onceover 3.21.0 → 3.22.0

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/cd4pe/haproxy.pp

@@ -0,0 +1,65 @@
+# Creates a load balancer for CD4PE
+#
+# This will result in the following services going into DNS:
+#
+# * cd4pe.puppet.local
+# * cd4pe-webhooks.puppet.local
+# * k8s-api.puppet.local
+# * k8s-console.puppet.local
+# * k8s-registry.puppet.local
+#
+class profile::cd4pe::haproxy {
+  require profile::haproxy
+
+  Haproxy::Listen {
+    ipaddress => $facts['networking']['ip'],
+  }
+
+  # For each of these endpoints we create a listener and a dns name
+  # e.g. {name}.{domain}
+  $endpoints = [
+    {
+      'name' => 'cd4pe',
+      'port' => '443',
+    },
+    {
+      'name' => 'cd4pe-webhooks',
+      'port' => '443',
+    },
+    {
+      'name' => 'k8s-api',
+      'port' => '6443',
+    },
+    {
+      'name' => 'kots-console',
+      'port' => '8800',
+    },
+    {
+      'name' => 'k8s-registry',
+      'port' => '443',
+    },
+  ]
+
+  $endpoints.each |$details| {
+    # Each endpoint gets a DNS name and a listener
+    $dns_name = "${details['name']}.puppet.local"
+    $ip       = $facts['networking']['ip']
+
+    # Create the listener
+    haproxy::listen { $details['name']:
+      ipaddress        => $ip,
+      collect_exported => true,
+      ports            => $details['port'],
+    }
+
+    @@resource_record { $dns_name:
+      ensure => present,
+      record => $dns_name,
+      type   => 'A',
+      zone   => 'puppet.local',
+      data   => [
+        $ip,
+      ],
+    }
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/cd4pe/replicated.pp

@@ -0,0 +1,53 @@
+# Manages CD4PE servers
+#
+# This profile doesn't actually install CD4PE 4.0 since there isn't a nice
+# way top do that yet with Puppet. Instead it exports the load balancer
+# endpoints and also sets up  the network so that CD4PE can definitely talk
+# to itself via the load balancer
+#
+# @param dns_name The DNS name that the kubernetes cluster has been configured to use for when people access CD4PE. This will be put into a host entry pointing at the load balancer IP
+# @param kubernetes_dns_name The DNS name of the kyubernetes API
+class profile::cd4pe::replicated () {
+  # Create HAProxy endpoints
+  # Balance the CD4PE ports
+  @@haproxy::balancermember { "${facts['fqdn']}-cd4pe":
+    listening_service => 'cd4pe',
+    ports             => '443',
+    server_names      => $facts['fqdn'],
+    ipaddresses       => $facts['networking']['ip'],
+    options           => 'check',
+  }
+
+  @@haproxy::balancermember { "${facts['fqdn']}-cd4pe-webhooks":
+    listening_service => 'cd4pe-webhooks',
+    ports             => '443',
+    server_names      => $facts['fqdn'],
+    ipaddresses       => $facts['networking']['ip'],
+    options           => 'check',
+  }
+
+  # Balance the Kubernetes ports too
+  @@haproxy::balancermember { "${facts['fqdn']}-k8s-api":
+    listening_service => 'k8s-api',
+    ports             => '6443',
+    server_names      => $facts['fqdn'],
+    ipaddresses       => $facts['networking']['ip'],
+    options           => 'check',
+  }
+
+  @@haproxy::balancermember { "${facts['fqdn']}-kots-console":
+    listening_service => 'kots-console',
+    ports             => '8800',
+    server_names      => $facts['fqdn'],
+    ipaddresses       => $facts['networking']['ip'],
+    options           => 'check',
+  }
+
+  @@haproxy::balancermember { "${facts['fqdn']}-k8s-registry":
+    listening_service => 'k8s-registry',
+    ports             => '443',
+    server_names      => $facts['fqdn'],
+    ipaddresses       => $facts['networking']['ip'],
+    options           => 'check',
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/compile/balancer.pp

@@ -0,0 +1,28 @@
+class profile::compile::balancer (
+  $listening_pool = 'puppet00',
+) {
+  class { '::haproxy':
+    global_options => {
+      'user'  => 'root',
+      'group' => 'root',
+    },
+  }
+
+  haproxy::listen { "${listening_pool}-8140":
+    collect_exported => true,
+    ipaddress        => $::ipaddress,
+    ports            => '8140',
+  }
+
+  haproxy::listen { "${listening_pool}-8142":
+    collect_exported => true,
+    ipaddress        => $::ipaddress,
+    ports            => '8142',
+    options          => {
+      'timeout' => [
+        'tunnel 15m',
+      ],
+      'balance' => 'leastconn',
+    },
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/compile/master.pp

