mirror of
https://github.com/inspec/inspec
synced 2025-03-05 07:47:33 +00:00
clanup for merge
This commit is contained in:
parent
cdbe8c1016
commit
8f20ba38f5
12 changed files with 0 additions and 645 deletions
11
.gitignore
vendored
11
.gitignore
vendored
|
@ -1,11 +0,0 @@
|
|||
.envrc
|
||||
.ruby-version
|
||||
.direnv
|
||||
Gemfile.lock
|
||||
inspec.lock
|
||||
.kitchen
|
||||
*.plan
|
||||
*.tfstate*
|
||||
local
|
||||
.vscode
|
||||
.terraform
|
2
.rspec
2
.rspec
|
@ -1,2 +0,0 @@
|
|||
--color
|
||||
--require spec_helper
|
76
.rubocop.yml
76
.rubocop.yml
|
@ -1,76 +0,0 @@
|
|||
---
|
||||
AllCops:
|
||||
Exclude:
|
||||
- Gemfile
|
||||
- Rakefile
|
||||
- 'test/**/*'
|
||||
- 'examples/**/*'
|
||||
- 'vendor/**/*'
|
||||
- 'lib/bundles/inspec-init/templates/**/*'
|
||||
Documentation:
|
||||
Enabled: false
|
||||
AlignParameters:
|
||||
Enabled: true
|
||||
Encoding:
|
||||
Enabled: true
|
||||
HashSyntax:
|
||||
Enabled: true
|
||||
ClassLength:
|
||||
Max: 200
|
||||
LineLength:
|
||||
Enabled: false
|
||||
EmptyLinesAroundBlockBody:
|
||||
Enabled: false
|
||||
MethodLength:
|
||||
Max: 40
|
||||
NumericLiterals:
|
||||
MinDigits: 10
|
||||
Metrics/CyclomaticComplexity:
|
||||
Max: 10
|
||||
Metrics/PerceivedComplexity:
|
||||
Max: 11
|
||||
Metrics/AbcSize:
|
||||
Max: 33
|
||||
Style/PercentLiteralDelimiters:
|
||||
PreferredDelimiters:
|
||||
'%': '{}'
|
||||
'%i': ()
|
||||
'%q': '{}'
|
||||
'%Q': ()
|
||||
'%r': '{}'
|
||||
'%s': ()
|
||||
'%w': '{}'
|
||||
'%W': ()
|
||||
'%x': ()
|
||||
Layout/AlignHash:
|
||||
Enabled: false
|
||||
Naming/PredicateName:
|
||||
Enabled: false
|
||||
Style/ClassAndModuleChildren:
|
||||
Enabled: false
|
||||
Style/ConditionalAssignment:
|
||||
Enabled: false
|
||||
Style/BracesAroundHashParameters:
|
||||
Enabled: false
|
||||
Style/AndOr:
|
||||
Enabled: false
|
||||
Style/Not:
|
||||
Enabled: false
|
||||
Naming/FileName:
|
||||
Enabled: false
|
||||
Style/TrailingCommaInLiteral:
|
||||
EnforcedStyleForMultiline: comma
|
||||
Style/TrailingCommaInArguments:
|
||||
EnforcedStyleForMultiline: comma
|
||||
Style/NegatedIf:
|
||||
Enabled: false
|
||||
Style/UnlessElse:
|
||||
Enabled: false
|
||||
BlockDelimiters:
|
||||
Enabled: false
|
||||
Layout/SpaceAroundOperators:
|
||||
Enabled: false
|
||||
Style/IfUnlessModifier:
|
||||
Enabled: false
|
||||
Lint/RescueWithoutErrorClass:
|
||||
Enabled: false
|
12
.travis.yml
12
.travis.yml
|
@ -1,12 +0,0 @@
|
|||
sudo: false
|
||||
language: ruby
|
||||
cache: bundler
|
||||
|
||||
rvm:
|
||||
- 2.3.1
|
||||
|
||||
env:
|
||||
- AZURE_VM_NAME="example-01" AZURE_RESOURCE_GROUP_NAME="MyResourceGroup" AZURE_CREDS_FILE=".travis_azure_creds"
|
||||
|
||||
bundler_args: --without integration
|
||||
script: bundle exec rake
|
61
CHANGELOG.md
61
CHANGELOG.md
|
@ -1,61 +0,0 @@
|
|||
# Change Log
|
||||
|
||||
## [0.5.0](https://github.com/chef/inspec-azure/tree/0.5.0) (2017-03-01)
|
||||
[Full Changelog](https://github.com/chef/inspec-azure/compare/0.4.0...0.5.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Add integration tests [\#19](https://github.com/chef/inspec-azure/issues/19)
|
||||
