openvox 9.0.0.pre.alpha2 → 9.0.0.pre.beta2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +114 -1
- data/CODE_OF_CONDUCT.md +1 -1
- data/Gemfile +5 -5
- data/README.md +6 -6
- data/Rakefile +3 -3
- data/conf/environment.conf +2 -2
- data/conf/fileserver.conf +3 -3
- data/conf/puppet.conf +4 -4
- data/examples/enc/regexp_nodes/regexp_nodes.rb +2 -2
- data/examples/hiera/README.md +1 -1
- data/examples/nagios/check_puppet.rb +1 -1
- data/ext/README.md +3 -3
- data/ext/hiera/hiera.yaml +1 -1
- data/ext/project_data.yaml +1 -1
- data/ext/redhat/client.sysconfig +1 -0
- data/ext/solaris/smf/puppet.xml +2 -2
- data/ext/windows/puppet_interactive.bat +1 -1
- data/ext/windows/service/daemon.rb +5 -5
- data/lib/hiera/puppet_function.rb +1 -2
- data/lib/hiera_puppet.rb +1 -1
- data/lib/puppet/agent/disabler.rb +3 -3
- data/lib/puppet/agent/locker.rb +1 -1
- data/lib/puppet/agent.rb +2 -2
- data/lib/puppet/application/agent.rb +33 -35
- data/lib/puppet/application/apply.rb +7 -7
- data/lib/puppet/application/describe.rb +3 -3
- data/lib/puppet/application/device.rb +1 -1
- data/lib/puppet/application/doc.rb +5 -7
- data/lib/puppet/application/facts.rb +1 -1
- data/lib/puppet/application/filebucket.rb +5 -5
- data/lib/puppet/application/lookup.rb +8 -8
- data/lib/puppet/application/resource.rb +5 -5
- data/lib/puppet/application/script.rb +3 -3
- data/lib/puppet/application/ssl.rb +4 -4
- data/lib/puppet/application_support.rb +2 -2
- data/lib/puppet/configurer.rb +13 -7
- data/lib/puppet/confine/variable.rb +2 -2
- data/lib/puppet/context.rb +1 -1
- data/lib/puppet/data_binding.rb +1 -1
- data/lib/puppet/defaults.rb +157 -226
- data/lib/puppet/error.rb +1 -1
- data/lib/puppet/etc.rb +4 -4
- data/lib/puppet/face/catalog/select.rb +3 -3
- data/lib/puppet/face/catalog.rb +4 -4
- data/lib/puppet/face/config.rb +6 -6
- data/lib/puppet/face/facts.rb +6 -6
- data/lib/puppet/face/help/man.erb +3 -3
- data/lib/puppet/face/node/clean.rb +3 -3
- data/lib/puppet/face/node.rb +2 -2
- data/lib/puppet/face/plugin.rb +4 -4
- data/lib/puppet/functions/all.rb +4 -4
- data/lib/puppet/functions/any.rb +4 -4
- data/lib/puppet/functions/assert_type.rb +5 -5
- data/lib/puppet/functions/defined.rb +1 -1
- data/lib/puppet/functions/each.rb +11 -11
- data/lib/puppet/functions/epp.rb +5 -5
- data/lib/puppet/functions/eyaml_lookup_key.rb +1 -1
- data/lib/puppet/functions/filter.rb +5 -5
- data/lib/puppet/functions/find_file.rb +1 -1
- data/lib/puppet/functions/hiera.rb +4 -4
- data/lib/puppet/functions/hiera_array.rb +5 -5
- data/lib/puppet/functions/hiera_hash.rb +5 -5
- data/lib/puppet/functions/hiera_include.rb +6 -6
- data/lib/puppet/functions/hocon_data.rb +1 -1
- data/lib/puppet/functions/include.rb +1 -1
- data/lib/puppet/functions/index.rb +3 -3
- data/lib/puppet/functions/inline_epp.rb +6 -6
- data/lib/puppet/functions/json_data.rb +1 -1
- data/lib/puppet/functions/lest.rb +1 -1
- data/lib/puppet/functions/lookup.rb +14 -14
- data/lib/puppet/functions/map.rb +5 -5
- data/lib/puppet/functions/reduce.rb +6 -6
- data/lib/puppet/functions/regsubst.rb +1 -13
- data/lib/puppet/functions/reverse_each.rb +5 -5
- data/lib/puppet/functions/scanf.rb +1 -1
- data/lib/puppet/functions/step.rb +5 -5
- data/lib/puppet/functions/then.rb +1 -1
- data/lib/puppet/functions/tree_each.rb +3 -3
- data/lib/puppet/functions/versioncmp.rb +1 -1
- data/lib/puppet/functions/with.rb +2 -2
- data/lib/puppet/functions/yaml_data.rb +1 -1
- data/lib/puppet/generate/type.rb +5 -1
- data/lib/puppet/gettext/config.rb +5 -5
- data/lib/puppet/gettext/module_translations.rb +1 -1
- data/lib/puppet/graph/simple_graph.rb +0 -1
- data/lib/puppet/http/client.rb +5 -5
- data/lib/puppet/http/factory.rb +1 -1
- data/lib/puppet/http/resolver/server_list.rb +2 -2
- data/lib/puppet/http/service/compiler.rb +3 -3
- data/lib/puppet/http/service/file_server.rb +1 -1
- data/lib/puppet/http/service.rb +19 -1
- data/lib/puppet/http/session.rb +1 -1
- data/lib/puppet/http.rb +1 -1
- data/lib/puppet/indirector/catalog/compiler.rb +2 -2
- data/lib/puppet/indirector/data_binding/hiera.rb +93 -2
- data/lib/puppet/indirector/face.rb +4 -4
- data/lib/puppet/indirector/facts/facter.rb +7 -7
- data/lib/puppet/indirector/file_bucket_file/file.rb +2 -2
- data/lib/puppet/indirector/file_bucket_file/rest.rb +7 -3
- data/lib/puppet/indirector/file_content/file_server.rb +1 -1
- data/lib/puppet/indirector/file_metadata/file_server.rb +1 -1
- data/lib/puppet/indirector/node/exec.rb +1 -1
- data/lib/puppet/indirector/node/rest.rb +1 -1
- data/lib/puppet/indirector/report/processor.rb +1 -1
- data/lib/puppet/indirector.rb +1 -1
- data/lib/puppet/interface/documentation.rb +1 -1
- data/lib/puppet/interface/face_collection.rb +1 -1
- data/lib/puppet/interface/option.rb +2 -2
- data/lib/puppet/module/task.rb +1 -1
- data/lib/puppet/module_tool/applications/application.rb +1 -1
- data/lib/puppet/module_tool/metadata.rb +1 -2
- data/lib/puppet/module_tool.rb +1 -1
- data/lib/puppet/network/authorization.rb +1 -1
- data/lib/puppet/network/http/api.rb +2 -2
- data/lib/puppet/network/http/connection.rb +2 -2
- data/lib/puppet/node/environment.rb +6 -6
- data/lib/puppet/node.rb +2 -2