@@ -0,0 +1,19 @@
+class profile::compile::master (
+  String $listening_pool = 'puppet00',
+) {
+  @@haproxy::balancermember { "${::fqdn}-8140":
+    listening_service => "${listening_pool}-8140",
+    server_names      => $::fqdn,
+    ipaddresses       => $::networking['ip'],
+    ports             => '8140',
+    options           => 'check',
+  }
+
+  @@haproxy::balancermember { "${::fqdn}-8142":
+    listening_service => "${listening_pool}-8142",
+    server_names      => $::fqdn,
+    ipaddresses       => $::networking['ip'],
+    ports             => '8142',
+    options           => 'check',
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/dns/host_record.pp

@@ -0,0 +1,16 @@
+# Set a DNS record for yourself
+define profile::dns::host_record (
+  String $record = $facts['fqdn'],
+  String $zone   = $facts['domain'],
+  String $ip     = $facts['networking']['ip'],
+) {
+  @@resource_record { $name:
+    ensure => present,
+    record => $record,
+    type   => 'A',
+    zone   => $zone,
+    data   => [
+      $ip,
+    ],
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/dns/server.pp

@@ -0,0 +1,66 @@
+# Manages a DNS server
+class profile::dns::server {
+  # Use P9 forwarders if they exst. Really I should be using hiera for this...
+  $forwarders = $facts['domain'] ? {
+    'platform9.puppet.net' => [
+      '192.168.0.5',
+      '192.168.0.7',
+      '192.168.0.4',
+    ],
+    default => [
+        '8.8.8.8',
+        '8.8.4.4',
+    ],
+  }
+
+  class { 'bind':
+    forwarders => $forwarders,
+    dnssec     => false,
+    version    => 'Controlled by Puppet',
+  }
+
+  # This key is just randomly generated. Not really a secret
+  $local_secret = '+0VnhFp9T+N0EcaDluU8rDdWX1/ecVPhrZQ/yse997DkfgBg57Xo2TTEdjiYBHs1v/bk8RTLi92WY+r39Aw2YQ=='
+
+  # Inject credentials
+  Resource_record <| |> {
+    keyname => 'local-update',
+    hmac    => 'hmac-sha256',
+    secret  => $local_secret,
+  }
+
+  bind::key { 'local-update':
+    algorithm => 'hmac-sha256',
+    secret    => $local_secret,
+  }
+
+  # Create a zone for the local domain
+  bind::zone { 'puppet.local':
+    zone_type     => 'master',
+    domain        => 'puppet.local',
+    allow_updates => [ 'key local-update' ],
+  }
+
+  bind::view { 'local':
+    recursion => true,
+    zones     => [
+      'puppet.local',
+      $facts['networking']['domain'],
+    ],
+  }
+
+  # Collect exported records
+  Resource_record <<| zone == 'puppet.local' |>>
+
+  if $facts['networking']['domain'] {
+      # Create a zone for the local domain
+      bind::zone { $facts['networking']['domain']:
+        zone_type     => 'master',
+        domain        => $facts['networking']['domain'],
+        allow_updates => [ 'key local-update' ],
+      }
+
+      # Collect exported records
+      Resource_record <<| zone == $facts['networking']['domain'] |>>
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/docker.pp

@@ -0,0 +1,5 @@
+class profile::docker (
+
+) {
+  include docker
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/eyeunify/base.pp

@@ -0,0 +1,43 @@
+# == Class: profile::eyeunify::base
+#
+class profile::eyeunify::base (
+  String $xmx                 = '512m',
+  String $xms                 = '256m',
+  String $management_user     = 'admin',
+  String $management_password = 'hunter2'
+) {
+  package { 'wget':
+    ensure => present,
+    before => Class['profile::eyeunify::core::database_connection'],
+  }
+
+  class { '::java':
+    distribution => 'jre',
+  }
+
+  class { '::wildfly':
+    java_home      => '/usr/lib/jvm/jre-1.8.0',
+    java_xmx       => $xmx,
+    java_xms       => $xms,
+    external_facts => true,
+    mgmt_user      => {
+      'username' => $management_user,
+      'password' => $management_password,
+    },
+    properties     => {
+      'jboss.bind.address'            => '0.0.0.0',
+      'jboss.bind.address.management' => '0.0.0.0',
+      'jboss.management.http.port'    => '9990',
+      'jboss.management.https.port'   => '9993',
+      'jboss.http.port'               => '8080',
+      'jboss.https.port'              => '8443',
+      'jboss.ajp.port'                => '8009',
+    },
+  }
+
+  # Create cache directory
+  file { '/var/cache/wget':
+    ensure => directory,
+    before => Class['::wildfly'],
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/eyeunify/core/database_connection.pp

