Skip to content

Commit 592024a

Browse files
lucywymanlucywyman
committed
m
1 parent 1e0f74f commit 592024a

9 files changed

Lines changed: 59 additions & 183 deletions

File tree

‎.github/workflows/windows.yaml‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,9 @@ on:
99
paths-ignore: ['**.md', '**.erb']
1010

1111
env:
12-
BOLT_WINRM_USER: roddypiper
12+
CI_USER: roddypiper
1313
BOLT_WINRM_HOST: localhost
14-
BOLT_WINRM_PORT: 5985
15-
BOLT_WINRM_SSL_PORT: 5986
14+
BOLT_WINRM_PASSWORD: BoltonWindows1
1615
BOLT_WINRM_SMB_PORT: 445
1716
RUBY_VERSION: 25-x64
1817

@@ -23,6 +22,7 @@ jobs:
2322
runs-on: windows-latest
2423
env:
2524
WINDOWS_AGENTS: true
25+
BOLT_WINRM_PORT: 35986
2626
steps:
2727
- name: Checkout repository
2828
uses: actions/checkout@v1
@@ -55,10 +55,12 @@ jobs:
5555
- name: Pre-test setup
5656
shell: powershell
5757
run: |
58-
docker-compose -f spec\docker-compose-windev.yml build
59-
docker-compose -f spec\docker-compose-windev.yml up -d
60-
. scripts\ci.ps1
61-
Set-ActiveRubyFromPuppet
58+
Enable-PSRemoting
59+
winrm "set" "winrm/config/client/auth" "@{Certificate=`"true`"}"
60+
#winrm "set" "winrm/config/client" "@{AllowUnencrypted=`"true`"}"
61+
# docker-compose prints stdout to stderr, which causes this to fail with no errors
62+
try { docker-compose -f spec\docker-compose-windev.yml up -d --build }
63+
catch [System.Management.Automation.RuntimeException] { exit 0 }
6264
- name: Run tests
6365
shell: powershell
6466
run: bundle exec rake integration:windows_agents
@@ -100,9 +102,12 @@ jobs:
100102
- name: Pre-test setup
101103
shell: powershell
102104
run: |
103-
docker-compose -f spec\docker-compose-windev.yml build
104-
docker-compose -f spec\docker-compose-windev.yml up -d
105-
. scripts\ci.ps1
105+
Enable-PSRemoting
106+
winrm "set" "winrm/config/client/auth" "@{Certificate=`"true`"}"
107+
#winrm "set" "winrm/config/client" "@{AllowUnencrypted=`"true`"}"
108+
# docker-compose prints stdout to stderr, which causes this to fail with no errors
109+
try { docker-compose -f spec\docker-compose-windev.yml up -d --build }
110+
catch [System.Management.Automation.RuntimeException] { exit 0 }
106111
- name: Run tests
107112
shell: powershell
108113
run: bundle exec rake windows_ci

‎scripts/ci.ps1‎

Lines changed: 3 additions & 155 deletions
Original file line numberDiff line numberDiff line change
@@ -1,158 +1,6 @@
11
$InformationPreference = 'Continue'
22
$ErrorActionPreference = 'Stop'
33

