Skip to content

Commit 4479baf

Browse files
petergmurphydavidmalloncares
petergmurphy
authored and
davidmalloncares
committed
(PE-39577) Optimise legacy compiler support
This commit: - Adds the `node_group_unpin` task. - `node_group_unpin` task is called in the convert plan to remove legacy compilers from from the PE Master node group. - Legacy compilers `pp_auth_role` changed to `pe_compiler_legacy`. - Changes the PEADM config to use the PE Certificate Authority node group. - Removes peadm_legacy_compiler OID extension. - Adds a task to update PE Master rules to support 'pe_compiler_legacy' as a pp_auth_role. - Adds a task to check if PE Master rules have been updated to support the new method of legacy compiler identification. - This task is being used in the `add_compilers` and `convert_compiler_to_legacy` plans to check if the infrastructure has been converted to support this new method of legacy compiler identification. If the infrastructure has not been converted, it will fail each plan and tell the user to run the Convert plan.
1 parent a8b5de4 commit 4479baf

21 files changed

+648
-135
lines changed

‎REFERENCE.md‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@
6060
* [`backup_classification`](#backup_classification): A task to call the classification api and write to file
6161
* [`cert_data`](#cert_data): Return certificate data related to the Puppet agent
6262
* [`cert_valid_status`](#cert_valid_status): Check primary for valid state of a certificate
63+
* [`check_pe_master_rules`](#check_pe_master_rules): Checks if the PE Master group rules have already been updated to support 'pe_compiler_legacy' as a pp_auth_role
6364
* [`classify_compilers`](#classify_compilers): Classify compilers as legacy or non-legacy
6465
* [`code_manager`](#code_manager): Perform various code manager actions
6566
* [`code_manager_enabled`](#code_manager_enabled): Run on a PE primary node to check if Code Manager is enabled.
@@ -74,6 +75,7 @@
7475
* [`infrastatus`](#infrastatus): Runs puppet infra status and returns the output
7576
* [`mkdir_p_file`](#mkdir_p_file): Create a file with the specified content at the specified location
7677
* [`mv`](#mv): Wrapper task for mv command
78+
* [`node_group_unpin`](#node_group_unpin): Unpins nodes from a specified PE node group
7779
* [`os_identification`](#os_identification): Return the operating system runnin gon the target as a string
7880
* [`pe_install`](#pe_install): Install Puppet Enterprise from a tarball
7981
* [`pe_ldap_config`](#pe_ldap_config): Set the ldap config in the PE console
@@ -90,6 +92,7 @@
9092
* [`ssl_clean`](#ssl_clean): Clean an agent's certificate
9193
* [`submit_csr`](#submit_csr): Submit a certificate signing request
9294
* [`transform_classification_groups`](#transform_classification_groups): Transform the user groups from a source backup to a list of groups on the target server
95+
* [`update_pe_master_rules`](#update_pe_master_rules): Updates the PE Master group rules to support 'pe_compiler_legacy' as a pp_auth_role
9396
* [`validate_rbac_token`](#validate_rbac_token): Check an RBAC token stored in a file is valid
9497
* [`wait_until_service_ready`](#wait_until_service_ready): Return when the orchestrator service is healthy, or timeout after 15 seconds
9598

@@ -129,7 +132,6 @@ Supported use cases:
129132
* `peadm::subplans::modify_certificate`
130133
* `peadm::subplans::prepare_agent`
131134
* `peadm::uninstall`: Single-entry-point plan for uninstalling Puppet Enterprise
132-
* `peadm::update_compiler_extensions`
133135
* `peadm::util::code_sync_status`
134136
* `peadm::util::copy_file`
135137
* `peadm::util::db_disable_pglogical`
@@ -1110,6 +1112,12 @@ Data type: `String`
11101112

11111113
The certifcate name to check validation of
11121114

1115+
### <a name="check_pe_master_rules"></a>`check_pe_master_rules`
1116+
1117+
Checks if the PE Master group rules have already been updated to support 'pe_compiler_legacy' as a pp_auth_role
1118+
1119+
**Supports noop?** false
1120+
11131121
### <a name="classify_compilers"></a>`classify_compilers`
11141122

11151123
Classify compilers as legacy or non-legacy
@@ -1326,6 +1334,26 @@ Data type: `String`
13261334

13271335
New path of file
13281336

1337+
### <a name="node_group_unpin"></a>`node_group_unpin`
1338+
1339+
Unpins nodes from a specified PE node group
1340+
1341+
**Supports noop?** false
1342+
1343+
#### Parameters
1344+
1345+
##### `node_certnames`
1346+
1347+
Data type: `Array[String]`
1348+
1349+
The certnames of the nodes to unpin
1350+
1351+
##### `group_name`
1352+
1353+
Data type: `String`
1354+
1355+
The name of the node group to unpin the nodes from
1356+
13291357
### <a name="os_identification"></a>`os_identification`
13301358