- Specify the subscription to be used by index [\#15](https://github.com/chef/inspec-azure/issues/15)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Alternative subscriptions cannot be loaded from the credentials file [\#14](https://github.com/chef/inspec-azure/issues/14)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Fix how internal libraries are loaded [\#11](https://github.com/chef/inspec-azure/issues/11)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Added integration tests for current resources [\#20](https://github.com/chef/inspec-azure/pull/20) ([russellseymour](https://github.com/russellseymour))
|
||||
- add contribution guidelines and license [\#18](https://github.com/chef/inspec-azure/pull/18) ([chris-rock](https://github.com/chris-rock))
|
||||
- remove .kitchen logs [\#17](https://github.com/chef/inspec-azure/pull/17) ([chris-rock](https://github.com/chris-rock))
|
||||
- Using Credentials [\#16](https://github.com/chef/inspec-azure/pull/16) ([russellseymour](https://github.com/russellseymour))
|
||||
|
||||
## [0.4.0](https://github.com/chef/inspec-azure/tree/0.4.0) (2017-02-23)
|
||||
[Full Changelog](https://github.com/chef/inspec-azure/compare/0.3.1...0.4.0)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Fixed loading of internal classes [\#13](https://github.com/chef/inspec-azure/pull/13) ([russellseymour](https://github.com/russellseymour))
|
||||
- Updated how internal libraries are located [\#12](https://github.com/chef/inspec-azure/pull/12) ([russellseymour](https://github.com/russellseymour))
|
||||
|
||||
## [0.3.1](https://github.com/chef/inspec-azure/tree/0.3.1) (2017-02-21)
|
||||
[Full Changelog](https://github.com/chef/inspec-azure/compare/0.3.0...0.3.1)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Remove Azure resource class helpers [\#9](https://github.com/chef/inspec-azure/issues/9)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Reconfigured the way in which Helpers work [\#10](https://github.com/chef/inspec-azure/pull/10) ([russellseymour](https://github.com/russellseymour))
|
||||
|
||||
## [0.3.0](https://github.com/chef/inspec-azure/tree/0.3.0) (2017-02-20)
|
||||
**Closed issues:**
|
||||
|
||||
- Add resource to check the status of a Resource Group [\#6](https://github.com/chef/inspec-azure/issues/6)
|
||||
- Add resources for checking the VM [\#5](https://github.com/chef/inspec-azure/issues/5)
|
||||
- Cannot determine the return for a filter [\#3](https://github.com/chef/inspec-azure/issues/3)
|
||||
- Add resource to check for presence and size of data disk [\#1](https://github.com/chef/inspec-azure/issues/1)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- Added support for checking Resource Group resources [\#8](https://github.com/chef/inspec-azure/pull/8) ([russellseymour](https://github.com/russellseymour))
|
||||
- Added more VM resource controls [\#7](https://github.com/chef/inspec-azure/pull/7) ([russellseymour](https://github.com/russellseymour))
|
||||
- Testing Machine data disks [\#4](https://github.com/chef/inspec-azure/pull/4) ([russellseymour](https://github.com/russellseymour))
|
||||
|
||||
|
||||
|
||||
\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
|
155
CONTRIBUTING.md
155
CONTRIBUTING.md
|
@ -1,155 +0,0 @@
|
|||
# Contributing to InSpec
|
||||
|
||||
We are glad you want to contribute to InSpec! This document will help answer common questions you may have during your first contribution.
