hybrid_platforms_conductor 32.17.1 → 33.0.3

data/spec/hybrid_platforms_conductor_test/api/deployer/secrets_reader_plugins/thycotic_spec.rb

@@ -0,0 +1,268 @@
+require 'savon'
+
+describe HybridPlatformsConductor::Deployer do
+
+  context 'when checking secrets_reader plugins' do
+
+    context 'with thycotic' do
+
+      # Setup a platform for tests
+      #
+      # Parameters::
+      # * *additional_config* (String): Additional config
+      # * *platform_info* (Hash): Platform configuration [default: 1 node having 1 service]
+      # * *block* (Proc): Code called when the platform is setup
+      def with_test_platform_for_thycotic_test(
+        additional_config,
+        platform_info: {
+          nodes: { 'node' => { services: %w[service] } },
+          deployable_services: %w[service]
+        },
+        &block
+      )
+        with_test_platform(
+          platform_info,
+          additional_config: "read_secrets_from :thycotic\n#{additional_config}",
+          &block
+        )
+      end
+
+      # Mock calls being made to a Thycotic SOAP API using Savon
+      #
+      # Parameters::
+      # * *thycotic_url* (String): Mocked URL
+      # * *secret_id* (String): The mocked secret ID
+      # * *mocked_secrets_file* (String or nil): The mocked secrets file stored in Thycotic, or nil to mock a missing secret
+      # * *user* (String or nil): The user to be expected, or nil if it should be read from netrc [default: nil]
+      # * *password* (String or nil): The password to be expected, or nil if it should be read from netrc [default: nil]
+      def mock_thycotic_file_download_on(thycotic_url, secret_id, mocked_secrets_file, user: nil, password: nil)
+        if user.nil?
+          user = 'thycotic_user_from_netrc'
+          password = 'thycotic_password_from_netrc'
+          expect(HybridPlatformsConductor::Credentials).to receive(:with_credentials_for) do |id, _logger, _logger_stderr, url: nil, &client_code|
+            expect(id).to eq :thycotic
+            expect(url).to eq thycotic_url
+            client_code.call user, password
+          end
+        end
+        # Mock the Savon calls
+        mocked_savon_client = instance_double Savon::Client
+        expect(Savon).to receive(:client) do |params|
+          expect(params[:wsdl]).to eq "#{thycotic_url}/webservices/SSWebservice.asmx?wsdl"
+          expect(params[:ssl_verify_mode]).to eq :none
+          mocked_savon_client
+        end
+        expect(mocked_savon_client).to receive(:call).with(
+          :authenticate,
+          message: {
+            username: user,
+            password: password,
+            domain: 'thycotic_auth_domain'
+          }
+        ).and_return(authenticate_response: { authenticate_result: { token: 'soap_token' } })
+        expect(mocked_savon_client).to receive(:call).with(
+          :get_secret,
+          message: {
+            token: 'soap_token',
+            secretId: secret_id
+          }
+        ) do
+          {
+            get_secret_response: {
+              get_secret_result:
+                if mocked_secrets_file
+                  { secret: { items: { secret_item: { id: '4242' } } } }
+                else
+                  { errors: { string: 'Access Denied' }, secret_error: { error_code: 'LOAD', error_message: 'Access Denied', allows_response: false } }
+                end
+            }
+          }
+        end
+        if mocked_secrets_file
+          expect(mocked_savon_client).to receive(:call).with(
+            :download_file_attachment_by_item_id,
+            message: {
+              token: 'soap_token',
+              secretId: secret_id,
+              secretItemId: '4242'
+            }
+          ) do
+            {
+              download_file_attachment_by_item_id_response: {
+                download_file_attachment_by_item_id_result: {
+                  file_attachment: Base64.encode64(mocked_secrets_file)
+                }
+              }
+            }
+          end
+        end
+        ENV['hpc_domain_for_thycotic'] = 'thycotic_auth_domain'
+      end
+
+      it 'gets secrets from a Thycotic Secret Server' do
+        with_test_platform_for_thycotic_test(
+          <<~EO_CONFIG
+            secrets_from_thycotic(
+              thycotic_url: 'https://my_thycotic.domain.com/SecretServer',
+              secret_id: 1107
+            )
+          EO_CONFIG
+        ) do
+          mock_thycotic_file_download_on('https://my_thycotic.domain.com/SecretServer', 1107, '{ "secret_name": "secret_value" }')
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node' => %w[service] },
+            secrets: { 'secret_name' => 'secret_value' },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'gets secrets from a Thycotic Secret Server for several nodes' do
+        additional_config = <<~EO_CONFIG
+          secrets_from_thycotic(
+            thycotic_url: 'https://my_thycotic.domain.com/SecretServer',
+            secret_id: 1107
+          )
+        EO_CONFIG
+        with_test_platform_for_thycotic_test(
+          additional_config,
+          platform_info: {
+            nodes: { 'node1' => { services: %w[service1] }, 'node2' => { services: %w[service2] } },
+            deployable_services: %w[service1 service2]
+          }
+        ) do
+          mock_thycotic_file_download_on('https://my_thycotic.domain.com/SecretServer', 1107, '{ "secret_name": "secret_value" }')
