Skip to content

Conversation

@AndreMarcel99
Copy link
Collaborator

@AndreMarcel99 AndreMarcel99 commented Jun 11, 2025

SUMMARY

Create template on test suite and helper of user to test the next become support.

Fixes #2097

ISSUE TYPE
  • Enabler Pull Request
COMPONENT NAME

execute_managed_user_become_test Function added to the helper/users to test the managed user with limited permissions by adding the options on command line avoiding to be written direct on the code and be hardcoded.

ADDITIONAL INFORMATION

To be able to execute a playbook on the test suite with manage user required to add new functions.

Add new options to the command line to get options flexibility and avoid hard coded content.

    parser.addoption(
         "--user_adm",
         action="store",
         default=None,
         help="Str "
     )
     parser.addoption(
         "--user_method",
         action="store",
         default=None,
         help="Str "
     )
     parser.addoption(
         "--ansible_promp",
         action="store",
         default=None,
         help="Str "
     )
     parser.addoption(
         "--password",
         action="store",
         default=None,
         help="Str "
     )
     parser.addoption(
         "--ssh_key",
         action="store",
         default=None,
         help="Str "
     )

Functions to read the new configuration file for user managed test cases.
And function to store the options added on commands.

@pytest.fixture(scope="function")
 def get_config_raw(request):
     """ Call the pytest-ansible plugin to check the options on user manager test cases."""
     path = request.config.getoption("--zinventory-raw")
     yield path

 @pytest.fixture(scope='session')
 def get_config_for_become(request):
     """ Return as a dict the values to be used on the test cases for become method"""
     become_config = {
         "user" : request.config.option.user_adm,
         "method" : request.config.option.user_method,
         "promp" : request.config.option.ansible_promp,
         "key" : request.config.option.password,
         "ssh_key" : request.config.option.ssh_key
     }

Add python interpreter for ansible playbooks with become method and not the pyz.

def __init__(self, model_user: str = None, remote_host: str = None, zoau_path: str = None, pyz_path: str = None, pythonpath: str = None, volumes: str = None, python_interpreter: str=None, hostpattern: str = None) -> None:

@AndreMarcel99 AndreMarcel99 marked this pull request as ready for review June 11, 2025 16:03
richp405
richp405 previously approved these changes Jun 11, 2025
Copy link
Collaborator

@richp405 richp405 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor grammar issue. Because these are in tests, I'm assuming this should not have a changelog entry.

Add CLI options and modify options for pytest-ansible where needed.
Note: Set the default to to None, otherwise when evaluating with `request.config.getoption("--zinventory"):`
will always return true because a default will be returned.
New option have been added to the execution of the command to allow the become method.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New option has been added (not have) to allow the become method to apply to the command.

@AndreMarcel99 AndreMarcel99 added the Do not Merge When a pull request should not be merged for issue noted reasons label Jun 12, 2025
"--user_adm",
action="store",
default=None,
help="Str "
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget to add the rest of the help mesasage for all the new options

help="Str "
)
parser.addoption(
"--ansible_promp",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would change this one to --ansible-prompt

help="Str - dictionary with values {'host': 'ibm.com', 'user': 'root', 'zoau': '/usr/lpp/zoau', 'pyz': '/usr/lpp/IBM/pyz'}",
)
parser.addoption(
"--user_adm",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this one could also be --super-user

help="Str "
)
parser.addoption(
"--password",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really need both password and ssh-key? It looks like they are basically the same, a way to give tests access to an ssh key file

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Do not Merge When a pull request should not be merged for issue noted reasons

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Enabler] [Tests] Research and implement a way to test privilege escalation in the collection

4 participants