|
||||
|
||||
## Submitting Issues
|
||||
|
||||
We utilize **Github Issues** for issue tracking and contributions. You can contribute in two ways:
|
||||
|
||||
1. Reporting an issue or making a feature request [here](#issues).
|
||||
2. Adding features or fixing bugs yourself and contributing your code to InSpec.
|
||||
|
||||
We ask you not to submit security concerns via Github. For details on submitting potential security issues please see <https://www.chef.io/security/>
|
||||
|
||||
## Contribution Process
|
||||
|
||||
We have a 3 step process for contributions:
|
||||
|
||||
1. Commit changes to a git branch, making sure to sign-off those changes for the [Developer Certificate of Origin](#developer-certification-of-origin-dco).
|
||||
2. Create a Github Pull Request for your change, following the instructions in the pull request template.
|
||||
3. Perform a [Code Review](#code-review-process) with the project maintainers on the pull request.
|
||||
|
||||
### Pull Request Requirements
|
||||
|
||||
Chef Projects are built to last. We strive to ensure high quality throughout the experience. In order to ensure this, we require that all pull requests to Chef projects meet these specifications:
|
||||
|
||||
1. **Tests:** To ensure high quality code and protect against future regressions, we require all the code in Chef Projects to have at least unit test coverage. See the [test/unit](https://github.com/chef/inspec/tree/master/test/unit)
|
||||
directory for the existing tests and use ```bundle exec rake test``` to run them.
|
||||
2. **Green CI Tests:** We use [Travis CI](https://travis-ci.org/) and/or [AppVeyor](https://www.appveyor.com/) CI systems to test all pull requests. We require these test runs to succeed on every pull request before being merged.
|
||||
3. **Up-to-date Documentation:** Every code change should be reflected in an update for our [documentation](https://github.com/chef/inspec/tree/master/docs). We expect PRs to update the documentation with the code change.
|
||||
|
||||
In addition to this it would be nice to include the description of the problem you are solving
|
||||
with your change. You can use [Issue Template](#issuetemplate) in the description section
|
||||
of the pull request.
|
||||
|
||||
### Code Review Process
|
||||
|
||||
Code review takes place in Github pull requests. See [this article](https://help.github.com/articles/about-pull-requests/) if you're not familiar with Github Pull Requests.
|
||||
|
||||
Once you open a pull request, project maintainers will review your code and respond to your pull request with any feedback they might have. The process at this point is as follows:
|
||||
|
||||
1. Two thumbs-up (:+1:) are required from project maintainers. See the master maintainers document for InSpec projects at <https://github.com/chef/inspec/blob/master/MAINTAINERS.md>.
|
||||
2. When ready, your pull request will be merged into `master`, we may require you to rebase your PR to the latest `master`.
|
||||
3. Once the PR is merged, you will be included in `CHANGELOG.md`.
|
||||
|
||||
If you would like to learn about when your code will be available in a release of Chef, read more about [Chef Release Cycles](#release-cycles).
|
||||
|
||||
|
||||
### Developer Certification of Origin (DCO)
|
||||
|
||||
Licensing is very important to open source projects. It helps ensure the software continues to be available under the terms that the author desired.
|
||||
|
||||
Chef uses [the Apache 2.0 license](https://github.com/chef/chef/blob/master/LICENSE) to strike a balance between open contribution and allowing you to use the software however you would like to.
|
||||
|
||||
The license tells you what rights you have that are provided by the copyright holder. It is important that the contributor fully understands what rights they are licensing and agrees to them. Sometimes the copyright holder isn't the contributor, such as when the contributor is doing work on behalf of a company.
|
||||
|
||||
To make a good faith effort to ensure these criteria are met, Chef requires the Developer Certificate of Origin (DCO) process to be followed.
|
||||
|
||||
The DCO is an attestation attached to every contribution made by every developer. In the commit message of the contribution, the developer simply adds a Signed-off-by statement and thereby agrees to the DCO, which you can find below or at <http://developercertificate.org/>.
