beaker-pe 1.19.0 → 1.20.0

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    NjMzOWUyYzQwMGMzNjM2N2Y0MDNhOWM4NjExNzk4NTQ1YjljNTkyMA==
+    OWJmNzE1Yzg4ZjY5OTA2NmQ1ODUyNGU2ODkyNTQ4MWNlMzRhZmM5MA==
   data.tar.gz: !binary |-
-    YThjYjA2MmE1NzZiZWI2ZWE2NzQ4NjM3OTgzNmQ3ZGMyZTk3ZmE2MA==
+    OGI4MzJjODkyYjQxNGI2MzMwZWNkMWYzOGVhN2RkNjYwOWRjZDc2MA==
 SHA512:
   metadata.gz: !binary |-
-    NDQ0YThhN2EyZjQwM2U2MzQzMTE3OWEwMDcyYjY3NmUzZjk5ZjdkYzRiMThj
-    ZWQ5NzNmMmI1YTIxZDlkZmRjZjdkODYyODlmMDgwMDZkNzFlMDNhOGVkYWYy
-    OTI2ZmNlNWVkZmUwMzc5NDE4NjhkNzE0MzNiNGIxOTEyZWI2Y2Y=
+    ZTgyZDk2Yzc4OTBkZDY5Nzk2ZjcxZjZlYjU5OGNkMTUzOGJlYjJhNTA3Y2Y4
+    NDg5ZGNlNmZiYWIxZWM0MGQzNTQ3MmVhYmVmYjAyYTk4MDc3NDE1MmIzNWUz
+    N2VhMjNkMzIyMmQ2YWZlMWE1ZTM3ZTQ1MzA0ZmU1OTBlOGViNDI=
   data.tar.gz: !binary |-
-    NzQ5YmQ5YTdmYWYyMzllNWNkNDM5OWQ4NmUwM2I5ZTBjNGMxYzQ4NTRjOTUw
-    YWU4OWMyYThhNWJiMzk2ZmM2OWY0YWE2MDE1MDA5MzRjZTczZmFkNTc4ZGI3
-    NjY3OGUxYzYzY2U3OWJjMWZlNzc1OTViNTM3MTQ2YzYxZmRlOWM=
+    MDdlMTk5ZTZhMzdlNmQxMDNkY2MyNTI1NTRjNmU4NTkxZDYxZTU4MzFmMWY4
+    MDU5Y2U2OThmNDZlYmU0Mjc5ZDAwOTc1N2E3M2M4YjhiYjgzYTI2MjNjNzcx
+    OTcxNTQyMGUwYmQ4OGNmYThhMzgzMTViNWIzNWE0MzY2NzdhOWM=

data/lib/beaker-pe/install/pe_utils.rb

@@ -81,6 +81,68 @@ module Beaker
           special_nodes + real_agents
         end
 