- data/lib/puppet/pal/catalog_compiler.rb +1 -1
- data/lib/puppet/pal/pal_impl.rb +1 -25
- data/lib/puppet/parser/compiler.rb +1 -1
- data/lib/puppet/parser/functions/assert_type.rb +5 -5
- data/lib/puppet/parser/functions/create_resources.rb +1 -1
- data/lib/puppet/parser/functions/defined.rb +1 -1
- data/lib/puppet/parser/functions/digest.rb +1 -1
- data/lib/puppet/parser/functions/each.rb +11 -11
- data/lib/puppet/parser/functions/epp.rb +5 -5
- data/lib/puppet/parser/functions/filter.rb +5 -5
- data/lib/puppet/parser/functions/generate.rb +1 -1
- data/lib/puppet/parser/functions/hiera.rb +3 -3
- data/lib/puppet/parser/functions/hiera_array.rb +4 -4
- data/lib/puppet/parser/functions/hiera_hash.rb +4 -4
- data/lib/puppet/parser/functions/hiera_include.rb +5 -5
- data/lib/puppet/parser/functions/include.rb +1 -1
- data/lib/puppet/parser/functions/inline_epp.rb +6 -6
- data/lib/puppet/parser/functions/inline_template.rb +1 -1
- data/lib/puppet/parser/functions/lest.rb +1 -1
- data/lib/puppet/parser/functions/lookup.rb +14 -14
- data/lib/puppet/parser/functions/map.rb +5 -5
- data/lib/puppet/parser/functions/reduce.rb +7 -7
- data/lib/puppet/parser/functions/reverse_each.rb +5 -5
- data/lib/puppet/parser/functions/scanf.rb +1 -1
- data/lib/puppet/parser/functions/step.rb +5 -5
- data/lib/puppet/parser/functions/then.rb +1 -1
- data/lib/puppet/parser/functions/versioncmp.rb +1 -1
- data/lib/puppet/parser/functions/with.rb +1 -1
- data/lib/puppet/parser/functions.rb +3 -3
- data/lib/puppet/parser/scope.rb +1 -1
- data/lib/puppet/plugins/syntax_checkers.rb +2 -2
- data/lib/puppet/plugins.rb +1 -1
- data/lib/puppet/pops/evaluator/collectors/exported_collector.rb +1 -1
- data/lib/puppet/pops/evaluator/deferred_resolver.rb +4 -1
- data/lib/puppet/pops/issues.rb +3 -3
- data/lib/puppet/pops/loader/module_loaders.rb +4 -4
- data/lib/puppet/pops/loader/ruby_legacy_function_instantiator.rb +1 -1
- data/lib/puppet/pops/loaders.rb +4 -4
- data/lib/puppet/pops/lookup/lookup_adapter.rb +7 -66
- data/lib/puppet/pops/model/factory.rb +5 -5
- data/lib/puppet/pops/resource/resource_type_impl.rb +1 -1
- data/lib/puppet/pops/serialization/to_data_converter.rb +1 -1
- data/lib/puppet/pops/types/iterable.rb +1 -1
- data/lib/puppet/property/keyvalue.rb +3 -3
- data/lib/puppet/provider/group/aix.rb +2 -2
- data/lib/puppet/provider/nameservice/directoryservice.rb +2 -2
- data/lib/puppet/provider/package/aix.rb +1 -1
- data/lib/puppet/provider/package/apt.rb +2 -2
- data/lib/puppet/provider/package/aptitude.rb +0 -1
- data/lib/puppet/provider/package/dnfmodule.rb +1 -1
- data/lib/puppet/provider/package/nim.rb +1 -1
- data/lib/puppet/provider/package/pacman.rb +1 -2
- data/lib/puppet/provider/package/pip.rb +1 -1
- data/lib/puppet/provider/package/pip2.rb +1 -1
- data/lib/puppet/provider/package/pip3.rb +1 -1
- data/lib/puppet/provider/package/pkgdmg.rb +2 -2
- data/lib/puppet/provider/package/puppet_gem.rb +2 -2
- data/lib/puppet/provider/package/puppetserver_gem.rb +1 -1
- data/lib/puppet/provider/package/windows.rb +1 -1
- data/lib/puppet/provider/service/freebsd.rb +1 -1
- data/lib/puppet/provider/service/init.rb +5 -5
- data/lib/puppet/provider/service/launchd.rb +2 -2
- data/lib/puppet/provider/service/smf.rb +1 -1
- data/lib/puppet/provider/service/upstart.rb +2 -2
- data/lib/puppet/provider/user/aix.rb +3 -3
- data/lib/puppet/provider/user/directoryservice.rb +9 -9
- data/lib/puppet/provider/user/pw.rb +3 -3
- data/lib/puppet/provider.rb +1 -1
- data/lib/puppet/reference/configuration.rb +6 -13
- data/lib/puppet/reference/function.rb +4 -4
- data/lib/puppet/reference/indirection.rb +2 -2
- data/lib/puppet/reference/metaparameter.rb +3 -3
- data/lib/puppet/reference/providers.rb +3 -3
- data/lib/puppet/reference/report.rb +4 -4
- data/lib/puppet/reference/type.rb +2 -2
- data/lib/puppet/relationship.rb +1 -1
- data/lib/puppet/reports/http.rb +4 -4
- data/lib/puppet/reports.rb +1 -1
- data/lib/puppet/resource/catalog.rb +4 -4
- data/lib/puppet/resource/type.rb +8 -8
- data/lib/puppet/settings/base_setting.rb +2 -3
- data/lib/puppet/settings/config_file.rb +3 -3
- data/lib/puppet/settings/environment_conf.rb +3 -11
- data/lib/puppet/settings.rb +11 -51
- data/lib/puppet/ssl/certificate.rb +4 -0
- data/lib/puppet/ssl/certificate_request.rb +1 -1
- data/lib/puppet/ssl/oids.rb +1 -1
- data/lib/puppet/ssl/openssl_loader.rb +1 -1
- data/lib/puppet/ssl/ssl_provider.rb +5 -5
- data/lib/puppet/ssl/state_machine.rb +9 -3
- data/lib/puppet/syntax_checkers.rb +1 -1
- data/lib/puppet/transaction/report.rb +3 -3
- data/lib/puppet/transaction.rb +0 -1
- data/lib/puppet/type/exec.rb +20 -20
- data/lib/puppet/type/file/content.rb +10 -37
- data/lib/puppet/type/file/ensure.rb +18 -9
- data/lib/puppet/type/file/mode.rb +4 -4
- data/lib/puppet/type/file/selcontext.rb +2 -2
- data/lib/puppet/type/file/source.rb +19 -25
- data/lib/puppet/type/file.rb +22 -15
- data/lib/puppet/type/filebucket.rb +22 -8
- data/lib/puppet/type/group.rb +5 -5
- data/lib/puppet/type/notify.rb +1 -1
- data/lib/puppet/type/package.rb +4 -4
- data/lib/puppet/type/schedule.rb +11 -11
- data/lib/puppet/type/service.rb +8 -8