|
||||
|
||||
```
|
||||
Developer's Certificate of Origin 1.1
|
||||
|
||||
By making a contribution to this project, I certify that:
|
||||
|
||||
(a) The contribution was created in whole or in part by me and I
|
||||
have the right to submit it under the open source license
|
||||
indicated in the file; or
|
||||
|
||||
(b) The contribution is based upon previous work that, to the
|
||||
best of my knowledge, is covered under an appropriate open
|
||||
source license and I have the right under that license to
|
||||
submit that work with modifications, whether created in whole
|
||||
or in part by me, under the same open source license (unless
|
||||
I am permitted to submit under a different license), as
|
||||
Indicated in the file; or
|
||||
|
||||
(c) The contribution was provided directly to me by some other
|
||||
person who certified (a), (b) or (c) and I have not modified
|
||||
it.
|
||||
|
||||
(d) I understand and agree that this project and the contribution
|
||||
are public and that a record of the contribution (including
|
||||
all personal information I submit with it, including my
|
||||
sign-off) is maintained indefinitely and may be redistributed
|
||||
consistent with this project or the open source license(s)
|
||||
involved.
|
||||
```
|
||||
|
||||
For more information on the change see the Chef Blog post [Introducing Developer Certificate of Origin](https://blog.chef.io/2016/09/19/introducing-developer-certificate-of-origin/)
|
||||
|
||||
#### DCO Sign-Off Methods
|
||||
|
||||
The DCO requires a sign-off message in the following format appear on each commit in the pull request:
|
||||
|
||||
```
|
||||
Signed-off-by: Julia Child <juliachild@chef.io>
|
||||
```
|
||||
|
||||
The DCO text can either be manually added to your commit body, or you can add either **-s** or **--signoff** to your usual git commit commands. If you forget to add the sign-off you can also amend a previous commit with the sign-off by running **git commit --amend -s**. If you've pushed your changes to Github already you'll need to force push your branch after this with **git push -f**.
|
||||
|
||||
### Obvious Fix Policy
|
||||
|
||||
Small contributions, such as fixing spelling errors, where the content is small enough to not be considered intellectual property, can be submitted without signing the contribution for the DCO.
|
||||
|
||||
As a rule of thumb, changes are obvious fixes if they do not introduce any new functionality or creative thinking. Assuming the change does not affect functionality, some common obvious fix examples include the following:
|
||||
|
||||
- Spelling / grammar fixes
|
||||
- Typo correction, white space and formatting changes
|
||||
- Comment clean up
|
||||
- Bug fixes that change default return values or error codes stored in constants
|
||||
- Adding logging messages or debugging output
|
||||
- Changes to 'metadata' files like Gemfile, .gitignore, build scripts, etc.
|
||||
- Moving source files from one directory or package to another
|
||||
|
||||
**Whenever you invoke the "obvious fix" rule, please say so in your commit message:**
|
||||
|
||||
```
|
||||
------------------------------------------------------------------------
|
||||
commit 370adb3f82d55d912b0cf9c1d1e99b132a8ed3b5
|
||||
Author: Julia Child <juliachild@chef.io>
|
||||
Date: Wed Sep 18 11:44:40 2015 -0700
|
||||
|
||||
Fix typo in the README.
|
||||
|
||||
Obvious fix.
|
||||
|
||||
------------------------------------------------------------------------
|
||||
```
|
||||
|
||||
## Release Cycles
|
||||
|
||||
Our primary shipping vehicle is operating system specific packages that includes all the requirements of InSpec. We call these [Omnibus packages](https://github.com/chef/omnibus)
|
||||
|
||||
We also release our software as gems to [Rubygems](https://rubygems.org/) but we strongly recommend using InSpec or ChefDK packages.
|
||||
|
||||
Our version numbering roughly follows [Semantic Versioning](http://semver.org/) standard. Our standard version numbers look like X.Y.Z which mean:
|
||||
|
||||
- X is a major release, which may not be fully compatible with prior major releases
|
||||
- Y is a minor release, which adds both new features and bug fixes
|
||||
- Z is a patch release, which adds just bug fixes
|
||||
|
||||
After shipping a release of InSpec we bump at least the `Minor` version by one to start development of the next minor release. We do a release approximately every week. Announcements of releases are made to the [InSpec mailing list](https://discourse.chef.io/c/chef-release) when they are available.
