bolt 2.7.0 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9354d4101556422d8d97c758b64a4e717a9b24488d11cfe48042ebe79e1a28fa
-  data.tar.gz: 3ca45b8616f2ff1aa53c67cccd150d06c7a2d8897a11b3ffdfda352d6d10ec0c
+  metadata.gz: bdb245ba4347b6309414b645bea7e8829651886d3f85152217801ce7463fdfb6
+  data.tar.gz: 4e93d16cbb9d5cd0314f1c12031cd1e7d1ca9eb0c40186119f15a902aa0732d9
 SHA512:
-  metadata.gz: 8afb009f9b4d602b3255d86dac20551fae9389782abd2dbb3bb256eb3431a33ad7e8bfa8c87d3ffcb14d9c0aad551a5ddb2df5df80a01d8e41b4ebe49a4a2ff5
-  data.tar.gz: b3b471d539c81f37bfcfe1b2b7a3e4a84db0ada296e4300a56830d5a41ad91db96efb9583b84027f85a69d0588f7c0a2fb977d6da24aa1f08e16aea856fb6d03
+  metadata.gz: 5264e15f6e29f8d2e8cd9b02f67161e110215c20161c9e5ef22cf85294597eb262c40f0e13491dcb83c683b5c11930bc26fa1f8e5b80bee5ce485c60567fa8f5
+  data.tar.gz: 3b6053135ba279dc70b41cfa13dcd7c5b00a70fa8dd2ed3370bcdd8b1e9c33b33ec2ea817bc6fc5c7afb6114a5abe1c93ea328e432c5b1748c22af04daad5a6f

data/Puppetfile

@@ -32,7 +32,8 @@ mod 'puppetlabs-ruby_plugin_helper', '0.1.0'
 # Plugin modules
 mod 'puppetlabs-aws_inventory', '0.5.0'
 mod 'puppetlabs-azure_inventory', '0.3.0'
-mod 'puppetlabs-gcloud_inventory', '0.1.0'
+mod 'puppetlabs-gcloud_inventory', '0.1.1'
+mod 'puppetlabs-pkcs7', '0.1.0'
 mod 'puppetlabs-terraform', '0.5.0'
 mod 'puppetlabs-vault', '0.3.0'
 mod 'puppetlabs-yaml', '0.2.0'