- data/lib/puppet/type/stage.rb +1 -1
- data/lib/puppet/type/user.rb +19 -21
- data/lib/puppet/type/whit.rb +2 -2
- data/lib/puppet/type.rb +27 -27
- data/lib/puppet/util/character_encoding.rb +3 -3
- data/lib/puppet/util/command_line.rb +1 -1
- data/lib/puppet/util/execution.rb +1 -1
- data/lib/puppet/util/filetype.rb +6 -6
- data/lib/puppet/util/log.rb +2 -2
- data/lib/puppet/util/logging.rb +3 -3
- data/lib/puppet/util/plist.rb +1 -1
- data/lib/puppet/util/profiler/around_profiler.rb +1 -1
- data/lib/puppet/util/profiler.rb +1 -1
- data/lib/puppet/util/rdoc.rb +6 -3
- data/lib/puppet/util/selinux.rb +5 -5
- data/lib/puppet/util/tag_set.rb +0 -1
- data/lib/puppet/util/windows/adsi.rb +1 -1
- data/lib/puppet/util/windows/com.rb +2 -2
- data/lib/puppet/util/windows/eventlog.rb +6 -6
- data/lib/puppet/util/windows/file.rb +2 -2
- data/lib/puppet/util/windows/security.rb +3 -3
- data/lib/puppet/util.rb +8 -3
- data/lib/puppet/version.rb +8 -8
- data/lib/puppet/x509/cert_provider.rb +1 -1
- data/lib/puppet.rb +5 -5
- data/locales/config.yaml +3 -3
- data/locales/puppet.pot +462 -464
- data/man/man5/puppet.conf.5 +122 -146
- data/man/man8/puppet-agent.8 +25 -25
- data/man/man8/puppet-apply.8 +6 -6
- data/man/man8/puppet-catalog.8 +11 -11
- data/man/man8/puppet-config.8 +7 -7
- data/man/man8/puppet-describe.8 +3 -3
- data/man/man8/puppet-device.8 +2 -2
- data/man/man8/puppet-doc.8 +5 -5
- data/man/man8/puppet-epp.8 +3 -3
- data/man/man8/puppet-facts.8 +11 -11
- data/man/man8/puppet-filebucket.8 +5 -5
- data/man/man8/puppet-generate.8 +3 -3
- data/man/man8/puppet-help.8 +3 -3
- data/man/man8/puppet-lookup.8 +8 -8
- data/man/man8/puppet-module.8 +7 -7
- data/man/man8/puppet-node.8 +11 -45
- data/man/man8/puppet-parser.8 +3 -3
- data/man/man8/puppet-plugin.8 +7 -7
- data/man/man8/puppet-report.8 +6 -6
- data/man/man8/puppet-resource.8 +5 -5
- data/man/man8/puppet-script.8 +3 -3
- data/man/man8/puppet-ssl.8 +21 -23
- data/man/man8/puppet.8 +2 -2
- metadata +5 -8
- data/lib/puppet/indirector/hiera.rb +0 -101
- data/lib/puppet/util/rdoc/generators/puppet_generator.rb +0 -902
- data/lib/puppet/util/rdoc/generators/template/puppet/puppet.rb +0 -1068
|
@@ -20,7 +20,7 @@ module Puppet
|
|
|
20
20
|
attribute is mutually exclusive with `content` and `target`. Allowed
|
|
21
21
|
values are:
|
|
22
22
|
|
|
23
|
-
* `puppet:` URIs, which point to files in modules or
|
|
23
|
+
* `puppet:` URIs, which point to files in modules or OpenVox file server
|
|
24
24
|
mount points.
|
|
25
25
|
* Fully qualified paths to locally available files (including files on NFS
|
|
26
26
|
shares or Windows mapped drives).
|
|
@@ -31,8 +31,8 @@ module Puppet
|
|
|
31
31
|
|
|
32
32
|
`puppet:///modules/<MODULE NAME>/<FILE PATH>`
|
|
33
33
|
|
|
34
|
-
This will fetch a file from a module on the
|
|
35
|
-
local module when using
|
|
34
|
+
This will fetch a file from a module on the OpenVox server (or from a
|
|
35
|
+
local module when using puppet apply). Given a `modulepath` of
|
|
36
36
|
`/etc/puppetlabs/code/modules`, the example above would resolve to
|
|
37
37
|
`/etc/puppetlabs/code/modules/<MODULE NAME>/files/<FILE PATH>`.
|
|
38
38
|
|
|
@@ -46,28 +46,28 @@ module Puppet
|
|
|
46
46
|
because HTTP servers do not transfer any metadata that translates to
|
|
47
47
|
ownership or permission details.
|
|
48
48
|
|
|
49
|
-
|
|
49
|
+
OpenVox determines if file content is synchronized by computing a checksum
|
|
50
50
|
for the local file and comparing it against the `checksum_value`
|
|
51
51
|
parameter. If the `checksum_value` parameter is not specified for
|
|
52
|
-
`puppet` and `file` sources,
|
|
53
|
-
`Puppet[:digest_algorithm]`. For `http(s)` sources,
|
|
52
|
+
`puppet` and `file` sources, OpenVox computes a checksum based on its
|
|
53
|
+
`Puppet[:digest_algorithm]`. For `http(s)` sources, OpenVox uses the
|
|
54
54
|
first HTTP header it recognizes out of the following list:
|
|
55
55
|
`X-Checksum-Sha256`, `X-Checksum-Sha1`, `X-Checksum-Md5` or `Content-MD5`.
|
|
56
|
-
If the server response does not include one of these headers,
|
|
57
|
-
defaults to using the `Last-Modified` header.
|
|
56
|
+
If the server response does not include one of these headers, OpenVox
|
|
57
|
+
defaults to using the `Last-Modified` header. OpenVox updates the local
|
|
58
58
|
file if the header is newer than the modified time (mtime) of the local
|
|
59
59
|
file.
|
|
60
60
|
|
|
61
|
-
_HTTP_ URIs can include a user information component so that
|
|
61
|
+
_HTTP_ URIs can include a user information component so that OpenVox can
|
|
62
62
|
retrieve file metadata and content from HTTP servers that require HTTP Basic
|
|
63
63
|
authentication. For example `https://<user>:<pass>@<server>:<port>/path/to/file.`
|
|
64
64
|
|
|
65
|
-
When connecting to _HTTPS_ servers,
|
|
66
|
-
puppet-agent certificate bundle and the
|
|
65
|
+
When connecting to _HTTPS_ servers, OpenVox trusts CA certificates in the
|
|
66
|
+
puppet-agent certificate bundle and the OpenVox CA. You can configure OpenVox
|
|
67
67
|
to trust additional CA certificates using the `Puppet[:ssl_trust_store]`
|
|
68
68
|
setting.