|
||||
|
||||
## InSpec Community
|
||||
|
||||
InSpec is made possible by a strong community of developers, system administrators, auditor and security experts. If you have any questions or if you would like to get involved in the InSpec community you can check out:
|
||||
|
||||
- [InSpec Mailing List](https://discourse.chef.io/c/inspec)
|
||||
- [Chef Community Slack](https://community-slack.chef.io/)
|
||||
|
||||
Also here are some additional pointers to some awesome Chef content:
|
||||
|
||||
- [InSpec Docs](http://inspec.io/docs/)
|
||||
- [Learn Chef](https://learn.chef.io/)
|
||||
- [Chef Website](https://www.chef.io/)
|
17
Gemfile
17
Gemfile
|
@ -1,17 +0,0 @@
|
|||
source 'https://rubygems.org'
|
||||
|
||||
gem 'inifile'
|
||||
gem 'azure_mgmt_resources', '~> 0.15'
|
||||
gem 'bundle'
|
||||
|
||||
group :development do
|
||||
gem 'rake'
|
||||
gem 'rubocop'
|
||||
gem 'github_changelog_generator'
|
||||
gem 'pry-coolline'
|
||||
gem 'passgen'
|
||||
end
|
||||
|
||||
group :inspec do
|
||||
gem 'inspec', '~> 1.1'
|
||||
end
|
13
LICENSE
13
LICENSE
|
@ -1,13 +0,0 @@
|
|||
Copyright (c) 2017 Chef Software Inc.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
190
README.md
190
README.md
|
@ -1,190 +0,0 @@
|
|||
# InSpec for Azure
|
||||
|
||||
This Resource Pack has been been completely rewritten so that it is able to check for _any_ resource in Azure, previous versions only supported 4 resource types.
|
||||
|
||||
Whenever an Azure resource is retrieved its attributes are interrogated and turned into things that can be called during tests on that particular resource. By making the profile dynamic it means that more or less any resource that is available in Azure can be tested.
|
||||
|
||||
To determine what methods can be called against an Azure resource please find the resource in https://resources.azure.com. The attributes of the resource are turned into the methods that can be called. Please refer to the examples further down the page or the integration tests for more information.
|
||||
|
||||
The only caveat to this is that the generic resource cannot interrogate an Azure resource group itself. There is an InSpec resource called `azure_resource_group` that permits this.
|
||||
|
||||
**The resource pack not only contains the generic resource but also expliclit tests for some resources. These are similar to the ones that were in previous versions, but now have different properties and attributes that may break existing tests. Please review the documentation for the resource you are using.**
|
||||
|
||||
## Roadmap
|
||||
|
||||
This repository is the development repository for InSpec for Azure. Once [RFC Platforms](https://github.com/chef/inspec/issues/1661) is fully implemented in InSpec, this repository is going to be merged into core InSpec.
|
||||
|
||||
As of now, Azure resources are implemented as an InSpec resource pack. It will ship with the required resources to write your own Azure tests:
|
||||
|
||||
```
|
||||
├── README.md - this readme
|
||||
└── libraries - contains Azure resources
|
||||
└── test - contains integration tests
|
||||
```
|
||||
|
||||
## Get Started
|
||||
|
||||
This profile uses one of the Azure Ruby SDK libraries 'Azure Resource Management' and as such requires a Service Principal Name (SPN) to be created in the Azure subscription that is being tested.
|
||||
|
||||
This can be done on the command line or from the Azure Portal
|
||||
|
||||
- Azure CLI: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal-cli
|
||||
- PowerShell: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal
|
||||
- Azure Portal: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal
|
||||
|
||||
The information from the SPN can be specified either in a file `~/.azure/credentials`, a different file or as environment variables.
