Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

quiet mode for inspec scans #47

Merged
merged 1 commit into from
May 20, 2016
Merged

quiet mode for inspec scans #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions attributes/default.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
default['audit']['token'] = nil
default['audit']['variant'] = 'chef'
default['audit']['owner'] = nil
default['audit']['quiet'] = nil
default['audit']['profiles'] = {}

# raise exception if Compliance API endpoint is unreachable
Expand Down
4 changes: 3 additions & 1 deletion libraries/profile.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ class ComplianceProfile < Chef::Resource # rubocop:disable Metrics/ClassLength
property :port, Integer
property :token, [String, nil]
property :inspec_version, String, default: 'latest'
property :quiet, [TrueClass, FalseClass], default: true
# TODO(sr) it might be nice to default to settings from attributes

# alternative to (owner, profile)-addressing for profiles,
Expand Down Expand Up @@ -107,7 +108,8 @@ class ComplianceProfile < Chef::Resource # rubocop:disable Metrics/ClassLength

# TODO: flesh out inspec's report CLI interface,
# make this an execute[inspec check ...]
runner = ::Inspec::Runner.new('report' => true, 'format' => 'json-min')
output = quiet ? ::File::NULL : $stdout
runner = ::Inspec::Runner.new('report' => true, 'format' => 'json-min', 'output' => output)
runner.add_target(path, {})
begin
runner.run
Expand Down
6 changes: 5 additions & 1 deletion libraries/report.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ class ComplianceReport < Chef::Resource
property :port, Integer
property :token, [String, nil]
property :variant, String, default: 'chef' # 'chef', 'compliance'
property :quiet, [TrueClass, FalseClass], default: true

property :environment, String # default: node.environment
property :owner, [String, nil]
Expand All @@ -25,7 +26,10 @@ class ComplianceReport < Chef::Resource
blob = node_info
blob[:reports] = reports
total_failed = 0
blob[:reports].each { |k, _| total_failed += blob[:reports][k]['summary']['failure_count'].to_i }
blob[:reports].each do |k, _|
Chef::Log.info "Summary for #{k} #{blob[:reports][k]['summary'].to_json}" if quiet
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this be unless quiet?

Copy link
Contributor Author

@jeremymv2 jeremymv2 May 20, 2016 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chris-rock That's intentional. I still think that the summary of the scan results is helpful / borderline necessary to output so that we can tell that the scan report contains valid results. Thus, if quiet == true then we WILL give a small courtesy summary during the compliance_report resource execution that looks like this:

  * compliance_report[chef-server] action execute
[2016-05-20T13:26:20+00:00] INFO: Summary for ssh {"duration":0.085985146,"example_count":69,"failure_count":44,"skip_count":0}
[2016-05-20T13:26:20+00:00] INFO: Summary for linux {"duration":0.624625593,"example_count":45,"failure_count":28,"skip_count":0}
[2016-05-20T13:26:20+00:00] INFO: Summary for apache {"duration":0.063314513,"example_count":5,"failure_count":2,"skip_count":3}

    - report compliance profiles' results

On the other hand, if quiet == false, then we don't want to output that Summary info during the compliance_report resource since it's redundant and already contained in output that is dumped during the compliance_profile execution stage. For example:

  * compliance_profile[apache] action execute
    * chef_gem[inspec] action install (up to date)
    - install/update inspec
[2016-05-20T13:02:55+00:00] INFO: Execute compliance profile base/apache
{"version":"0.22.1","controls":[{"id":"apache-1","status":"failed","code_desc":"Service apache2 should be enabled","message":"expected that `Service apache2` is enabled"},{"id":"apache-1","status":"failed","code_desc":"Service apache2 should be running","message":"expected that `Service apache2` is running"},
{"id":"apache-2","status":"skipped","code_desc":"Apache Config /etc/apache2/apache2.conf Can't find file \"/etc/apache2/apache2.conf\"","skip_message":"Can't find file \"/etc/apache2/apache2.conf\"","resource":"Apache Config /etc/apache2/apache2.conf"},{"id":"apache-3","status":"skipped","code_desc":"Apache Config /etc/apache2/apache2.conf Can't find file \"/etc/apache2/apache2.conf\"","skip_message":"Can't find file \"/etc/apache2/apache2.conf\"","resource":"Apache Config /etc/apache2/apache2.conf"},{"id":"apache-4","status":"skipped","code_desc":"Apache Config /etc/apache2/apache2.conf Can't find file \"/etc/apache2/apache2.conf\"","skip_message":"Can't find file \"/etc/apache2/apache2.conf\"","resource":"Apache Config /etc/apache2/apache2.conf"}],
"summary":{"duration":0.060710606,"example_count":5,"failure_count":2,"skip_count":3}}
    - execute compliance profile

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LMK if that doesn't feel right to you 😄

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like your approach!

total_failed += blob[:reports][k]['summary']['failure_count'].to_i
end
blob[:profiles] = ownermap

# resolve owner
Expand Down
2 changes: 2 additions & 0 deletions recipes/default.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
server server
token token
inspec_version node['audit']['inspec_version']
quiet node['audit']['quiet'] unless node['audit']['quiet'].nil?
action [:fetch, :execute]
end
end
Expand All @@ -42,5 +43,6 @@
server server
token token
variant node['audit']['variant']
quiet node['audit']['quiet'] unless node['audit']['quiet'].nil?
action :execute
end if node['audit']['profiles'].values.any?
4 changes: 4 additions & 0 deletions spec/unit/recipes/default_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,8 @@
runner = ChefSpec::ServerRunner.new(platform: 'centos', version: '6.5')
runner.node.set['audit']['profiles'] = { 'admin/myprofile' => true,
'base/ssh' => false }
runner.node.set['audit']['inspec_version'] = 'latest'
runner.node.set['audit']['quiet'] = true
runner.converge(described_recipe)
end

Expand All @@ -51,12 +53,14 @@
server: nil,
token: nil,
inspec_version: 'latest',
quiet: true,
)
expect(chef_run).to execute_compliance_report('chef-server').with(
owner: nil,
server: nil,
token: nil,
variant: 'chef',
quiet: true,
)
end

Expand Down