Broadcast/ansible-role-owncast
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
ansible-role-owncast/tests/test.yml
T
eric b894fa148a Initial commit
2026-10-24 16:21:16 -04:00

164 lines
7.5 KiB
YAML
Executable File
Raw Permalink Blame History

---
- name: Validate Owncast templates without a cluster
hosts: localhost
connection: local
gather_facts: false
tasks:
- name: Load role defaults and validate them without deploying
ansible.builtin.include_role:
name: ansible-role-owncast
tasks_from: validate.yml
public: true
- name: Render generic default resources
ansible.builtin.set_fact:
deployment: "{{ lookup('template', '../templates/deployment.yml.j2') | from_yaml }}"
service: "{{ lookup('template', '../templates/service.yml.j2') | from_yaml }}"
pvc: "{{ lookup('template', '../templates/pvc.yml.j2') | from_yaml }}"
- name: Check private defaults and single-writer safeguards
ansible.builtin.assert:
that:
- deployment.apiVersion == 'apps/v1'
- deployment.spec.strategy.type == 'Recreate'
- deployment.spec.replicas == 1
- not deployment.spec.template.spec.automountServiceAccountToken
- not deployment.spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
- service.spec.type == 'ClusterIP'
- "'externalTrafficPolicy' not in service.spec"
- "'storageClassName' not in pvc.spec"
- pvc.spec.resources.requests.storage == '10Gi'
- not owncast_ingress_enabled
- not owncast_onion_enabled
- name: Load the actual eom playbook variables
ansible.builtin.set_fact:
"{{ item.key }}": "{{ item.value }}"
loop: "{{ (lookup('file', '../playbooks/deploy-eom.yml') | from_yaml)[0].vars | dict2items }}"
- name: Validate eom settings
ansible.builtin.include_role:
name: ansible-role-owncast
tasks_from: validate.yml
- name: Render eom resources
ansible.builtin.set_fact:
deployment: "{{ lookup('template', '../templates/deployment.yml.j2') | from_yaml }}"
service: "{{ lookup('template', '../templates/service.yml.j2') | from_yaml }}"
pvc: "{{ lookup('template', '../templates/pvc.yml.j2') | from_yaml }}"
ingress: "{{ lookup('template', '../templates/ingress.yml.j2') | from_yaml }}"
onion: "{{ lookup('template', '../templates/onion.yml.j2') | from_yaml }}"
- name: Check preservation of existing resource identities and settings
ansible.builtin.assert:
that:
- deployment.metadata.name == 'owncast'
- deployment.metadata.namespace == 'owncast'
- deployment.spec.selector.matchLabels == {'app':'owncast'}
- deployment.spec.template.spec.volumes[0].persistentVolumeClaim.claimName == 'owncast'
- deployment.spec.template.spec.containers[0].image == 'owncast/owncast:0.3.0'
- deployment.spec.template.spec.containers[0].resources.requests.cpu == '1.5'
- deployment.spec.template.spec.containers[0].volumeMounts[0].mountPath == '/app/data'
- service.spec.type == 'LoadBalancer'
- service.spec.externalTrafficPolicy == 'Local'
- service.spec.ports | map(attribute='port') | list == [1935, 8080]
- pvc.spec.resources.requests.storage == '128Gi'
- ingress.spec.ingressClassName == 'nginx'
- ingress.spec.rules[0].host == 'owncast.eom.dev'
- ingress.spec.tls[0].secretName == 'owncast'
- ingress.metadata.annotations['cert-manager.io/cluster-issuer'] == 'ca-issuer'
- onion.metadata.name == 'http'
- onion.metadata.namespace == 'owncast'
- onion.spec.rules[0].backend.service.name == 'owncast'
- onion.spec.rules[0].backend.service.port.number == 8080
- name: Set fake friend settings for validation
ansible.builtin.set_fact:
friend_owncast_hostname: stream.friend.example.org
friend_owncast_cluster_issuer: friend-issuer
- name: Load the actual friend playbook variables
ansible.builtin.set_fact:
"{{ item.key }}": "{{ item.value }}"
loop: "{{ (lookup('template', '../playbooks/deploy-friend.yml') | from_yaml)[0].vars | dict2items }}"
- name: Validate friend settings
ansible.builtin.include_role:
name: ansible-role-owncast
tasks_from: validate.yml
- name: Render friend resources
ansible.builtin.set_fact:
deployment: "{{ lookup('template', '../templates/deployment.yml.j2') | from_yaml }}"
pvc: "{{ lookup('template', '../templates/pvc.yml.j2') | from_yaml }}"
ingress: "{{ lookup('template', '../templates/ingress.yml.j2') | from_yaml }}"
- name: Check friend isolation
ansible.builtin.assert:
that:
- deployment.metadata.namespace == 'owncast-friend'
- deployment.spec.selector.matchLabels == {'app':'owncast-friend'}
- deployment.spec.template.spec.volumes[0].persistentVolumeClaim.claimName == 'owncast-friend'
- pvc.metadata.name == 'owncast-friend'
- ingress.spec.rules[0].host == friend_owncast_hostname
- ingress.spec.tls[0].secretName == 'owncast-friend'
- ingress.metadata.annotations['cert-manager.io/cluster-issuer'] == friend_owncast_cluster_issuer
- not owncast_onion_enabled
- name: Exercise existing storage and optional non-TLS ingress
ansible.builtin.set_fact:
owncast_existing_claim: external-data
owncast_storage_class: encrypted-storage
owncast_service_type: NodePort
owncast_tls_enabled: false
owncast_cluster_issuer: ""
owncast_ingress_class: ""
owncast_ingress_annotations:
example.org/test: "true"
- name: Render optional configuration
ansible.builtin.set_fact:
deployment: "{{ lookup('template', '../templates/deployment.yml.j2') | from_yaml }}"
pvc: "{{ lookup('template', '../templates/pvc.yml.j2') | from_yaml }}"
service: "{{ lookup('template', '../templates/service.yml.j2') | from_yaml }}"
ingress: "{{ lookup('template', '../templates/ingress.yml.j2') | from_yaml }}"
- name: Check optional configuration
ansible.builtin.assert:
that:
- deployment.spec.template.spec.volumes[0].persistentVolumeClaim.claimName == 'external-data'
- pvc.spec.storageClassName == 'encrypted-storage'
- service.spec.type == 'NodePort'
- service.spec.externalTrafficPolicy == 'Local'
- "'tls' not in ingress.spec"
- "'ingressClassName' not in ingress.spec"
- ingress.metadata.annotations == {'example.org/test':'true'}
- name: Set restricted load balancer settings
ansible.builtin.set_fact:
owncast_service_type: LoadBalancer
owncast_load_balancer_source_ranges: [192.0.2.0/24]
- name: Check load balancer restrictions
ansible.builtin.assert:
that:
- (lookup('template', '../templates/service.yml.j2') | from_yaml).spec.loadBalancerSourceRanges == ['192.0.2.0/24']
- name: Set invalid DNS hostname
ansible.builtin.set_fact:
owncast_hostname: https://invalid.example.org/
- name: Check invalid-input rejection
block:
- name: Run validation with an invalid hostname
ansible.builtin.include_role:
name: ansible-role-owncast
tasks_from: validate.yml
- name: Fail if invalid configuration was accepted
ansible.builtin.fail:
msg: Invalid hostname was accepted
rescue:
- name: Confirm the expected validation failure
ansible.builtin.assert:
that:
- ansible_failed_task.name == 'Validate Owncast ingress settings'
Reference in New Issue View Git Blame Copy Permalink