openvox 9.0.0.pre.alpha2 → 9.0.0.pre.beta2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +114 -1
- data/CODE_OF_CONDUCT.md +1 -1
- data/Gemfile +5 -5
- data/README.md +6 -6
- data/Rakefile +3 -3
- data/conf/environment.conf +2 -2
- data/conf/fileserver.conf +3 -3
- data/conf/puppet.conf +4 -4
- data/examples/enc/regexp_nodes/regexp_nodes.rb +2 -2
- data/examples/hiera/README.md +1 -1
- data/examples/nagios/check_puppet.rb +1 -1
- data/ext/README.md +3 -3
- data/ext/hiera/hiera.yaml +1 -1
- data/ext/project_data.yaml +1 -1
- data/ext/redhat/client.sysconfig +1 -0
- data/ext/solaris/smf/puppet.xml +2 -2
- data/ext/windows/puppet_interactive.bat +1 -1
- data/ext/windows/service/daemon.rb +5 -5
- data/lib/hiera/puppet_function.rb +1 -2
- data/lib/hiera_puppet.rb +1 -1
- data/lib/puppet/agent/disabler.rb +3 -3
- data/lib/puppet/agent/locker.rb +1 -1
- data/lib/puppet/agent.rb +2 -2
- data/lib/puppet/application/agent.rb +33 -35
- data/lib/puppet/application/apply.rb +7 -7
- data/lib/puppet/application/describe.rb +3 -3
- data/lib/puppet/application/device.rb +1 -1
- data/lib/puppet/application/doc.rb +5 -7
- data/lib/puppet/application/facts.rb +1 -1
- data/lib/puppet/application/filebucket.rb +5 -5
- data/lib/puppet/application/lookup.rb +8 -8
- data/lib/puppet/application/resource.rb +5 -5
- data/lib/puppet/application/script.rb +3 -3
- data/lib/puppet/application/ssl.rb +4 -4
- data/lib/puppet/application_support.rb +2 -2
- data/lib/puppet/configurer.rb +13 -7
- data/lib/puppet/confine/variable.rb +2 -2
- data/lib/puppet/context.rb +1 -1
- data/lib/puppet/data_binding.rb +1 -1
- data/lib/puppet/defaults.rb +157 -226
- data/lib/puppet/error.rb +1 -1
- data/lib/puppet/etc.rb +4 -4
- data/lib/puppet/face/catalog/select.rb +3 -3
- data/lib/puppet/face/catalog.rb +4 -4
- data/lib/puppet/face/config.rb +6 -6
- data/lib/puppet/face/facts.rb +6 -6
- data/lib/puppet/face/help/man.erb +3 -3
- data/lib/puppet/face/node/clean.rb +3 -3
- data/lib/puppet/face/node.rb +2 -2
- data/lib/puppet/face/plugin.rb +4 -4
- data/lib/puppet/functions/all.rb +4 -4
- data/lib/puppet/functions/any.rb +4 -4
- data/lib/puppet/functions/assert_type.rb +5 -5
- data/lib/puppet/functions/defined.rb +1 -1
- data/lib/puppet/functions/each.rb +11 -11
- data/lib/puppet/functions/epp.rb +5 -5
- data/lib/puppet/functions/eyaml_lookup_key.rb +1 -1
- data/lib/puppet/functions/filter.rb +5 -5
- data/lib/puppet/functions/find_file.rb +1 -1
- data/lib/puppet/functions/hiera.rb +4 -4
- data/lib/puppet/functions/hiera_array.rb +5 -5
- data/lib/puppet/functions/hiera_hash.rb +5 -5
- data/lib/puppet/functions/hiera_include.rb +6 -6
- data/lib/puppet/functions/hocon_data.rb +1 -1
- data/lib/puppet/functions/include.rb +1 -1
- data/lib/puppet/functions/index.rb +3 -3
- data/lib/puppet/functions/inline_epp.rb +6 -6
- data/lib/puppet/functions/json_data.rb +1 -1
- data/lib/puppet/functions/lest.rb +1 -1
- data/lib/puppet/functions/lookup.rb +14 -14
- data/lib/puppet/functions/map.rb +5 -5
- data/lib/puppet/functions/reduce.rb +6 -6
- data/lib/puppet/functions/regsubst.rb +1 -13
- data/lib/puppet/functions/reverse_each.rb +5 -5
- data/lib/puppet/functions/scanf.rb +1 -1
- data/lib/puppet/functions/step.rb +5 -5
- data/lib/puppet/functions/then.rb +1 -1
- data/lib/puppet/functions/tree_each.rb +3 -3
- data/lib/puppet/functions/versioncmp.rb +1 -1
- data/lib/puppet/functions/with.rb +2 -2
- data/lib/puppet/functions/yaml_data.rb +1 -1
- data/lib/puppet/generate/type.rb +5 -1
- data/lib/puppet/gettext/config.rb +5 -5