data/bolt-modules/boltlib/lib/puppet/functions/run_task_with.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require 'bolt/error'
+require 'bolt/pal'
+require 'bolt/task'
+
+# Runs a given instance of a `Task` with target-specific parameters on the given set of targets and
+# returns the result from each. This function differs from {run_task} by accepting a block that returns
+# a `Hash` of target-specific parameters that are passed to the task. This can be used to send parameters
+# based on a target's attributes, such as its `facts`, or to use conditional logic to determine the
+# parameters a task should receive for a specific target.
+#
+# This function does nothing if the list of targets is empty.
+#
+# > **Note:** Not available in apply block
+#
+# > **Note:** Not available to targets using the pcp transport
+Puppet::Functions.create_function(:run_task_with) do
+  # Run a task with target-specific parameters.
+  # @param task_name The task to run.
+  # @param targets A pattern identifying zero or more targets. See {get_targets} for accepted patterns.
+  # @param options A hash of additional options.
+  # @option options [Boolean] _catch_errors Whether to catch raised errors.
+  # @option options [Boolean] _noop Run the task in noop mode if available.
+  # @option options [String] _run_as User to run as using privilege escalation.
+  # @param block A block that returns a `Hash` of target-specific parameters for the task.
+  # @return A list of results, one entry per target.
+  # @example Run a task with target-specific parameters as root
+  #   run_task_with('my_task', $targets, '_run_as' => 'root') |$t| {
+  #     { 'param1' => $t.vars['var1'],
+  #       'param2' => $t.vars['var2'] }
+  #   }
+  dispatch :run_task_with do
+    param 'String[1]', :task_name
+    param 'Boltlib::TargetSpec', :targets
+    optional_param 'Hash[String[1], Any]', :options
+    required_block_param 'Callable[Target]', :block
+    return_type 'ResultSet'
+  end
+
+  # Run a task with target-specific parameters, logging the provided description.
+  # @param task_name The task to run.
+  # @param targets A pattern identifying zero or more targets. See {get_targets} for accepted patterns.
+  # @param description A description to be output when calling this function.
+  # @param options A hash of additional options.
+  # @option options [Boolean] _catch_errors Whether to catch raised errors.
+  # @option options [Boolean] _noop Run the task in noop mode if available.
+  # @option options [String] _run_as User to run as using privilege escalation.
+  # @param block A block that returns a `Hash` of target-specific parameters for the task.
+  # @return A list of results, one entry per target.
+  # @example Run a task with target-specific parameters and a description
+  #   run_task_with('my_task', $targets, 'Update system packages') |$t| {
+  #     { 'param1' => $t.vars['var1'],
+  #       'param2' => $t.vars['var2'] }
+  #   }
+  dispatch :run_task_with_with_description do
+    param 'String[1]', :task_name
+    param 'Boltlib::TargetSpec', :targets
+    param 'Optional[String]', :description
+    optional_param 'Hash[String[1], Any]', :options
+    required_block_param 'Callable[Target]', :block
+    return_type 'ResultSet'
+  end
+
+  def run_task_with(task_name, targets, options = {}, &block)
+    run_task_with_with_description(task_name, targets, nil, options, &block)
+  end
+
+  def run_task_with_with_description(task_name, targets, description, options = {})
+    unless Puppet[:tasks]
+      raise Puppet::ParseErrorWithIssue
+        .from_issue_and_stack(
+          Bolt::PAL::Issues::PLAN_OPERATION_NOT_SUPPORTED_WHEN_COMPILING,
+          action: 'run_task_with'
+        )
+    end
+
+    executor  = Puppet.lookup(:bolt_executor)
+    inventory = Puppet.lookup(:bolt_inventory)
+    error_set = []
+
+    # Report to analytics
+    executor.report_function_call(self.class.name)
+    executor.report_bundled_content('Task', task_name)
+
+    # Keep valid metaparameters, discarding everything else
+    options = options.select { |k, _v| k.start_with?('_') }
