- Project State: Maintained
- Issues Response Time Maximum: 7 days or more
- Pull Request Response Time Maximum: 7 days or more
This InSpec resource pack provides InSpec resources to verify Digitialocean Cloud settings. It is designed to work hand-in-hand with Digitalocean's terrafrom provider and follows their naming convention.
Verify a droplet:
describe digitalocean_droplet(id: '123456') do
it { should exist }
its('name') { should eq 'nginx-web-ams3' }
its('image') { should eq 'ubuntu-16-04-x64' }
its('region') { should eq 'ams3' }
its('size') { should eq 's-1vcpu-1gb' }
end
Verify a ssh key:
describe digitalocean_ssh_key(name: 'Terraform Example') do
it { should exist }
its('fingerprint') { should eq '2c:c2:8f:6b:f0:12:f0:b2:0f:9c:f2:cd:8f:6d:24:c1'}
end
At this point, the following resources are implemented:
- digitalocean_certificate
- digitalocean_droplet
- digitalocean_loadbalancer
- digitalocean_ssh_key
- digitalocean_tag
- digitalocean_volume
- InSpec 3
- InSpec Digitalocean backend plugin train-digitalocean
- Digitalocean API key
You can easily verify your environment by
$ inspec version
3.0.0
$ inspec plugin list
Plugin Name Version Via ApiVer
-------------------------------------------------------
train-digitalocean src path train-1
-------------------------------------------------------
1 plugin(s) total
If the plugin is missing, just install it via InSpec's cli
$ inspec plugin install train-digitalocean
In order to use this example, you need to create a DigitalOcean API Token and export it as an environment variable.
export DIGITALOCEAN_TOKEN="Put Your Token Here" Verify the plugin and the connection to Digitalocean
$ inspec detect -t digitalocean://
== Platform Details
Name: digitalocean
Families: cloud, api
Release: 0.1.0
The integration tests launch an Ubuntu 16.04, install nginx and connects it to a load balancer via Terraform. Once created, InSpec is executed to verify that the environment is in its expected shape.
If you just want to run the full test cycle:
rake test:integrationIn addition you can also walk through each step individually:
cd test/integration/build
# generate private key for ssh
ssh-keygen -t rsa -b 4096 -C "digitalocean" -N '' -f ./id_rsa
# generate self-signed https certificate
openssl req \
-newkey rsa:2048 -nodes -keyout domain.key \
-out domain.csr \
-subj "/C=DE/ST=Berlin/L=Berlin/O=InSpec Security/OU=IT Department/CN=example.com"
openssl req \
-key domain.key \
-new \
-x509 -days 365 -out domain.crt \
-subj "/C=DE/ST=Berlin/L=Berlin/O=InSpec Security/OU=IT Department/CN=example.com"
# run terraform
terraform init
terraform plan
terraform apply
# derive inspec attributes from the terraform state
rake test:tfstate
# run inspec
inspec exec ./verify -t digitalocean:// --attrs attributes.yml