@@ -0,0 +1,42 @@
+# == Class: profile::eyeunify::core::database_connection
+#
+class profile::eyeunify::core::database_connection (
+    Optional[String] $database_server       = undef,
+    String           $database_server_query = 'facts.role = "role::eyeunify::database"',
+    String           $database_name         = 'eyeunify',
+    String           $username              = 'eyeunify',
+    String           $password              = 'hunter2',
+) {
+  # Work out what the database server should be
+  if $database_server {
+    $_database_server = $database_server
+  } else {
+    $_database_server = puppetdb_query("inventory[certname] { ${database_server_query} }")[0].dig('certname')
+  }
+
+  wildfly::config::module { 'org.postgresql':
+    source       => 'http://central.maven.org/maven2/org/postgresql/postgresql/9.4-1206-jdbc42/postgresql-9.4-1206-jdbc42.jar',
+    dependencies => ['javax.api', 'javax.transaction.api'],
+    require      => Class['::wildfly::install'],
+  }
+
+  wildfly::datasources::driver { 'Driver postgresql':
+    driver_name                     => 'postgresql',
+    driver_module_name              => 'org.postgresql',
+    driver_xa_datasource_class_name => 'org.postgresql.xa.PGXADataSource',
+    require                         => Wildfly::Config::Module['org.postgresql'],
+  }
+
+  wildfly::datasources::datasource { 'eyeUNIFY_datasource':
+    name    => 'eyeUNIFY_datasource',
+    config  => {
+      'driver-name'           => 'postgresql',
+      'connection-url'        => "jdbc:postgresql://${_database_server}/${database_name}",
+      'jndi-name'             => 'java:/datasources/heliopsis',
+      'transaction-isolation' => 'TRANSACTION_SERIALIZABLE',
+      'user-name'             => $username,
+      'password'              => $password,
+    },
+    require => Wildfly::Datasources::Driver['Driver postgresql'],
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/eyeunify/core.pp

@@ -0,0 +1,72 @@
+class profile::eyeunify::core (
+  String $source         = 'https://eyeunify.org/wp_root/wp-content/uploads/2016/11/eyeUNIFYcore_1_2_8953ad59.zip',
+  String $admin_user     = $profile::eyeunify::base::management_user,
+  String $admin_password = $profile::eyeunify::base::management_password,
+) {
+  include ::profile::eyeunify::base
+  include ::profile::eyeunify::core::database_connection
+
+  # Create users
+  file { 'unify_users_file':
+    ensure  => file,
+    path    => "${wildfly::dirname}/${wildfly::mode}/configuration/unify-default-users.properties",
+    owner   => $wildfly::user,
+    group   => $wildfly::group,
+    mode    => '0644',
+    require => Class['::wildfly::install'],
+  }
+
+  wildfly::config::user { "${admin_user}:ApplicationRealm":
+    password  => $admin_password,
+    file_name => 'application-users.properties',
+    require   => File['unify_users_file'],
+  }
+
+  wildfly::config::user_roles { $admin_user:
+    roles => 'administrator,operator',
+  }
+
+  wildfly::config::user { 'guest:ApplicationRealm':
+    password  => 'guest',
+    file_name => 'application-users.properties',
+    require   => File['unify_users_file'],
+  }
+
+  wildfly::config::user_roles { 'guest':
+    roles => 'administrator,operator',
+  }
+
+  # Create the security domain that eyeunify will use
+  wildfly::security::domain { 'unify-default':
+    login_modules => {
+      'main-login-module' => {
+        'code'           => 'UsersRoles',
+        'flag'           => 'required',
+        'domain'         => 'unify-default',
+        'module_options' => {
+          'usersProperties' => "${wildfly::dirname}/${wildfly::mode}/configuration/application-users.properties",
+          'rolesProperties' => "${wildfly::dirname}/${wildfly::mode}/configuration/application-roles.properties",
+        },
+      },
+    },
+  }
+
+  # Actually deploy the core
+  archive { 'eyeunify_core.zip':
+    path         => '/tmp/eyeunify_core.zip',
+    source       => $source,
+    extract      => true,
+    extract_path => '/tmp',
+    creates      => '/tmp/eyeUNIFYcore_1_2_8953ad59.ear',
+    cleanup      => true,
+    user         => $wildfly::user,
+    group        => $wildfly::user,
+    require      => Package['unzip'],
+    before       => Wildfly::Deployment['eyeunify_core.ear'],
+  }
+
+  wildfly::deployment { 'eyeunify_core.ear':
+    source  => 'file:///tmp/eyeUNIFYcore_1_2_8953ad59.ear',
+    require => Class['profile::eyeunify::core::database_connection'],
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/eyeunify/ctrl.pp

