iis_config resource not being idempotent

[pratikpotdar]

Cookbook version

4.1.8

Chef-client version

12.5.1

Platform Details

AWS- Windows 2012 R2

Scenario:

I am using iis_config resource. But it is not being idempotent (even when I saw that Issue#69 says fixed). When running it more than one time, it should not update any resource, yet that seems to be happening.

Steps to Reproduce:

Wrote a simple test cookbook which depends on IIS (v4.1.8) and Windows(v1.39.2) cookbooks.
It has just one line of code as of now to set retail deployment as true. It is compiling and executing with no issues:

iis_config "/commit:MACHINE /section:deployment /retail:true"

Expected Result:

Chef Client finished, 0/1 resources updated in xx seconds

On every run after the first..unless machine.config was manually changed. Which in this case was not.

Actual Result:

Chef Client finished, 1/1 resources updated in 27 seconds

[spuder]

The work around still appears to be to add the 'returns' statement

 returns [0,183]

or

returns [0, 4312]

[EasyAsABC123]

The iis_config option literally can configure anything in multiple different patterns and areas. Until we create a method for storing the pre-config data and then checking that the iis_config resource will remain non-itempotent. This is something that could be an enhancement, but currently it is working as expected.

[pratikpotdar]

Thanks @spuder. Used your suggestion. It currently seems to be working. But I'd have hoped that at least this exit code would've been there by default.

[EasyAsABC123]

@spuder
For idempotency on iis_config I think we should break out the action into more properties

new properties:
Commit
ConfigurationPath
Add_Remove
Section
Property
Value

So this command

iis_config "/commit:MACHINE /section:deployment /retail:true"

becomes

iis_config "Enable Deployment for Retail" do
   commit :MACHINE
   section "deployment"
   property "retail"
   value "true"
end

this would allow for us to break the command apart enough that we should be able to do something like

appcmd.exe list config /section:deployment /config:* /XML

or

appcmd.exe list config /section:deployment /config:*

from the result we should be able to get the value, this is a major change and definitely a breaking change. But would add idempotency to something.

[EasyAsABC123]

This feature is now in testing, some changes have been made over the current v4.2 branch that handle multiple properties at a time better

[EasyAsABC123]

@spuder can you please test this new version v4.2? it is working for all my examples in the readme.md but i don't have any other examples

[spuder]

@EasyAsABC123 Yes, though it might take me some time.

[EasyAsABC123]

@spuder definitely no worries

[spuder]

@EasyAsABC123

The clear action broke on iis_config

    Error executing action `clear` on resource 'iis_config[NetDocuments/neweb2 /section:system.webserver/staticContent /"[fileExtension='.']" /commit:app]'
    ================================================================================

    NoMethodError
    -------------
    undefined method `node_type' for nil:NilClass

    Resource Declaration:
    ---------------------
    # In c:/chef/local-mode-cache/cache/cookbooks/nd-web/recipes/nd_webserver.rb

    188:   iis_config "NetDocuments/neweb2 /section:system.webserver/staticContent /\"[fileExtension='.']\" /commit:app" do
    191:     action :clear
    192:   #  returns [0, 4312] # https://github.com/chef-cookbooks/iis/issues/205
    193:   end
    194:

I've also tried updating to the new syntax with the same error "undefined method `node_type' for nil:NilClass"

  iis_config "Remove mime type" do
    zone 'NetDocuments/neweb2'
    section 'system.webserver/staticContent'
    property 'fileExtension' => '.'
    commit 'app'
    action :clear
  end

node_type refers to the REXML ruby gem that was added.

[EasyAsABC123]

@spuder what is the above config suppose to do? Just remove 1 mime type? Currently that wouldn't be possible with the new iis_config I will need to take a look at that.

If you did

iis_config "Remove mime type" do
    zone 'NetDocuments/neweb2'
    section 'system.webserver/staticContent'
    commit 'app'
    action :clear
  end

it should delete everything in the NetDocuments/neweb2 (zone) and the whole section for static content. Let me know what that is suppose to do so I can adjust the code

[spuder]

@EasyAsABC123 Correct it removes 1 mime type. We have some builds that have an erroneous line in the neweb2/web.config file.

<mimeMap fileExtension="." mimeType="application/octet-stream"`

As a precaution we remove this line at the beginning of the chef run, and at it back at the end.

