We believe that Ansible is the best tool around for the automation of systems management tasks, including testing. We gather periodically to share knowledge, best practices, and opportunities around Ansible. This short deck shares experience and lessons learned in a meetup group at Ordina bij Bas Meijer @bbaassssiiee #AnsibleBenelux

1. Testing with Ansible
AnsibleBenelux Meetup 2017/5/17
@bbaassssiiee

2. Bas Meijer
• Developer Support
• Cloud provisioning
• Deployment tools
• Ansible Ambassador
• Developer for fun
• @bbaassssiiee
CI/CD Specialist

3. Test scenario's
• Testing.yml playbooks
• Ansible Lint
• Component Smoke tests
• Integration Tests
• Confidence Tests
• Security Audits
Multi-purpose IT automation

4. Yaml Lint failed for one file

5. Invalid syntax: role was not found.

6. Lint finds quality issues in playbooks

7. One build step to find such problems

8. Invoke playbook after the tests

9. Component tests for RabbitMQ
config ok
no errors
port listens
web ui
api call
fully functional
server is up

10. Testing connectivity between components
test setup
local port listens
php to mysql connect with
real credentials and libraries
test teardown
client server tcp check
client-server tcp check
non-applicable test

11. 1000 sanity tests per hour, in PRODUCTION!
1000 tests per hour

12. DAILY security auditing using Ansible
compliant machine
compliant machine
compliant machine
compliant machine
compliant machine
non-compliant machine

13. - name: Copy test code template
template:
src: pdo.php.j2
dest: '/usr/local/bin/pdo.php'
mode: 0700
changed_when: no # test is not a 'real' change
tags:
- test
- name: Run mysql connect test code
command: /usr/local/bin/pdo.php
changed_when: no # test is not a 'real' change
no_log: yes # hide credentials
tags:
- test
Batteries to use in testing
script:
uri: register: registered json
stat: path: fail: when:
wait_for: delegate_to:
- name: Validate Config as an Erlang term
script: validate.escript /etc/rabbitmq/rabbitmq.config
changed_when: no
ignore_errors: "{{ continue_on_error | default(True) }}"
tags:
- test
- name: Checking startup_err logfile
stat:
path: /var/log/rabbitmq/startup_err
register: startup_err
tags:
- test
- name: skipping when startup_err is empty
fail:
when: startup_err.stat.size != 0
tags:
- test
- name: Test RabbitMQ listening port
wait_for:
port: 5672
tags:
- test
- name: Test remote connect on RabbitMQ port
delegate_to: "{{ groups['webserver'][0] }}"
wait_for:
host: "{{ groups['rabbit'][0] }}"
port: 5672
timeout: 10
tags:
- test
- name: Collecting data with rabbitmq api
uri:
url: "https://{{ inventory_hostname }}:15672/api/nodes"
return_content: yes
user: "{{ rabbitmq.administrator }}"
password: "{{ rabbitmq.users[0].password }}"
no_log: yes
register: uri_return
tags:
- test
- name: Checking rabbit_exchanges_count
fail:
when: "(uri_return.json)[0]['exchange_types']|count != rabbit_exch"
tags:
- test
template: command:
- name: Verify time synchronization
command: ntpstat
register: ntpstat
changed_when: no
ignore_errors: yes
tags:
- test
- ntp
- name: Stop ntpd as a service
service:
name: ntpd
enabled: yes
state: stopped
when: ntpstat.rc is defined and ntpstat.rc != 0
tags:
- ntp
- name: Sync the clock to the nl ntp pool
command: ntpdate 0.nl.pool.ntp.org
when: ntpstat.rc is defined and ntpstat.rc != 0
changed_when: yes
tags:
- ntp
- name: Start ntpd after syncing
service:
name: ntpd
state: started
when: ntpstat.rc is defined and ntpstat.rc != 0
tags:
- ntp
command: command.rcassert:
that:
- name: Verify if main_user is defined
assert:
that: "'{{ main_user }}' is defined"

14. Ansible
• Tested modules
• Versatile usage
• Build quality in!
• End-to-end tests
• Confidence tests
• Security audits
Multi-purpose IT tool!

15. Build Quality In!
AnsibleBenelux Meetup 2017/5/17
@bbaassssiiee

16. https://www.meetup.com/Ansible-Benelux