@@ -0,0 +1,57 @@
+# == Class: profile::eyeunify::ctrl
+#
+class profile::eyeunify::ctrl (
+  String $source = 'https://eyeunify.org/wp_root/wp-content/uploads/2016/11/eyeUNIFYctrl_1_2_74261798.zip',
+) {
+  include ::profile::eyeunify::base
+
+  # Actually deploy the core
+  archive { 'eyeunify_ctrl.zip':
+    path         => '/tmp/eyeunify_ctrl.zip',
+    source       => $source,
+    extract      => true,
+    extract_path => '/tmp',
+    creates      => '/tmp/eyeUNIFYctrl_1_2_74261798.war',
+    cleanup      => true,
+    user         => $wildfly::user,
+    group        => $wildfly::user,
+    require      => Package['unzip'],
+    before       => Wildfly::Deployment['eyeunify_ctrl.war'],
+  }
+
+  wildfly::deployment { 'eyeunify_ctrl.war':
+    source  => 'file:///tmp/eyeUNIFYctrl_1_2_74261798.war',
+    require => Class['profile::eyeunify::core::database_connection'],
+  }
+
+  # Also add a reverse proxy
+  include ::profile::nginx
+
+  # Reverse proxy on port 80
+  nginx::resource::server { $::facts['fqdn']:
+    listen_port => 80,
+    proxy       => 'http://localhost:8080',
+  }
+
+  # Allow through the firewall
+  firewall { "100 allow nginx 80":
+    proto  => 'tcp',
+    dport  => 80,
+    action => 'accept',
+  }
+
+  # Detect the correct IP based on what virualisation we are using
+  $ip = $facts['virtual'] ? {
+    'virtualbox' => $facts['networking']['interfaces']['enp0s8']['ip'],
+    default      => $facts['networking']['ip'],
+  }
+
+  # Export balancer member in case this load balanced
+  @@haproxy::balancermember { "${facts['fqdn']}-eyeunify":
+    listening_service => 'eyeunify',
+    ports             => '80',
+    server_names      => $facts['fqdn'],
+    ipaddresses       => $ip,
+    options           => 'check',
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/eyeunify/database.pp

@@ -0,0 +1,32 @@
+class profile::eyeunify::database {
+  class { '::postgresql::globals':
+    manage_package_repo => true,
+    version             => '9.4',
+  }
+
+  class { '::postgresql::server':
+    listen_addresses => $facts['networking']['ip'],
+  }
+
+  postgresql::server::db { 'eyeunify':
+    user     => 'eyeunify',
+    password => postgresql_password('eyeunify', 'hunter2'),
+    require  => Class['::postgresql::server'],
+  }
+
+  postgresql::server::pg_hba_rule { 'allow application network to access app database':
+    description => 'Open up PostgreSQL for access from app server/s',
+    type        => 'host',
+    database    => 'eyeunify',
+    user        => 'eyeunify',
+    address     => "${facts['networking']['network']}/24",
+    auth_method => 'md5',
+  }
+
+  # Allow through the firewall
+  firewall { "100 allow postgres 5432":
+    proto  => 'tcp',
+    dport  => 5432,
+    action => 'accept',
+  }
+}

data/spec/fixtures/controlrepos/puppet_controlrepo/site-modules/profile/manifests/eyeunify/exec.pp

@@ -0,0 +1,11 @@
+# == Class: profile::eyeunify::exec
+#
+class profile::eyeunify::exec {
+  java::oracle { 'jre8' :
+    ensure  => 'present',
+    version => '8',
+    java_se => 'jre',
+  }
+
+  # TODO: This is a work in progress
+}