bolt 2.13.0 → 2.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0fd39267ed3b68619b0e9f40f8415446d0061ebe5367650d50e6e5ab3229d8b9
-  data.tar.gz: b4d88aee228eeccb8c9ed8ebcb6221960c3197f1ac43d4a195e5c3d4a8833a9d
+  metadata.gz: fbe6053f1a3801adb0f1d0684f1e4616311c93bf0513a74cde2c54c82d5de503
+  data.tar.gz: b51e4068dcceb096d5e6cec4a79d692b84d1472abe57065de1a219d8ed84a4ad
 SHA512:
-  metadata.gz: 0a225b8e5e695da5268aa9b748c57c06944046ebc4865d76ec8d0f446ec37d0584f2fca2d19ee9910cd5ed5555f8cc15910693a66e813b0b0e6aab48dd9e8789
-  data.tar.gz: 6d2853adea34d7b0006ac0d643f1af8cda862903618fde138cf64079d9b9c433815537c7f70c483fcbb00287462f4762285d5e8e5147b6327c7c5c71346412b4
+  metadata.gz: ea53a6643459311d007ad7b8c2a60e5d0d4af6b0005b037295edff063a2e1f0236054d9cb5c14cec039ee8d0eb0ffa94e887b6a1ba64c3bb196f2a10cd90ce6d
+  data.tar.gz: 7bfde56e613103081c5ce73095c82b897f5db8b973365e6fbd28dfc7f57873fce518d37fe55bb76e36f36ab9dc802a12e545621bbff44f3a389ff071898bbc2c

data/bolt-modules/boltlib/lib/puppet/functions/resource.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+# Lookup a resource in the target's data.
+#
+# For more information about resources see [the
+# documentation](https://puppet.com/docs/puppet/latest/lang_resources.html).
+#
+# > **Note:** The `ResourceInstance` data type is under active development and is subject to
+#   change. You can read more about the data type in the [experimental features
+#   documentation](experimental_features.md#resourceinstance-data-type).
+Puppet::Functions.create_function(:resource) do
+  # Lookup a resource in the target's data.
+  # @param target The Target object to add resources to. See {get_targets}.
+  # @param type The type of the resource
+  # @param title The title of the resource
+  # @return The ResourceInstance if found, or Undef
+  # @example Get the openssl package resource
+  #   $target.apply_prep
+  #   $resources = $target.get_resources(Package).first['resources']
+  #   $target.set_resources($resources)
+  #   $openssl = $target.resource('Package', 'openssl')
+  dispatch :resource do
+    param 'Target', :target
+    param 'Type[Resource]', :type
+    param 'String[1]', :title
+    return_type 'Optional[ResourceInstance]'
+  end
+
+  # Lookup a resource in the target's data, referring to resource as a string
+  # @param target The Target object to add resources to. See {get_targets}.
+  # @param type The type of the resource
+  # @param title The title of the resource
+  # @return The ResourceInstance if found, or Undef
+  dispatch :resource_from_string do
+    param 'Target', :target
+    param 'String[1]', :type
+    param 'String[1]', :title
+    return_type 'Optional[ResourceInstance]'
+  end
+
+  def resource(target, type, title)
+    inventory = Puppet.lookup(:bolt_inventory)
+    executor  = Puppet.lookup(:bolt_executor) { nil }
+    executor&.report_function_call(self.class.name)
+
+    inventory.resource(target, type, title)
+  end
+
+  def resource_from_string(target, type, title)
+    resource(target, type, title)
+  end
+end

data/bolt-modules/boltlib/lib/puppet/functions/run_plan.rb

@@ -187,7 +187,11 @@ Puppet::Functions.create_function(:run_plan, Puppet::Functions::InternalFunction
     params.each_with_object({}) do |(name, value), acc|
       model = models[name]
 
-      if sensitive_type?(model.type_expr)
+      # Parameters passed to a plan that the plan is not expecting don't have a model,
+      # so keep the parameter as-is.
+      if model.nil?
+        acc[name] = value
+      elsif sensitive_type?(model.type_expr)
         acc[name] = Puppet::Pops::Types::PSensitiveType::Sensitive.new(value)
       else
         if model.type_expr.to_s.include?('Sensitive')

data/lib/bolt/applicator.rb

@@ -21,7 +21,7 @@ module Bolt
 
       @inventory = inventory
       @executor = executor
-      @modulepath = modulepath
+      @modulepath = modulepath || []
       @plugin_dirs = plugin_dirs
       @project = project
       @pdb_client = pdb_client
@@ -146,6 +146,7 @@ module Bolt
 
     def apply(args, apply_body, scope)
       raise(ArgumentError, 'apply requires a TargetSpec') if args.empty?
+      raise(ArgumentError, 'apply requires at least one statement in the apply block') if apply_body.nil?
       type0 = Puppet.lookup(:pal_script_compiler).type('TargetSpec')
       Puppet::Pal.assert_type(type0, args[0], 'apply targets')
 

data/lib/bolt/apply_inventory.rb

@@ -70,6 +70,10 @@ module Bolt
       @targets[target.name].features
     end
 
+    def resource(target, type, title)
+      @targets[target.name].resource(type, title)
+    end
+
     def add_to_group(*_params)
       raise InvalidFunctionCall, 'add_to_group'
     end

data/lib/bolt/apply_target.rb

@@ -62,6 +62,10 @@ module Bolt
       @safe_name
     end
 
+    def resource(type, title)
+      resources[Bolt::ResourceInstance.format_reference(type, title)]
+    end
+
     def parse_uri(string)
       require 'addressable/uri'
       if string.nil?

data/lib/bolt/catalog.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
+require 'bolt/apply_inventory'
 require 'bolt/apply_target'
 require 'bolt/config'
 require 'bolt/error'
 require 'bolt/inventory'
-require 'bolt/apply_inventory'
 require 'bolt/pal'
 require 'bolt/puppetdb'
 require 'bolt/util'
@@ -19,7 +19,7 @@ module Bolt
       @log_level = log_level
     end
 