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node1' => %w[service1], 'node2' => %w[service2] },
+            secrets: { 'secret_name' => 'secret_value' },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node1 node2]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'gets secrets from a Thycotic Secret Server using env variables' do
+        with_test_platform_for_thycotic_test(
+          <<~EO_CONFIG
+            secrets_from_thycotic(
+              thycotic_url: 'https://my_thycotic.domain.com/SecretServer',
+              secret_id: 1107
+            )
+          EO_CONFIG
+        ) do
+          mock_thycotic_file_download_on(
+            'https://my_thycotic.domain.com/SecretServer',
+            1107,
+            '{ "secret_name": "secret_value" }',
+            user: 'thycotic_user_from_env',
+            password: 'thycotic_password_from_env'
+          )
+          ENV['hpc_user_for_thycotic'] = 'thycotic_user_from_env'
+          ENV['hpc_password_for_thycotic'] = 'thycotic_password_from_env'
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node' => %w[service] },
+            secrets: { 'secret_name' => 'secret_value' },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'gets secrets from several Thycotic Secret Servers' do
+        additional_config = <<~EO_CONFIG
+          secrets_from_thycotic(
+            thycotic_url: 'https://my_thycotic1.domain.com/SecretServer',
+            secret_id: 110701
+          )
+          for_nodes('node2') do
+            secrets_from_thycotic(
+              thycotic_url: 'https://my_thycotic2.domain.com/SecretServer',
+              secret_id: 110702
+            )
+          end
+        EO_CONFIG
+        with_test_platform_for_thycotic_test(
+          additional_config,
+          platform_info: {
+            nodes: { 'node1' => { services: %w[service1] }, 'node2' => { services: %w[service2] } },
+            deployable_services: %w[service1 service2]
+          }
+        ) do
+          mock_thycotic_file_download_on('https://my_thycotic1.domain.com/SecretServer', 110_701, '{ "secret1": "value1" }')
+          mock_thycotic_file_download_on('https://my_thycotic2.domain.com/SecretServer', 110_702, '{ "secret2": "value2" }')
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node1' => %w[service1], 'node2' => %w[service2] },
+            secrets: { 'secret1' => 'value1', 'secret2' => 'value2' },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node1 node2]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'merges secrets from several Thycotic Secret Servers' do
+        with_test_platform_for_thycotic_test(
+          <<~EO_CONFIG
+            secrets_from_thycotic(
+              thycotic_url: 'https://my_thycotic1.domain.com/SecretServer',
+              secret_id: 110701
+            )
+            for_nodes('node') do
+              secrets_from_thycotic(
+                thycotic_url: 'https://my_thycotic2.domain.com/SecretServer',
+                secret_id: 110702
+              )
+            end
+          EO_CONFIG
+        ) do
+          mock_thycotic_file_download_on('https://my_thycotic1.domain.com/SecretServer', 110_701, '{ "secret1": "value1", "secret2": "value2" }')
+          mock_thycotic_file_download_on('https://my_thycotic2.domain.com/SecretServer', 110_702, '{ "secret2": "value2", "secret3": "value3" }')
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node' => %w[service] },
+            secrets: { 'secret1' => 'value1', 'secret2' => 'value2', 'secret3' => 'value3' },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'fails in case of secrets conflicts from several Thycotic Secret Servers' do
+        with_test_platform_for_thycotic_test(
+          <<~EO_CONFIG
+            secrets_from_thycotic(
+              thycotic_url: 'https://my_thycotic1.domain.com/SecretServer',
+              secret_id: 110701
+            )
+            for_nodes('node') do
+              secrets_from_thycotic(
+                thycotic_url: 'https://my_thycotic2.domain.com/SecretServer',
+                secret_id: 110702
+              )
+            end
+          EO_CONFIG
+        ) do
+          mock_thycotic_file_download_on('https://my_thycotic1.domain.com/SecretServer', 110_701, '{ "secret1": "value1", "secret2": "value2" }')
+          mock_thycotic_file_download_on('https://my_thycotic2.domain.com/SecretServer', 110_702, '{ "secret2": "other_value", "secret3": "value3" }')
+          expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Thycotic secret secret2 served by https://my_thycotic2.domain.com/SecretServer from secret ID 110702 has conflicting values between different secrets.'
+        end
+      end
+
+      it 'fails to get secrets from a missing Thycotic Secret Server' do
+        with_test_platform_for_thycotic_test(
+          <<~EO_CONFIG
+            secrets_from_thycotic(
+              thycotic_url: 'https://my_thycotic.domain.com/SecretServer',
+              secret_id: 1107
+            )
+          EO_CONFIG
+        ) do
+          mock_thycotic_file_download_on('https://my_thycotic.domain.com/SecretServer', 1107, nil)
+          expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Unable to fetch secret file ID 1107 from https://my_thycotic.domain.com/SecretServer'
+        end
+      end
+
+    end
+
+  end
+
+end