4-
function Set-CACert
5-
{
6-
$uri = 'https://curl.haxx.se/ca/cacert.pem'
7-
$CACertFile = Join-Path -Path $ENV:AppData -ChildPath 'RubyCACert.pem'
8-
9-
$retryArgs = @{
10-
SuccessMessage = "Succeeded in downloading CA bundle from $uri"
11-
FailMessage = "Failed to download CA bundle from $uri"
12-
Retries = 5
13-
Timeout = 1
14-
Script = {
15-
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
16-
Invoke-WebRequest -Uri $uri -UseBasicParsing -OutFile $CACertFile | Out-Null
17-
}
18-
}
19-
20-
# only download CA file if not present - throw on failures
21-
If (-Not (Test-Path -Path $CACertFile)) { Invoke-ScriptBlockWithRetry @retryArgs }
22-
23-
Write-Information "Setting CA Certificate store set to $CACertFile.."
24-
$ENV:SSL_CERT_FILE = $CACertFile
25-
[System.Environment]::SetEnvironmentVariable('SSL_CERT_FILE', $CACertFile, [System.EnvironmentVariableTarget]::Machine)
26-
}
27-
28-
function Install-Puppetfile
29-
{
30-
Set-CACert
31-
32-
# Forge connections may fail intermittently
33-
$retryArgs = @{
34-
SuccessMessage = 'Succeeded in installing Puppetfile'
35-
FailMessage = 'Failed to install required modules from Forge'
36-
Retries = 10
37-
Timeout = 2
38-
Script = { bundle exec r10k puppetfile install }
39-
}
40-
41-
Invoke-ScriptBlockWithRetry @retryArgs
42-
}
43-
44-
function New-RandomPassword
45-
{
46-
Add-Type -AssemblyName System.Web
47-
"&aA4" + [System.Web.Security.Membership]::GeneratePassword(10, 3)
48-
}
49-
50-
function New-LocalAdmin($userName, $password)
51-
{
52-
$userArgs = @{
53-
Name = $userName
54-
Password = (ConvertTo-SecureString -String $password -Force -AsPlainText)
55-
}
56-
57-
$user = New-LocalUser @userArgs
58-
Write-Information ($user | Format-List | Out-String)
59-
Add-LocalGroupMember -Group 'Remote Management Users' -Member $user
60-
Add-LocalGroupMember -Group Administrators -Member $user
61-
}
62-
63-
function Install-Certificate($path, $password)
64-
{
65-
$importArgs = @{
66-
FilePath = $path
67-
CertStoreLocation = 'cert:\\LocalMachine\\My'
68-
Password = (ConvertTo-SecureString -String $password -Force -AsPlainText)
69-
}
70-
71-
return (Import-PfxCertificate @importArgs)
72-
}
73-
74-
#function Grant-WinRMHttpsAccess($certThumbprint)
75-
#{
76-
# $winRMArgs = @{
77-
# ResourceURI = 'winrm/config/Listener'
78-
# SelectorSet = @{ Address = '*'; Transport = 'HTTPS'; }
79-
# ValueSet = @{ Hostname = 'boltserver'; CertificateThumbprint = $certThumbprint }
80-
# }
81-
# $instance = Set-WSManInstance @winRMArgs
82-
# Write-Information ($instance | Format-List | Out-String)
83-
#}
84-
85-
#function Set-WinRMHostConfiguration
86-
#{
87-
# # configure WinRM to use cert.pfx for SSL
88-
# $cert = Install-Certificate -Path 'spec/fixtures/ssl/cert.pfx' -Password 'bolt'
89-
# Write-Information ($cert | Format-List | Out-String)
90-
# Grant-WinRMHttpsAccess -CertThumbprint $cert.Thumbprint
91-
#}
92-
93-
function Invoke-ScriptBlockWithRetry([ScriptBlock]$script, $failMessage, $successMessage, $retries = 15, $timeout = 1)
94-
{
95-
$retried = 0
96-
97-
Do
98-
{
99-
try {
100-
$script.Invoke()
101-
Write-Information "$successMessage after $($retried + 1) attempt(s)"
102-
return $true
103-
}
104-
catch
105-
{
106-
$retried++
107-
Start-Sleep -Seconds $timeout
108-
}
109-
} While ($retried -lt $retries)
110-
111-
throw "ERROR: $failMessage in $retried retries`n$($Error[0])"
112-
113-
}
114-
115-
#function Test-WinRMConfiguration($userName, $password, $retries = 15, $timeout = 1)
116-
#{
117-
# $retryArgs = @{
118-
# FailMessage = 'Failed to establish WinRM connection over SSL'
119-
# SuccessMessage = "Successfully established WinRM connection with $userName"
120-
# Retries = $retries
121-
# Timeout = $timeout
122-
# Script = {
123-
# $pass = ConvertTo-SecureString $password -AsPlainText -Force
124-
# $sessionArgs = @{
125-
# ComputerName = 'localhost'
126-
# Credential = New-Object System.Management.Automation.PSCredential ($userName, $pass)
127-
# UseSSL = $true
128-
# SessionOption = New-PSSessionOption -SkipRevocationCheck -SkipCACheck
129-
# }
130-
#
131-
# if (New-PSSession @sessionArgs) { return $true }
132-
# }
133-
# }
134-
#
135-
# Invoke-ScriptBlockWithRetry @retryArgs
136-
#}
137-
138-
# Ensure Puppet Ruby 5 / 6 takes precedence over system Ruby
139-
function Set-ActiveRubyFromPuppet
140-
{
141-
# https://github.com/puppetlabs/puppet-specifications/blob/master/file_paths.md
142-
$path = @(
143-
"${ENV:ProgramFiles}\Puppet Labs\Puppet\sys\ruby\bin",
144-
"${ENV:ProgramFiles}\Puppet Labs\Puppet\puppet\bin",
145-
$ENV:Path
146-
) -join ';'
147-
148-
[System.Environment]::SetEnvironmentVariable('Path', $path, [System.EnvironmentVariableTarget]::Machine)
149-
}
150-
151-
$Pass = New-RandomPassword
152-
$User = @{ UserName = $ENV:BOLT_WINRM_USER; Password = $Pass }
153-
New-LocalAdmin @User
154-
#Enable-PSRemoting
155-
#Set-WSManQuickConfig -Force
156-
#Set-WinRMHostConfiguration
157-
#Test-WinRMConfiguration @User | Out-Null
158-
#Write-Output "::set-env name=BOLT_WINRM_PASSWORD::$pass"
4+
Enable-PSRemoting
5+
winrm "set" "winrm/config/client/auth" "@{Basic=`"true`"}"
6+
winrm "set" "winrm/config/client" "@{AllowUnencrypted=`"true`"}"