13311359
Return the operating system runnin gon the target as a string
@@ -1622,6 +1650,12 @@ Data type: `String`
16221650

16231651
Location of target node group yaml file and where to create the transformed file
16241652

1653+
### <a name="update_pe_master_rules"></a>`update_pe_master_rules`
1654+
1655+
Updates the PE Master group rules to support 'pe_compiler_legacy' as a pp_auth_role
1656+
1657+
**Supports noop?** false
1658+
16251659
### <a name="validate_rbac_token"></a>`validate_rbac_token`
16261660

16271661
Check an RBAC token stored in a file is valid

‎manifests/setup/legacy_compiler_group.pp‎

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,19 @@
11
# @api private
22
class peadm::setup::legacy_compiler_group (
33
String[1] $primary_host,
4-
Optional[String] $internal_compiler_a_pool_address = undef,
5-
Optional[String] $internal_compiler_b_pool_address = undef,
4+
Optional[String] $internal_compiler_a_pool_address = undef,
5+
Optional[String] $internal_compiler_b_pool_address = undef,
66
) {
77
Node_group {
88
purge_behavior => none,
99
}
1010

1111
node_group { 'PE Legacy Compiler':
12-
parent => 'PE Master',
13-
rule => ['and',
14-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
15-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
16-
],
17-
classes => {
12+
ensure => 'present',
13+
parent => 'PE Master',
14+
purge_behavior => 'rule',
15+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
16+
classes => {
1817
'puppet_enterprise::profile::master' => {
1918
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_b_pool_address].filter |$_| { $_ },
2019
'puppetdb_port' => [8081],
@@ -23,50 +22,50 @@
2322
}
2423

2524
node_group { 'PE Legacy Compiler Group A':
26-
ensure => 'present',
27-
parent => 'PE Legacy Compiler',
28-
rule => ['and',
29-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
25+
ensure => 'present',
26+
parent => 'PE Legacy Compiler',
27+
purge_behavior => 'rule',
28+
rule => ['and',
29+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
3030
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
31-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
3231
],
33-
classes => {
34-
'puppet_enterprise::profile::master' => {
32+
classes => {
33+
'puppet_enterprise::profile::master' => {
3534
'puppetdb_host' => [$internal_compiler_b_pool_address, $internal_compiler_a_pool_address].filter |$_| { $_ },
3635
'puppetdb_port' => [8081],
3736
},
3837
},
39-
data => {
40-
# Workaround for GH-118
38+
data => {
4139
'puppet_enterprise::profile::master::puppetdb' => {
4240
'ha_enabled_replicas' => [],
4341
},
4442
},
4543
}
4644

4745
node_group { 'PE Legacy Compiler Group B':
48-
ensure => 'present',
49-
parent => 'PE Legacy Compiler',
50-
rule => ['and',
51-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
46+
ensure => 'present',
47+
parent => 'PE Legacy Compiler',
48+
purge_behavior => 'rule',
49+
rule => ['and',
50+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
5251
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
53-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
5452
],
55-
classes => {
56-
'puppet_enterprise::profile::master' => {
53+
classes => {
54+
'puppet_enterprise::profile::master' => {
5755
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_b_pool_address].filter |$_| { $_ },
5856
'puppetdb_port' => [8081],
5957
},
6058
},
61-
data => {
62-
# Workaround for GH-118
59+
data => {
6360
'puppet_enterprise::profile::master::puppetdb' => {
6461
'ha_enabled_replicas' => [],
6562
},
6663
},
6764
}
6865

6966
node_group { 'PE Compiler':
70-
rule => ['and', ['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'false']],
67+
parent => 'PE Master',
68+
purge_behavior => 'rule',
69+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
7170
}
7271
}

‎manifests/setup/node_manager.pp‎

Lines changed: 33 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,9 @@
8181

8282
# PE Compiler group comes from default PE and already has the pe compiler role
8383
node_group { 'PE Compiler':
84-
parent => 'PE Master',
85-
rule => ['and', ['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'false']],
84+
parent => 'PE Master',
85+
purge_behavior => 'rule',
86+
rule => ['and', ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler']],
8687
}
8788

