(#29) Ensure vault is updated when version changes

This PR fixes the issue that version is not updated on parameter change.
This is due the nature of creates parameter in archive.

This PR is creating a fact of vaults version and compares it against the parameter.
If parameter is newer it will download the archive and extract it.

This will not reboot vault server.
Please be aware to restart vault server, so vault sources the new binary.

Fixes #29

Cherry-picked and rebased from #52

.github/workflows/ci.yml

@@ -19,3 +19,5 @@ jobs:
   puppet:
     name: Puppet
     uses: voxpupuli/gha-puppet/.github/workflows/beaker.yml@v2
+    with:
+      beaker_facter: 'vault_version:Vault:1.12.0'

.sync.yml

@@ -11,3 +11,6 @@ spec/spec_helper_acceptance.rb:
 .puppet-lint.rc:
   enabled_lint_checks:
     - parameter_documentation
+.github/workflows/ci.yml:
+  with:
+    beaker_facter: 'vault_version:Vault:1.12.0'

lib/facter/vault_version.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Fact: vault_version
+#
+# Purpose: Retrieve vault version if installed
+#
+Facter.add(:vault_version) do
+  confine { Facter::Util::Resolution.which('vault') }
+  setcode do
+    vault_server_version_output = Facter::Util::Resolution.exec('vault version')
+    match = vault_server_version_output.match(%r{Vault v(\d+\.\d+\.\d+)})
+    match&.captures&.first
+  end
+end

manifests/install.pp

@@ -19,7 +19,13 @@
         extract_path => $vault::bin_dir,
         source       => $vault::real_download_url,
         cleanup      => true,
-        creates      => $vault_bin,
+        creates      => $facts['vault_version'] ? { # lint:ignore:selector_inside_resource
+          undef   => $vault_bin,
+          default => versioncmp($vault::version, $facts['vault_version']) > 0 ? {
+            true    => undef,
+            default => $vault_bin
+          }
+        },
         before       => File['vault_binary'],
       }
 

spec/acceptance/class_spec.rb

@@ -82,6 +82,46 @@ class { 'file_capability':
     describe port(8200) do
       it { is_expected.to be_listening.on('127.0.0.1').with('tcp') }
     end
+
+    describe command('/usr/local/bin/vault version') do
+      its(:exit_status) { is_expected.to eq 0 }
+      its(:stdout) { is_expected.to match %r{Vault v1.12.0} }
+    end
+  end
+
+  context 'default parameters with vesion higher than fact' do
+    let(:manifest) do
+      <<-PUPPET
+      if $facts['os']['name'] == 'Archlinux' {
+        class { 'file_capability':
+          package_name => 'libcap',
+        }
+      } else {
+        include file_capability
+      }
+      package { 'unzip': ensure => present }
+      -> class { 'vault':
+        storage => {
+          file => {
+            path => '/tmp',
+          }
+        },
+        bin_dir => '/usr/local/bin',
+        install_method => 'archive',
+        version => '1.12.1',
+        require => Class['file_capability'],
+      }
+      PUPPET
+    end
+
+    it 'will not be idempotent and cause changes' do
+      apply_manifest(manifest, expect_changes: true)
+    end
+
+    describe command('/usr/local/bin/vault version') do
+      its(:exit_status) { is_expected.to eq 0 }
+      its(:stdout) { is_expected.to match %r{Vault v1.12.1} }
+    end
   end
 
   context 'with package based setup' do