‎spec/Dockerfile.winagent‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
FROM mcr.microsoft.com/windows/servercore:ltsc2019
2+
3+
COPY fixtures/scripts/windev/setup.ps1 ./
4+
COPY fixtures/scripts/windev/agent.ps1 ./
5+
RUN powershell ./setup.ps1
6+
RUN powershell ./agent.ps1
7+
CMD ["powershell", "Start-Sleep", "-s 1000000"]

‎spec/Dockerfile.windev‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
FROM mcr.microsoft.com/windows/servercore:ltsc2019
22

3-
ADD fixtures/ssl/cert.pfx C:\cert.pfx
4-
ADD fixtures/scripts/windev/setup.ps1 C:\setup.ps1
5-
RUN powershell C:\setup.ps1
6-
# TODO: Remove file? Do we care?
3+
COPY fixtures/ssl/cert.pfx ./
4+
COPY fixtures/scripts/windev/setup.ps1 ./
5+
RUN powershell ./setup.ps1
6+
CMD ["powershell", "Start-Sleep", "-s 1000000"]

‎spec/docker-compose-windev.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,16 @@ services:
44
build:
55
context: .
66
dockerfile: Dockerfile.windev
7-
image: windows_node
7+
hostname: boltserver
88
ports:
99
- "25985:5985"
10-
- "2455:455"
11-
container_name: windows_node
10+
- "25986:5986"
11+
12+
windows_agent:
13+
build:
14+
context: .
15+
dockerfile: Dockerfile.winagent
16+
hostname: boltserver
17+
ports:
18+
- "35985:5985"
19+
- "35986:5986"