-    def with_puppet_settings(hiera_config = {})
+    def with_puppet_settings(overrides = {})
       Dir.mktmpdir('bolt') do |dir|
         cli = []
         Puppet::Settings::REQUIRED_APP_SETTINGS.each do |setting|
@@ -31,7 +31,9 @@ module Bolt
         Puppet.settings.override_default(:vendormoduledir, '')
 
         Puppet.initialize_settings(cli)
-        Puppet.settings[:hiera_config] = hiera_config
+        overrides.each do |setting, value|
+          Puppet.settings[setting] = value
+        end
 
         # Use a special logdest that serializes all log messages and their level to stderr.
         Puppet::Util::Log.newdestination(:stderr)
@@ -54,83 +56,51 @@ module Bolt
     end
 
     def compile_catalog(request)
-      pal_main = request['code_ast'] || request['code_string']
-      target = request['target']
       pdb_client = Bolt::PuppetDB::Client.new(Bolt::PuppetDB::Config.new(request['pdb_config']))
-      options = request['puppet_config'] || {}
       project = request['project'] || {}
       bolt_project = Struct.new(:name, :path).new(project['name'], project['path']) unless project.empty?
-      with_puppet_settings(request['hiera_config']) do
-        Puppet[:rich_data] = true
-        Puppet[:node_name_value] = target['name']
-        env_conf = { modulepath: request['modulepath'] || [],
-                     facts: target['facts'] || {} }
-        env_conf[:variables] = {}
+      inv = Bolt::ApplyInventory.new(request['config'])
+      puppet_overrides = {
+        bolt_pdb_client: pdb_client,
+        bolt_inventory: inv,
+        bolt_project: bolt_project
+      }
+
+      # Facts will be set by the catalog compiler, so we need to ensure
+      # that any plan or target variables with the same name are not
+      # passed into the apply block to avoid a redefinition error.
+      # Filter out plan and target vars separately and raise a Puppet
+      # warning if there are any collisions for either. Puppet warning
+      # is the only way to log a message that will make it back to Bolt
+      # to be printed.
+      target = request['target']
+      plan_vars = shadow_vars('plan', request['plan_vars'], target['facts'])
+      target_vars = shadow_vars('target', target['variables'], target['facts'])
+      topscope_vars = target_vars.merge(plan_vars)
+      env_conf = { modulepath: request['modulepath'],
+                   facts: target['facts'],
+                   variables: topscope_vars }
+
+      puppet_settings = {
+        node_name_value: target['name'],
+        hiera_config: request['hiera_config']
+      }
+
+      with_puppet_settings(puppet_settings) do
         Puppet::Pal.in_tmp_environment('bolt_catalog', env_conf) do |pal|
-          inv = Bolt::ApplyInventory.new(request['config'])
-          Puppet.override(bolt_pdb_client: pdb_client,
-                          bolt_inventory: inv,
-                          bolt_project: bolt_project) do
+          Puppet.override(puppet_overrides) do
             Puppet.lookup(:pal_current_node).trusted_data = target['trusted']
             pal.with_catalog_compiler do |compiler|
-              # Deserializing needs to happen inside the catalog compiler so
-              # loaders are initialized for loading
-              plan_vars = Puppet::Pops::Serialization::FromDataConverter.convert(request['plan_vars'])
-
-              # Facts will be set by the catalog compiler, so we need to ensure
-              # that any plan or target variables with the same name are not
-              # passed into the apply block to avoid a redefinition error.
-              # Filter out plan and target vars separately and raise a Puppet
-              # warning if there are any collisions for either. Puppet warning
-              # is the only way to log a message that will make it back to Bolt
-              # to be printed.
-              pv_collisions, pv_filtered = plan_vars.partition do |k, _|
-                target['facts'].keys.include?(k)
-              end.map(&:to_h)
-              unless pv_collisions.empty?
-                print_pv = pv_collisions.keys.map { |k| "$#{k}" }.join(', ')
-                plural = pv_collisions.keys.length == 1 ? '' : 's'
-                Puppet.warning("Plan variable#{plural} #{print_pv} will be overridden by fact#{plural} " \
-                               "of the same name in the apply block")
-              end
-
-              tv_collisions, tv_filtered = target['variables'].partition do |k, _|
-                target['facts'].keys.include?(k)
-              end.map(&:to_h)
-              unless tv_collisions.empty?
-                print_tv = tv_collisions.keys.map { |k| "$#{k}" }.join(', ')
-                plural = tv_collisions.keys.length == 1 ? '' : 's'
-                Puppet.warning("Target variable#{plural} #{print_tv} " \
-                               "will be overridden by fact#{plural} of the same name in the apply block")
-              end
-
-              pal.send(:add_variables, compiler.send(:topscope), tv_filtered.merge(pv_filtered))
-
+              options = request['puppet_config'] || {}
               # Configure language strictness in the CatalogCompiler. We want Bolt to be able
               # to compile most Puppet 4+ manifests, so we default to allowing deprecated functions.
               Puppet[:strict] = options['strict'] || :warning
               Puppet[:strict_variables] = options['strict_variables'] || false
-              ast = Puppet::Pops::Serialization::FromDataConverter.convert(pal_main)
-              # This will be a Program when running via `bolt apply`, but will
-              # only be a subset of the AST when compiling an apply block in a
-              # plan. In that case, we need to discover the definitions (which
-              # would ordinarily be stored on the Program) and construct a Program object.
-              unless ast.is_a?(Puppet::Pops::Model::Program)
-                # Node definitions must be at the top level of the apply block.
-                # That means the apply body either a) consists of just a
-                # NodeDefinition, b) consists of a BlockExpression which may
-                # contain NodeDefinitions, or c) doesn't contain NodeDefinitions.
-                definitions = if ast.is_a?(Puppet::Pops::Model::BlockExpression)
-                                ast.statements.select { |st| st.is_a?(Puppet::Pops::Model::NodeDefinition) }
-                              elsif ast.is_a?(Puppet::Pops::Model::NodeDefinition)
-                                [ast]
-                              else
-                                []
-                              end
-                ast = Puppet::Pops::Model::Factory.PROGRAM(ast, definitions, ast.locator).model
-              end
+
+              pal_main = request['code_ast'] || request['code_string']
+              ast = build_program(pal_main)
               compiler.evaluate(ast)
-              compiler.instance_variable_get(:@internal_compiler).send(:evaluate_ast_node)
+              compiler.evaluate_ast_node
               compiler.compile_additions
               compiler.with_json_encoding(&:encode)
             end
@@ -138,5 +108,45 @@ module Bolt
         end
       end
     end
+
+    # Warn and remove variables that will be shadowed by facts of the same
+    # name, which are set in scope earlier.
+    def shadow_vars(type, vars, facts)
+      collisions, valid = vars.partition do |k, _|
+        facts.include?(k)
+      end
+      if collisions.any?
+        names = collisions.map { |k, _| "$#{k}" }.join(', ')
+        plural = collisions.length == 1 ? '' : 's'
+        Puppet.warning("#{type.capitalize} variable#{plural} #{names} will be overridden by fact#{plural} " \
+                       "of the same name in the apply block")
+      end
+      valid.to_h
+    end
+
+    def build_program(code)
+      ast = Puppet::Pops::Serialization::FromDataConverter.convert(code)
+
+      # This will be a Program when running via `bolt apply`, but will
+      # only be a subset of the AST when compiling an apply block in a
+      # plan. In that case, we need to discover the definitions (which
+      # would ordinarily be stored on the Program) and construct a Program object.
+      if ast.is_a?(Puppet::Pops::Model::Program)
+        ast
+      else
+        # Node definitions must be at the top level of the apply block.
+        # That means the apply body either a) consists of just a
+        # NodeDefinition, b) consists of a BlockExpression which may
+        # contain NodeDefinitions, or c) doesn't contain NodeDefinitions.
+        definitions = if ast.is_a?(Puppet::Pops::Model::BlockExpression)
+                        ast.statements.select { |st| st.is_a?(Puppet::Pops::Model::NodeDefinition) }
+                      elsif ast.is_a?(Puppet::Pops::Model::NodeDefinition)
+                        [ast]
+                      else
+                        []
+                      end
+        Puppet::Pops::Model::Factory.PROGRAM(ast, definitions, ast.locator).model
+      end
+    end
   end
 end

