Skip to content

Commit bba2ae0

Browse files
author
petergmurphy
committed
temp commit
1 parent dac38e5 commit bba2ae0

File tree

3 files changed

+83
-49
lines changed

3 files changed

+83
-49
lines changed

‎manifests/setup/legacy_compiler_group.pp‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,11 @@
99
}
1010

1111
node_group { 'PE Legacy Compiler':
12-
ensure => 'present',
13-
parent => 'PE Infrastructure',
14-
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
15-
classes => {
12+
ensure => 'present',
13+
parent => 'PE Infrastructure',
14+
purge_behavior => 'rule',
15+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
16+
classes => {
1617
'puppet_enterprise::profile::master' => {
1718
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_b_pool_address].filter |$_| { $_ },
1819
'puppetdb_port' => [8081],
@@ -23,19 +24,20 @@
2324
}
2425

2526
node_group { 'PE Legacy Compiler Group A':
26-
ensure => 'present',
27-
parent => 'PE Legacy Compiler',
28-
rule => ['and',
27+
ensure => 'present',
28+
parent => 'PE Legacy Compiler',
29+
purge_behavior => 'rule',
30+
rule => ['and',
2931
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
3032
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
3133
],
32-
classes => {
34+
classes => {
3335
'puppet_enterprise::profile::master' => {
3436
'puppetdb_host' => [$internal_compiler_b_pool_address, $internal_compiler_a_pool_address].filter |$_| { $_ },
3537
'puppetdb_port' => [8081],
3638
},
3739
},
38-
data => {
40+
data => {
3941
'puppet_enterprise::profile::master::puppetdb' => {
4042
'ha_enabled_replicas' => [],
4143
},
@@ -45,7 +47,7 @@
4547
node_group { 'PE Legacy Compiler Group B':
4648
ensure => 'present',
4749
parent => 'PE Legacy Compiler',
48-
purge_behavior => 'classes',
50+
purge_behavior => 'rule',
4951
rule => ['and',
5052
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
5153
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
@@ -64,6 +66,8 @@
6466
}
6567

6668
node_group { 'PE Compiler':
67-
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
69+
parent => 'PE Master',
70+
purge_behavior => 'rule',
71+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
6872
}
6973
}

‎manifests/setup/node_manager.pp‎

Lines changed: 31 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,9 @@
8181

8282
# PE Compiler group comes from default PE and already has the pe compiler role
8383
node_group { 'PE Compiler':
84-
parent => 'PE Master',
85-
rule => ['and', ['=', ['trusted', 'extensions', peadm::oid('pp_auth_role')], 'pe_compiler']],
84+
parent => 'PE Master',
85+
purge_behavior => 'rule',
86+
rule => ['and', ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler']],
8687
}
8788

8889
# This group should pin the primary, and also map to any pe-postgresql nodes
@@ -116,13 +117,14 @@
116117
# Configure the A pool for compilers. There are up to two pools for DR, each
117118
# having an affinity for one "availability zone" or the other.
118119
node_group { 'PE Compiler Group A':
119-
ensure => 'present',
120-
parent => 'PE Compiler',
121-
rule => ['and',
120+
ensure => 'present',
121+
purge_behavior => 'rule',
122+
parent => 'PE Compiler',
123+
rule => ['and',
122124
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
123125
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
124126
],
125-
classes => {
127+
classes => {
126128
'puppet_enterprise::profile::puppetdb' => {
127129
'database_host' => pick($postgresql_a_host, $notconf),
128130
},
@@ -133,7 +135,7 @@
133135
'puppetdb_port' => [8081],
134136
},
135137
},
136-
data => {
138+
data => {
137139
# Workaround for GH-118
138140
'puppet_enterprise::profile::master::puppetdb' => {
139141
'ha_enabled_replicas' => [],
@@ -174,13 +176,14 @@
174176
}
175177

176178
node_group { 'PE Compiler Group B':
177-
ensure => 'present',
178-
parent => 'PE Compiler',
179-
rule => ['and',
179+
ensure => 'present',
180+
purge_behavior => 'rule',
181+
parent => 'PE Compiler',
182+
rule => ['and',
180183
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
181184
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
182185
],
183-
classes => {
186+
classes => {
184187
'puppet_enterprise::profile::puppetdb' => {
185188
'database_host' => pick($postgresql_b_host, $notconf),
186189
},
@@ -191,7 +194,7 @@
191194
'puppetdb_port' => [8081],
192195
},
193196
},
194-
data => {
197+
data => {
195198
# Workaround for GH-118
196199
'puppet_enterprise::profile::master::puppetdb' => {
197200
'ha_enabled_replicas' => [],
@@ -200,9 +203,10 @@
200203
}
201204