data/spec/hybrid_platforms_conductor_test/api/nodes_handler/cmdbs/config_spec.rb

@@ -1,12 +1,11 @@
 describe HybridPlatformsConductor::NodesHandler do
 
-  context 'checking CMDB plugin Config' do
+  context 'when checking CMDB plugin Config' do
 
     it 'sets global metadata' do
       with_test_platform(
         { nodes: { 'node1' => {} } },
-        false,
-        'set_metadata(my_property: \'my_value\')'
+        additional_config: 'set_metadata(my_property: \'my_value\')'
       ) do
         expect(cmdb(:config).get_others(['node1'], {})).to eq('node1' => { my_property: 'my_value' })
       end
@@ -15,15 +14,14 @@ describe HybridPlatformsConductor::NodesHandler do
     it 'sets different metadata for different nodes' do
       with_test_platform(
         { nodes: { 'node1' => {}, 'node2' => {} } },
-        false,
-        '
-          for_nodes(\'node1\') { set_metadata(my_property1: \'my_value1\', my_property2: \'my_value2\') }
-          for_nodes(\'node2\') { set_metadata(my_property2: \'my_value3\', my_property3: \'my_value4\') }
-        '
+        additional_config: <<~'EO_CONFIG'
+          for_nodes('node1') { set_metadata(my_property_1: 'my_value1', my_property_2: 'my_value2') }
+          for_nodes('node2') { set_metadata(my_property_2: 'my_value3', my_property_3: 'my_value4') }
+        EO_CONFIG
       ) do
         expect(cmdb(:config).get_others(%w[node1 node2], {})).to eq(
-          'node1' => { my_property1: 'my_value1', my_property2: 'my_value2' },
-          'node2' => { my_property2: 'my_value3', my_property3: 'my_value4' }
+          'node1' => { my_property_1: 'my_value1', my_property_2: 'my_value2' },
+          'node2' => { my_property_2: 'my_value3', my_property_3: 'my_value4' }
         )
       end
     end

data/spec/hybrid_platforms_conductor_test/api/nodes_handler/cmdbs/host_ip_spec.rb

@@ -1,57 +1,66 @@
 describe HybridPlatformsConductor::NodesHandler do
 
-  context 'checking CMDB plugin HostIp' do
+  context 'when checking CMDB plugin HostIp' do
 
     it 'makes sure to have hostname set to compute host_ip' do
-      with_test_platform do
+      with_test_platform({}) do
         expect(cmdb(:host_ip).property_dependencies[:host_ip]).to eq :hostname
       end
     end
 
     it 'does not return a host IP when hostname is not set' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
         expect(cmdb(:host_ip).get_host_ip(['test_node'], { 'test_node' => { property: 'value' } })).to eq({})
       end
     end
 
     it 'returns a host IP when hostname is set' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['getent hosts my_domain.my_host', proc { [0, '192.168.42.42 my_domain.my_host', ''] }]
-        ]) do
+        ] do
           expect(cmdb(:host_ip).get_host_ip(['test_node'], { 'test_node' => { hostname: 'my_domain.my_host' } })).to eq('test_node' => '192.168.42.42')
         end
       end
     end
 