+        # If host or opts has the :use_puppet_ca_cert flag set, then push the master's
+        # ca cert onto the given host at /etc/puppetlabs/puppet/ssl/certs/ca.pem.
+        #
+        # This in turn allows +frictionless_agent_installer_cmd+ to generate
+        # an install which references the cert to verify the master when downloading
+        # resources.
+        def install_ca_cert_on(host, opts)
+          if host[:use_puppet_ca_cert] || opts[:use_puppet_ca_cert]
+            @cert_cache_dir ||= Dir.mktmpdir("master_ca_cert")
+            local_cert_copy = "#{@cert_cache_dir}/ca.pem"
+            step "Copying master ca.pem to agent for secure frictionless install" do
+              ca_pem_dir = '/etc/puppetlabs/puppet/ssl/certs'
+              ca_pem_path = "#{ca_pem_dir}/ca.pem"
+              scp_from(master, ca_pem_path , @cert_cache_dir) unless File.exist?(local_cert_copy)
+              on(host, "mkdir -p #{ca_pem_dir}")
+              scp_to(host, local_cert_copy, ca_pem_dir)
+            end
+          end
+        end
+
+        # Generate the command line string needed to from a frictionless puppet-agent
+        # install on this host in a PE environment.
+        #
+        # @param [Host] host The host to install puppet-agent onto
+        # @param [Hash] opts The full beaker options
+        # @option opts [Boolean] :use_puppet_ca_cert (false) if true the
+        #   command will reference the local puppet ca cert to verify the master
+        #   when obtaining the installation script
+        # @param [String] pe_version The PE version string for capabilities testing
+        # @return [String] of the commands to be executed for the install
+        def frictionless_agent_installer_cmd(host, opts, pe_version)
+          # PE 3.4 introduced the ability to pass in config options to the bash
+          # script in the form of <section>:<key>=<value>
+          frictionless_install_opts = []
+          if host.has_key?('frictionless_options') and !  version_is_less(pe_version, '3.4.0')
+            # since we have options to pass in, we need to tell the bash script
+            host['frictionless_options'].each do |section, settings|
+              settings.each do |key, value|
+                frictionless_install_opts << "#{section}:#{key}=#{value}"
+              end
+            end
+          end
+
+          pe_debug = host[:pe_debug] || opts[:pe_debug] ? ' -x' : ''
+          use_puppet_ca_cert = host[:use_puppet_ca_cert] || opts[:use_puppet_ca_cert]
+
+          if host['platform'] =~ /windows/ then
+            cmd = %Q{powershell -c "cd #{host['working_dir']};[Net.ServicePointManager]::ServerCertificateValidationCallback = {\\$true};\\$webClient = New-Object System.Net.WebClient;\\$webClient.DownloadFile('https://#{master}:8140/packages/current/install.ps1', '#{host['working_dir']}/install.ps1');#{host['working_dir']}/install.ps1 -verbose #{frictionless_install_opts.join(' ')}"}
+          else
+            curl_opts = %w{--tlsv1 -O}
+            if use_puppet_ca_cert
+              curl_opts << '--cacert /etc/puppetlabs/puppet/ssl/certs/ca.pem'
+            elsif host['platform'] !~ /aix/
+              curl_opts << '-k'
+            end
+
+            cmd = "export FRICTIONLESS_TRACE=true; cd #{host['working_dir']} && curl #{curl_opts.join(' ')} https://#{master}:8140/packages/current/install.bash && bash#{pe_debug} install.bash #{frictionless_install_opts.join(' ')}".strip
+          end
+
+          return cmd
+        end
+
         #Create the PE install command string based upon the host and options settings
         # @param [Host] host The host that PE is to be installed on
         #                    For UNIX machines using the full PE installer, the host object must have the 'pe_installer' field set correctly.
@@ -96,28 +158,7 @@ module Beaker
           # Frictionless install didn't exist pre-3.2.0, so in that case we fall
           # through and do a regular install.
           if host['roles'].include? 'frictionless' and ! version_is_less(version, '3.2.0')
-            # PE 3.4 introduced the ability to pass in config options to the bash script in the form
-            # of <section>:<key>=<value>
-            frictionless_install_opts = []
-            if host.has_key?('frictionless_options') and !  version_is_less(version, '3.4.0')
-              # since we have options to pass in, we need to tell the bash script
-              host['frictionless_options'].each do |section, settings|
-                settings.each do |key, value|
-                  frictionless_install_opts << "#{section}:#{key}=#{value}"
-                end
-              end
-            end
-
-            pe_debug = host[:pe_debug] || opts[:pe_debug] ? ' -x' : ''
-            if host['platform'] =~ /windows/ then
-              "powershell -c \"cd #{host['working_dir']};[Net.ServicePointManager]::ServerCertificateValidationCallback = {\\$true};\\$webClient = New-Object System.Net.WebClient;\\$webClient.DownloadFile('https://#{master}:8140/packages/current/install.ps1', '#{host['working_dir']}/install.ps1');#{host['working_dir']}/install.ps1 -verbose #{frictionless_install_opts.join(' ')}\""
-            elsif host['platform'] =~ /aix/ then
-              curl_opts = '--tlsv1 -O'
-              "cd #{host['working_dir']} && curl #{curl_opts} https://#{master}:8140/packages/current/install.bash && bash#{pe_debug} install.bash #{frictionless_install_opts.join(' ')}".strip
-            else
-              curl_opts = '--tlsv1 -kO'
-              "cd #{host['working_dir']} && curl #{curl_opts} https://#{master}:8140/packages/current/install.bash && bash#{pe_debug} install.bash #{frictionless_install_opts.join(' ')}".strip
-            end
+            frictionless_agent_installer_cmd(host, opts, version)
           elsif host['platform'] =~ /osx/
             version = host['pe_ver'] || opts[:pe_ver]
             pe_debug = host[:pe_debug] || opts[:pe_debug] ? ' -verboseR' : ''
@@ -295,7 +336,7 @@ module Beaker
           end
         end
 
