42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
---
|
|
- name: Get all users from MySQL server
|
|
community.mysql.mysql_query:
|
|
query: >
|
|
SELECT CONCAT(USER, '@', HOST) AS users FROM mysql.user;
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
register: mysql_users
|
|
|
|
- name: Create list of users from mysql query
|
|
ansible.builtin.set_fact:
|
|
mysql_users_list: "{{ mysql_users.query_result.0 | json_query('[*].users') | list }}"
|
|
|
|
- name: Assert that only accounts with password remain
|
|
ansible.builtin.assert:
|
|
that:
|
|
- '"user@delete" not in mysql_users_list'
|
|
- '"[email protected]" not in mysql_users_list'
|
|
- '"user@::1" not in mysql_users_list'
|
|
- '"user@%" not in mysql_users_list'
|
|
- '"[email protected].%" not in mysql_users_list'
|
|
- '"[email protected]" not in mysql_users_list'
|
|
- '"%@192.168.0.1" not in mysql_users_list'
|
|
- '"[email protected]" in mysql_users_list'
|
|
- '"user@keep" in mysql_users_list'
|
|
- '"[email protected].%" in mysql_users_list'
|
|
|
|
- name: Detect role support on MySQL
|
|
community.mysql.mysql_query:
|
|
query: >
|
|
SELECT 1 FROM information_schema.COLUMNS
|
|
WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user'
|
|
AND COLUMN_NAME = 'is_role';
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
register: mysql_role_support
|
|
|
|
- name: Assert that roles remain
|
|
ansible.builtin.assert:
|
|
that:
|
|
- '"role_keep@" in mysql_users_list'
|
|
when:
|
|
- mysql_role_support.rowcount[0] > 0
|