Here is the same thing in powershell

appcmd.exe set config 'NetDocuments/neweb2' /commit:app /section:system.webserver/staticContent /-"[fileExtension='.',mimeType='application/octet-stream']" # Doesn't always work

or

appcmd.exe clear config 'NetDocuments/neweb2' /commit:app /section:staticContent /"[fileExtension='.']" # More relable than 'set config'

[EasyAsABC123]

Interesting, I will mess with this over the weekend so that clear is idempotent with :clear and using property. I basically did :set it worked then tacked :clear support on at the end

[spuder]

Is it expected that the old syntax will continue to work?

iis_config "NetDocuments/neweb2 /section:system.webserver/staticContent /\"[fileExtension='.']\" /commit:app" do
end

Or is the new syntax mandatory?

iis_config "Remove mime type" do
    zone 'NetDocuments/neweb2'
    section 'system.webserver/staticContent'
    commit 'app'
end

If the old syntax is going away, maybe this should be a 5.0.0 release.

http://semver.org/

[EasyAsABC123]

@spuder The only way the old syntax could stay is to simply add a new provider/resource. This wouldn't be ideal since they are both managing the same thing.

A new provider may be created that is simply to allow the running of appcmd commands, something like iis_cmd.

iis_cmd "my command goes here" do
end

like that...but otherwise since everyone complains about idempotency (understandably) I would prefer to avoid offering something of little to no value.

Naming it version 5.0.0 is fine since it is just a version number and basically only has meaning as stated in the semver syntax used by chef

[spuder]

In my opinion abandoning the old syntax is preferable. The new style is much easier to understand and requires less character escaping.

[EasyAsABC123]

@spuder agreed, i'll likely move that direction but that will mean also making each property additive or subtractive

[scolligan]

@EasyAsABC123 Sorry if I'm not following etiquette, this is my first time opening an issue (#366). Is the iis_config not being idempotent an issue still from June 2016? I read this issue before opening mine, but didn't follow why this was marked as a feature request.

[EasyAsABC123]

Hey, no you are fine. I read all issues and then just clear out things that are duplicates.

So on to why this is a feature request, the iis_config resource just runs any command. This means that to make it idempotent we would have to parse whatever command is run (might even be a list command which doesn't do anything) and then determine how we can get the current value. This would mean that a lot of coding would have to go into making the iis_config idempotent.
It would be easier to just add any feature you are doing with iis_config into a normal resource.

I types this on my phone sorry for typos or anything that doesn't make sense, feel free to ask more questions

[EasyAsABC123]

@scolligan I think you are just setting the logging file? Is that on a site? Or application?

We can likely add that property relatively easily

[scolligan]

@EasyAsABC123 No worries, just wanted to make sure I was following protocol.

The example I used was from the iis cookbook readme page (which was related to logging). When I couldn't make my config work idempotently, I grabbed the example from the readme to test with. When I saw that also didn't work I decided to submit the issue.

I have a bunch of appcmd type tasks that I do with powershell. I was hoping to get rid of the powershell resources and use the iis_config. But, if that resource isn't working yet, I'll just stick to powershell.

Thanks for following up!

[EasyAsABC123]

Definitely not a problem, we will be moving to a PowerShell resource eventually when given the chance to rewrite for it. In the readme there is an alternative for IIS PowerShell that is very good.

[scolligan]

FWIW, I created the following to address this:

Attribute Definition

default['jjk_ts_transport_webserver']['config_items'] = {
  'Forms Authentication - Require SSL' => {
    commit: 'WEBROOT',
    section: 'system.web/authentication',
    item: 'forms.requireSSL',
    item_value: 'True'
  },
  'Forms Authentication - UseCookies' => {
    commit: 'WEBROOT',
    section: 'system.web/authentication',
    item: 'forms.cookieless',
    item_value: 'UseCookies'
  },
  'Machine Key Validation - AES' => {
    commit: 'WEBROOT',
    section: 'system.web/machineKey',
    item: 'validation',
    item_value: 'AES'
  },
  'Machine Key Decryption - AES' => {
    commit: 'WEBROOT',
    section: 'system.web/machineKey',
    item: 'decryption',
    item_value: 'AES'
  },
  'Request Filtering - Do NOT Allow High Bit Characters' => {
    commit: 'APPHOST',
    section: 'requestFiltering',
    item: 'allowHighBitCharacters',
    item_value: 'False'
  },
  'HTTPCookies - HTTPOnlyCookies' => {
    commit: 'WEBROOT',
    section: 'system.web/httpCookies',
    item: 'httpOnlyCookies',
    item_value: 'True'
  }
}

Cookbook Code

# set various web server configuration items
node['jjk_ts_transport_webserver']['config_items'].each do |key, value|

  powershell_script key do
    code <<-EOH
    & "#{ENV['SystemRoot']}\\system32\\inetsrv\\appcmd.exe" set config /commit:#{value['commit']} -section:#{value['section']} /#{value['item']}:#{value['item_value']}
    EOH
    guard_interpreter :powershell_script
    not_if "[bool](& #{ENV['SystemRoot']}\\system32\\inetsrv\\appcmd.exe list config -section:#{value['section']} -text:#{value['item']} | Where-Object {$_ -eq '#{value['item_value']}'})"
  end

end