-        #Classify the master so that it can deploy frictionless packages for a given host. 
+        #Classify the master so that it can deploy frictionless packages for a given host.
         #This function does nothing when using meep for classification.
         # @param [Host] host The host to install pacakges for
         # @api private
@@ -345,7 +386,16 @@ module Beaker
               node_group['classes'][klass] = {}
 
               _console_dispatcher.create_new_node_group_model(node_group)
-              on master, puppet("agent -t"), :acceptable_exit_codes => [0,2]
+              # The puppet agent run that will download the agent tarballs to the master can sometimes fail with
+              # curl errors if there is a network hiccup. Use beakers `retry_on` method to retry up to
+              # three times to avoid failing the entire test pipeline due to a network blip
+              retry_opts = {
+                :desired_exit_codes => [0,2],
+                :max_retries => 3,
+                # Beakers retry_on method wants the verbose value to be a string, not a bool.
+                :verbose => 'true'
+              }
+              retry_on(master, puppet("agent -t"), retry_opts)
             end
           end
         end
@@ -471,6 +521,7 @@ module Beaker
 
           step "Install agents" do
             block_on(agents, {:run_in_parallel => true}) do |host|
+              install_ca_cert_on(host, opts)
               on(host, installer_cmd(host, opts))
             end
           end
@@ -571,6 +622,7 @@ module Beaker
                 if host['platform'] != master['platform'] # only need to do this if platform differs
                   deploy_frictionless_to_master(host)
                 end
+                install_ca_cert_on(host, opts)
                 on host, installer_cmd(host, opts)
                 configure_type_defaults_on(host)
               elsif host['platform'] =~ /osx|eos/

data/lib/beaker-pe/version.rb

@@ -3,7 +3,7 @@ module Beaker
     module PE
 
       module Version
-        STRING = '1.19.0'
+        STRING = '1.20.0'
       end
 
     end

data/spec/beaker-pe/install/pe_utils_spec.rb

@@ -188,6 +188,62 @@ describe ClassMixedWithDSLInstallUtils do
     end
   end
 
+  describe 'frictionless_agent_installer_cmd' do
+    let(:host) do
+      the_host = unixhost.dup
+      the_host['roles'] = ['frictionless']
+      the_host
+    end
+
+    before(:each) do
+      expect( subject ).to receive( :master ).and_return( 'testmaster' )
+    end
+
+    it 'generates a unix PE frictionless install command without cert verification' do
+      expect( subject.frictionless_agent_installer_cmd( host, {}, '2016.4.0' ) ).to eq("export FRICTIONLESS_TRACE=true; cd /tmp && curl --tlsv1 -O -k https://testmaster:8140/packages/current/install.bash && bash install.bash")
+    end
+
+    it 'generates a unix PE frictionless install command with cert verification' do
+      host['use_puppet_ca_cert'] = true
+      expect( subject.frictionless_agent_installer_cmd( host, {}, '2016.4.0' ) ).to eq("export FRICTIONLESS_TRACE=true; cd /tmp && curl --tlsv1 -O --cacert /etc/puppetlabs/puppet/ssl/certs/ca.pem https://testmaster:8140/packages/current/install.bash && bash install.bash")
+    end
+
+    it 'generates a unix PE frictionless install command without cert verification on aix' do
+      host['platform'] = 'aix-61-power'
+      expect( subject.frictionless_agent_installer_cmd( host, {}, '2016.4.0' ) ).to eq("export FRICTIONLESS_TRACE=true; cd /tmp && curl --tlsv1 -O https://testmaster:8140/packages/current/install.bash && bash install.bash")
+    end
+
+    it 'generates a PS1 frictionless install command for windows' do
+      host['platform'] = 'windows-2012-64'
+      expect( subject.frictionless_agent_installer_cmd( host, {}, '2016.4.0' ) ).to eq(%q{powershell -c "cd /tmp;[Net.ServicePointManager]::ServerCertificateValidationCallback = {\\$true};\\$webClient = New-Object System.Net.WebClient;\\$webClient.DownloadFile('https://testmaster:8140/packages/current/install.ps1', '/tmp/install.ps1');/tmp/install.ps1 -verbose "})
+    end
+  end
+
+  describe 'install_ca_cert_on' do
+    let(:host) do
+      the_host = unixhost.dup
+      the_host['roles'] = ['frictionless']
+      the_host
+    end
+
+    before(:each) do
+      allow( subject ).to receive( :master ).and_return( 'testmaster' )
+    end
+
+    it 'installs ca.pem if use_puppet_ca_cert is true' do
+      host['use_puppet_ca_cert'] = true
+      expect(Dir).to receive(:mktmpdir).with('master_ca_cert').and_return('/tmp/master_ca_cert_random')
+      expect(subject).to receive(:on).with(host, 'mkdir -p /etc/puppetlabs/puppet/ssl/certs')
+      expect(subject).to receive(:scp_from).with('testmaster', '/etc/puppetlabs/puppet/ssl/certs/ca.pem', %r{/tmp/master_ca_cert_random})
+      expect(subject).to receive(:scp_to).with(host, %r{/tmp/master_ca_cert_random/ca.pem}, '/etc/puppetlabs/puppet/ssl/certs')
+      expect( subject.install_ca_cert_on(host, {}) )
+    end
+
+    it 'does nothing if use_puppet_ca_cert is false' do
+      expect( subject.install_ca_cert_on(host, {}) ).to be_nil
+    end
+  end
+
   describe 'installer_cmd' do
 