‎spec/fixtures/scripts/windev/setup.ps1‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,23 @@
1+
# Disable password complexity requirements
2+
secedit /export /cfg c:\secpol.cfg
3+
(gc C:\secpol.cfg).replace("PasswordComplexity = 1", "PasswordComplexity = 0") | Out-File C:\secpol.cfg
4+
secedit /configure /db c:\windows\security\local.sdb /cfg c:\secpol.cfg /areas SECURITYPOLICY
5+
rm -force c:\secpol.cfg -confirm:$false
6+
17
# add the bolt user account
2-
($user = New-LocalUser -Name bolt -Password (ConvertTo-SecureString -String bolt -Force -AsPlainText)) | Format-List
8+
New-LocalUser -Name bolt -Password (ConvertTo-SecureString -String bolt -Force -AsPlainText)
39
# add the bolt user to the 'Remote Management Users' group
4-
Add-LocalGroupMember -Group 'Remote Management Users' -Member $user
5-
Add-LocalGroupMember -Group 'Administrators' -Member $user
10+
Add-LocalGroupMember -Group 'Remote Management Users' -Member "bolt"
11+
Add-LocalGroupMember -Group 'Administrators' -Member "bolt"
612

713
# import the certificate to be used for the winrm-ssl
814
($cert = Import-PfxCertificate -FilePath C:\\cert.pfx -CertStoreLocation cert:\\LocalMachine\\My -Password (ConvertTo-SecureString -String bolt -Force -AsPlainText)) | Format-List
915

1016
# add the winrm-ssl listener
1117
New-WSManInstance -ResourceURI winrm/config/Listener -SelectorSet @{Address='*';Transport='HTTPS'} -ValueSet @{Hostname='boltserver';CertificateThumbprint=$cert.Thumbprint} | Format-List
1218

13-
# add a firewall rule allowing access to the winrm-ssl port (TCP port 5986)
14-
New-NetFirewallRule -DisplayName 'Windows Remote Management (HTTPS-In)' -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow | Format-List
19+
Enable-PSRemoting
20+
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
21+
winrm "set" "winrm/config/service/auth" "@{Basic=`"true`"}"
22+
winrm "set" "winrm/config/service/auth" "@{Certificate=`"true`"}"
23+
#winrm "set" "winrm/config/service/" "@{AllowUnencrypted=`"true`"}"

‎spec/integration/apply_spec.rb‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -430,8 +430,7 @@ def task_plugin_inventory
430430
def config
431431
{ 'modulepath' => File.join(__dir__, '../fixtures/apply'),
432432
'winrm' => {
433-
'ssl' => false,
434-
'ssl-verify' => false,
433+
'cacert' => File.join(__dir__, '../fixtures/ssl/ca.pem'),
435434
'user' => conn_info('winrm')[:user],
436435
'password' => conn_info('winrm')[:password]
437436
} }

‎spec/integration/winrm_spec.rb‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,11 @@
1414
let(:uri) { conn_uri('winrm') }
1515
let(:password) { conn_info('winrm')[:password] }
1616
let(:user) { conn_info('winrm')[:user] }
17+
let(:cacert) { File.join(__dir__, '../fixtures/ssl/ca.pem') }
1718

1819
context 'when using CLI options' do
1920
let(:config_flags) {
20-
%W[--targets #{uri} --no-ssl --no-ssl-verify --format json --modulepath #{modulepath}
21+
%W[--targets #{uri} --cacert #{cacert} --format json --modulepath #{modulepath}
2122
--password #{password}]
2223
}
2324

@@ -93,8 +94,7 @@
9394
'winrm' => {
9495
'user' => user,
9596
'password' => password,
96-
'ssl' => false,
97-
'ssl-verify' => false
97+
'cacert' => cacert
9898
}
9999
}
100100
}

‎spec/lib/bolt_spec/conn.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ def conn_info(transport)
1919
when 'ssh'
2020
default_port = 20022
2121
when 'winrm'
22-
default_port = 25985
22+
default_port = 25986
2323
when 'docker'
2424
default_user = ''
2525
default_password = ''

0 commit comments

Comments
 (0)
⚡