202205
node_group { 'PE Legacy Compiler':
203-
parent => 'PE Master',
204-
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
205-
classes => {
206+
parent => 'PE Master',
207+
purge_behavior => 'rule',
208+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
209+
classes => {
206210
'puppet_enterprise::profile::master' => {
207211
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_b_pool_address].filter |$_| { $_ },
208212
'puppetdb_port' => [8081],
@@ -213,19 +217,20 @@
213217
# Configure the A pool for legacy compilers. There are up to two pools for DR, each
214218
# having an affinity for one "availability zone" or the other.
215219
node_group { 'PE Legacy Compiler Group A':
216-
ensure => 'present',
217-
parent => 'PE Legacy Compiler',
218-
rule => ['and',
220+
ensure => 'present',
221+
parent => 'PE Legacy Compiler',
222+
purge_behavior => 'rule',
223+
rule => ['and',
219224
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
220225
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
221226
],
222-
classes => {
227+
classes => {
223228
'puppet_enterprise::profile::master' => {
224229
'puppetdb_host' => [$internal_compiler_b_pool_address, $internal_compiler_a_pool_address].filter |$_| { $_ },
225230
'puppetdb_port' => [8081],
226231
},
227232
},
228-
data => {
233+
data => {
229234
# Workaround for GH-118
230235
'puppet_enterprise::profile::master::puppetdb' => {
231236
'ha_enabled_replicas' => [],
@@ -236,19 +241,20 @@
236241
# Configure the B pool for legacy compilers. There are up to two pools for DR, each
237242
# having an affinity for one "availability zone" or the other.
238243
node_group { 'PE Legacy Compiler Group B':
239-
ensure => 'present',
240-
parent => 'PE Legacy Compiler',
241-
rule => ['and',
244+
ensure => 'present',
245+
parent => 'PE Legacy Compiler',
246+
purge_behavior => 'rule',
247+
rule => ['and',
242248
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler_legacy'],
243249
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
244250
],
245-
classes => {
251+
classes => {
246252
'puppet_enterprise::profile::master' => {
247253
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_a_pool_address].filter |$_| { $_ },
248254
'puppetdb_port' => [8081],
249255
},
250256
},
251-
data => {
257+
data => {
252258
# Workaround for GH-118
253259
'puppet_enterprise::profile::master::puppetdb' => {
254260
'ha_enabled_replicas' => [],

‎plans/upgrade.pp‎

Lines changed: 37 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -141,19 +141,45 @@
141141
}
142142

143143
# Add legacy compiler role to compilers that are missing it
144-
$legacy_compiler_targets = $cert_extensions_temp.filter |$name,$exts| {
144+
$compilers_with_legacy_compiler_flag = $cert_extensions_temp.filter |$name,$exts| {
145145
($name in $compiler_targets.map |$t| { $t.name }) and
146-
($exts[peadm::oid('peadm_legacy_compiler')] != undef) and
147-
($exts[peadm::oid('peadm_legacy_compiler')] == 'true') and
148-
($exts['pp_auth_role'] != 'pe_compiler_legacy')
149-
}.keys
146+
($exts[peadm::oid('peadm_legacy_compiler')] != undef)
147+
}
150148

151-
run_plan('peadm::modify_certificate', $legacy_compiler_targets,
152-
primary_host => $primary_target,
153-
add_extensions => {
154-
'pp_auth_role' => 'pe_compiler_legacy',
155-
},
156-
)
149+
run_task('peadm::update_pe_master_rules', $primary_target)
150+
151+
if $compilers_with_legacy_compiler_flag.size > 0 {
152+
$legacy_compilers = $compilers_with_legacy_compiler_flag.filter |$name,$exts| {
153+
$exts[peadm::oid('peadm_legacy_compiler')] == 'true'
154+
}.keys
155+
156+
$modern_compilers = $compilers_with_legacy_compiler_flag.filter |$name,$exts| {
157+
$exts[peadm::oid('peadm_legacy_compiler')] == 'false'
158+
}.keys
159+
160+
if $modern_compilers.size > 0 {
161+
out::message('MODERN COMPILERS: Beginning removal of legacy compiler flag')
162+
out::message($modern_compilers)
163+
run_plan('peadm::modify_certificate', $modern_compilers,
164+
primary_host => $primary_target,
165+
remove_extensions => [peadm::oid('peadm_legacy_compiler')],
166+
)
167+
out::message('MODERN COMPILERS: Removed legacy compiler flag')
168+
}
169+
170+
if $legacy_compilers.size > 0 {
171+
out::message('LEGACY COMPILERS: Beginning addition of legacy compiler role and removal of legacy compiler flag')
172+
out::message($legacy_compilers)
173+
run_plan('peadm::modify_certificate', $legacy_compilers,
174+
primary_host => $primary_target,
175+
add_extensions => {
176+
'pp_auth_role' => 'pe_compiler_legacy',
177+
},
178+
remove_extensions => [peadm::oid('peadm_legacy_compiler'), peadm::oid('pp_auth_role')],
179+
)
180+
out::message('LEGACY COMPILERS: Added legacy compiler role and removed legacy compiler flag')
181+
}
182+
}
157183

158184
# Gather certificate extension information from all systems
159185
$cert_extensions = run_task('peadm::cert_data', $all_targets).reduce({}) |$memo,$result| {
@@ -460,7 +486,5 @@
460486
461487
peadm::check_version_and_known_hosts($current_pe_version, $_version, $r10k_known_hosts)
462488
463-
run_task('peadm::update_pe_master_rules', $primary_target)
464-
465489
return("Upgrade of Puppet Enterprise ${arch['architecture']} completed.")
466490
}

0 commit comments

Comments
 (0)