+                     .transform_keys { |k| k.sub(/^_/, '').to_sym }
+
+    options[:description] = description if description
+
+    # Get all the targets
+    targets = Array(inventory.get_targets(targets))
+
+    # If all targets use the 'pcp' transport, use a fake task instead of loading the local definition
+    # Otherwise, load the local task definition
+    if (pcp_only = targets.any? && targets.all? { |t| t.transport == 'pcp' })
+      task = Bolt::Task.new(task_name, {}, [{ 'name' => '', 'path' => '' }])
+    else
+      task_signature = Puppet::Pal::ScriptCompiler.new(closure_scope.compiler).task_signature(task_name)
+
+      if task_signature.nil?
+        raise Bolt::Error.unknown_task(task_name)
+      end
+
+      task = Bolt::Task.from_task_signature(task_signature)
+    end
+
+    # Map the targets to their specific parameters and merge with the defaults
+    target_mapping = targets.each_with_object({}) do |target, mapping|
+      params = yield(target)
+
+      # Parameters returned from the block should be a Hash. If they're not, create a failing
+      # Result for the target that will later be added to the ResultSet.
+      unless params.is_a?(Hash)
+        exception = with_stack(
+          :TYPE_MISMATCH,
+          "Block must return a Hash of parameters, received #{params.class}"
+        )
+        error_set << Bolt::Result.from_exception(target, exception, action: 'task')
+        next
+      end
+
+      # If parameters are mismatched, create a failing result for the target that will later
+      # be added to the ResultSet.
+      unless pcp_only
+        params = task.parameter_defaults.merge(params)
+
+        type_match = task_signature.runnable_with?(params) do |mismatch_message|
+          exception = with_stack(:TYPE_MISMATCH, mismatch_message)
+          error_set << Bolt::Result.from_exception(target, exception, action: 'task')
+        end
+
+        next unless type_match
+      end
+
+      # If there is a type mismatch between the type Data and the type of the params, create
+      # a failing result for the target that will later be added to the ResultSet.
+      unless Puppet::Pops::Types::TypeFactory.data.instance?(params)
+        params_t = Puppet::Pops::Types::TypeCalculator.infer_set(params)
+        desc = Puppet::Pops::Types::TypeMismatchDescriber.singleton.describe_mismatch(
+          'Task parameters are not of type Data. run_task_with()',
+          Puppet::Pops::Types::TypeFactory.data, params_t
+        )
+        exception = with_stack(:TYPE_NOT_DATA, desc)
+        error_set << Bolt::Result.from_exception(target, exception, action: 'task')
+        next
+      end
+
+      # Wrap parameters marked with '"sensitive": true' in the task metadata with a
+      # Sensitive wrapper type. This way it's not shown in logs.
+      if (param_spec = task.parameters)
+        params.each do |k, v|
+          if param_spec[k] && param_spec[k]['sensitive']
+            params[k] = Puppet::Pops::Types::PSensitiveType::Sensitive.new(v)
+          end
+        end
+      end
+
+      mapping[target] = task.parameter_defaults.merge(params)
+    end
+
+    # Add a noop parameter if the function was called with the noop metaparameter.
+    if options[:noop]
+      if task.supports_noop
+        target_mapping.each_value { |params| params['_noop'] = true }
+      else
+        raise with_stack(:TASK_NO_NOOP, 'Task does not support noop')
+      end
+    end
+
+    if targets.empty?
+      Bolt::ResultSet.new([])
+    else
+      # Combine the results from the task run with any failing results that were
+      # generated earlier when creating the target mapping
+      task_result = executor.run_task_with(target_mapping, task, options)
+      result = Bolt::ResultSet.new(task_result.results + error_set)
+
+      if !result.ok && !options[:catch_errors]
+        raise Bolt::RunFailure.new(result, 'run_task', task_name)
+      end
+
+      result
+    end
+  end
+
+  def with_stack(kind, msg)
+    issue = Puppet::Pops::Issues.issue(kind) { msg }
+    Puppet::ParseErrorWithIssue.from_issue_and_stack(issue)
+  end
+end

