T9393: new rolesmain

1 files changed, 36 insertions, 0 deletions

diff --git a/extensions/molecule/vrf_firewall/verify.yml b/extensions/molecule/vrf_firewall/verify.yml
new file mode 100644
index 0000000..82989cc
--- /dev/null
+++ b/extensions/molecule/vrf_firewall/verify.yml
@@ -0,0 +1,36 @@
+---
+- name: Verify role state
+  hosts: vyos
+  gather_facts: false
+  tasks:
+    - name: Run role checks
+      ansible.builtin.include_role:
+        name: vyos.blueprints.vrf_firewall
+        tasks_from: verify
+
+- name: Verify traffic between VRFs against the page's requirements
+  hosts: localhost
+  gather_facts: false
+  vars:
+    _flows:
+      - {from: mgmt, to: 10.150.150.10, allowed: true, why: "MGMT may connect to LAN"}
+      - {from: mgmt, to: 172.16.20.10, allowed: true, why: "MGMT may connect to PROD"}
+      - {from: mgmt, to: 203.0.113.100, allowed: false, why: "MGMT may not reach the internet"}
+      - {from: lan, to: 172.16.20.10, allowed: true, why: "LAN may connect to PROD"}
+      - {from: lan, to: 203.0.113.100, allowed: true, why: "LAN may reach the internet"}
+      - {from: lan, to: 10.100.100.10, allowed: false, why: "nothing may connect to MGMT"}
+      - {from: prod, to: 10.150.150.10, allowed: false, why: "PROD only accepts connections"}
+      # The page's text says WAN may connect to PROD, but its configuration has
+      # no rule for it, so the configuration (default drop) is what is tested.
+      - {from: wan, to: 172.16.20.10, allowed: false, why: "no WAN->PROD rule in the page's configuration"}
+  tasks:
+    - name: Ping across VRFs
+      ansible.builtin.command:
+        cmd: docker exec clab-bp-vrf-{{ item.from }} ping -c 2 -W 2 {{ item.to }}
+      become: "{{ lookup('ansible.builtin.env', 'CLAB_BECOME', default='true') | bool }}"
+      register: _ping
+      changed_when: false
+      failed_when: (_ping.rc == 0) != item.allowed
+      loop: "{{ _flows }}"
+      loop_control:
+        label: "{{ item.from }} -> {{ item.to }} ({{ item.why }})"