|
||||
|
||||
### Credentials File
|
||||
|
||||
The simplest way is to create the file `~/.azure/credentials` with the following format. The profile is configured to look for this file by default do no settings are required.
|
||||
|
||||
```
|
||||
[<SUBSCRIPTION_ID>]
|
||||
client_id = "<CLIENT_ID>"
|
||||
client_secret = "<CLIENT_SECRET>"
|
||||
tenant_id = "<TENANT_ID>"
|
||||
```
|
||||
|
||||
So to run the profile now it is as simple as running:
|
||||
|
||||
```bash
|
||||
inspec exec inspec-azure
|
||||
```
|
||||
|
||||
A different credentials file, with the same format, can be specified as an environment variable `AZURE_CREDS_FILE`:
|
||||
|
||||
```bash
|
||||
AZURE_CREDS_FILE="/path/to/another/file" inspec exec inspec-azure
|
||||
```
|
||||
|
||||
Note that this file format supports multiple subscription_ids. By default `inspec-azure` will pick the first subscription in the file. However if another subscription should be used then specify it in the environment variable `AZURE_SUBSCRIPTION_ID`.
|
||||
|
||||
```bash
|
||||
AZURE_SUBSCRIPTION_ID="2fbdbb02-df2e-11e6-bf01-fe55135034f3" inspec exec inspec-azure
|
||||
```
|
||||
|
||||
Alternatively, if you know that the subscription you want to use is the second one in you credentials file then you can use the following:
|
||||
|
||||
```bash
|
||||
AZURE_SUBSCRIPTION_NUMBER=2 inspec exec inspec-azure
|
||||
```
|
||||
|
||||
### Environment variables
|
||||
|
||||
It is possible to not have a credentials file at all and specify all of the required information as the following environment variables:
|
||||
|
||||
- `AZURE_SUBSCRIPTION_ID`
|
||||
- `AZURE_CLIENT_ID`
|
||||
- `AZURE_CLIENT_SECRET`
|
||||
- `AZURE_TENANT_ID`
|
||||
|
||||
For example:
|
||||
|
||||
```bash
|
||||
AZURE_SUBSCRIPTION_ID="2fbdbb02-df2e-11e6-bf01-fe55135034f3" \
|
||||
AZURE_CLIENT_ID="58dc4f6c-df2e-11e6-bf01-fe55135034f3" \
|
||||
AZURE_CLIENT_SECRET="Jibr4iwwaaZwBb6W" \
|
||||
AZURE_TENANT_ID="6ad89b58-df2e-11e6-bf01-fe55135034f3" inspec exec inspec-azure
|
||||
```
|
||||
|
||||
## Use the resources
|
||||
|
||||
Since this is an InSpec resource pack, it only defines InSpec resources. It includes example tests only. To easily use the Azure InSpec resources in your tests do the following:
|
||||
|
||||
### Create a new profile
|
||||
|
||||
```bash
|
||||
inspec init profile my-profile
|
||||
```
|
||||
|
||||
### Adapt the `inspec.yml`
|
||||
|
||||
```yaml
|
||||
name: my-profile
|
||||
title: My own Azure profile
|
||||
version: 0.1.0
|
||||
depends:
|
||||
- name: azure
|
||||
url: https://github.com/chef/inspec-azure/archive/master.tar.gz
|
||||
```
|
||||
|
||||
### Add controls
|
||||
|
||||
Since your profile depends on the InSpec resource pack, you can use those resources in your own profile. In this example a virtual machine in the specified Azure resource group is being tested.
|
||||
|
||||
Using the https://resources.azure.com portal the virtual machine has the following attributes.
|
||||
|
||||

|
||||
|
||||
Using this information tests can be written, for example:
|
||||
|
||||
```ruby
|
||||
control 'azure-1' do
|
||||
impact 1.0
|
||||
title 'Checks that the machine was built from the correct image'
|
||||
|
||||
describe azure_generic_resource(group_name: 'Inspec-Azure', name: 'Linux-Internal-VM') do
|
||||
its('properties.storageProfile.imageReference.publisher') { should cmp 'Canonical' }
|
||||
its('properties.storageProfile.imageReference.offer') { should cmp 'UbuntuServer' }
|
||||
its('properties.storageProfile.imageReference.sku') { should cmp '16.04.0-LTS' }
|
||||
end
|
||||
end
|
||||
```
|
||||
|
||||
There are a few different ways in which tests can be written, which mean that arrays can be tested. A lot of the different ways and techniques are shown and documented in the integrations tests which are highly recommended reading.
