Skip to content

Commit 1e0f74f

Browse files
lucywymanlucywyman
committed
(puppetlabsGH-1535) Create container infrastructure for WinRM testing
This creates a Windows container in the Github Actions Windows testing environment to run WinRM and windows-based tests against. This allows us to test actual WinRM connections rather than having the GH Action environment connect to itself. Additionally, it removes unnecessary steps from our GH Action workflows, as Docker and docker-compose are already installed in GH Action environments.
1 parent 8fbb6ec commit 1e0f74f

6 files changed

Lines changed: 84 additions & 52 deletions

File tree

‎.github/workflows/linux.yaml‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,10 @@ jobs:
3838
run: bundle install --jobs 4 --retry 3
3939
- name: Pre-test setup
4040
run: |
41-
sudo curl -L https://github.com/docker/compose/releases/download/1.23.0/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
42-
sudo chmod +x /usr/local/bin/docker-compose
4341
echo 'runner:runner' | sudo chpasswd
4442
sudo sh -c "echo 'Defaults authenticate' >> /etc/sudoers"
4543
sudo sh -c "echo 'runner ALL=(ALL) PASSWD:ALL' >> /etc/sudoers"
46-
docker-compose -f spec/docker-compose.yml build --parallel ubuntu_node puppet_5_node puppet_6_node
44+
docker-compose -f spec/docker-compose.yml build ubuntu_node puppet_5_node puppet_6_node
4745
docker-compose -f spec/docker-compose.yml up -d ubuntu_node puppet_5_node puppet_6_node
4846
bundle exec r10k puppetfile install
4947
- name: Run tests with minimal container infrastructure
@@ -74,9 +72,7 @@ jobs:
7472
run: bundle install --jobs 4 --retry 3
7573
- name: Pre-test setup
7674
run: |
77-
sudo curl -L https://github.com/docker/compose/releases/download/1.23.0/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
78-
sudo chmod +x /usr/local/bin/docker-compose
79-
docker-compose -f spec/docker-compose.yml build --parallel
75+
docker-compose -f spec/docker-compose.yml build
8076
docker-compose -f spec/docker-compose.yml up -d
8177
bundle exec r10k puppetfile install
8278
- name: Run tests with expensive containers

‎.github/workflows/windows.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ jobs:
5555
- name: Pre-test setup
5656
shell: powershell
5757
run: |
58+
docker-compose -f spec\docker-compose-windev.yml build
59+
docker-compose -f spec\docker-compose-windev.yml up -d
5860
. scripts\ci.ps1
5961
Set-ActiveRubyFromPuppet
6062
- name: Run tests
@@ -97,7 +99,10 @@ jobs:
9799
run: bundle exec r10k puppetfile install
98100
- name: Pre-test setup
99101
shell: powershell
100-
run: '& scripts\ci.ps1'
102+
run: |
103+
docker-compose -f spec\docker-compose-windev.yml build
104+
docker-compose -f spec\docker-compose-windev.yml up -d
105+
. scripts\ci.ps1
101106
- name: Run tests
102107
shell: powershell
103108
run: bundle exec rake windows_ci

‎scripts/ci.ps1‎

Lines changed: 45 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -71,24 +71,24 @@ function Install-Certificate($path, $password)
7171
return (Import-PfxCertificate @importArgs)
7272
}
7373

74-
function Grant-WinRMHttpsAccess($certThumbprint)
75-
{
76-
$winRMArgs = @{
77-
ResourceURI = 'winrm/config/Listener'
78-
SelectorSet = @{ Address = '*'; Transport = 'HTTPS'; }
79-
ValueSet = @{ Hostname = 'boltserver'; CertificateThumbprint = $certThumbprint }
80-
}
81-
$instance = Set-WSManInstance @winRMArgs
82-
Write-Information ($instance | Format-List | Out-String)
83-
}
84-
85-
function Set-WinRMHostConfiguration
86-
{
87-
# configure WinRM to use cert.pfx for SSL
88-
$cert = Install-Certificate -Path 'spec/fixtures/ssl/cert.pfx' -Password 'bolt'
89-
Write-Information ($cert | Format-List | Out-String)
90-
Grant-WinRMHttpsAccess -CertThumbprint $cert.Thumbprint
91-
}
74+
#function Grant-WinRMHttpsAccess($certThumbprint)
75+
#{
76+
# $winRMArgs = @{
77+
# ResourceURI = 'winrm/config/Listener'
78+
# SelectorSet = @{ Address = '*'; Transport = 'HTTPS'; }
79+
# ValueSet = @{ Hostname = 'boltserver'; CertificateThumbprint = $certThumbprint }
80+
# }
81+
# $instance = Set-WSManInstance @winRMArgs
82+
# Write-Information ($instance | Format-List | Out-String)
83+
#}
84+
85+
#function Set-WinRMHostConfiguration
86+
#{
87+
# # configure WinRM to use cert.pfx for SSL
88+
# $cert = Install-Certificate -Path 'spec/fixtures/ssl/cert.pfx' -Password 'bolt'
89+
# Write-Information ($cert | Format-List | Out-String)
90+
# Grant-WinRMHttpsAccess -CertThumbprint $cert.Thumbprint
91+
#}
9292