|
|
69
69
|
|
|
70
|
-
Multiple `source` values can be specified as an array, and
|
|
70
|
+
Multiple `source` values can be specified as an array, and OpenVox will
|
|
71
71
|
use the first source that exists. This can be used to serve different
|
|
72
72
|
files to different system types:
|
|
73
73
|
|
|
@@ -323,9 +323,9 @@ module Puppet
|
|
|
323
323
|
|
|
324
324
|
def chunk_file_from_source(&block)
|
|
325
325
|
if uri.scheme =~ /^https?/
|
|
326
|
-
# Historically
|
|
326
|
+
# Historically OpenVox has not encoded the http(s) source URL before parsing
|
|
327
327
|
# it, for example, if the path contains spaces, then it must be URL encoded
|
|
328
|
-
# as %20 in the manifest.
|
|
328
|
+
# as %20 in the manifest. OpenVox behaves the same when retrieving file
|
|
329
329
|
# metadata via http(s), see Puppet::Indirector::FileMetadata::Http#find.
|
|
330
330
|
url = URI.parse(metadata.source)
|
|
331
331
|
get_from_http_source(url, &block)
|
|
@@ -347,7 +347,7 @@ module Puppet
|
|
|
347
347
|
|
|
348
348
|
Puppet::Type.type(:file).newparam(:source_permissions) do
|
|
349
349
|
desc <<-'EOT'
|
|
350
|
-
Whether (and how)
|
|
350
|
+
Whether (and how) OpenVox should copy owner, group, and mode permissions from
|
|
351
351
|
the `source` to `file` resources when the permissions are not explicitly
|
|
352
352
|
specified. (In all cases, explicit permissions will take precedence.)
|
|
353
353
|
Valid values are `use`, `use_when_creating`, and `ignore`:
|
|
@@ -355,10 +355,10 @@ module Puppet
|
|
|
355
355
|
* `ignore` (the default) will never apply the owner, group, or mode from
|
|
356
356
|
the `source` when managing a file. When creating new files without explicit
|
|
357
357
|
permissions, the permissions they receive will depend on platform-specific
|
|
358
|
-
behavior. On POSIX,
|
|
359
|
-
On Windows,
|
|
358
|
+
behavior. On POSIX, OpenVox will use the umask of the user it is running as.
|
|
359
|
+
On Windows, OpenVox will use the default DACL associated with the user it is
|
|
360
360
|
running as.
|
|
361
|
-
* `use` will cause
|
|
361
|
+
* `use` will cause OpenVox to apply the owner, group,
|
|
362
362
|
and mode from the `source` to any files it is managing.
|
|
363
363
|
* `use_when_creating` will only apply the owner, group, and mode from the
|
|
364
364
|
`source` when creating a file; existing files will not have their permissions
|
|
@@ -368,13 +368,7 @@ module Puppet
|
|
|
368
368
|
defaultto :ignore
|
|
369
369
|
newvalues(:use, :use_when_creating, :ignore)
|
|
370
370
|
munge do |value|
|
|
371
|
-
value
|
|
372
|
-
if @resource.file && @resource.line && value != :ignore
|
|
373
|
-
# TRANSLATORS "source_permissions" is a parameter name and should not be translated
|
|
374
|
-
Puppet.puppet_deprecation_warning(_("The `source_permissions` parameter is deprecated. Explicitly set `owner`, `group`, and `mode`."), file: @resource.file, line: @resource.line)
|
|
375
|
-
end
|
|
376
|
-
|
|
377
|
-
value
|
|
371
|
+
value ? value.to_sym : :ignore
|
|
378
372
|
end
|
|
379
373
|
end
|
|
380
374
|
end
|
data/lib/puppet/type/file.rb
CHANGED
|
@@ -27,11 +27,11 @@ Puppet::Type.newtype(:file) do
|
|
|
27
27
|
downloaded from a remote source using the `source` attribute; the latter
|
|
28
28
|
can also be used to recursively serve directories (when the `recurse`
|
|
29
29
|
attribute is set to `true` or `local`). On Windows, note that file
|
|
30
|
-
contents are managed in binary mode;
|
|
30
|
+
contents are managed in binary mode; OpenVox never automatically translates
|
|
31
31
|
line endings.
|
|
32
32
|
|
|
33
|
-
**Autorequires:** If
|
|
34
|
-
file, the file resource will autorequire them. If
|
|
33
|
+
**Autorequires:** If OpenVox is managing the user or group that owns a
|
|
34
|
+
file, the file resource will autorequire them. If OpenVox is managing any
|
|
35
35
|
parent directories of a file, the file resource autorequires them.
|
|
36
36
|
|
|
37
37
|
Warning: Enabling `recurse` on directories containing large numbers of
|
|
@@ -80,11 +80,11 @@ Puppet::Type.newtype(:file) do
|
|
|
80
80
|
(`File { backup => main }`), so it can affect all file resources.
|
|
81
81
|
|
|
82
82
|
* If set to `false`, file content won't be backed up.
|
|
83
|
-
* If set to a string beginning with `.`, such as `.puppet-bak`,
|
|
83
|
+
* If set to a string beginning with `.`, such as `.puppet-bak`, OpenVox will
|
|
84
84
|
use copy the file in the same directory with that value as the extension
|
|
85
85
|
of the backup. (A value of `true` is a synonym for `.puppet-bak`.)
|
|
86
|
-
* If set to any other string,
|
|
87
|
-
with that title.
|
|
86
|
+
* If set to any other string, OpenVox will try to back up to a filebucket
|
|
87
|
+
with that title. OpenVox automatically creates a **local** filebucket
|
|
88
88
|
named `puppet` if one doesn't already exist. See the `filebucket` resource
|
|
89
89
|
type for more details.
|
|
90
90
|
|
|
@@ -92,18 +92,25 @@ Puppet::Type.newtype(:file) do
|
|
|
92
92
|
|
|
93
93
|
Backing up to a local filebucket isn't particularly useful. If you want
|
|
94
94
|
to make organized use of backups, you will generally want to use the
|
|
95
|
-
primary
|
|
95
|
+
primary OpenVox server's filebucket service. This requires declaring a
|
|
96
96
|
filebucket resource and a resource default for the `backup` attribute
|
|
97
97
|
in site.pp:
|
|
98
98
|
|
|
99
99
|
# /etc/puppetlabs/puppet/manifests/site.pp
|
|
100
100
|
filebucket { 'main':
|
|
101
101
|
path => false, # This is required for remote filebuckets.
|
|
102
|
-
server => 'puppet.example.com', # Optional; defaults to the configured primary
|
|
102
|
+
server => 'puppet.example.com', # Optional; defaults to the configured primary OpenVox server.
|
|
103
103
|
}
|
|
104
104
|
|
|
105
105
|
File { backup => main, }
|
|
106
106
|
|
|
107
|
+
> **Note**: A central filebucket is shared by every node that backs up to it,
|
|
108
|
+
and stored content is addressed only by checksum, with no record of which
|
|
109
|
+
node submitted it. Treat anything backed up there as readable by every
|
|
110
|
+
certificate the server's `auth.conf` allows to reach the `file_bucket_file`
|
|
111
|
+
endpoint, and avoid pointing `backup` at a central filebucket for files whose
|
|
112
|
+
contents are sensitive. See the `filebucket` resource type for details.
|
|
113
|
+
|
|
107
114
|
If you are using multiple primary servers, you will want to
|
|
108
115
|
centralize the contents of the filebucket. Either configure your load
|
|
109
116
|
balancer to direct all filebucket traffic to a single primary server, or use
|
|
@@ -149,7 +156,7 @@ Puppet::Type.newtype(:file) do
|
|
|
149
156
|
|
|
150
157
|
* `false` --- The default behavior. The contents of the directory will not be
|
|
151
158
|
automatically managed.
