インフラCI実践ガイドを試してみる④【テスト(前半)】

[root@infraci ~]# cd ~/
[root@infraci ~]# git clone https://github.com/infra-ci-book/lint-rules.git
Cloning into 'lint-rules'...
remote: Enumerating objects: 103, done.
remote: Total 103 (delta 0), reused 0 (delta 0), pack-reused 103
Receiving objects: 100% (103/103), 13.28 KiB | 0 bytes/s, done.
Resolving deltas: 100% (39/39), done.
[root@infraci ~]# cd ~/lint-rules/samples/ansible/
[root@infraci ansible]# ll
-rw-r--r-- 1 root root 239  6月 24 16:54 named_tasks.yml
-rw-r--r-- 1 root root 157  6月 24 16:54 nameless_tasks.yml

[root@infraci ansible]# cd ~/lint-rules/samples/ansible/
[root@infraci ansible]# ansible-playbook named_tasks.yml
※nameが表示される
[root@infraci ansible]# ansible-playbook nameless_tasks.yml
※nameがない

[root@infraci ansible]# cd  ~/lint-rules/samples/ansible/
[root@infraci ansible]# ansible-lint --force-color -v named_tasks.yml
Examining named_tasks.yml of type playbook
[root@infraci ansible]# echo $?
0
[root@infraci ansible]#
[root@infraci ansible]# ansible-lint --force-color -v nameless_tasks.yml
Examining nameless_tasks.yml of type playbook
[ANSIBLE0011] All tasks should be named
nameless_tasks.yml:4
Task/Handler: shell ps |grep -v grep

[root@infraci ansible]# echo $0
-bash

[root@infraci ansible]# ansible-lint -R -L
ANSIBLE0002: Trailing whitespace
  There should not be any trailing whitespace
ANSIBLE0004: Git checkouts must contain explicit version
  All version control checkouts must point to an explicit commit or tag, not just "latest"
ANSIBLE0005: Mercurial checkouts must contain explicit revision
  All version control checkouts must point to an explicit commit or tag, not just "latest"
ANSIBLE0006: Using command rather than module
  Executing a command when there is an Ansible module is generally a bad idea
ANSIBLE0007: Using command rather than an argument to e.g. file
  Executing a command when there is are arguments to modules is generally a bad idea
ANSIBLE0008: Deprecated sudo
  Instead of sudo/sudo_user, use become/become_user.
ANSIBLE0009: Octal file permissions must contain leading zero
  Numeric file permissions without leading zero can behave in unexpected ways. See http://docs.ansible.com/ansible/file_module.html
ANSIBLE0010: Package installs should not use latest
  Package installs should use state=present with or without a version
ANSIBLE0011: All tasks should be named
  All tasks should have a distinct name for readability and for --start-at-task to work
ANSIBLE0012: Commands should not change things if nothing needs doing
  Commands should either read information (and thus set changed_when) or not do something if it has already been done (using creates/removes) or only do it if another check has a particular result (when)
ANSIBLE0013: Use shell only when shell functionality is required
  Shell should only be used when piping, redirecting or chaining commands (and Ansible would be preferred for some of those!)
ANSIBLE0014: Environment variables don't work as part of command
  Environment variables should be passed to shell or command through environment argument
ANSIBLE0015: Using bare variables is deprecated
  Using bare variables is deprecated. Update your playbooks so that the environment value uses the full variable syntax ("{{your_variable}}").
ANSIBLE0016: Tasks that run when changed should likely be handlers
  If a task has a `when: result.changed` setting, it's effectively acting as a handler
ANSIBLE0017: become_user requires become to work as expected
  become_user without become will not actually change user
ANSIBLE0018: Deprecated always_run
  Instead of always_run, use check_mode.

[root@infraci ketchup-vagrant-ansible]# cat  ~/lint-rules/rules/ansible/.ansible-lint
parseable: true
quiet: false
rulesdir:
  - lint-rules/rules/ansible/rules
skip_list:
  - ANSIBLE0006
use_default_rules: true
verbosity: 1

[root@infraci ketchup-vagrant-ansible]# cd ~/lint-rules/rules/ansible/rules/
[root@infraci rules]# vim ShellRestrictRm.py
from ansiblelint import AnsibleLintRule

class ShellRestrictRm(AnsibleLintRule):
        id = 'MYRULE0001'
        shortdesc = 'rm command is not allowd in shell module'
        description = 'This is a sample rule for ansible-lint'
        tags = ['shell']
        check_command = 'rm'

        def matchtask(self, file, task):
                if task['action']['__ansible_module__'] not in ['shell', 'command']:
                        return False
                if self.check_command in task['action']['__ansible_arguments__']:
                        return True
                return False

[root@infraci rules]# python -m py_compile ShellRestrictRm.py
[root@infraci rules]# ansible-lint -r ~/lint-rules/rules/ansible/rules -L
MYRULE0001: rm command is not allowd in shell module
  This is a sample rule for ansible-lint

[root@infraci ansible]# cd ~/lint-rules/rules/ansible/rules/
[root@infraci rules]# vim IosCommandRestrictShowRunningConfig.py
from ansiblelint import AnsibleLintRule

class IosCommandRestrictShowRunningConfig(AnsibleLintRule):
        id = 'MYRULE0002'
        shortdesc = 'show running-config is not allowed in ios_command'
        description = 'This is a sample rule for ansible-lint'
        tags = ['ios']
        check_command = 'show running-config'

        def matchtask(self, file, task):
                if task['action']['__ansible_module__'] not in ['ios_command']:
                        return False
                if self.check_command in task['action']['commands']:
                        return True
                return False

[root@infraci rules]# ansible-lint -r ~/lint-rules/rules/ansible/rules -L
MYRULE0001: rm command is not allowd in shell module
  This is a sample rule for ansible-lint
MYRULE0002: show running-config is not allowed in ios_command
  This is a sample rule for ansible-lint

[root@infraci rules]# cd ~/lint-rules/samples/ansible/
[root@infraci ansible]# vim lint-sample.yml
- hosts: localhost
  tasks:
   - shell: rm -rf /hoge
   - ios_command:
      commands: show running-config