|
||||
|
||||
### Available Resources
|
||||
|
||||
The following resources are available in the Inspec Azure Profile
|
||||
|
||||
- [Azure Generic Resource](docs/resources/azure_generic_resource.md)
|
||||
- [Azure Resource Group](docs/resources/azure_resource_group.md)
|
||||
- [Azure Virtual Machine](docs/resources/azure_virtual_machine.md)
|
||||
- [Azure Data Disk](docs/resources/azure_virtual_machine_data_disk.md)
|
||||
|
||||
When multiple resources are returned a FilterTable is created. This means it is possible to retrieve all of hte resources in a resource group and interrogate them within the testing block using the `.where` function on the FilterTable. Please refer to the `test/integration/verify/controls/resources.rb` file for an example of this.
|
||||
|
||||
## Integration Testing
|
||||
|
||||
Our integration tests spin up an environment with terraform 0.10+ and verify the result with InSpec. The `test/integration/verify/controls` directory contains all of the tests that are run during integration tests. These can be used as examples of how to use this resource pack.
|
||||
|
||||
Rake tasks have been configured to enable the running of the integration tests:
|
||||
|
||||
```bash
|
||||
rake changelog # Generate a Change log from GitHub
|
||||
rake lint # Run robocop linter
|
||||
rake rubocop # Run Rubocop lint checks
|
||||
rake test:integration # Perform Integration Tests
|
||||
```
|
||||
|
||||
As with using the InSpec resources themselves the integration tests rely on a Service Principal Name being defined. Please see the information at the start of this page on how to generate this.
|
||||
|
||||
Due to the fact that any Azure resource can now be tested the integration tests check the following Azure resource types:
|
||||
|
||||
- Microsoft.Compute/virtualMachines
|
||||
- Microsoft.Compute/disks
|
||||
- Microsoft.Network/networkInterfaces
|
||||
- Microsoft.Network/virtualNetworks
|
||||
- Microsoft.Network/networkSecurityGroups
|
||||
- Microsoft.Network/publicIPAddresses
|
||||
- Microsoft.Storage/storageAccounts
|
||||
|
||||
## License
|
||||
|
||||
| | |
|
||||
| ------ | --- |
|
||||
| **Author:** | Russell Seymour (<russell@chef.io>) |
|
||||
| **Copyright:** | Copyright (c) 2017 Chef Software Inc. |
|
||||
| **License:** | Apache License, Version 2.0 |
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
101
Rakefile
101
Rakefile
|
@ -1,101 +0,0 @@
|
|||
#!/usr/bin/env rake
|
||||
|
||||
require 'rake/testtask'
|
||||
require 'rubocop/rake_task'
|
||||
require 'inifile'
|
||||
require 'passgen'
|
||||
require_relative 'libraries/azure_backend'
|
||||
|
||||
# Rubocop
|
||||
desc 'Run Rubocop lint checks'
|
||||
task :rubocop do
|
||||
RuboCop::RakeTask.new
|
||||
end
|
||||
|
||||
# lint the project
|
||||
desc 'Run robocop linter'
|
||||
task lint: [:rubocop]
|
||||
|
||||
# run tests
|
||||
task default: [:lint]
|
||||
|
||||
namespace :test do
|
||||
|
||||
# Specify the directory for the integration tests
|
||||
integration_dir = "test/integration"
|
||||
|
||||
# run inspec check to verify that the profile is properly configured
|
||||
#task :check do
|
||||
# dir = File.join(File.dirname(__FILE__))
|
||||
# sh("bundle exec inspec check #{dir}")
|
||||
#end
|
||||
|
||||
task :init_workspace do