data/lib/bolt/applicator.rb

@@ -155,7 +155,6 @@ module Bolt
       end
 
       plan_vars = scope.to_hash(true, true)
-      %w[trusted server_facts facts].each { |k| plan_vars.delete(k) }
 
       targets = @inventory.get_targets(args[0])
 

data/lib/bolt/apply_inventory.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'bolt/boltdir'
+require 'bolt/project'
 require 'bolt/config'
 require 'bolt/error'
 

data/lib/bolt/apply_target.rb

@@ -57,6 +57,10 @@ module Bolt
       @user = Addressable::URI.unencode_component(uri_obj.user) || t_conf['user']
     end
 
+    def to_s
+      @safe_name
+    end
+
     def parse_uri(string)
       require 'addressable/uri'
       if string.nil?
@@ -73,5 +77,9 @@ module Bolt
     rescue Addressable::URI::InvalidURIError => e
       raise Bolt::ParseError, "Could not parse target URI: #{e.message}"
     end
+
+    def hash
+      @name.hash
+    end
   end
 end

data/lib/bolt/bolt_option_parser.rb

@@ -64,7 +64,7 @@ module Bolt
           { flags: OPTIONS[:global] + OPTIONS[:global_config_setters],
             banner: PLAN_CONVERT_HELP }
         when 'run'
-          { flags: ACTION_OPTS + %w[params compile-concurrency tmpdir],
+          { flags: ACTION_OPTS + %w[params compile-concurrency tmpdir hiera-config],
             banner: PLAN_RUN_HELP }
         when 'show'
           { flags: OPTIONS[:global] + OPTIONS[:global_config_setters] + %w[filter format],
@@ -112,7 +112,7 @@ module Bolt
       when 'secret'
         case action
         when 'createkeys'
-          { flags: OPTIONS[:global] + OPTIONS[:global_config_setters] + %w[plugin],
+          { flags: OPTIONS[:global] + OPTIONS[:global_config_setters] + %w[plugin force],
             banner: SECRET_CREATEKEYS_HELP }
         when 'decrypt'
           { flags: OPTIONS[:global] + OPTIONS[:global_config_setters] + %w[plugin],
@@ -716,6 +716,10 @@ module Bolt
              'Directory containing bolt.yaml will be used as the Boltdir.') do |path|
         @options[:configfile] = path
       end
+      define('--hiera-config FILEPATH',
+             'Specify where to load Hiera config from (default: ~/.puppetlabs/bolt/hiera.yaml)') do |path|
+        @options[:'hiera-config'] = path
+      end
       define('-i', '--inventoryfile FILEPATH',
              'Specify where to load inventory from (default: ~/.puppetlabs/bolt/inventory.yaml)') do |path|
         if ENV.include?(Bolt::Inventory::ENVIRONMENT_VAR)
@@ -775,6 +779,9 @@ module Bolt
              'when initializing a project. Resolves and installs all dependencies.') do |modules|
         @options[:modules] = modules.split(',')
       end
+      define('--force', 'Overwrite existing key pairs') do |_force|
+        @options[:force] = true
+      end
 
       separator "\nGLOBAL OPTIONS"
       define('-h', '--help', 'Display help') do |_|

data/lib/bolt/cli.rb

@@ -114,12 +114,12 @@ module Bolt
       @config = if options[:configfile]
                   Bolt::Config.from_file(options[:configfile], options)
                 else
-                  boltdir = if options[:boltdir]
-                              Bolt::Boltdir.new(options[:boltdir])
+                  project = if options[:boltdir]
+                              Bolt::Project.new(options[:boltdir])
                             else
-                              Bolt::Boltdir.find_boltdir(Dir.pwd)
+                              Bolt::Project.find_boltdir(Dir.pwd)
                             end
-                  Bolt::Config.from_boltdir(boltdir, options)
+                  Bolt::Config.from_project(project, options)
                 end
 
       Bolt::Logger.configure(config.log, config.color)
@@ -238,6 +238,12 @@ module Bolt
       if options[:subcommand] == 'command' && (!options[:object] || options[:object].empty?)
         raise Bolt::CLIError, "Must specify a command to run"
       end
+
+      if options[:subcommand] == 'secret' &&
+         (options[:action] == 'decrypt' || options[:action] == 'encrypt') &&
+         !options[:object]
+        raise Bolt::CLIError, "Must specify a value to #{options[:action]}"
+      end
     end
 
     def handle_parser_errors
@@ -252,7 +258,7 @@ module Bolt
 
     def puppetdb_client
       return @puppetdb_client if @puppetdb_client
-      puppetdb_config = Bolt::PuppetDB::Config.load_config(nil, config.puppetdb, config.boltdir.path)
+      puppetdb_config = Bolt::PuppetDB::Config.load_config(nil, config.puppetdb, config.project.path)
       @puppetdb_client = Bolt::PuppetDB::Client.new(puppetdb_config)
     end
 
@@ -314,7 +320,8 @@ module Bolt
 
       screen_view_fields = {
         output_format: config.format,
-        boltdir_type: config.boltdir.type
+        # For continuity
+        boltdir_type: config.project.type
       }
 
       # Only include target and inventory info for commands that take a targets
@@ -447,6 +454,7 @@ module Bolt
     def list_tasks
       tasks = pal.list_tasks
       tasks.select! { |task| task.first.include?(options[:filter]) } if options[:filter]
+      tasks.select! { |task| config.project.tasks.include?(task.first) } unless config.project.tasks.nil?
       outputter.print_tasks(tasks, pal.list_modulepath)
     end
 