     it 'does not return a host IP when getent can\'t retrieve it' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['getent hosts my_domain.my_host', proc { [0, '', ''] }]
-        ]) do
+        ] do
           expect(cmdb(:host_ip).get_host_ip(['test_node'], { 'test_node' => { hostname: 'my_domain.my_host' } })).to eq({})
         end
       end
     end
 
     it 'returns a host IPs for the maximum hosts it can from the list' do
-      with_test_platform(nodes: {
-        'test_node1' => {},
-        'test_node2' => {},
-        'test_node3' => {},
-        'test_node4' => {}
-      }) do
-        with_cmd_runner_mocked([
+      with_test_platform(
+        {
+          nodes: {
+            'test_node1' => {},
+            'test_node2' => {},
+            'test_node3' => {},
+            'test_node4' => {}
+          }
+        }
+      ) do
+        with_cmd_runner_mocked [
           ['getent hosts my_domain.my_host1', proc { [0, '192.168.42.1 my_domain.my_host1', ''] }],
           ['getent hosts my_domain.my_host2', proc { [0, '', ''] }],
-          ['getent hosts my_domain.my_host4', proc { [0, '192.168.42.4 my_domain.my_host4', ''] }],
-        ]) do
-          expect(cmdb(:host_ip).get_host_ip(['test_node'], {
-            'test_node1' => { hostname: 'my_domain.my_host1' },
-            'test_node2' => { hostname: 'my_domain.my_host2' },
-            'test_node3' => {},
-            'test_node4' => { hostname: 'my_domain.my_host4' }
-          })).to eq(
+          ['getent hosts my_domain.my_host4', proc { [0, '192.168.42.4 my_domain.my_host4', ''] }]
+        ] do
+          expect(
+            cmdb(:host_ip).get_host_ip(
+              ['test_node'],
+              {
+                'test_node1' => { hostname: 'my_domain.my_host1' },
+                'test_node2' => { hostname: 'my_domain.my_host2' },
+                'test_node3' => {},
+                'test_node4' => { hostname: 'my_domain.my_host4' }
+              }
+            )
+          ).to eq(
             'test_node1' => '192.168.42.1',
             'test_node4' => '192.168.42.4'
           )

data/spec/hybrid_platforms_conductor_test/api/nodes_handler/cmdbs/host_keys_spec.rb

@@ -1,49 +1,49 @@
 describe HybridPlatformsConductor::NodesHandler do
 
-  context 'checking CMDB plugin HostKeys' do
+  context 'when checking CMDB plugin HostKeys' do
 
     it 'makes sure to have hostname or host_ip set to compute host_keys' do
-      with_test_platform do
+      with_test_platform({}) do
         expect(cmdb(:host_keys).property_dependencies[:host_keys].sort).to eq %i[hostname host_ip].sort
       end
     end
 
     it 'does not return host keys when neither hostname nor host_ip are set' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
         expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { property: 'value' } })).to eq({})
       end
     end
 
     it 'returns host keys when hostname is set' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['ssh-keyscan my_host.my_domain', proc { [0, "my_host.my_domain ssh-rsa fake_host_key\n", ''] }]
-        ]) do
+        ] do
           expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { hostname: 'my_host.my_domain' } })).to eq('test_node' => ['ssh-rsa fake_host_key'])
         end
       end
     end
 
     it 'returns host keys when host_ip is set' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['ssh-keyscan 192.168.42.42', proc { [0, "192.168.42.42 ssh-rsa fake_host_key\n", ''] }]
-        ]) do
+        ] do
           expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { host_ip: '192.168.42.42' } })).to eq('test_node' => ['ssh-rsa fake_host_key'])
         end
       end
     end
 
     it 'returns several host keys' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['ssh-keyscan 192.168.42.42', proc do
-            [0, <<~EOS, '']
+            [0, <<~EO_STDOUT, '']
               192.168.42.42 ssh-rsa fake_host_key_rsa
               192.168.42.42 ssh-ed25519 fake_host_key_ed25519
-            EOS
+            EO_STDOUT
           end]
-        ]) do
+        ] do
           expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { host_ip: '192.168.42.42' } })).to eq('test_node' => [
             'ssh-rsa fake_host_key_rsa',
             'ssh-ed25519 fake_host_key_ed25519'
@@ -53,74 +53,87 @@ describe HybridPlatformsConductor::NodesHandler do
     end
 