|
||||
# Initialize terraform workspace
|
||||
cmd = format("cd %s/build/ && terraform init", integration_dir)
|
||||
sh(cmd)
|
||||
end
|
||||
|
||||
task :setup_integration_tests do
|
||||
|
||||
azure_backend = AzureConnection.new
|
||||
creds = azure_backend.spn
|
||||
|
||||
# Determine the storage account name and the admin password
|
||||
sa_name = (0...15).map { (65 + rand(26)).chr }.join.downcase
|
||||
admin_password = Passgen::generate(length: 12, uppercase: true, lowercase: true, symbols: true, digits: true)
|
||||
|
||||
# Use the first 4 characters of the storage account to create a suffix
|
||||
suffix = sa_name[0..3]
|
||||
|
||||
puts "----> Setup"
|
||||
|
||||
# Create the plan that can be applied to Azure
|
||||
cmd = format("cd %s/build/ && terraform plan -var 'subscription_id=%s' -var 'client_id=%s' -var 'client_secret=%s' -var 'tenant_id=%s' -var 'storage_account_name=%s' -var 'admin_password=%s' -var 'suffix=%s' -out inspec-azure.plan", integration_dir, creds[:subscription_id], creds[:client_id], creds[:client_secret], creds[:tenant_id], sa_name, admin_password, suffix)
|
||||
sh(cmd)
|
||||
|
||||
# Apply the plan on Azure
|
||||
cmd = format("cd %s/build/ && terraform apply inspec-azure.plan", integration_dir)
|
||||
sh(cmd)
|
||||
end
|
||||
|
||||
task :run_integration_tests do
|
||||
puts "----> Run"
|
||||
|
||||
cmd = format("bundle exec inspec exec %s/verify", integration_dir)
|
||||
sh(cmd)
|
||||
end
|
||||
|
||||
task :cleanup_integration_tests do
|
||||
|
||||
azure_backend = AzureConnection.new
|
||||
creds = azure_backend.spn
|
||||
|
||||
puts "----> Cleanup"
|
||||
cmd = format("cd %s/build/ && terraform destroy -force -var 'subscription_id=%s' -var 'client_id=%s' -var 'client_secret=%s' -var 'tenant_id=%s' -var 'admin_password=dummy' -var 'storage_account_name=dummy' -var 'suffix=dummy'", integration_dir, creds[:subscription_id], creds[:client_id], creds[:client_secret], creds[:tenant_id])
|
||||
sh(cmd)
|
||||
|
||||
end
|
||||
|
||||
desc "Perform Integration Tests"
|
||||
task :integration do
|
||||
Rake::Task["test:init_workspace"].execute
|
||||
Rake::Task["test:cleanup_integration_tests"].execute
|
||||
Rake::Task["test:setup_integration_tests"].execute
|
||||
Rake::Task["test:run_integration_tests"].execute
|
||||
Rake::Task["test:cleanup_integration_tests"].execute
|
||||
end
|
||||
end
|
||||
|
||||
# Automatically generate a changelog for this project. Only loaded if
|
||||
# the necessary gem is installed.
|
||||
# use `rake changelog to=1.2.0`
|
||||
begin
|
||||
v = ENV['to']
|
||||
require 'github_changelog_generator/task'
|
||||
GitHubChangelogGenerator::RakeTask.new :changelog do |config|
|
||||
config.future_release = v
|
||||
end
|
||||
rescue LoadError
|
||||
puts '>>>>> GitHub Changelog Generator not loaded, omitting tasks'
|
||||
end
|
Binary file not shown.
Before ![]() (image error) Size: 193 KiB |
|
@ -1,7 +0,0 @@
|
|||
name: azure
|
||||
title: Azure Resource Pack
|
||||
maintainer: russell.seymour@turtlesystems.co.uk
|
||||
summary: This resource pack provides compliance resources for Azure
|
||||
copyright: russell.seymour@turtlesystems.co.uk
|
||||
copyright_email: russell.seymour@turtlesystems.co.uk
|
||||
version: 0.2.0
|
Loading…
Add table
Reference in a new issue