@@ -457,6 +465,7 @@ module Bolt
     def list_plans
       plans = pal.list_plans
       plans.select! { |plan| plan.first.include?(options[:filter]) } if options[:filter]
+      plans.select! { |plan| config.project.plans.include?(plan.first) } unless config.project.plans.nil?
       outputter.print_plans(plans, pal.list_modulepath)
     end
 
@@ -567,10 +576,10 @@ module Bolt
     # Initializes a specified directory as a Bolt project and installs any modules
     # specified by the user, along with their dependencies
     def initialize_project
-      boltdir    = Pathname.new(File.expand_path(options[:object] || Dir.pwd))
-      config     = boltdir + 'bolt.yaml'
-      puppetfile = boltdir + 'Puppetfile'
-      modulepath = [boltdir + 'modules']
+      project    = Pathname.new(File.expand_path(options[:object] || Dir.pwd))
+      config     = project + 'bolt.yaml'
+      puppetfile = project + 'Puppetfile'
+      modulepath = [project + 'modules']
 
       # If modules were specified, first check if there is already a Puppetfile at the project
       # directory, erroring if there is. If there is no Puppetfile, generate the Puppetfile
@@ -590,20 +599,20 @@ module Bolt
       # Warn the user if the project directory already exists. We don't error here since users
       # might not have installed any modules yet.
       if config.exist?
-        @logger.warn "Found existing project directory at #{boltdir}"
+        @logger.warn "Found existing project directory at #{project}"
       end
 
       # Create the project directory
-      FileUtils.mkdir_p(boltdir)
+      FileUtils.mkdir_p(project)
 
-      # Bless the project directory as a boltdir
+      # Bless the project directory as a...wait for it...project
       if FileUtils.touch(config)
-        outputter.print_message "Successfully created Bolt project at #{boltdir}"
+        outputter.print_message "Successfully created Bolt project at #{project}"
       else
-        raise Bolt::FileError.new("Could not create Bolt project directory at #{boltdir}", nil)
+        raise Bolt::FileError.new("Could not create Bolt project directory at #{project}", nil)
       end
 
-      # Write the generated Puppetfile to the fancy new boltdir
+      # Write the generated Puppetfile to the fancy new project
       if puppetfile_specs
         File.write(puppetfile, puppetfile_specs.join("\n"))
         outputter.print_message "Successfully created Puppetfile at #{puppetfile}"
@@ -752,12 +761,14 @@ module Bolt
     end
 
     def pal
+      project = config.project.load_as_module? ? config.project : nil
       @pal ||= Bolt::PAL.new(config.modulepath,
                              config.hiera_config,
-                             config.boltdir.resource_types,
+                             config.project.resource_types,
                              config.compile_concurrency,
                              config.trusted_external,
-                             config.apply_settings)
+                             config.apply_settings,
+                             project)
     end
 
     def convert_plan(plan)

data/lib/bolt/config.rb

@@ -3,7 +3,7 @@
 require 'etc'
 require 'logging'
 require 'pathname'
-require 'bolt/boltdir'
+require 'bolt/project'
 require 'bolt/logger'
 require 'bolt/util'
 # Transport config objects
@@ -23,7 +23,7 @@ module Bolt
   end
 
   class Config
-    attr_reader :config_files, :warnings, :data, :transports, :boltdir
+    attr_reader :config_files, :warnings, :data, :transports, :project
 
     TRANSPORT_CONFIG = {
       'ssh'    => Bolt::Config::Transport::SSH,
@@ -102,30 +102,30 @@ module Bolt
     }.freeze
 
     def self.default
-      new(Bolt::Boltdir.new('.'), {})
+      new(Bolt::Project.new('.'), {})
     end
 