9393
function Invoke-ScriptBlockWithRetry([ScriptBlock]$script, $failMessage, $successMessage, $retries = 15, $timeout = 1)
9494
{
@@ -112,28 +112,28 @@ function Invoke-ScriptBlockWithRetry([ScriptBlock]$script, $failMessage, $succes
112112

113113
}
114114

115-
function Test-WinRMConfiguration($userName, $password, $retries = 15, $timeout = 1)
116-
{
117-
$retryArgs = @{
118-
FailMessage = 'Failed to establish WinRM connection over SSL'
119-
SuccessMessage = "Successfully established WinRM connection with $userName"
120-
Retries = $retries
121-
Timeout = $timeout
122-
Script = {
123-
$pass = ConvertTo-SecureString $password -AsPlainText -Force
124-
$sessionArgs = @{
125-
ComputerName = 'localhost'
126-
Credential = New-Object System.Management.Automation.PSCredential ($userName, $pass)
127-
UseSSL = $true
128-
SessionOption = New-PSSessionOption -SkipRevocationCheck -SkipCACheck
129-
}
130-
131-
if (New-PSSession @sessionArgs) { return $true }
132-
}
133-
}
134-
135-
Invoke-ScriptBlockWithRetry @retryArgs
136-
}
115+
#function Test-WinRMConfiguration($userName, $password, $retries = 15, $timeout = 1)
116+
#{
117+
# $retryArgs = @{
118+
# FailMessage = 'Failed to establish WinRM connection over SSL'
119+
# SuccessMessage = "Successfully established WinRM connection with $userName"
120+
# Retries = $retries
121+
# Timeout = $timeout
122+
# Script = {
123+
# $pass = ConvertTo-SecureString $password -AsPlainText -Force
124+
# $sessionArgs = @{
125+
# ComputerName = 'localhost'
126+
# Credential = New-Object System.Management.Automation.PSCredential ($userName, $pass)
127+
# UseSSL = $true
128+
# SessionOption = New-PSSessionOption -SkipRevocationCheck -SkipCACheck
129+
# }
130+
#
131+
# if (New-PSSession @sessionArgs) { return $true }
132+
# }
133+
# }
134+
#
135+
# Invoke-ScriptBlockWithRetry @retryArgs
136+
#}
137137

138138
# Ensure Puppet Ruby 5 / 6 takes precedence over system Ruby
139139
function Set-ActiveRubyFromPuppet
@@ -151,8 +151,8 @@ function Set-ActiveRubyFromPuppet
151151
$Pass = New-RandomPassword
152152
$User = @{ UserName = $ENV:BOLT_WINRM_USER; Password = $Pass }
153153
New-LocalAdmin @User
154-
Enable-PSRemoting
155-
Set-WSManQuickConfig -Force
156-
Set-WinRMHostConfiguration
157-
Test-WinRMConfiguration @User | Out-Null
158-
Write-Output "::set-env name=BOLT_WINRM_PASSWORD::$pass"
154+
#Enable-PSRemoting
155+
#Set-WSManQuickConfig -Force
156+
#Set-WinRMHostConfiguration
157+
#Test-WinRMConfiguration @User | Out-Null
158+
#Write-Output "::set-env name=BOLT_WINRM_PASSWORD::$pass"

‎spec/Dockerfile.windev‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
FROM mcr.microsoft.com/windows/servercore:ltsc2019
2+
3+
ADD fixtures/ssl/cert.pfx C:\cert.pfx
4+
ADD fixtures/scripts/windev/setup.ps1 C:\setup.ps1
5+
RUN powershell C:\setup.ps1
6+
# TODO: Remove file? Do we care?

‎spec/docker-compose-windev.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
version: "3"
2+
services:
3+
windows_node:
4+
build:
5+
context: .
6+
dockerfile: Dockerfile.windev
7+
image: windows_node
8+
ports:
9+
- "25985:5985"
10+
- "2455:455"
11+
container_name: windows_node

‎spec/fixtures/scripts/windev/setup.ps1‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# add the bolt user account
2+
($user = New-LocalUser -Name bolt -Password (ConvertTo-SecureString -String bolt -Force -AsPlainText)) | Format-List
3+
# add the bolt user to the 'Remote Management Users' group
4+
Add-LocalGroupMember -Group 'Remote Management Users' -Member $user
5+
Add-LocalGroupMember -Group 'Administrators' -Member $user
6+
7+
# import the certificate to be used for the winrm-ssl
8+
($cert = Import-PfxCertificate -FilePath C:\\cert.pfx -CertStoreLocation cert:\\LocalMachine\\My -Password (ConvertTo-SecureString -String bolt -Force -AsPlainText)) | Format-List
9+
10+
# add the winrm-ssl listener
11+
New-WSManInstance -ResourceURI winrm/config/Listener -SelectorSet @{Address='*';Transport='HTTPS'} -ValueSet @{Hostname='boltserver';CertificateThumbprint=$cert.Thumbprint} | Format-List
12+
13+
# add a firewall rule allowing access to the winrm-ssl port (TCP port 5986)
14+
New-NetFirewallRule -DisplayName 'Windows Remote Management (HTTPS-In)' -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow | Format-List

0 commit comments

Comments
 (0)
⚡