fips_enabled¶
About The Role¶
This role will check if system has turned on FIPS. This validation can be enabled or disabled within the variable: enforce_fips_validation, setting it to true will enable the validation, setting to false will disable it.
Requirements¶
Turned on FIPS.
Dependencies¶
No dependencies.
Example Playbook¶
- hosts: localhost
gather_facts: false
roles:
- { role: fips_enabled }
Licence¶
Apache
Full Description¶
Role Documentation¶
Welcome to the “fips_enabled” role documentation.
Role Variables: main.yml¶
# While options found within the vars/ path can be overridden using extra
# vars, items within this path are considered part of the role and not
# intended to be modified.
# All variables within this role should have a prefix of "tripleo_check_fips_status"
# !!!! IMPORTANT !!!!
# Add a comment above every variables describing them.
# This will be included in the sphinx role documentation
# !!!! IMPORTANT !!!!
fips_status_path: /proc/sys/crypto/fips_enabled
enforce_fips_validation: false
Molecule Scenarios¶
Molecule is being used to test the “fips_enabled” role. The following section highlights the drivers in service and provides an example playbook showing how the role is leveraged.
- Driver: podman
Scenario: default¶
Molecule Platform(s)¶
- name: centos
hostname: centos
image: centos/centos:stream8
registry:
url: quay.io
dockerfile: ../../../../.config/molecule/Dockerfile
pkg_extras: python*-setuptools python*-pyyaml
volumes:
- /etc/ci/mirror_info.sh:/etc/ci/mirror_info.sh:ro
privileged: true
environment:
http_proxy: "{{ lookup('env', 'http_proxy') }}"
https_proxy: "{{ lookup('env', 'https_proxy') }}"
ulimits:
- host
Molecule Inventory¶
hosts:
all:
hosts:
centos:
ansible_python_interpreter: /usr/bin/python3
Example default playbook¶
- name: Converge
hosts: all
vars:
fips_enabled_path: /proc/sys/crypto/fips_enabled
tasks:
- name: FIPS enabled
copy:
dest: fips_enabled_path
mode: 0755
content: '1'
- name: Test FIPS Enabled
vars:
enforce_fips_validation: false
include_role:
name: fips_enabled
- name: FIPS disabled
copy:
dest: fips_enabled_path
mode: 0755
content: '0'
- name: Test FIPS disabled fails
vars:
enforce_fips_validation: true
block:
- name: Load role with failure
include_role:
name: fips_enabled
rescue:
- name: Clear host error
meta: clear_host_errors
- name: Status message
debug:
msg: Successfully detected FIPS is disabled!
- name: End play
meta: end_play
- name: Fail if we get to this place
fail:
msg: 'Unit test failed: Did not detect that FIPS is disabled!'