     it 'generates a unix PE install command for a unix host' do
@@ -203,7 +259,7 @@ describe ClassMixedWithDSLInstallUtils do
       the_host['pe_ver'] = '3.8.0'
       the_host['pe_installer'] = 'puppet-enterprise-installer'
       the_host['roles'] = ['frictionless']
-      expect( subject.installer_cmd( the_host, {} ) ).to be ===  "cd /tmp && curl --tlsv1 -kO https://testmaster:8140/packages/current/install.bash && bash install.bash"
+      expect( subject.installer_cmd( the_host, {} ) ).to be ===  "export FRICTIONLESS_TRACE=true; cd /tmp && curl --tlsv1 -O -k https://testmaster:8140/packages/current/install.bash && bash install.bash"
     end
 
     it 'generates a unix PE frictionless install command for a unix host with role "frictionless" and "frictionless_options"' do
@@ -213,7 +269,7 @@ describe ClassMixedWithDSLInstallUtils do
       the_host['pe_installer'] = 'puppet-enterprise-installer'
       the_host['roles'] = ['frictionless']
       the_host['frictionless_options'] = { 'main' => { 'dns_alt_names' => 'puppet' } }
-      expect( subject.installer_cmd( the_host, {} ) ).to be ===  "cd /tmp && curl --tlsv1 -kO https://testmaster:8140/packages/current/install.bash && bash install.bash main:dns_alt_names=puppet"
+      expect( subject.installer_cmd( the_host, {} ) ).to be ===  "export FRICTIONLESS_TRACE=true; cd /tmp && curl --tlsv1 -O -k https://testmaster:8140/packages/current/install.bash && bash install.bash main:dns_alt_names=puppet"
     end
 
     it 'generates a osx PE install command for a osx host' do
@@ -250,7 +306,7 @@ describe ClassMixedWithDSLInstallUtils do
       the_host['pe_installer'] = 'puppet-enterprise-installer'
       the_host['roles'] = ['frictionless']
       the_host[:pe_debug] = true
-      expect( subject.installer_cmd( the_host, {} ) ).to be === "cd /tmp && curl --tlsv1 -kO https://testmaster:8140/packages/current/install.bash && bash -x install.bash"
+      expect( subject.installer_cmd( the_host, {} ) ).to be === "export FRICTIONLESS_TRACE=true; cd /tmp && curl --tlsv1 -O -k https://testmaster:8140/packages/current/install.bash && bash -x install.bash"
     end
   end
 
@@ -978,7 +1034,7 @@ describe ClassMixedWithDSLInstallUtils do
     let(:node_group) { {} }
 
     before :each do
-      allow(subject).to receive(:on)
+      allow(subject).to receive(:retry_on)
 
       allow(subject).to receive(:hosts).and_return([master, agent])
       allow(Scooter::HttpDispatchers::ConsoleDispatcher).to receive(:new).and_return(dispatcher)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: beaker-pe
 version: !ruby/object:Gem::Version
-  version: 1.19.0
+  version: 1.20.0
 platform: ruby
 authors:
 - Puppetlabs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-30 00:00:00.000000000 Z
+date: 2017-07-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec