chef 14.2.0 → 14.3.37

data/lib/chef/resource/rhsm_register.rb

@@ -36,10 +36,10 @@ class Chef
                description: "The FQDN of the Satellite host to register with. If not specified, the host will be registered with Red Hat's public RHSM service."
 
       property :organization, String,
-               description: "The organization to use when registering, required when using an activation key"
+               description: "The organization to use when registering, required when using an activation key."
 
       property :environment, String,
-               description: "The environment to use when registering, required when using username and password"
+               description: "The environment to use when registering, required when using username and password."
 
       property :username, String,
                description: "The username to use when registering. Not applicable if using an activation key. If specified, password and environment are also required."
@@ -61,7 +61,7 @@ class Chef
                default: false, desired_state: false
 
       action :register do
-        description "Register the node with RHSM"
+        description "Register the node with RHSM."
 
         package "subscription-manager"
 
@@ -98,7 +98,7 @@ class Chef
       end
 
       action :unregister do
-        description "Unregister the node from RHSM"
+        description "Unregister the node from RHSM."
 
         execute "Unregister from RHSM" do
           command "subscription-manager unregister"

data/lib/chef/resource/rhsm_repo.rb

@@ -32,7 +32,7 @@ class Chef
                name_property: true
 
       action :enable do
-        description "Enable a RHSM repository"
+        description "Enable a RHSM repository."
 
         execute "Enable repository #{new_resource.repo_name}" do
           command "subscription-manager repos --enable=#{new_resource.repo_name}"
@@ -42,7 +42,7 @@ class Chef
       end
 
       action :disable do
-        description "Disable a RHSM repository"
+        description "Disable a RHSM repository."
 
         execute "Enable repository #{new_resource.repo_name}" do
           command "subscription-manager repos --disable=#{new_resource.repo_name}"

data/lib/chef/resource/rhsm_subscription.rb

@@ -33,7 +33,7 @@ class Chef
                name_property: true
 
       action :attach do
-        description "Attach the node to a subscription pool"
+        description "Attach the node to a subscription pool."
 
         execute "Attach subscription pool #{new_resource.pool_id}" do
           command "subscription-manager attach --pool=#{new_resource.pool_id}"
@@ -43,7 +43,7 @@ class Chef
       end
 
       action :remove do
-        description "Remove the node from a subscription pool"
+        description "Remove the node from a subscription pool."
 
         execute "Remove subscription pool #{new_resource.pool_id}" do
           command "subscription-manager remove --serial=#{pool_serial(new_resource.pool_id)}"

data/lib/chef/resource/script.rb

@@ -40,7 +40,7 @@ class Chef
       # FIXME: remove this and use an execute sub-resource instead of inheriting from Execute
       def command(arg = nil)
         unless arg.nil?
-          raise Chef::Exceptions::Script, "Do not use the command attribute on a #{resource_name} resource, use the 'code' attribute instead."
+          raise Chef::Exceptions::Script, "Do not use the command property on a #{resource_name} resource, use the 'code' property instead."
         end
         super
       end

data/lib/chef/resource/service.rb

@@ -62,7 +62,7 @@ class Chef
         set_or_return(
           :service_name,
           arg,
-          :kind_of => [ String ]
+          kind_of: [ String ]
         )
       end
 
@@ -71,7 +71,7 @@ class Chef
         set_or_return(
           :pattern,
           arg,
-          :kind_of => [ String ]
+          kind_of: [ String ]
         )
       end
 
@@ -80,7 +80,7 @@ class Chef
         set_or_return(
           :start_command,
           arg,
-          :kind_of => [ String, NilClass, FalseClass ]
+          kind_of: [ String, NilClass, FalseClass ]
         )
       end
 
@@ -89,7 +89,7 @@ class Chef
         set_or_return(
           :stop_command,
           arg,
-          :kind_of => [ String, NilClass, FalseClass ]
+          kind_of: [ String, NilClass, FalseClass ]
         )
       end
 
@@ -98,7 +98,7 @@ class Chef
         set_or_return(
           :status_command,
           arg,
-          :kind_of => [ String, NilClass, FalseClass ]
+          kind_of: [ String, NilClass, FalseClass ]
         )
       end
 
@@ -107,7 +107,7 @@ class Chef
         set_or_return(
           :restart_command,
           arg,
-          :kind_of => [ String, NilClass, FalseClass ]
+          kind_of: [ String, NilClass, FalseClass ]
         )
       end
 
@@ -115,7 +115,7 @@ class Chef
         set_or_return(
           :reload_command,
           arg,
-          :kind_of => [ String, NilClass, FalseClass ]
+          kind_of: [ String, NilClass, FalseClass ]
         )
       end
 
@@ -123,12 +123,12 @@ class Chef
       # distributions this is '/etc/init.d/SERVICE_NAME' by default. In
       # non-standard configurations setting this value will save having to
       # specify overrides for the start_command, stop_command and
-      # restart_command attributes.
+      # restart_command properties.
       def init_command(arg = nil)
         set_or_return(
           :init_command,
           arg,
-          :kind_of => [ String ]
+          kind_of: [ String ]
         )
       end
 
@@ -137,7 +137,7 @@ class Chef
         set_or_return(
           :enabled,
           arg,
-          :kind_of => [ TrueClass, FalseClass ]
+          kind_of: [ TrueClass, FalseClass ]
         )
       end
 
@@ -146,7 +146,7 @@ class Chef
         set_or_return(
           :running,
           arg,
-          :kind_of => [ TrueClass, FalseClass ]
+          kind_of: [ TrueClass, FalseClass ]
         )
       end
 
@@ -155,7 +155,7 @@ class Chef
         set_or_return(
           :masked,
           arg,
-          :kind_of => [ TrueClass, FalseClass ]
+          kind_of: [ TrueClass, FalseClass ]
         )
       end
 
@@ -163,7 +163,7 @@ class Chef
         set_or_return(
           :options,
           arg.respond_to?(:split) ? arg.shellsplit : arg,
-          :kind_of => [ Array, String ]
+          kind_of: [ Array, String ]
         )
       end
 
@@ -181,7 +181,7 @@ class Chef
         set_or_return(
           :priority,
           arg,
-          :kind_of => [ Integer, String, Hash ]
+          kind_of: [ Integer, String, Hash ]
         )
       end
 
@@ -190,7 +190,7 @@ class Chef
         set_or_return(
           :timeout,
           arg,
-          :kind_of => Integer
+          kind_of: Integer
         )
       end
 
@@ -198,7 +198,7 @@ class Chef
         set_or_return(
           :parameters,
           arg,
-          :kind_of => [ Hash ]
+          kind_of: [ Hash ]
         )
       end
 
@@ -206,14 +206,14 @@ class Chef
         set_or_return(
           :run_levels,
           arg,
-          :kind_of => [ Array ] )
+          kind_of: [ Array ] )
       end
 
       def user(arg = nil)
         set_or_return(
           :user,
           arg,
-          :kind_of => [ String ]
+          kind_of: [ String ]
         )
       end
     end

data/lib/chef/resource/ssh_known_hosts_entry.rb

@@ -0,0 +1,146 @@
+#
+# Author:: Seth Vargo (<sethvargo@gmail.com>)
+#
+# Copyright:: 2013-2018, Seth Vargo
+# Copyright:: 2017-2018, Chef Software, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require "chef/resource"
+
+class Chef
+  class Resource
+    class SshKnownHostsEntry < Chef::Resource
+      preview_resource true
+      resource_name :ssh_known_hosts_entry
+
+      description "Use the ssh_known_hosts_entry resource to add an entry for the specified host in /etc/ssh/ssh_known_hosts or a user's known hosts file if specified."
+      introduced "14.3"
+
+      property :host, String,
+               description: "The host to add to the known hosts file.",
+               name_property: true
+
+      property :key, String,
+               description: "An optional key for the host. If not provided this will be automatically determined."
+
+      property :key_type, String,
+               description: "The type of key to store.",
+               default: "rsa"
+
+      property :port, Integer,
+               description: "The server port that the ssh-keyscan command will use to gather the public key.",
+               default: 22
+
+      property :timeout, Integer,
+               description: "The timeout in seconds for ssh-keyscan.",
+               default: 30
+
+      property :mode, String,
+               description: "The file mode for the ssh_known_hosts file.",
+               default: "0644"
+
+      property :owner, String,
+               description: "The file owner for the ssh_known_hosts file.",
+               default: "root"
+
+      property :group, String,
+               description: "The file group for the ssh_known_hosts file.",
+               default: lazy { node["root_group"] }
+
+      property :hash_entries, [TrueClass, FalseClass],
+               description: "Hash the hostname and addresses in the ssh_known_hosts file for privacy.",
+               default: false
+
+      property :file_location, String,
+               description: "The location of the ssh known hosts file. Change this to set a known host file for a particular user.",
+               default: "/etc/ssh/ssh_known_hosts"
+
+      action :create do
+        description "Create an entry in the ssh_known_hosts file."
+
+        key =
+          if new_resource.key
+            hoststr = (new_resource.port != 22) ? "[#{new_resource.host}]:#{new_resource.port}" : new_resource.host
+            "#{hoststr} #{type_string(new_resource.key_type)} #{new_resource.key}"
+          else
+            keyscan_cmd = ["ssh-keyscan", "-t#{new_resource.key_type}", "-p #{new_resource.port}"]
+            keyscan_cmd << "-H" if new_resource.hash_entries
+            keyscan_cmd << new_resource.host
+            keyscan = shell_out!(keyscan_cmd.join(" "), timeout: new_resource.timeout)
+            keyscan.stdout
+          end
+
+        key.sub!(/^#{new_resource.host}/, "[#{new_resource.host}]:#{new_resource.port}") if new_resource.port != 22
+
+        comment = key.split("\n").first || ""
+
+        r = with_run_context :root do
+          find_resource(:template, "update ssh known hosts file #{new_resource.file_location}") do
+            source ::File.expand_path("../support/ssh_known_hosts.erb", __FILE__)
+            local true
+            path new_resource.file_location
+            owner new_resource.owner
+            group new_resource.group
+            mode new_resource.mode
+            action :nothing
+            delayed_action :create
+            backup false
+            variables(entries: [])
+          end
+        end
+
+        keys = r.variables[:entries].reject(&:empty?)
+
+        if key_exists?(keys, key, comment)
+          Chef::Log.debug "Known hosts key for #{new_resource.name} already exists - skipping"
+        else
+          r.variables[:entries].push(key)
+        end
+      end
+
+      # all this does is send an immediate run_action(:create) to the template resource
+      action :flush do
+        description "Immediately flush the entries to the config file. Without this the actual writing of the file is delayed in the Chef run so all entries can be accumulated before writing the file out."
+
+        with_run_context :root do
+          # if you haven't ever called ssh_known_hosts_entry before you're definitely doing it wrong so we blow up hard.
+          find_resource!(:template, "update ssh known hosts file #{new_resource.file_location}").run_action(:create)
+          # it is the user's responsibility to only call this *after* all the ssh_known_hosts_entry resources have been called.
+          # if you call this too early in your run_list you will get a partial known_host file written to disk, and the resource
+          # behavior will not be idempotent (template resources will flap and never show 0 resources updated on converged boxes).
+          Chef::Log.warn "flushed ssh_known_hosts entries to file, later ssh_known_hosts_entry resources will not have been written"
+        end
+      end
+
+      action_class do
+        def key_exists?(keys, key, comment)
+          keys.any? do |line|
+            line.match(/#{Regexp.escape(comment)}|#{Regexp.escape(key)}/)
+          end
+        end
+
+        def type_string(key_type)
+          type_map = {
+            "rsa" => "ssh-rsa",
+            "dsa" => "ssh-dss",
+            "ecdsa" => "ecdsa-sha2-nistp256",
+            "ed25519" => "ssh-ed25519",
+          }
+          type_map[key_type] || key_type
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/sudo.rb

@@ -37,7 +37,7 @@ class Chef
       # acording to the sudo man pages sudo will ignore files in an include dir that have a `.` or `~`
       # We convert either to `__`
       property :filename, String,
-               description: "The name of the sudoers.d file",
+               description: "The name of the sudoers.d file.",
                name_property: true,
                coerce: proc { |x| x.gsub(/[\.~]/, "__") }
 
@@ -60,11 +60,11 @@ class Chef
                default: "ALL"
 
       property :runas, String,
-               description: "User the command(s) can be run as",
+               description: "User the command(s) can be run as.",
                default: "ALL"
 
       property :nopasswd, [TrueClass, FalseClass],
-               description: "Allow running sudo without specifying a password sudo",
+               description: "Allow running sudo without specifying a password sudo.",
                default: false
 
       property :noexec, [TrueClass, FalseClass],
@@ -83,7 +83,7 @@ class Chef
                default: lazy { [] }
 
       property :command_aliases, Array,
-               description: "Command aliases that can be used as allowed commands later in the config",
+               description: "Command aliases that can be used as allowed commands later in the config.",
                default: lazy { [] }
 
       property :setenv, [TrueClass, FalseClass],

data/lib/chef/resource/support/ssh_known_hosts.erb

@@ -0,0 +1,3 @@
+<% @entries.sort.each do |entry| -%>
+<%= entry %>
+<% end -%>

data/lib/chef/resource/sysctl.rb

@@ -50,8 +50,8 @@ class Chef
                default: "/etc/sysctl.d"
 
       def after_created
-        raise "The systctl resource requires Linux as it needs sysctl and the systctl.d directory functionality." unless node["os"] == "linux"
-        raise "The systctl resource does not support SLES releases less than 12 as it requires a systctl.d directory" if platform_family?("suse") && node["platform_version"].to_i < 12
+        raise "The sysctl resource requires Linux as it needs sysctl and the sysctl.d directory functionality." unless node["os"] == "linux"
+        raise "The sysctl resource does not support SLES releases less than 12 as it requires a sysctl.d directory" if platform_family?("suse") && node["platform_version"].to_i < 12
       end
 
       def coerce_value(v)
@@ -63,15 +63,17 @@ class Chef
         end
       end
 
-      # shellout to systctl to get the current value
+      # shellout to sysctl to get the current value
       # ignore missing keys by using '-e'
-      # convert tabs to spaces since systctl tab deliminates multivalue parameters
+      # convert tabs to spaces since sysctl tab deliminates multivalue parameters
       # strip the newline off the end of the output as well
       load_current_value do
         value shell_out!("sysctl -n -e #{key}").stdout.tr("\t", " ").strip
       end
 
       action :apply do
+        description "Apply a sysctl value."
+
         converge_if_changed do
           # set it temporarily
           set_sysctl_param(new_resource.key, new_resource.value)
@@ -91,9 +93,11 @@ class Chef
       end
 
       action :remove do
+        description "Remove a sysctl value."
+
         # only converge the resource if the file actually exists to delete
         if ::File.exist?("#{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf")
-          converge_by "removing systctl config at #{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf" do
+          converge_by "removing sysctl config at #{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf" do
             file "#{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf" do
               action :delete
             end