feat: add extra-vars flag and overlay drop detection for lab config - #34
Merged
Conversation
**Added:** - `--extra-vars`/`-E` flag to `provision`, `ad-users`, and `lab reset` commands, enabling role defaults like `ad_reconcile_check_only=true` to be set from the command line for dry-run drift reporting instead of destructive writes - cli/cmd/provision.go, cli/cmd/lab_reset.go - `parseExtraVars` and `sortedPairs` helpers to parse repeatable key=value flags (rejecting malformed input) and render var maps for display, with user-supplied vars layered on top of tunnel vars so explicit `-E` always wins - cli/cmd/provision.go - `CheckOverlayDrops` integrity check that catches capability the base config grants a host but the merged overlay silently discards, a class CheckIntegrity cannot detect since RFC 7386 arrays replace wholesale - cli/internal/labconfig/integrity.go - `Scripts` and `VulnsADCSTemplates` fields to the host struct so their per-host arrays are covered by drop detection - cli/internal/labconfig/integrity.go - `adcs_esc10_case1` vuln to dc03 across dev, staging, and test overlays for GOAD and GOAD-variant-1, restoring the ESC6/ESC9 capability the base grant left unexploitable in those environments - Tests covering extra-vars parsing, malformed rejection, stable pair sorting, silent overlay-drop detection, and deleted-host handling - cli/cmd/provision_test.go, cli/internal/labconfig/integrity_test.go - Documentation explaining array-replace overlay semantics and the requirement to propagate new vulns to every re-declaring overlay - docs/mkdocs/docs/developers/add_lab.md **Changed:** - `provisionPlaybooks` signature to accept an `extraVars` map, merged into run vars before execution - cli/cmd/provision.go - `known_findings.txt` to record two deliberate, correct srv02 share relocations flagged by the new drop check, replacing the "intentionally empty" note - cli/internal/labconfig/testdata/known_findings.txt
**Added:** - `applyExtraVars` helper that layers user-supplied vars over the SOCKS tunnel's connection vars, preserving -e precedence and echoing applied vars - `cli/cmd/provision.go` - Tests for `applyExtraVars` covering var precedence, non-mutation of the caller's map, and passthrough when no user vars are given - `cli/cmd/provision_test.go` **Changed:** - Replaced inline var-merging logic in `provisionPlaybooks` with a call to the new `applyExtraVars` helper - `cli/cmd/provision.go` - Aligned struct field indentation for `MSSQL` in the host type - `cli/internal/labconfig/integrity.go` - Normalized "re-declare"/"re-declared" to "redeclare"/"redeclared" across comments, tests, and docs - `integrity.go`, `integrity_test.go`, `add_lab.md`
l50
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
-E/--extra-varsflag onprovisionandlab resetso operators can pass Ansible variables from the CLI, most importantlyad_reconcile_check_only=trueto rehearse a reset as a drift report instead of a destructive writeCheckOverlayDropsto catch a class of silent misconfiguration where an overlay redeclares a per-host array (likevulns) and drops entries the base config grants, which RFC 7386 array replacement makes invisible to referential checksadcs_esc10_case1was added to dc03 in each lab'sconfig.jsonbut missing from the dev, staging, and test overlays, leaving ESC6/ESC9 unexploitable in those environmentsAdded:
-E/--extra-varsflag (sharedextraVarsUsageconst),parseExtraVarsto read repeatablekey=valuepairs, andapplyExtraVars/sortedPairsto layer user vars over SOCKS tunnel vars with user precedence and echo what was applied -cli/cmd/provision.go,cli/cmd/lab_reset.goCheckOverlayDrops,hostsOf, and theoverlayDropKeystable coveringvulns,scripts, andvulns_adcs_templates; deleted hosts (explicit null) are intentionally not reported since the removal is already legible -cli/internal/labconfig/integrity.goprovision_test.gocovering extra-vars parsing edge cases (multiple equals signs, empty values, malformed input, precedence, non-mutation of caller maps) and overlay-drop tests pinning the shipped defect and the deleted-host exemption -cli/cmd/provision_test.go,cli/internal/labconfig/integrity_test.goadcs_esc10_case1vuln - Added the missing vuln to the dc03 host in the dev, staging, and test overlays for both GOAD and GOAD-variant-1 labsCheckOverlayDropsandknown_findings.txt-docs/mkdocs/docs/developers/add_lab.mdChanged:
provisionPlaybooksto acceptextraVarsand thread them into the Ansible runner'sExtraVars, replacing the SOCKS-only var map -cli/cmd/provision.gohosttype withScriptsandVulnsADCSTemplatesfields so the drop check can inspect all provisioned arrays -cli/internal/labconfig/integrity.gosharesdrops as correct-by-design entries (the share is rehomed to dc02, not lost) with a reason and removal condition, replacing the "intentionally empty" note -cli/internal/labconfig/testdata/known_findings.txtad_reconcile_check_only=truerehearsal workflow in thelab resetlong help and examples -cli/cmd/lab_reset.go