|
|
152
|
-
* `remote` --- If the `source` attribute is set,
|
|
159
|
+
* `remote` --- If the `source` attribute is set, OpenVox will automatically
|
|
153
160
|
manage the contents of the source directory (or directories), ensuring
|
|
154
161
|
that equivalent files and directories exist on the target system and
|
|
155
162
|
that their contents match.
|
|
@@ -188,13 +195,13 @@ Puppet::Type.newtype(:file) do
|
|
|
188
195
|
end
|
|
189
196
|
|
|
190
197
|
newparam(:recurselimit) do
|
|
191
|
-
desc "How far
|
|
198
|
+
desc "How far OpenVox should descend into subdirectories, when using
|
|
192
199
|
`ensure => directory` and either `recurse => true` or `recurse => remote`.
|
|
193
200
|
The recursion limit affects which files will be copied from the `source`
|
|
194
201
|
directory, as well as which files can be purged when `purge => true`.
|
|
195
202
|
|
|
196
203
|
Setting `recurselimit => 0` is the same as setting `recurse => false` ---
|
|
197
|
-
|
|
204
|
+
OpenVox will manage the directory, but all of its contents will be treated
|
|
198
205
|
as unmanaged.
|
|
199
206
|
|
|
200
207
|
Setting `recurselimit => 1` will manage files and directories that are
|
|
@@ -241,7 +248,7 @@ Puppet::Type.newtype(:file) do
|
|
|
241
248
|
whose content doesn't match what the `source` or `content` attribute
|
|
242
249
|
specifies. Setting this to false allows file resources to initialize files
|
|
243
250
|
without overwriting future changes. Note that this only affects content;
|
|
244
|
-
|
|
251
|
+
OpenVox will still manage ownership and permissions."
|
|
245
252
|
defaultto :true
|
|
246
253
|
end
|
|
247
254
|
|
|
@@ -320,7 +327,7 @@ Puppet::Type.newtype(:file) do
|
|
|
320
327
|
newparam(:show_diff, :boolean => true, :parent => Puppet::Parameter::Boolean) do
|
|
321
328
|
desc "Whether to display differences when the file changes, defaulting to
|
|
322
329
|
true. This parameter is useful for files that may contain passwords or
|
|
323
|
-
other secret data, which might otherwise be included in
|
|
330
|
+
other secret data, which might otherwise be included in OpenVox reports or
|
|
324
331
|
other insecure outputs. If the global `show_diff` setting
|
|
325
332
|
is false, then no diffs will be shown even if this parameter is true."
|
|
326
333
|
|
|
@@ -353,14 +360,14 @@ Puppet::Type.newtype(:file) do
|
|
|
353
360
|
|
|
354
361
|
newparam(:validate_cmd) do
|
|
355
362
|
desc "A command for validating the file's syntax before replacing it. If
|
|
356
|
-
|
|
363
|
+
OpenVox would need to rewrite a file due to new `source` or `content`, it
|
|
357
364
|
will check the new content's validity first. If validation fails, the file
|
|
358
365
|
resource will fail.
|
|
359
366
|
|
|
360
367
|
This command must have a fully qualified path, and should contain a
|
|
361
368
|
percent (`%`) token where it would expect an input file. It must exit `0`
|
|
362
369
|
if the syntax is correct, and non-zero otherwise. The command will be
|
|
363
|
-
run on the target system while applying the catalog, not on the primary
|
|
370
|
+
run on the target system while applying the catalog, not on the primary OpenVox server.
|
|
364
371
|
|
|
365
372
|
Example:
|
|
366
373
|
|
|
@@ -6,19 +6,18 @@ module Puppet
|
|
|
6
6
|
Type.newtype(:filebucket) do
|
|
7
7
|
@doc = <<-EOT
|
|
8
8
|
A repository for storing and retrieving file content by cryptographic checksum. Can
|
|
9
|
-
be local to each agent node, or centralized on a primary
|
|
10
|
-
|
|
9
|
+
be local to each agent node, or centralized on a primary OpenVox server. All
|
|
10
|
+
OpenVox servers provide a filebucket service that agent nodes can access
|
|
11
11
|
via HTTP, but you must declare a filebucket resource before any agents
|
|
12
12
|
will do so.
|
|
13
13
|
|
|
14
14
|
Filebuckets are used for the following features:
|
|
15
15
|
|
|
16
16
|
- **Content backups.** If the `file` type's `backup` attribute is set to
|
|
17
|
-
the name of a filebucket,
|
|
17
|
+
the name of a filebucket, OpenVox will back up the _old_ content whenever
|
|
18
18
|
it rewrites a file; see the documentation for the `file` type for more
|
|
19
19
|
details. These backups can be used for manual recovery of content, but
|
|
20
|
-
are more commonly used to display changes and differences
|
|
21
|
-
Puppet Dashboard.
|
|
20
|
+
are more commonly used to display changes and differences.
|
|
22
21
|
|
|
23
22
|
To use a central filebucket for backups, you will usually want to declare
|
|
24
23
|
a filebucket resource and a resource default for the `backup` attribute
|
|
@@ -32,10 +31,25 @@ module Puppet
|
|
|
32
31
|
|
|
33
32
|
File { backup => main, }
|
|
34
33
|
|
|
35
|
-
|
|
34
|
+
OpenVox Servers automatically provide the filebucket service, so
|
|
36
35
|
this will work in a default configuration. If you have a heavily
|
|
37
|
-
restricted
|
|
36
|
+
restricted OpenVox Server `auth.conf` file, you may need to allow access to the
|
|
38
37
|
`file_bucket_file` endpoint.
|
|
38
|
+
|
|
39
|
+
> **Security note**: a central filebucket is shared by every node that backs
|
|
40
|
+
up to it. Content is addressed purely by checksum, and the service records no
|
|
41
|
+
association between stored content and the node that submitted it, so a
|
|
42
|
+
request for `/puppet/v3/file_bucket_file/<digest>/<checksum>` returns the
|
|
43
|
+
matching content to any client the server's `auth.conf` permits, regardless
|
|
44
|
+
of which node originally backed that file up. Retrieving content requires
|
|
45
|
+
knowing the checksum of the exact bytes, so this is not a general-purpose
|
|
46
|
+
read primitive, but you should treat a central filebucket as readable by
|
|
47
|
+
every certificate allowed to reach the endpoint and avoid backing up files
|
|
48
|
+
whose contents are sensitive. Since OpenVox 9 the default `auth.conf` grants
|
|
49
|
+
agents only the `HEAD` and `PUT` access they need in order to store backups,
|
|
50
|
+
and restricts `GET` to certificates carrying the `pp_cli_auth` extension. If
|
|
51
|
+
you restore remotely using some other administrative certificate, add a rule
|
|
52
|
+
of your own rather than widening the shipped one.
|
|
39
53
|
EOT
|
|
40
54
|
|
|
41
55
|
newparam(:name) do
|
|
@@ -98,7 +112,7 @@ module Puppet
|
|
|
98
112
|
def mkbucket
|
|
99
113
|
# Default is a local filebucket, if no server is given.
|
|
100
114
|
# If the default path has been removed, too, then
|
|
101
|
-
# the
|
|
115
|
+
# the OpenVox server is used as default server
|
|
102
116
|
|
|
103
117
|
type = "local"
|
|
104
118
|
args = {}
|
data/lib/puppet/type/group.rb
CHANGED
|
@@ -151,9 +151,9 @@ module Puppet
|
|
|
151
151
|
desc "Configures the behavior of the `members` parameter.
|
|
152
152
|
|
|
153
153
|
* `false` (default) --- The provided list of group members is partial,
|
|
154
|
-
and
|
|
154
|
+
and OpenVox **ignores** any members that aren't listed there.
|
|
155
155
|
* `true` --- The provided list of of group members is comprehensive, and
|
|
156
|
-
|
|
156
|
+
OpenVox **purges** any members that aren't listed there."
|
|
157
157
|
defaultto false
|
|
158
158
|
end
|
|
159
159
|
|
|
@@ -162,7 +162,7 @@ module Puppet
|
|
|
162
162
|
it is advisable to restrict names to the lowest common denominator,
|
|
163
163
|
which is a maximum of 8 characters beginning with a letter.
|
|
164
164
|
|
|
165
|
-
Note that
|
|
165
|
+
Note that OpenVox considers group names to be case-sensitive, regardless
|
|
166
166
|
of the platform's own rules; be sure to always use the same case when
|
|
167
167
|
referring to a given group."
|
|
168
168
|
isnamevar
|
|
@@ -197,10 +197,10 @@ module Puppet
|
|
|
197
197
|
newparam(:attribute_membership) do
|
|
198
198
|
desc "AIX only. Configures the behavior of the `attributes` parameter.
|
|
199
199
|
|
|
200
|
-
* `minimum` (default) --- The provided list of attributes is partial, and
|
|
200
|
+
* `minimum` (default) --- The provided list of attributes is partial, and OpenVox
|
|
201
201
|
**ignores** any attributes that aren't listed there.
|
|
202
202
|
* `inclusive` --- The provided list of attributes is comprehensive, and
|
|
203
|
-
|
|
203
|
+
OpenVox **purges** any attributes that aren't listed there."
|
|
204
204
|
|
|
205
205
|
newvalues(:inclusive, :minimum)
|
|
206
206
|
|
data/lib/puppet/type/notify.rb
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
|
|
6
6
|
module Puppet
|
|
7
7
|
Type.newtype(:notify) do
|
|
8
|
-
@doc = "Sends an arbitrary message, specified as a string, to the agent run-time log. It's important to note that the notify resource type is not idempotent. As a result, notifications are shown as a change on every
|
|
8
|
+
@doc = "Sends an arbitrary message, specified as a string, to the agent run-time log. It's important to note that the notify resource type is not idempotent. As a result, notifications are shown as a change on every OpenVox run."
|
|
9
9
|
|
|
10
10
|
apply_to_all
|
|
11
11
|
|
data/lib/puppet/type/package.rb
CHANGED
|
@@ -17,7 +17,7 @@ module Puppet
|
|
|
17
17
|
cannot. For those package formats that cannot retrieve their own files,
|
|
18
18
|
you can use the `source` parameter to point to the correct file.
|
|
19
19
|
|
|
20
|
-
|
|
20
|
+
OpenVox will automatically guess the packaging format that you are
|
|
21
21
|
using based on the platform you are on, but you can override it
|
|
22
22
|
using the `provider` parameter; each provider defines what it
|
|
23
23
|
requires in order to function, and you must meet those requirements
|
|
@@ -30,7 +30,7 @@ module Puppet
|
|
|
30
30
|
resource; `Package[<NAME>]` is not a synonym for `Package[<TITLE>]` like
|
|
31
31
|
it is for many other resource types.
|
|
32
32
|
|
|
33
|
-
**Autorequires:** If
|
|
33
|
+
**Autorequires:** If OpenVox is managing the files specified as a
|
|
34
34
|
package's `adminfile`, `responsefile`, or `source`, the package
|
|
35
35
|
resource will autorequire those files."
|
|
36
36
|
|
|
@@ -431,7 +431,7 @@ module Puppet
|
|
|
431
431
|
|
|
432
432
|
Different providers accept different values for `source`. Most providers
|
|
433
433
|
accept paths to local files stored on the target system. Some providers
|
|
434
|
-
may also accept URLs or network drive paths.
|
|
434
|
+
may also accept URLs or network drive paths. OpenVox will not
|
|
435
435
|
automatically retrieve source files for you, and usually just passes the
|
|
436
436
|
value of `source` to the package installation command.
|
|
437
437
|
|
|
@@ -598,7 +598,7 @@ module Puppet
|
|
|
598
598
|
option will automatically be quoted when passed to the uninstall
|
|
599
599
|
command.
|
|
600
600
|
|
|
601
|
-
On Windows, this is the **only** place in
|
|
601
|
+
On Windows, this is the **only** place in OpenVox where backslash
|
|
602
602
|
separators should be used. Note that backslashes in double-quoted
|
|
603
603
|
strings _must_ be double-escaped and backslashes in single-quoted
|
|
604
604
|
strings _may_ be double-escaped.
|
data/lib/puppet/type/schedule.rb
CHANGED
|
@@ -3,8 +3,8 @@
|
|
|
3
3
|
module Puppet
|
|
4
4
|
Type.newtype(:schedule) do
|
|
5
5
|
@doc = <<-'EOT'
|
|
6
|
-
Define schedules for
|
|
7
|
-
[`schedule`](https://
|
|
6
|
+
Define schedules for OpenVox. Resources can be limited to a schedule by using the
|
|
7
|
+
[`schedule`](https://docs.openvoxproject.org/openvox/latest/metaparameter.html#schedule)
|
|
8
8
|
metaparameter.
|
|
9
9
|
|
|
10
10
|
Currently, **schedules can only be used to stop a resource from being
|
|
@@ -12,11 +12,11 @@ module Puppet
|
|
|
12
12
|
wouldn't be, and they cannot accurately specify a time when a resource
|
|
13
13
|
should run.
|
|
14
14
|
|
|
15
|
-
Every time
|
|
15
|
+
Every time OpenVox applies its configuration, it will apply the
|
|
16
16
|
set of resources whose schedule does not eliminate them from
|
|
17
17
|
running right then, but there is currently no system in place to
|
|
18
18
|
guarantee that a given resource runs at a given time. If you
|
|
19
|
-
specify a very restrictive schedule and
|
|
19
|
+
specify a very restrictive schedule and OpenVox happens to run at a
|
|
20
20
|
time within that schedule, then the resources will get applied;
|
|
21
21
|
otherwise, that work may never get done.
|
|
22
22
|
|
|
@@ -31,13 +31,13 @@ module Puppet
|
|
|
31
31
|
repeat => 1,
|
|
32
32
|
}
|
|
33
33
|
|
|
34
|
-
With this schedule, the first time that
|
|
34
|
+
With this schedule, the first time that OpenVox runs between 2 and 4 AM,
|
|
35
35
|
all resources with this schedule will get applied, but they won't
|
|
36
36
|
get applied again between 2 and 4 because they will have already
|
|
37
37
|
run once that day, and they won't get applied outside that schedule
|
|
38
38
|
because they will be outside the scheduled range.
