Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix non-ssl, abilliy to customize templates, and run with less privileges (but call r10k/mco via sudo) #170

Merged
merged 3 commits into from
May 14, 2015
Merged

Fix non-ssl, abilliy to customize templates, and run with less privileges (but call r10k/mco via sudo) #170

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f627a07
Fix non-ssl usage
robbat2 May 13, 2015
b748318
parameterize template arguments.
robbat2 May 13, 2015
9a80bfa
command_prefix: Ability to run mco/r10k via sudo
robbat2 May 13, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion manifests/config.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@
$r10k_basedir = $r10k::params::r10k_basedir,
$manage_configfile_symlink = $r10k::params::manage_configfile_symlink,
$configfile_symlink = '/etc/r10k.yaml',
$r10k_yaml_template = 'r10k/r10k.yaml.erb'
) inherits r10k::params {

validate_bool($manage_modulepath)
Expand Down Expand Up @@ -92,7 +93,7 @@
group => '0',
mode => '0644',
path => $configfile,
content => template('r10k/r10k.yaml.erb'),
content => template($r10k_yaml_template),
}

if $manage_configfile_symlink_real == true {
Expand Down
3 changes: 3 additions & 0 deletions manifests/params.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,9 @@
$webhook_r10k_deploy_arguments = '-pv'
$webhook_public_key_path = undef
$webhook_private_key_path = undef
$webhook_bin_template = 'r10k/webhook.bin.erb'
$webhook_yaml_template = 'r10k/webhook.yaml.erb'
$webhook_command_prefix = '' # 'sudo' is the canonical example for this

if $::osfamily == Debian {
$functions_path = '/lib/lsb/init-functions'
Expand Down
3 changes: 2 additions & 1 deletion manifests/webhook.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
$user = 'peadmin',
$group = 'peadmin',
$git_server = 'localhost',
$webhook_bin_template = $::r10k::params::webhook_bin_template,
) inherits r10k::params {

File {
Expand Down Expand Up @@ -35,7 +36,7 @@
}

file { 'webhook_bin':
content => template('r10k/webhook.bin.erb'),
content => template($webhook_bin_template),
path => '/usr/local/bin/webhook',
notify => Service['webhook'],
}
Expand Down
5 changes: 4 additions & 1 deletion manifests/webhook/config.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@
$r10k_deploy_arguments = $r10k::params::webhook_r10k_deploy_arguments,
$public_key_path = $r10k::params::webhook_public_key_path,
$private_key_path = $r10k::params::webhook_private_key_path,
$yaml_template = $r10k::params::webhook_yaml_template,
$command_prefix = $r10k::params::webhook_command_prefix,
$configfile = '/etc/webhook.yaml',
) inherits r10k::params {

Expand All @@ -53,6 +55,7 @@
'r10k_deploy_arguments' => $r10k_deploy_arguments,
'public_key_path' => $public_key_path,
'private_key_path' => $private_key_path,
'command_prefix' => $command_prefix,
}
} else {
validate_hash($hash)
Expand All @@ -65,7 +68,7 @@
group => '0',
mode => '0644',
path => $configfile,
content => template('r10k/webhook.yaml.erb'),
content => template($yaml_template),
notify => Service['webhook'],
}
}
30 changes: 17 additions & 13 deletions templates/webhook.bin.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,16 +42,20 @@ $config['private_key_path'] = File.join("#{$config['certpath']}", "#{$config['ce
<% end %>

opts = {
:Host => $config['bind_address'],
:Port => $config['port'],
:Logger => $logger,
:ServerType => WEBrick::Daemon,
:SSLEnable => $config['enable_ssl'],
:SSLVerifyClient => OpenSSL::SSL::VERIFY_NONE,
:SSLCertificate => OpenSSL::X509::Certificate.new(File.open("#{$config['public_key_path']}").read),
:SSLPrivateKey => OpenSSL::PKey::RSA.new(File.open("#{$config['private_key_path']}").read),
:SSLCertName => [ [ "CN",WEBrick::Utils::getservername ] ]
:Host => $config['bind_address'],
:Port => $config['port'],
:Logger => $logger,
:ServerType => WEBrick::Daemon,
:SSLEnable => $config['enable_ssl'],
}
if $config['enable_ssl'] then
opts[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_NONE,
opts[:SSLCertificate] = OpenSSL::X509::Certificate.new(File.open("#{$config['public_key_path']}").read),
opts[:SSLPrivateKey] = OpenSSL::PKey::RSA.new(File.open("#{$config['private_key_path']}").read),
opts[:SSLCertName] = [ [ "CN",WEBrick::Utils::getservername ] ]
end

$command_prefix = $config['command_prefix'] || ''

class Server < Sinatra::Base

Expand Down Expand Up @@ -126,10 +130,10 @@ class Server < Sinatra::Base
def deploy_module(module_name)
begin
if $config['use_mcollective']
command = "mco r10k deploy_module #{module_name} >> #{$config['mco_logfile']} 2>&1 &"
command = "#{$command_prefix} mco r10k deploy_module #{module_name} >> #{$config['mco_logfile']} 2>&1 &"
else
# If you don't use mcollective then this hook needs to be running as r10k's user i.e. root
command = "r10k deploy module #{module_name} >> #{$config['mco_logfile']} 2>&1 &"
command = "#{$command_prefix} r10k deploy module #{module_name} >> #{$config['mco_logfile']} 2>&1 &"
end
message = "triggered: #{command}"
Process.detach(fork{ exec "#{command}"})
Expand All @@ -152,10 +156,10 @@ class Server < Sinatra::Base
end
else
if $config['use_mcollective']
command = "mco r10k deploy #{branch} >> #{$config['mco_logfile']} 2>&1 &"
command = "#{$command_prefix} mco r10k deploy #{branch} >> #{$config['mco_logfile']} 2>&1 &"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not super clear on why this is needed if you are running the script as the user, is the user case that you want to run the script as say root and then run r10k as non-root?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm running webhook as non-root and sudoing to root for r10k. I modified all of the command calls for doing that. In the case of MCO, they'd run the webhook as nobody and sudo to puppet/peadmin for mco.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After the template pull is in, I've got another branch ready for the Gentoo init script.
https://github.com/robbat2/r10k/commit/4dcba8212ead2fe3c829867e1fd8ecc6ce662c1f

else
# If you don't use mcollective then this hook needs to be running as r10k's user i.e. root
command = "r10k deploy environment #{branch} #{$config['r10k_deploy_arguments']} >> #{$config['mco_logfile']} 2>&1 &"
command = "#{$command_prefix} r10k deploy environment #{branch} #{$config['r10k_deploy_arguments']} >> #{$config['mco_logfile']} 2>&1 &"
end
message = "triggered: #{command}"
Process.detach(fork{ exec "#{command}"})
Expand Down