8889
# This group should pin the primary, and also map to any pe-postgresql nodes
@@ -116,14 +117,14 @@
116117
# Configure the A pool for compilers. There are up to two pools for DR, each
117118
# having an affinity for one "availability zone" or the other.
118119
node_group { 'PE Compiler Group A':
119-
ensure => 'present',
120-
parent => 'PE Compiler',
121-
rule => ['and',
120+
ensure => 'present',
121+
purge_behavior => 'rule',
122+
parent => 'PE Compiler',
123+
rule => ['and',
122124
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
123125
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
124-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'false'],
125126
],
126-
classes => {
127+
classes => {
127128
'puppet_enterprise::profile::puppetdb' => {
128129
'database_host' => pick($postgresql_a_host, $notconf),
129130
},
@@ -134,7 +135,7 @@
134135
'puppetdb_port' => [8081],
135136
},
136137
},
137-
data => {
138+
data => {
138139
# Workaround for GH-118
139140
'puppet_enterprise::profile::master::puppetdb' => {
140141
'ha_enabled_replicas' => [],
@@ -175,14 +176,14 @@
175176
}
176177

177178
node_group { 'PE Compiler Group B':
178-
ensure => 'present',
179-
parent => 'PE Compiler',
180-
rule => ['and',
179+
ensure => 'present',
180+
purge_behavior => 'rule',
181+
parent => 'PE Compiler',
182+
rule => ['and',
181183
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
182184
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
183-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'false'],
184185
],
185-
classes => {
186+
classes => {
186187
'puppet_enterprise::profile::puppetdb' => {
187188
'database_host' => pick($postgresql_b_host, $notconf),
188189
},
@@ -193,7 +194,7 @@
193194
'puppetdb_port' => [8081],
194195
},
195196
},
196-
data => {
197+
data => {
197198
# Workaround for GH-118
198199
'puppet_enterprise::profile::master::puppetdb' => {
199200
'ha_enabled_replicas' => [],
@@ -202,12 +203,10 @@
202203
}
203204

204205
node_group { 'PE Legacy Compiler':
205-
parent => 'PE Master',
206-
rule => ['and',
207-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
208-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
209-
],
210-
classes => {
206+
parent => 'PE Master',
207+
purge_behavior => 'rule',
208+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
209+
classes => {
211210
'puppet_enterprise::profile::master' => {
212211
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_b_pool_address].filter |$_| { $_ },
213212
'puppetdb_port' => [8081],
@@ -218,20 +217,20 @@
218217
# Configure the A pool for legacy compilers. There are up to two pools for DR, each
219218
# having an affinity for one "availability zone" or the other.
220219
node_group { 'PE Legacy Compiler Group A':
221-
ensure => 'present',
222-
parent => 'PE Legacy Compiler',
223-
rule => ['and',
224-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
220+
ensure => 'present',
221+
parent => 'PE Legacy Compiler',
222+
purge_behavior => 'rule',
223+
rule => ['and',
224+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
225225
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
226-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
227226
],
228-
classes => {
227+
classes => {
229228
'puppet_enterprise::profile::master' => {
230229
'puppetdb_host' => [$internal_compiler_b_pool_address, $internal_compiler_a_pool_address].filter |$_| { $_ },
231230
'puppetdb_port' => [8081],
232231
},
233232
},
234-
data => {
233+
data => {
235234
# Workaround for GH-118
236235
'puppet_enterprise::profile::master::puppetdb' => {
237236
'ha_enabled_replicas' => [],
@@ -242,20 +241,20 @@
242241
# Configure the B pool for legacy compilers. There are up to two pools for DR, each
243242
# having an affinity for one "availability zone" or the other.
244243
node_group { 'PE Legacy Compiler Group B':
245-
ensure => 'present',
246-
parent => 'PE Legacy Compiler',
247-
rule => ['and',
248-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
244+
ensure => 'present',
245+
parent => 'PE Legacy Compiler',
246+
purge_behavior => 'rule',
247+
rule => ['and',
248+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
249249
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
250-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
251250
],
252-
classes => {
251+
classes => {
253252
'puppet_enterprise::profile::master' => {
254253
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_a_pool_address].filter |$_| { $_ },
255254
'puppetdb_port' => [8081],
256255
},
257256
},
258-
data => {
257+
data => {
259258
# Workaround for GH-118
260259
'puppet_enterprise::profile::master::puppetdb' => {
261260
'ha_enabled_replicas' => [],

‎plans/add_compilers.pp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@
1616
$compiler_targets = peadm::get_targets($compiler_hosts)
1717
$primary_target = peadm::get_targets($primary_host, 1)
1818

19+
# Check if PE Master rules have been updated to support pe_compiler_legacy
20+
$rules_check = run_task('peadm::check_pe_master_rules', $primary_host).first.value
21+
unless $rules_check['updated'] {
22+
fail_plan('Please run the Convert plan to convert your Puppet infrastructure to be managed by this version of PEADM.')
23+
}
24+
1925
# Get current peadm config to determine where to setup additional rules for
2026
# compiler's secondary PuppetDB instances
2127
$peadm_config = run_task('peadm::get_peadm_config', $primary_target).first.value

0 commit comments

Comments
 (0)