data/lib/bolt/cli.rb

@@ -115,7 +115,7 @@ module Bolt
                   Bolt::Config.from_file(options[:configfile], options)
                 else
                   project = if options[:boltdir]
-                              Bolt::Project.new(options[:boltdir])
+                              Bolt::Project.create_project(options[:boltdir])
                             else
                               Bolt::Project.find_boltdir(Dir.pwd)
                             end
@@ -392,7 +392,7 @@ module Bolt
         end
         code = apply_manifest(options[:code], options[:targets], options[:object], options[:noop])
       else
-        executor = Bolt::Executor.new(config.concurrency, analytics, options[:noop])
+        executor = Bolt::Executor.new(config.concurrency, analytics, options[:noop], config.modified_concurrency)
         targets = options[:targets]
 
         results = nil
@@ -512,7 +512,7 @@ module Bolt
                        params: plan_arguments }
       plan_context[:description] = options[:description] if options[:description]
 
-      executor = Bolt::Executor.new(config.concurrency, analytics, options[:noop])
+      executor = Bolt::Executor.new(config.concurrency, analytics, options[:noop], config.modified_concurrency)
       if options.fetch(:format, 'human') == 'human'
         executor.subscribe(outputter)
       else
@@ -548,7 +548,7 @@ module Bolt
         @logger.warn(message)
       end
 
-      executor = Bolt::Executor.new(config.concurrency, analytics, noop)
+      executor = Bolt::Executor.new(config.concurrency, analytics, noop, config.modified_concurrency)
       executor.subscribe(outputter) if options.fetch(:format, 'human') == 'human'
       executor.subscribe(log_outputter)
       # apply logging looks like plan logging, so tell the outputter we're in a
@@ -771,7 +771,7 @@ module Bolt
     end
 
     def pal
-      project = config.project.load_as_module? ? config.project : nil
+      project = config.project.project_file? ? config.project : nil
       @pal ||= Bolt::PAL.new(config.modulepath,
                              config.hiera_config,
                              config.project.resource_types,

data/lib/bolt/config.rb

@@ -23,7 +23,7 @@ module Bolt
   end
 
   class Config
-    attr_reader :config_files, :warnings, :data, :transports, :project
+    attr_reader :config_files, :warnings, :data, :transports, :project, :modified_concurrency
 
     TRANSPORT_CONFIG = {
       'ssh'    => Bolt::Config::Transport::SSH,
@@ -34,6 +34,13 @@ module Bolt
       'remote' => Bolt::Config::Transport::Remote
     }.freeze
 
+    TRANSPORT_OPTION = { 'transport' => 'The default transport to use when the '\
+                         'transport for a target is not specified in the URL.' }.freeze
+
+    DEFAULT_TRANSPORT_OPTION = { 'transport' => 'ssh' }.freeze
+
+    CONFIG_IN_INVENTORY = TRANSPORT_CONFIG.merge(TRANSPORT_OPTION)
+
     # NOTE: All configuration options should have a corresponding schema property
     #       in schemas/bolt-config.schema.json
     OPTIONS = {
@@ -55,8 +62,8 @@ module Bolt
       "save-rerun"               => "Whether to update `.rerun.json` in the Bolt project directory. If "\
                                     "your target names include passwords, set this value to `false` to avoid "\
                                     "writing passwords to disk.",
-      "transport"                => "The default transport to use when the transport for a target is not "\
-                                    "specified in the URL or inventory.",
+      "transport"                => "The default transport to use when the transport for a target is not specified "\
+                                    "in the URL or inventory.",
       "trusted-external-command" => "The path to an executable on the Bolt controller that can produce "\
                                     "external trusted facts. **External trusted facts are experimental in both "\
                                     "Puppet and Bolt and this API may change or be removed.**"
@@ -104,14 +111,17 @@ module Bolt
     DEFAULT_DEFAULT_CONCURRENCY = 100
 
     def self.default
-      new(Bolt::Project.new('.'), {})
+      new(Bolt::Project.create_project('.'), {})
     end
 
     def self.from_project(project, overrides = {})
-      data = {
-        filepath: project.config_file,
-        data: Bolt::Util.read_optional_yaml_hash(project.config_file, 'config')
-      }
+      conf = if project.project_file == project.config_file
+               project.data
+             else
+               Bolt::Util.read_optional_yaml_hash(project.config_file, 'config')
+             end
+
+      data = { filepath: project.config_file, data: conf }
 
       data = load_defaults(project).push(data).select { |config| config[:data]&.any? }
 
@@ -119,12 +129,13 @@ module Bolt
     end
 
     def self.from_file(configfile, overrides = {})
-      project = Bolt::Project.new(Pathname.new(configfile).expand_path.dirname)
-
-      data = {
-        filepath: project.config_file,
-        data: Bolt::Util.read_yaml_hash(configfile, 'config')
-      }
+      project = Bolt::Project.create_project(Pathname.new(configfile).expand_path.dirname)
+      conf = if project.project_file == project.config_file
+               project.data
+             else
+               Bolt::Util.read_yaml_hash(configfile, 'config')
+             end
+      data = { filepath: project.config_file, data: conf }
       data = load_defaults(project).push(data).select { |config| config[:data]&.any? }
 
       new(project, data, overrides)
@@ -158,8 +169,8 @@ module Bolt
       end
 
       @logger = Logging.logger[self]
-      @warnings = []
       @project = project
+      @warnings = @project.warnings.dup
       @transports = {}
       @config_files = []
 
@@ -187,15 +198,9 @@ module Bolt
 
       # If we need to lower concurrency and concurrency is not configured
       ld_concurrency = loaded_data.map(&:keys).flatten.include?('concurrency')
-      if default_concurrency != DEFAULT_DEFAULT_CONCURRENCY &&
-         !ld_concurrency &&
-         !override_data.key?('concurrency')
-        concurrency_warning = { option: 'concurrency',
-                                msg: "Concurrency will default to #{default_concurrency} because ulimit "\
-                                "is low: #{Etc.sysconf(Etc::SC_OPEN_MAX)}. Set concurrency with "\
-                                "'--concurrency', or set your ulimit with 'ulimit -n <limit>'" }
-        @warnings << concurrency_warning
-      end
+      @modified_concurrency = default_concurrency != DEFAULT_DEFAULT_CONCURRENCY &&
+                              !ld_concurrency &&
+                              !override_data.key?('concurrency')
 
       @data = merge_config_layers(default_data, *loaded_data, override_data)
 
@@ -483,7 +488,7 @@ module Bolt
       @default_concurrency ||= if !sc_open_max_available? || Etc.sysconf(Etc::SC_OPEN_MAX) >= 300
                                  DEFAULT_DEFAULT_CONCURRENCY
                                else
-                                 Etc.sysconf(Etc::SC_OPEN_MAX) / 3
+                                 Etc.sysconf(Etc::SC_OPEN_MAX) / 7
                                end
     end
   end

data/lib/bolt/config/transport/ssh.rb

@@ -12,94 +12,132 @@ module Bolt
         # NOTE: All transport configuration options should have a corresponding schema definition
         #       in schemas/bolt-transport-definitions.json
         OPTIONS = {
-          "cleanup"            => { type: TrueClass,
-                                    external: true,
-                                    desc: "Whether to clean up temporary files created on targets." },
-          "connect-timeout"    => { type: Integer,
-                                    desc: "How long to wait when establishing connections." },
-          "copy-command"       => { external: true,
-                                    desc: "Command to use when copying files using ssh-command. "\
-                                          "Bolt runs `<copy-command> <src> <dest>`. **This option is experimental.**" },
-          "disconnect-timeout" => { type: Integer,
-                                    desc: "How long to wait before force-closing a connection." },
-          "host"               => { type: String,
-                                    external: true,
-                                    desc: "Host name." },
-          "host-key-check"     => { type: TrueClass,
-                                    external: true,
-                                    desc: "Whether to perform host key validation when connecting." },
-          "extensions"         => { type: Array,
-                                    desc: "List of file extensions that are accepted for scripts or tasks on Windows. "\
-                                         "Scripts with these file extensions rely on the target's file type "\
-                                         "association to run. For example, if Python is installed on the system, "\
-                                         "a `.py` script runs with `python.exe`. The extensions `.ps1`, `.rb`, and "\
-                                         "`.pp` are always allowed and run via hard-coded executables." },
-          "interpreters"       => { type: Hash,
-                                    external: true,
-                                    desc: "A map of an extension name to the absolute path of an executable, "\
-                                          "enabling you to override the shebang defined in a task executable. The "\
-                                          "extension can optionally be specified with the `.` character (`.py` and "\
-                                          "`py` both map to a task executable `task.py`) and the extension is case "\
-                                          "sensitive. When a target's name is `localhost`, Ruby tasks run with the "\
-                                          "Bolt Ruby interpreter by default." },
-          "load-config"        => { type: TrueClass,
-                                    desc: "Whether to load system SSH configuration." },
-          "login-shell"        => { type: String,
-                                    desc: "Which login shell Bolt should expect on the target. "\
-                                          "Supported shells are #{LOGIN_SHELLS.join(', ')}. "\
-                                          "**This option is experimental.**" },
-          "password"           => { type: String,
-                                    desc: "Login password." },
-          "port"               => { type: Integer,
-                                    external: true,
-                                    desc: "Connection port." },
-          "private-key"        => { external: true,
-                                    desc: "Either the path to the private key file to use for authentication, or a "\
-                                          "hash with the key `key-data` and the contents of the private key." },
-          "proxyjump"          => { type: String,
-                                    desc: "A jump host to proxy connections through, and an optional user to "\
-                                          "connect with." },
-          "run-as"             => { type: String,
-                                    external: true,
-                                    desc: "A different user to run commands as after login." },
-          "run-as-command"     => { type: Array,
-                                    external: true,
-                                    desc: "The command to elevate permissions. Bolt appends the user and command "\
-                                          "strings to the configured `run-as-command` before running it on the "\
-                                          "target. This command must not require an interactive password prompt, "\
-                                          "and the `sudo-password` option is ignored when `run-as-command` is "\
-                                          "specified. The `run-as-command` must be specified as an array." },
-          "script-dir"         => { type: String,
-                                    external: true,
-                                    desc: "The subdirectory of the tmpdir to use in place of a randomized "\
-                                          "subdirectory for uploading and executing temporary files on the "\
-                                          "target. It's expected that this directory already exists as a subdir "\
-                                          "of tmpdir, which is either configured or defaults to `/tmp`." },
-          "ssh-command"        => { external: true,
-                                    desc: "Command and flags to use when SSHing. This enables the external "\
-                                          "SSH transport which shells out to the specified command. "\
-                                          "**This option is experimental.**" },
-          "sudo-executable"    => { type: String,
-                                    external: true,
-                                    desc: "The executable to use when escalating to the configured `run-as` "\
-                                          "user. This is useful when you want to escalate using the configured "\
-                                          "`sudo-password`, since `run-as-command` does not use `sudo-password` "\
-                                          "or support prompting. The command executed on the target is "\
-                                          "`<sudo-executable> -S -u <user> -p custom_bolt_prompt <command>`. "\
-                                          "**This option is experimental.**" },
-          "sudo-password"      => { type: String,
-                                    external: true,
-                                    desc: "Password to use when changing users via `run-as`." },
-          "tmpdir"             => { type: String,
-                                    external: true,
-                                    desc: "The directory to upload and execute temporary files on the target." },
-          "tty"                => { type: TrueClass,
-                                    desc: "Request a pseudo tty for the session. This option is generally "\
-                                          "only used in conjunction with the `run-as` option when the sudoers "\
-                                          "policy requires a `tty`." },
-          "user"               => { type: String,
-                                    external: true,
-                                    desc: "Login user." }
+          "cleanup"               => { type: TrueClass,
+                                       external: true,
+                                       desc: "Whether to clean up temporary files created on targets." },
+          "connect-timeout"       => { type: Integer,
+                                       desc: "How long to wait when establishing connections." },
+          "copy-command"          => { external: true,
+                                       desc: "Command to use when copying files using ssh-command. "\
+                                             "Bolt runs `<copy-command> <src> <dest>`. **This option is "\
+                                             "experimental.**" },
+          "disconnect-timeout"    => { type: Integer,
+                                       desc: "How long to wait before force-closing a connection." },
+          "encryption-algorithms" => { type: Array,
+                                       desc: "List of encryption algorithms to use when establishing a "\
+                                             "connection with a target. Supported algorithms are "\
+                                             "defined by the Ruby net-ssh library and can be viewed "\
+                                             "[here](https://github.com/net-ssh/net-ssh#supported-algorithms). "\
+                                             "All supported, non-deprecated algorithms are available by default when "\
+                                             "this option is not used. To reference all default algorithms "\
+                                             "when using this option, add 'defaults' to the list of supported "\
+                                             "algorithms." },
+          "extensions"            => { type: Array,
+                                       desc: "List of file extensions that are accepted for scripts or tasks on "\
+                                             "Windows. Scripts with these file extensions rely on the target's file "\
+                                             "type association to run. For example, if Python is installed on the "\
+                                             "system, a `.py` script runs with `python.exe`. The extensions `.ps1`, "\
+                                             "`.rb`, and `.pp` are always allowed and run via hard-coded "\
+                                             "executables." },
+          "host"                  => { type: String,
+                                       external: true,
+                                       desc: "Host name." },
+          "host-key-algorithms"   => { type: Array,
+                                       desc: "List of host key algorithms to use when establishing a connection "\
+                                             "with a target. Supported algorithms are defined by the Ruby net-ssh "\
+                                             "library "\
+                                             "([docs](https://github.com/net-ssh/net-ssh#supported-algorithms)). "\
+                                             "All supported, non-deprecated algorithms are available by default when "\
+                                             "this option is not used. To reference all default algorithms "\
+                                             "using this option, add 'defaults' to the list of supported "\
+                                             "algorithms." },
+          "host-key-check"        => { type: TrueClass,
+                                       external: true,
+                                       desc: "Whether to perform host key validation when connecting." },
+          "interpreters"          => { type: Hash,
+                                       external: true,
+                                       desc: "A map of an extension name to the absolute path of an executable, "\
+                                             "enabling you to override the shebang defined in a task executable. "\
+                                             "The extension can optionally be specified with the `.` character "\
+                                             "(`.py` and `py` both map to a task executable `task.py`) and the "\
+                                             "extension is case sensitive. When a target's name is `localhost`, "\
+                                             "Ruby tasks run with the Bolt Ruby interpreter by default." },
+          "kex-algorithms"        => { type: Array,
+                                       desc: "List of key exchange algorithms to use when establishing a "\
+                                             "connection to a target. Supported algorithms are defined by the "\
+                                             "Ruby net-ssh library "\
+                                             "([docs](https://github.com/net-ssh/net-ssh#supported-algorithms)). "\
+                                             "All supported, non-deprecated algorithms are available by default when "\
+                                             "this option is not used. To reference all default algorithms "\
+                                             "using this option, add 'defaults' to the list of supported "\
+                                             "algorithms." },
+          "load-config"           => { type: TrueClass,
+                                       desc: "Whether to load system SSH configuration." },
+          "login-shell"           => { type: String,
+                                       desc: "Which login shell Bolt should expect on the target. "\
+                                             "Supported shells are #{LOGIN_SHELLS.join(', ')}. "\
+                                             "**This option is experimental.**" },
+          "mac-algorithms"        => { type: Array,
+                                       desc: "List of message authentication code algorithms to use when "\
+                                             "establishing a connection to a target. Supported algorithms are "\
+                                             "defined by the Ruby net-ssh library "\
+                                             "([docs](https://github.com/net-ssh/net-ssh#supported-algorithms)). "\
+                                             "All supported, non-deprecated algorithms are available by default when "\
+                                             "this option is not used. To reference all default algorithms "\
+                                             "using this option, add 'defaults' to the list of supported "\
+                                             "algorithms." },
+          "password"              => { type: String,
+                                       desc: "Login password." },
+          "port"                  => { type: Integer,
+                                       external: true,
+                                       desc: "Connection port." },
+          "private-key"           => { external: true,
+                                       desc: "Either the path to the private key file to use for authentication, or "\
+                                             "a hash with the key `key-data` and the contents of the private key." },
+          "proxyjump"             => { type: String,
+                                       desc: "A jump host to proxy connections through, and an optional user to "\
+                                             "connect with." },
+          "run-as"                => { type: String,
+                                       external: true,
+                                       desc: "A different user to run commands as after login." },
+          "run-as-command"        => { type: Array,
+                                       external: true,
+                                       desc: "The command to elevate permissions. Bolt appends the user and command "\
+                                             "strings to the configured `run-as-command` before running it on the "\
+                                             "target. This command must not require an interactive password prompt, "\
+                                             "and the `sudo-password` option is ignored when `run-as-command` is "\
+                                             "specified. The `run-as-command` must be specified as an array." },
+          "script-dir"            => { type: String,
+                                       external: true,
+                                       desc: "The subdirectory of the tmpdir to use in place of a randomized "\
+                                             "subdirectory for uploading and executing temporary files on the "\
+                                             "target. It's expected that this directory already exists as a subdir "\
+                                             "of tmpdir, which is either configured or defaults to `/tmp`." },
+          "ssh-command"           => { external: true,
+                                       desc: "Command and flags to use when SSHing. This enables the external "\
+                                             "SSH transport which shells out to the specified command. "\
+                                             "**This option is experimental.**" },
+          "sudo-executable"       => { type: String,
+                                       external: true,
+                                       desc: "The executable to use when escalating to the configured `run-as` "\
+                                             "user. This is useful when you want to escalate using the configured "\
+                                             "`sudo-password`, since `run-as-command` does not use `sudo-password` "\
+                                             "or support prompting. The command executed on the target is "\
+                                             "`<sudo-executable> -S -u <user> -p custom_bolt_prompt <command>`. "\
+                                             "**This option is experimental.**" },
+          "sudo-password"         => { type: String,
+                                       external: true,
+                                       desc: "Password to use when changing users via `run-as`." },
+          "tmpdir"                => { type: String,
+                                       external: true,
+                                       desc: "The directory to upload and execute temporary files on the target." },
+          "tty"                   => { type: TrueClass,
+                                       desc: "Request a pseudo tty for the session. This option is generally "\
+                                             "only used in conjunction with the `run-as` option when the sudoers "\
+                                             "policy requires a `tty`." },
+          "user"                  => { type: String,
+                                       external: true,
+                                       desc: "Login user." }
         }.freeze
 
         DEFAULTS = {
@@ -142,10 +180,11 @@ module Bolt
                   "Unsupported login-shell #{@config['login-shell']}. Supported shells are #{LOGIN_SHELLS.join(', ')}"
           end
 
-          if (run_as_cmd = @config['run-as-command'])
-            unless run_as_cmd.all? { |n| n.is_a?(String) }
+          %w[encryption-algorithms host-key-algorithms kex-algorithms mac-algorithms run-as-command].each do |opt|
+            next unless @config.key?(opt)
+            unless @config[opt].all? { |n| n.is_a?(String) }
               raise Bolt::ValidationError,
-                    "run-as-command must be an Array of Strings, received #{run_as_cmd.class} #{run_as_cmd.inspect}"
+                    "#{opt} must be an Array of Strings, received #{@config[opt].inspect}"
             end
           end
 

data/lib/bolt/executor.rb

@@ -34,7 +34,8 @@ module Bolt
 
     def initialize(concurrency = 1,
                    analytics = Bolt::Analytics::NoopClient.new,
-                   noop = false)
+                   noop = false,
+                   modified_concurrency = false)
       # lazy-load expensive gem code
       require 'concurrent'
 
@@ -64,6 +65,9 @@ module Bolt
                 Concurrent.global_immediate_executor
               end
       @logger.debug { "Started with #{concurrency} max thread(s)" }
+
+      @concurrency = concurrency
+      @warn_concurrency = modified_concurrency
     end
 
     def transport(transport)
@@ -102,6 +106,15 @@ module Bolt
     # defined by the transport. Yields each batch, along with the corresponding
     # transport, to the block in turn and returns an array of result promises.
     def queue_execute(targets)
+      if @warn_concurrency && targets.length > @concurrency
+        @warn_concurrency = false
+        @logger.warn("The ulimit is low, which may cause file limit issues. Default concurrency has been set to "\
+                     "'#{@concurrency}' to mitigate those issues, which may cause Bolt to run slow. "\
+                     "Disable this warning by configuring ulimit using 'ulimit -n <limit>' in your shell "\
+                     "configuration, or by configuring Bolt's concurrency. "\
+                     "See https://puppet.com/docs/bolt/latest/bolt_known_issues.html for details.")
+      end
+
       targets.group_by(&:transport).flat_map do |protocol, protocol_targets|
         transport = transport(protocol)
         report_transport(transport, protocol_targets.count)

data/lib/bolt/inventory/group.rb

@@ -16,7 +16,7 @@ module Bolt
       DATA_KEYS = %w[config facts vars features plugin_hooks].freeze
       TARGET_KEYS = DATA_KEYS + %w[name alias uri]
       GROUP_KEYS = DATA_KEYS + %w[name groups targets]
-      CONFIG_KEYS = Bolt::Config::TRANSPORT_CONFIG.keys + ['transport']
+      CONFIG_KEYS = Bolt::Config::CONFIG_IN_INVENTORY.keys
 
       def initialize(input, plugins)
         @logger = Logging.logger[self]

data/lib/bolt/inventory/inventory.rb

@@ -323,6 +323,10 @@ module Bolt
       def resources(target)
         @targets[target.name].resources
       end
+
+      def resource(target, type, title)
+        @targets[target.name].resource(type, title)
+      end
     end
   end
 end

data/lib/bolt/inventory/target.rb

@@ -90,6 +90,10 @@ module Bolt
         end
       end
 
+      def resource(type, title)
+        resources[Bolt::ResourceInstance.format_reference(type, title)]
+      end
+
       def plugin_hooks
         # Merge plugin_hooks from the config file with any defined by the group
         # or assigned dynamically to the target

data/lib/bolt/project.rb

@@ -12,14 +12,14 @@ module Bolt
       "tasks" => "An array of task names to whitelist. Whitelisted plans are included in `bolt task show` output"
     }.freeze
 
-    attr_reader :path, :config_file, :inventory_file, :modulepath, :hiera_config,
-                :puppetfile, :rerunfile, :type, :resource_types
+    attr_reader :path, :data, :config_file, :inventory_file, :modulepath, :hiera_config,
+                :puppetfile, :rerunfile, :type, :resource_types, :warnings, :project_file
 
     def self.default_project
-      Project.new(File.expand_path(File.join('~', '.puppetlabs', 'bolt')), 'user')
+      create_project(File.expand_path(File.join('~', '.puppetlabs', 'bolt')), 'user')
     # If homedir isn't defined use the system config path
     rescue ArgumentError
-      Project.new(system_path, 'system')
+      create_project(system_path, 'system')
     end
 
     def self.system_path
@@ -37,9 +37,9 @@ module Bolt
     def self.find_boltdir(dir)
       dir = Pathname.new(dir)
       if (dir + BOLTDIR_NAME).directory?
-        new(dir + BOLTDIR_NAME, 'embedded')
+        create_project(dir + BOLTDIR_NAME, 'embedded')
       elsif (dir + 'bolt.yaml').file? || (dir + 'bolt-project.yaml').file?
-        new(dir, 'local')
+        create_project(dir, 'local')
       elsif dir.root?
         default_project
       else
@@ -47,9 +47,25 @@ module Bolt
       end
     end
 
-    def initialize(path, type = 'option')
+    def self.create_project(path, type = 'option')
+      fullpath = Pathname.new(path).expand_path
+      project_file = File.join(fullpath, 'bolt-project.yaml')
+      data = Bolt::Util.read_optional_yaml_hash(File.expand_path(project_file), 'project')
+      new(data, path, type)
+    end
+
+    def initialize(raw_data, path, type = 'option')
       @path = Pathname.new(path).expand_path
-      @config_file = @path + 'bolt.yaml'
+      @project_file = @path + 'bolt-project.yaml'
+
+      @warnings = []
+      if (@path + 'bolt.yaml').file? && project_file?
+        msg = "Project-level configuration in bolt.yaml is deprecated if using bolt-project.yaml. "\
+          "Transport config should be set in inventory.yaml, all other config should be set in "\
+          "bolt-project.yaml."
+        @warnings << { msg: msg }
+      end
+
       @inventory_file = @path + 'inventory.yaml'
       @modulepath = [(@path + 'modules').to_s, (@path + 'site-modules').to_s, (@path + 'site').to_s]
       @hiera_config = @path + 'hiera.yaml'
@@ -58,9 +74,26 @@ module Bolt
       @resource_types = @path + '.resource_types'
       @type = type
 
-      @project_file = @path + 'bolt-project.yaml'
-      @data = Bolt::Util.read_optional_yaml_hash(File.expand_path(@project_file), 'project') || {}
-      validate if load_as_module?
+      tc = Bolt::Config::CONFIG_IN_INVENTORY.keys & raw_data.keys
+      if tc.any?
+        msg = "Transport configuration isn't supported in bolt-project.yaml. Ignoring keys #{tc}"
+        @warnings << { msg: msg }
+      end
+
+      @data = raw_data.reject { |k, _| Bolt::Config::CONFIG_IN_INVENTORY.keys.include?(k) }
+
+      # Once bolt.yaml deprecation is removed, this attribute should be removed
+      # and replaced with .project_file in lib/bolt/config.rb
+      @config_file = if (Bolt::Config::OPTIONS.keys & @data.keys).any?
+                       if (@path + 'bolt.yaml').file?
+                         msg = "bolt-project.yaml contains valid config keys, bolt.yaml will be ignored"
+                         @warnings << { msg: msg }
+                       end
+                       @project_file
+                     else
+                       @path + 'bolt.yaml'
+                     end
+      validate if project_file?
     end
 
     def to_s
@@ -78,7 +111,7 @@ module Bolt
     end
     alias == eql?
 
-    def load_as_module?
+    def project_file?
       @project_file.file?
     end
 

data/lib/bolt/resource_instance.rb

@@ -83,8 +83,12 @@ module Bolt
       to_hash.to_json(opts)
     end
 
+    def self.format_reference(type, title)
+      "#{type.capitalize}[#{title}]"
+    end
+
     def reference
-      "#{type}[#{title}]"
+      self.class.format_reference(@type, @title)
     end
     alias to_s reference
 

data/lib/bolt/shell/powershell/snippets.rb

@@ -20,6 +20,14 @@ module Bolt
             PS
           end
 
+          def exit_with_code(command)
+            <<~PS
+            #{command}
+            if (-not $? -and ($LASTEXITCODE -eq $null)) { exit 1 }
+            exit $LASTEXITCODE
+            PS
+          end
+
           def make_tmpdir(parent)
             <<~PS
             $parent = #{parent}

data/lib/bolt/transport/local/connection.rb

@@ -50,7 +50,8 @@ module Bolt
             # If it's already a powershell command then invoke it normally.
             # Otherwise, wrap it in powershell.exe.
             unless command.start_with?('powershell.exe')
-              command = ['powershell.exe', *Bolt::Shell::Powershell::PS_ARGS, '-Command', command]
+              cmd = Bolt::Shell::Powershell::Snippets.exit_with_code(command)
+              command = ['powershell.exe', *Bolt::Shell::Powershell::PS_ARGS, '-Command', cmd]
             end
           end
 

data/lib/bolt/transport/ssh/connection.rb

@@ -78,6 +78,28 @@ module Bolt
 
           options[:proxy] = Net::SSH::Proxy::Jump.new(target.options['proxyjump']) if target.options['proxyjump']
 
+          # Override the default supported algorithms for net-ssh. By default, a subset of supported algorithms
+          # are enabled in 6.x, while several are deprecated and not enabled by default. The *-algorithms
+          # options can be used to specify a list of algorithms to enable in net-ssh. Any algorithms not in the
+          # list are disabled, including ones that are normally enabled by default. Support for deprecated
+          # algorithms will be removed in 7.x.
+          # https://github.com/net-ssh/net-ssh#supported-algorithms
+          if target.options['encryption-algorithms']
+            options[:encryption] = net_ssh_algorithms(:encryption, target.options['encryption-algorithms'])
+          end
+
+          if target.options['host-key-algorithms']
+            options[:host_key] = net_ssh_algorithms(:host_key, target.options['host-key-algorithms'])
+          end
+
+          if target.options['kex-algorithms']
+            options[:kex] = net_ssh_algorithms(:kex, target.options['kex-algorithms'])
+          end
+
+          if target.options['mac-algorithms']
+            options[:hmac] = net_ssh_algorithms(:hmac, target.options['mac-algorithms'])
+          end
+
           # This option was to address discrepency betwen net-ssh host-key-check and ssh(1)
           # For the net-ssh 5.x series it defaults to true, in 6.x it will default to false, and will be removed in 7.x
           # https://github.com/net-ssh/net-ssh/pull/663#issuecomment-469979931
@@ -246,6 +268,19 @@ module Bolt
           end
         end
 
+        # Add all default algorithms if the 'defaults' key is present and filter
+        # out any unsupported algorithms.
+        def net_ssh_algorithms(type, algorithms)
+          if algorithms.include?('defaults')
+            defaults = Net::SSH::Transport::Algorithms::DEFAULT_ALGORITHMS[type]
+            algorithms += defaults
+          end
+
+          known = Net::SSH::Transport::Algorithms::ALGORITHMS[type]
+
+          algorithms & known
+        end
+
         def shell
           @shell ||= if target.options['login-shell'] == 'powershell'
                        Bolt::Shell::Powershell.new(target, self)

data/lib/bolt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bolt
-  VERSION = '2.13.0'
+  VERSION = '2.14.0'
 end

data/lib/bolt_spec/bolt_context.rb

@@ -138,7 +138,7 @@ module BoltSpec
     # Override in your tests
     def config
       @config ||= begin
-                    conf = Bolt::Config.new(Bolt::Project.new('.'), {})
+                    conf = Bolt::Config.default
                     conf.modulepath = [modulepath].flatten
                     conf
                   end

data/lib/bolt_spec/run.rb

@@ -144,7 +144,7 @@ module BoltSpec
       end
 
       def config
-        @config ||= Bolt::Config.new(Bolt::Project.new(@project_path), @config_data)
+        @config ||= Bolt::Config.new(Bolt::Project.create_project(@project_path), @config_data)
       end
 
       def inventory

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bolt
 version: !ruby/object:Gem::Version
-  version: 2.13.0
+  version: 2.14.0
 platform: ruby
 authors:
 - Puppet
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-06-08 00:00:00.000000000 Z
+date: 2020-06-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -184,7 +184,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.15.0
+        version: 6.16.0
     - - "<"
       - !ruby/object:Gem::Version
         version: '7'
@@ -194,7 +194,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.15.0
+        version: 6.16.0
     - - "<"
       - !ruby/object:Gem::Version
         version: '7'
@@ -407,6 +407,7 @@ files:
 - bolt-modules/boltlib/lib/puppet/functions/puppetdb_query.rb
 - bolt-modules/boltlib/lib/puppet/functions/remove_from_group.rb
 - bolt-modules/boltlib/lib/puppet/functions/resolve_references.rb
+- bolt-modules/boltlib/lib/puppet/functions/resource.rb
 - bolt-modules/boltlib/lib/puppet/functions/run_command.rb
 - bolt-modules/boltlib/lib/puppet/functions/run_plan.rb
 - bolt-modules/boltlib/lib/puppet/functions/run_script.rb
@@ -588,7 +589,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
+rubygems_version: 3.0.8
 signing_key: 
 specification_version: 4
 summary: Execute commands remotely over SSH and WinRM