     it 'returns several host keys and ignores comments from ssh-keyscan' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['ssh-keyscan 192.168.42.42', proc do
-            [0, <<~EOS, '']
+            [0, <<~EO_STDOUT, '']
               # That's a comment
               192.168.42.42 ssh-rsa fake_host_key_rsa
               # And another one
               192.168.42.42 ssh-ed25519 fake_host_key_ed25519
               # Woot third!
-            EOS
+            EO_STDOUT
           end]
-        ]) do
-          expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { host_ip: '192.168.42.42' } })).to eq('test_node' => [
-            'ssh-rsa fake_host_key_rsa',
-            'ssh-ed25519 fake_host_key_ed25519'
-          ].sort)
+        ] do
+          expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { host_ip: '192.168.42.42' } })).to eq(
+            'test_node' => [
+              'ssh-rsa fake_host_key_rsa',
+              'ssh-ed25519 fake_host_key_ed25519'
+            ].sort
+          )
         end
       end
     end
 
     it 'returns host keys sorted' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['ssh-keyscan 192.168.42.42', proc do
-            [0, <<~EOS, '']
+            [0, <<~EO_STDOUT, '']
               192.168.42.42 ssh-dsa fake_host_key_dsa
               192.168.42.42 ssh-rsa fake_host_key_rsa
               192.168.42.42 ssh-ed25519 fake_host_key_ed25519
-            EOS
+            EO_STDOUT
           end]
-        ]) do
-          expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { host_ip: '192.168.42.42' } })).to eq('test_node' => [
-            'ssh-dsa fake_host_key_dsa',
-            'ssh-ed25519 fake_host_key_ed25519',
-            'ssh-rsa fake_host_key_rsa'
-          ])
+        ] do
+          expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { host_ip: '192.168.42.42' } })).to eq(
+            'test_node' => [
+              'ssh-dsa fake_host_key_dsa',
+              'ssh-ed25519 fake_host_key_ed25519',
+              'ssh-rsa fake_host_key_rsa'
+            ]
+          )
         end
       end
     end
 
     it 'does not return host keys when ssh-keyscan can\'t retrieve them' do
-      with_test_platform(nodes: { 'test_node' => {} }) do
-        with_cmd_runner_mocked([
+      with_test_platform({ nodes: { 'test_node' => {} } }) do
+        with_cmd_runner_mocked [
           ['ssh-keyscan 192.168.42.42', proc { [0, '', ''] }]
-        ]) do
+        ] do
           expect(cmdb(:host_keys).get_host_keys(['test_node'], { 'test_node' => { host_ip: '192.168.42.42' } })).to eq({})
         end
       end
     end
 
     it 'returns host keys for the maximum hosts it can from the list' do
-      with_test_platform(nodes: {
-        'test_node1' => {},
-        'test_node2' => {},
-        'test_node3' => {},
-        'test_node4' => {}
-      }) do
-        with_cmd_runner_mocked([
+      with_test_platform(
+        {
+          nodes: {
+            'test_node1' => {},
+            'test_node2' => {},
+            'test_node3' => {},
+            'test_node4' => {}
+          }
+        }
+      ) do
+        with_cmd_runner_mocked [
           ['ssh-keyscan 192.168.42.1', proc { [0, "192.168.42.1 ssh-rsa fake_host_key_1\n", ''] }],
           ['ssh-keyscan 192.168.42.2', proc { [0, '', ''] }],
-          ['ssh-keyscan my_host_4.my_domain', proc { [0, "my_host_4.my_domain ssh-rsa fake_host_key_4\n", ''] }],
-        ]) do
-          expect(cmdb(:host_keys).get_host_keys(['test_node'], {
-            'test_node1' => { host_ip: '192.168.42.1' },
-            'test_node2' => { host_ip: '192.168.42.2' },
-            'test_node3' => {},
-            'test_node4' => { hostname: 'my_host_4.my_domain' }
-          })).to eq(
+          ['ssh-keyscan my_host_4.my_domain', proc { [0, "my_host_4.my_domain ssh-rsa fake_host_key_4\n", ''] }]
+        ] do
+          expect(
+            cmdb(:host_keys).get_host_keys(
+              ['test_node'],
+              {
+                'test_node1' => { host_ip: '192.168.42.1' },
+                'test_node2' => { host_ip: '192.168.42.2' },
+                'test_node3' => {},
+                'test_node4' => { hostname: 'my_host_4.my_domain' }
+              }
+            )
+          ).to eq(
             'test_node1' => ['ssh-rsa fake_host_key_1'],
             'test_node4' => ['ssh-rsa fake_host_key_4']
           )