|
|
39
39
|
|
|
40
|
-
|
|
40
|
+
OpenVox automatically creates a schedule for each of the valid periods
|
|
41
41
|
with the same name as that period (such as hourly and daily).
|
|
42
42
|
Additionally, a schedule named `puppet` is created and used as the
|
|
43
43
|
default, with the following attributes:
|
|
@@ -195,7 +195,7 @@ module Puppet
|
|
|
195
195
|
newparam(:period) do
|
|
196
196
|
desc <<-EOT
|
|
197
197
|
The period of repetition for resources on this schedule. The default is
|
|
198
|
-
for resources to get applied every time
|
|
198
|
+
for resources to get applied every time OpenVox runs.
|
|
199
199
|
|
|
200
200
|
Note that the period defines how often a given resource will get
|
|
201
201
|
applied but not when; if you would like to restrict the hours
|
|
@@ -203,7 +203,7 @@ module Puppet
|
|
|
203
203
|
during a maintenance window), then use the `range` attribute.
|
|
204
204
|
|
|
205
205
|
If the provided periods are not sufficient, you can provide a
|
|
206
|
-
value to the *repeat* attribute, which will cause
|
|
206
|
+
value to the *repeat* attribute, which will cause OpenVox to
|
|
207
207
|
schedule the affected resources evenly in the period the
|
|
208
208
|
specified number of times. Take this schedule:
|
|
209
209
|
|
|
@@ -212,12 +212,12 @@ module Puppet
|
|
|
212
212
|
repeat => 6,
|
|
213
213
|
}
|
|
214
214
|
|
|
215
|
-
This can cause
|
|
215
|
+
This can cause OpenVox to apply that resource up to every 10 minutes.
|
|
216
216
|
|
|
217
|
-
At the moment,
|
|
217
|
+
At the moment, OpenVox cannot guarantee that level of repetition; that
|
|
218
218
|
is, the resource can applied _up to_ every 10 minutes, but internal
|
|
219
219
|
factors might prevent it from actually running that often (for instance,
|
|
220
|
-
if
|
|
220
|
+
if an OpenVox run is still in progress when the next run is scheduled to
|
|
221
221
|
start, that next run will be suppressed).
|
|
222
222
|
|
|
223
223
|
See the `periodmatch` attribute for tuning whether to match
|
data/lib/puppet/type/service.rb
CHANGED
|
@@ -11,24 +11,24 @@ module Puppet
|
|
|
11
11
|
@doc = "Manage running services. Service support unfortunately varies
|
|
12
12
|
widely by platform --- some platforms have very little if any concept of a
|
|
13
13
|
running service, and some have a very codified and powerful concept.
|
|
14
|
-
|
|
14
|
+
OpenVox's service support is usually capable of doing the right thing, but
|
|
15
15
|
the more information you can provide, the better behaviour you will get.
|
|
16
16
|
|
|
17
17
|
Puppet 2.7 and newer expect init scripts to have a working status command.
|
|
18
18
|
If this isn't the case for any of your services' init scripts, you will
|
|
19
19
|
need to set `hasstatus` to false and possibly specify a custom status
|
|
20
|
-
command in the `status` attribute. As a last resort,
|
|
20
|
+
command in the `status` attribute. As a last resort, OpenVox will attempt to
|
|
21
21
|
search the process table by calling whatever command is listed in the `ps`
|
|
22
22
|
fact. The default search pattern is the name of the service, but you can
|
|
23
23
|
specify it with the `pattern` attribute.
|
|
24
24
|
|
|
25
25
|
**Refresh:** `service` resources can respond to refresh events (via
|
|
26
26
|
`notify`, `subscribe`, or the `~>` arrow). If a `service` receives an
|
|
27
|
-
event from another resource,
|
|
27
|
+
event from another resource, OpenVox will restart the service it manages.
|
|
28
28
|
The actual command used to restart the service depends on the platform and
|
|
29
29
|
can be configured:
|
|
30
30
|
|
|
31
|
-
* If you set `hasrestart` to true,
|
|
31
|
+
* If you set `hasrestart` to true, OpenVox will use the init script's restart command.
|
|
32
32
|
* You can provide an explicit command for restarting with the `restart` attribute.
|
|
33
33
|
* If you do neither, the service's stop and start commands will be used."
|
|
34
34
|
|
|
@@ -61,7 +61,7 @@ module Puppet
|
|
|
61
61
|
wherever possible, it relies on local tools to enable or disable
|
|
62
62
|
a given service. Default values depend on the platform.
|
|
63
63
|
|
|
64
|
-
If you don't specify a value for the `enable` attribute,
|
|
64
|
+
If you don't specify a value for the `enable` attribute, OpenVox leaves
|
|
65
65
|
that aspect of the service alone and your operating system determines
|
|
66
66
|
the behavior."
|
|
67
67
|
|
|
@@ -175,12 +175,12 @@ module Puppet
|
|
|
175
175
|
The init script's status command must return 0 if the service is
|
|
176
176
|
running and a nonzero value otherwise. Ideally, these exit codes
|
|
177
177
|
should conform to [the LSB's specification][lsb-exit-codes] for init
|
|
178
|
-
script status actions, but
|
|
178
|
+
script status actions, but OpenVox only considers the difference
|
|
179
179
|
between 0 and nonzero to be relevant.
|
|
180
180
|
|
|
181
181
|
If a service's init script does not support any kind of status command,
|
|
182
182
|
you should set `hasstatus` to false and either provide a specific
|
|
183
|
-
command using the `status` attribute or expect that
|
|
183
|
+
command using the `status` attribute or expect that OpenVox will look for
|
|
184
184
|
the service name in the process table. Be aware that 'virtual' init
|
|
185
185
|
scripts (like 'network' under Red Hat systems) will respond poorly to
|
|
186
186
|
refresh events from other resources if you override the default behavior
|
|
@@ -240,7 +240,7 @@ module Puppet
|
|
|
240
240
|
return 0 if the service is running and a nonzero value otherwise.
|
|
241
241
|
Ideally, these exit codes should conform to [the LSB's
|
|
242
242
|
specification][lsb-exit-codes] for init script status actions, but
|
|
243
|
-
|
|
243
|
+
OpenVox only considers the difference between 0 and nonzero to be
|
|
244
244
|
relevant.
|
|
245
245
|
|
|
246
246
|
If left unspecified, the status of the service will be determined
|
data/lib/puppet/type/stage.rb
CHANGED
|
@@ -4,7 +4,7 @@ Puppet::Type.newtype(:stage) do
|
|
|
4
4
|
desc "A resource type for creating new run stages. Once a stage is available,
|
|
5
5
|
classes can be assigned to it by declaring them with the resource-like syntax
|
|
6
6
|
and using
|
|
7
|
-
[the `stage` metaparameter](https://
|
|
7
|
+
[the `stage` metaparameter](https://docs.openvoxproject.org/openvox/latest/metaparameter.html#stage).
|
|
8
8
|
|
|
9
9
|
Note that new stages are not useful unless you also declare their order
|
|
10
10
|
in relation to the default `main` stage.