-    def self.from_boltdir(boltdir, overrides = {})
+    def self.from_project(project, overrides = {})
       data = {
-        filepath: boltdir.config_file,
-        data: Bolt::Util.read_optional_yaml_hash(boltdir.config_file, 'config')
+        filepath: project.config_file,
+        data: Bolt::Util.read_optional_yaml_hash(project.config_file, 'config')
       }
 
       data = load_defaults.push(data).select { |config| config[:data]&.any? }
 
-      new(boltdir, data, overrides)
+      new(project, data, overrides)
     end
 
     def self.from_file(configfile, overrides = {})
-      boltdir = Bolt::Boltdir.new(Pathname.new(configfile).expand_path.dirname)
+      project = Bolt::Project.new(Pathname.new(configfile).expand_path.dirname)
 
       data = {
-        filepath: boltdir.config_file,
+        filepath: project.config_file,
         data: Bolt::Util.read_yaml_hash(configfile, 'config')
       }
       data = load_defaults.push(data).select { |config| config[:data]&.any? }
 
-      new(boltdir, data, overrides)
+      new(project, data, overrides)
     end
 
     def self.load_defaults
@@ -148,14 +148,14 @@ module Bolt
       confs
     end
 
-    def initialize(boltdir, config_data, overrides = {})
+    def initialize(project, config_data, overrides = {})
       unless config_data.is_a?(Array)
-        config_data = [{ filepath: boltdir.config_file, data: config_data }]
+        config_data = [{ filepath: project.config_file, data: config_data }]
       end
 
       @logger = Logging.logger[self]
       @warnings = []
-      @boltdir = boltdir
+      @project = project
       @transports = {}
       @config_files = []
 
@@ -184,7 +184,7 @@ module Bolt
       @data = merge_config_layers(default_data, *loaded_data, override_data)
 
       TRANSPORT_CONFIG.each do |transport, config|
-        @transports[transport] = config.new(@data.delete(transport), @boltdir.path)
+        @transports[transport] = config.new(@data.delete(transport), @project.path)
       end
 
       finalize_data
@@ -250,7 +250,7 @@ module Bolt
         @data['log'] = update_logs(@data['log'])
       end
 
-      # Expand paths relative to the Boltdir. Any settings that came from the
+      # Expand paths relative to the project. Any settings that came from the
       # CLI will already be absolute, so the expand will be skipped.
       if @data.key?('modulepath')
         moduledirs = if data['modulepath'].is_a?(String)
@@ -259,12 +259,12 @@ module Bolt
                        data['modulepath']
                      end
         @data['modulepath'] = moduledirs.map do |moduledir|
-          File.expand_path(moduledir, @boltdir.path)
+          File.expand_path(moduledir, @project.path)
         end
       end
 
       %w[hiera-config inventoryfile trusted-external-command].each do |opt|
-        @data[opt] = File.expand_path(@data[opt], @boltdir.path) if @data.key?(opt)
+        @data[opt] = File.expand_path(@data[opt], @project.path) if @data.key?(opt)
       end
 
       # Filter hashes to only include valid options
@@ -275,7 +275,7 @@ module Bolt
     private def normalize_log(target)
       return target if target == 'console'
       target = target[5..-1] if target.start_with?('file:')
-      'file:' + File.expand_path(target, @boltdir.path)
+      'file:' + File.expand_path(target, @project.path)
     end
 
     private def update_logs(logs)
@@ -348,23 +348,23 @@ module Bolt
     end
 
     def default_inventoryfile
-      @boltdir.inventory_file
+      @project.inventory_file
     end
 
     def rerunfile
-      @boltdir.rerunfile
+      @project.rerunfile
     end
 
     def hiera_config
-      @data['hiera-config'] || @boltdir.hiera_config
+      @data['hiera-config'] || @project.hiera_config
     end
 
     def puppetfile
-      @puppetfile || @boltdir.puppetfile
+      @puppetfile || @project.puppetfile
     end
 
     def modulepath
-      @data['modulepath'] || @boltdir.modulepath
+      @data['modulepath'] || @project.modulepath
     end
 
     def modulepath=(value)