitchen converge kitchen verify kitchen destroy driver provisioner Test Kitchen kitchen test
- 61. @nathenharvey kitchen create kitchen converge kitchen verify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy
- 62. @nathenharvey kitchen create kitchen converge kitchen verify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create
- 63. @nathenharvey kitchen create kitchen converge kitchen verify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge
- 64. @nathenharvey kitchen create kitchen converge kitchen verify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge kitchen verify
- 65. @nathenharvey kitchen create kitchen converge kitchen verify kitchen destroy driver provisioner Test Kitchen kitchen test kitchen destroy kitchen create kitchen converge kitchen verify kitchen destroy
- 67. PART OF A PROCESS OF CONTINUOUS COMPLIANCE Scan for Compliance Build & Test Locally Build & Test CI/CD Remediate Verify A SIMPLE EXAMPLE OF AN INSPEC CIS RULE InSpec ▪ Translate compliance into Code ▪ Clearly express statements of policy ▪ Move risk to build/test from runtime ▪ Find issues early ▪ Write code quickly ▪ Run code anywhere ▪ Inspect machines, data and APIs Turn security and compliance into code control ‘cis-1.4.1’ do title ‘1.4.1 Enable SELinux in /etc/grub.conf’ desc ‘ Do not disable SELinux and enforcing in your GRUB configuration. These are important security features that prevent attackers from escalating their access to your systems. For reference see … ‘ impact 1.0 expect(grub_conf.param ‘selinux’).to_not eq ‘0’ expect(grub_conf.param ‘enforcing’).to_not eq ‘0’ end
- 68. @nathenharvey Get Started with InSpec • Install Chef Development Kit - https://downloads.chef.io/chefdk Test Kitchen InSpec • Install Ansible Provisioner chef gem install kitchen-ansible • Install Driver Requirements Vagrant – VirtualBox & Vagrant Docker – Docker EC2 – None, but you need an AWS account
- 69. @nathenharvey Use, Share, Contribute! • dev-sec.io - https://github.com/dev-sec/ • InSpec – https://github.com/chef/inspec • Supermarket - https://supermarket.chef.io/tools?type=compliance_profile • Test Kitchen - https://github.com/test-kitchen • Test Kitchen Ansible Provisioner - https://github.com/neillturner/kitchen-ansible • Code from this presentation - https://github.com/nathenharvey/testing-ansible- with-inspec
- 70. Join us on Slack • http://community-slack.chef.io • #general (for Chef stuff) • #inspec • #test-kitchen The Chef community believes that diversity is one of our biggest strengths! Ansible users are more than welcome here!
- 71. @nathenharvey InSpec Hacking - Tomorrow
- 72. @nathenharvey
- 73. Thank You! Nathen Harvey VP, Community Development Chef @nathenharvey
Editor's Notes
- https://youtu.be/Warn6p28spA
- https://youtu.be/d14Ma-S78QE
- https://youtu.be/CeJ0egGdQe8
- https://youtu.be/pIbLYLp4z68
- https://youtu.be/PRJi4uR2UJI
- https://youtu.be/pIbLYLp4z68
- https://youtu.be/TKQTEhhwS4c
- https://youtu.be/6u4j57ksmSU
- https://youtu.be/v8_e9l4p1K8
- https://youtu.be/udomS3XyxQg
- https://youtu.be/jP704Io0ikU
- https://youtu.be/fp7y3Qj7vMk
- https://youtu.be/eosqOmXde-8
- https://youtu.be/RU4T4wIt76g
- https://youtu.be/ZVn6i8Kqq_c
- https://youtu.be/eMUuODXOymw
- https://youtu.be/WDImV9oYQI4
- https://youtu.be/BbB7lrihWtM