main.yml

---
# vim: set ft=ansible:
#
# Logging
#   Running the playbook will automatically create a test result file in the
#   playbook directory called admin-unlock-results.log.
#
#   To disable result logging, run this playbook with the following option:
#     -e log_results=false
#
#   To change the log file name and location run with the following option:
#     -e result_file=/your/file.log
#
# Core Functionality
#   Verify rpms can installed and uninstalled after ostree admin unlock
#   Verify overlayfs is created after running ostree admin unlock
#     (use mount command verify presence of overlayfs mount)
#   Verify ostree admin status indicates "Unlocked: development" after running
#     ostree admin unlock
#   Verify that changes to deployment after ostree admin unlock do not persist
#     through reboot.
#   Verify overlayfs is removed (use mount command verify absence of overlayfs
#       mount)
#   Verify ostree admin status does not show locked deployment
#   Verify rpms can be installed and uninstalled after ostree admin unlock
#     --hotfix and changes persist through reboot.
#   Verify ostree admin status indicates "Unlocked: hotfix"
#   Verify a clone of the current deployment is added to the deployment
#   Use rpm-ostree status to verify there are two deployments with the same
#     commit ID
#   Verify overlayfs is created (use mount command verify presence of overlayfs
#      mount)
#   Verify rpms can still be installed and uninstalled after reboot
#   Verify ostree admin unlock --hotfix overwrites any other deployment already
#      on the system
#   Verify rollback between hotfixed deployment and regular deployment
# NOT TESTED:
#   Verify upgrade from hotfixed deployment
#     Upgrade should be successful
#     Packages installed in previous unlocked deployment should not be present
#       in the upgraded deployment
#
# Negative Testing
#   Verify rpms cannot be installed without ostree admin unlock
#   Run ostree admin unlock twice.  Verify that an error message specifying
#     that the deployment is already in an unlocked state: development
#   Run ostree admin unlock, then ostree admin unlock --hotfix.  Verify that
#     an error message specifying that the deployment is already in an unlocked
#     state: development
#   Run ostree admin unlock --hotfix twice.  Verify that an error message
#     specifying that the deployment is already in an unlocked state: hotfix
#   Run ostree admin unlock --hotfix then ostree admin unlock.  Verify that an
#     error message specifying that the deployment is already in an unlocked
#     state: hotfix

- name: Ostree Admin Unlock - Test Suite
  hosts: all
  become: true

  vars_files:
    - vars.yml

  vars:
    tests: []

  tasks:
    - name: Set logging
      set_fact:
        log_results: true
        result_file: "{{ playbook_dir }}/admin-unlock-result.log"
      tags: setup

    - include_tasks: 'setup.yml'
      tags: setup

    # TEST
    # Verify installed/removed packages do not persist through reboot with unlock
    - block:
        - include_tasks: 'add_remove_package_non_persistence.yml'
        - set_fact:
            tests: "{{ tests + [ { 'name':'Add/Remove Package - Non Persistence', 'result':'Passed', 'result_details': '' } ] }}"
      rescue:
        - set_fact:
            tests: "{{ tests + [ { 'name':'Add/Remove Package - Non Persistence', 'result':'Failed', 'result_details': ansible_failed_result } ] }}"
      tags: add_remove_package_non_persistence

    # TEST
    # Verify installed/removed packages persist through reboot with hotfix unlock
    - block:
        - include_tasks: 'add_remove_package_persistence.yml'
        - set_fact:
            tests: "{{ tests + [ { 'name':'Add/Remove Package - Persistence', 'result':'Passed', 'result_details': '' } ] }}"
      rescue:
        - set_fact:
            tests: "{{ tests + [ { 'name':'Add/Remove Package - Persistence', 'result':'Failed', 'result_details': ansible_failed_result } ] }}"
      tags: add_remove_package_persistence

    # TEST
    # Verify rollback to original deployment after hotfix unlock
    - block:
        - include_tasks: 'hotfix_rollback.yml'
        - set_fact:
            tests: "{{ tests + [ { 'name':'Hotfix rollback', 'result':'Passed', 'result_details': '' } ] }}"
      rescue:
        - set_fact:
            tests: "{{ tests + [ { 'name':'Hotfix rollback', 'result':'Failed', 'result_details': ansible_failed_result } ] }}"
      tags: hotfix_rollback

    # TEST
    # Verify no packages can be installed wihtout unlock
    - block:
        - include_tasks: 'no_install_without_unlock.yml'
        - set_fact:
            tests: "{{ tests + [ { 'name':'No install without unlock', 'result':'Passed', 'result_details': '' } ] }}"
      rescue:
        - set_fact:
            tests: "{{ tests + [ { 'name':'No install without unlock', 'result':'Failed', 'result_details': ansible_failed_result } ] }}"
      tags: no_install_without_unlock

    # TEST
    # Verify unlocking twice causes error
    - block:
        - include_tasks: 'unlock_twice_error.yml'
        - set_fact:
            tests: "{{ tests + [ { 'name':'Unlock twice error', 'result':'Passed', 'result_details': '' } ] }}"
      rescue:
        - set_fact:
            tests: "{{ tests + [ { 'name':'Unlock twice error', 'result':'Failed', 'result_details': ansible_failed_result } ] }}"
      tags: unlock_twice_error

    # TEST
    # Verify hotfix unlocking twice causes error
    - block:
        - include_tasks: 'unlock_twice_hotfix_error.yml'
        - set_fact:
            tests: "{{ tests + [ { 'name':'Unlock twice hotfix error', 'result':'Passed', 'result_details': '' } ] }}"
      rescue:
        - set_fact:
            tests: "{{ tests + [ { 'name':'Unlock twice hotfix error', 'result':'Failed', 'result_details': ansible_failed_result } ] }}"
      tags:  unlock_twice_hotfix_error

    # CLEANUP
    - block:
        - include_tasks: 'cleanup.yml'
        - set_fact:
            tests: "{{ tests + [ { 'name': 'Cleanup', 'result':'Passed', 'result_details': '' } ] }}"
      rescue:
        - set_fact:
            tests: "{{ tests + [ { 'name':'Cleanup', 'result':'Failed', 'result_details': ansible_failed_result } ] }}"
      always:
        # WRITE RESULTS TO FILE
        - name: Remove existing log files
          local_action: file path={{ result_file }} state=absent
          become: false

        - name: Save result to file
          when: log_results
          local_action: copy content={{ tests | to_nice_yaml(indent=2) }} dest={{ result_file }}
          become: false
      tags: cleanup

    # Handled exceptions show up as failures in Ansible but the playbook
    # itself does not return 0, so explicitly fail the test by checking
    # the test results
    - name: Explicitly fail based on test results
      when: item['result']|lower == "failed"
      fail:
        msg: "Failure found in test"
      with_items: "{{ tests }}"