|
data/lib/puppet/type/user.rb
CHANGED
|
@@ -16,9 +16,9 @@ module Puppet
|
|
|
16
16
|
groups and generally uses POSIX APIs for retrieving information
|
|
17
17
|
about them. It does not directly modify `/etc/passwd` or anything.
|
|
18
18
|
|
|
19
|
-
**Autorequires:** If
|
|
19
|
+
**Autorequires:** If OpenVox is managing the user's primary group (as
|
|
20
20
|
provided in the `gid` attribute) or any group listed in the `groups`
|
|
21
|
-
attribute then the user resource will autorequire that group. If
|
|
21
|
+
attribute then the user resource will autorequire that group. If OpenVox
|
|
22
22
|
is managing any role accounts corresponding to the user's roles, the
|
|
23
23
|
user resource will autorequire those role accounts."
|
|
24
24
|
|
|
@@ -126,7 +126,7 @@ module Puppet
|
|
|
126
126
|
automatically. This will likely result in the same user having
|
|
127
127
|
different UIDs on different systems, which is not recommended. This is
|
|
128
128
|
especially noteworthy when managing the same user on both Darwin and
|
|
129
|
-
other platforms, since
|
|
129
|
+
other platforms, since OpenVox does UID generation on Darwin, but
|
|
130
130
|
the underlying tools do so on other platforms.
|
|
131
131
|
|
|
132
132
|
On Windows, this property is read-only and will return the user's
|
|
@@ -149,7 +149,7 @@ module Puppet
|
|
|
149
149
|
|
|
150
150
|
This attribute is not supported on Windows systems; use the `groups`
|
|
151
151
|
attribute instead. (On Windows, designating a primary group is only
|
|
152
|
-
meaningful for domain accounts, which
|
|
152
|
+
meaningful for domain accounts, which OpenVox does not currently manage.)"
|
|
153
153
|
|
|
154
154
|
munge do |value|
|
|
155
155
|
if value.is_a?(String) and value =~ /^[-0-9]+$/
|
|
@@ -223,26 +223,24 @@ module Puppet
|
|
|
223
223
|
encryption formats and requirements.
|
|
224
224
|
|
|
225
225
|
* Mac OS X 10.5 and 10.6, and some older Linux distributions, use salted SHA1
|
|
226
|
-
hashes. You can use
|
|
226
|
+
hashes. You can use OpenVox's built-in `sha1` function to generate a salted SHA1
|
|
227
227
|
hash from a password.
|
|
228
228
|
* Mac OS X 10.7 (Lion), and many recent Linux distributions, use salted SHA512
|
|
229
|
-
hashes. The
|
|
229
|
+
hashes. The puppetlabs [stdlib](https://forge.puppet.com/modules/puppetlabs/stdlib) module contains a `str2saltedsha512` function
|
|
230
230
|
which can generate password hashes for these operating systems.
|
|
231
231
|
* OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When managing passwords
|
|
232
232
|
on these systems, the `salt` and `iterations` attributes need to be specified as
|
|
233
233
|
well as the password.
|
|
234
|
-
* macOS 10.15 and later require the salt to be 32 bytes. Because
|
|
234
|
+
* macOS 10.15 and later require the salt to be 32 bytes. Because OpenVox's user
|
|
235
235
|
resource requires the value to be hex encoded, the length of the salt's
|
|
236
236
|
string must be 64.
|
|
237
237
|
* Windows passwords can be managed only in cleartext, because there is no Windows
|
|
238
238
|
API for setting the password hash.
|
|
239
239
|
|
|
240
|
-
[stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
|
|
241
|
-
|
|
242
240
|
Enclose any value that includes a dollar sign ($) in single quotes (') to avoid
|
|
243
241
|
accidental variable interpolation.
|
|
244
242
|
|
|
245
|
-
To redact passwords from reports to
|
|
243
|
+
To redact passwords from reports to OpenVoxDB, use the `Sensitive` data type. For
|
|
246
244
|
example, this resource protects the password:
|
|
247
245
|
|
|
248
246
|
```puppet
|
|
@@ -388,18 +386,18 @@ module Puppet
|
|
|
388
386
|
it is advisable to restrict names to the lowest common denominator,
|
|
389
387
|
which is a maximum of 8 characters beginning with a letter.
|
|
390
388
|
|
|
391
|
-
Note that
|
|
389
|
+
Note that OpenVox considers user names to be case-sensitive, regardless
|
|
392
390
|
of the platform's own rules; be sure to always use the same case when
|
|
393
391
|
referring to a given user."
|
|
394
392
|
isnamevar
|
|
395
393
|
end
|
|
396
394
|
|
|
397
395
|
newparam(:membership) do
|
|
398
|
-
desc "If `minimum` is specified,
|
|
396
|
+
desc "If `minimum` is specified, OpenVox will ensure that the user is a
|
|
399
397
|
member of all specified groups, but will not remove any other groups
|
|
400
398
|
that the user is a part of.
|
|
401
399
|
|
|
402
|
-
If `inclusive` is specified,
|
|
400
|
+
If `inclusive` is specified, OpenVox will ensure that the user is a
|
|
403
401
|
member of **only** specified groups."
|
|
404
402
|
|
|
405
403
|
newvalues(:inclusive, :minimum)
|
|
@@ -423,14 +421,14 @@ module Puppet
|
|
|
423
421
|
end
|
|
424
422
|
|
|
425
423
|
newparam(:managehome, :boolean => true, :parent => Puppet::Parameter::Boolean) do
|
|
426
|
-
desc "Whether to manage the home directory when
|
|
427
|
-
This creates the home directory if
|
|
428
|
-
home directory if
|
|
429
|
-
|
|
430
|
-
This parameter has no effect unless
|
|
431
|
-
resource at the same time. For instance,
|
|
432
|
-
user if `ensure => present` and the user does not exist at the time of the
|
|
433
|
-
If the home directory is then deleted manually,
|
|
424
|
+
desc "Whether to manage the home directory when OpenVox creates or removes the user.
|
|
425
|
+
This creates the home directory if OpenVox also creates the user account, and deletes the
|
|
426
|
+
home directory if OpenVox also removes the user account.
|
|
427
|
+
|
|
428
|
+
This parameter has no effect unless OpenVox is also creating or removing the user in the
|
|
429
|
+
resource at the same time. For instance, OpenVox creates a home directory for a managed
|
|
430
|
+
user if `ensure => present` and the user does not exist at the time of the OpenVox run.
|
|
431
|
+
If the home directory is then deleted manually, OpenVox will not recreate it on the next
|
|
434
432
|
run.
|
|
435
433
|
|
|
436
434
|
Note that on Windows, this manages creation/deletion of the user profile instead of the
|
data/lib/puppet/type/whit.rb
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
3
|
Puppet::Type.newtype(:whit) do
|
|
4
|
-
desc "Whits are internal artifacts of
|
|
5
|
-
|
|
4
|
+
desc "Whits are internal artifacts of OpenVox's current implementation, and
|
|
5
|
+
OpenVox suppresses their appearance in all logs. We make no guarantee of
|
|
6
6
|
the whit's continued existence, and it should never be used in an actual
|
|
7
7
|
manifest. Use the `anchor` type from the puppetlabs-stdlib module if you
|
|
8
8
|
need arbitrary whit-like no-op resources."
|