- data/lib/puppet/gettext/module_translations.rb +1 -1
- data/lib/puppet/graph/simple_graph.rb +0 -1
- data/lib/puppet/http/client.rb +5 -5
- data/lib/puppet/http/factory.rb +1 -1
- data/lib/puppet/http/resolver/server_list.rb +2 -2
- data/lib/puppet/http/service/compiler.rb +3 -3
- data/lib/puppet/http/service/file_server.rb +1 -1
- data/lib/puppet/http/service.rb +19 -1
- data/lib/puppet/http/session.rb +1 -1
- data/lib/puppet/http.rb +1 -1
- data/lib/puppet/indirector/catalog/compiler.rb +2 -2
- data/lib/puppet/indirector/data_binding/hiera.rb +93 -2
- data/lib/puppet/indirector/face.rb +4 -4
- data/lib/puppet/indirector/facts/facter.rb +7 -7
- data/lib/puppet/indirector/file_bucket_file/file.rb +2 -2
- data/lib/puppet/indirector/file_bucket_file/rest.rb +7 -3
- data/lib/puppet/indirector/file_content/file_server.rb +1 -1
- data/lib/puppet/indirector/file_metadata/file_server.rb +1 -1
- data/lib/puppet/indirector/node/exec.rb +1 -1
- data/lib/puppet/indirector/node/rest.rb +1 -1
- data/lib/puppet/indirector/report/processor.rb +1 -1
- data/lib/puppet/indirector.rb +1 -1
- data/lib/puppet/interface/documentation.rb +1 -1
- data/lib/puppet/interface/face_collection.rb +1 -1
- data/lib/puppet/interface/option.rb +2 -2
- data/lib/puppet/module/task.rb +1 -1
- data/lib/puppet/module_tool/applications/application.rb +1 -1
- data/lib/puppet/module_tool/metadata.rb +1 -2
- data/lib/puppet/module_tool.rb +1 -1
- data/lib/puppet/network/authorization.rb +1 -1
- data/lib/puppet/network/http/api.rb +2 -2
- data/lib/puppet/network/http/connection.rb +2 -2
- data/lib/puppet/node/environment.rb +6 -6
- data/lib/puppet/node.rb +2 -2
- data/lib/puppet/pal/catalog_compiler.rb +1 -1
- data/lib/puppet/pal/pal_impl.rb +1 -25
- data/lib/puppet/parser/compiler.rb +1 -1
- data/lib/puppet/parser/functions/assert_type.rb +5 -5
- data/lib/puppet/parser/functions/create_resources.rb +1 -1
- data/lib/puppet/parser/functions/defined.rb +1 -1
- data/lib/puppet/parser/functions/digest.rb +1 -1
- data/lib/puppet/parser/functions/each.rb +11 -11
- data/lib/puppet/parser/functions/epp.rb +5 -5
- data/lib/puppet/parser/functions/filter.rb +5 -5
- data/lib/puppet/parser/functions/generate.rb +1 -1
- data/lib/puppet/parser/functions/hiera.rb +3 -3
- data/lib/puppet/parser/functions/hiera_array.rb +4 -4
- data/lib/puppet/parser/functions/hiera_hash.rb +4 -4
- data/lib/puppet/parser/functions/hiera_include.rb +5 -5
- data/lib/puppet/parser/functions/include.rb +1 -1
- data/lib/puppet/parser/functions/inline_epp.rb +6 -6
- data/lib/puppet/parser/functions/inline_template.rb +1 -1
- data/lib/puppet/parser/functions/lest.rb +1 -1
- data/lib/puppet/parser/functions/lookup.rb +14 -14
- data/lib/puppet/parser/functions/map.rb +5 -5
- data/lib/puppet/parser/functions/reduce.rb +7 -7
- data/lib/puppet/parser/functions/reverse_each.rb +5 -5
- data/lib/puppet/parser/functions/scanf.rb +1 -1
- data/lib/puppet/parser/functions/step.rb +5 -5
- data/lib/puppet/parser/functions/then.rb +1 -1
- data/lib/puppet/parser/functions/versioncmp.rb +1 -1
- data/lib/puppet/parser/functions/with.rb +1 -1
- data/lib/puppet/parser/functions.rb +3 -3
- data/lib/puppet/parser/scope.rb +1 -1
- data/lib/puppet/plugins/syntax_checkers.rb +2 -2
- data/lib/puppet/plugins.rb +1 -1
- data/lib/puppet/pops/evaluator/collectors/exported_collector.rb +1 -1
- data/lib/puppet/pops/evaluator/deferred_resolver.rb +4 -1
- data/lib/puppet/pops/issues.rb +3 -3
- data/lib/puppet/pops/loader/module_loaders.rb +4 -4
- data/lib/puppet/pops/loader/ruby_legacy_function_instantiator.rb +1 -1
- data/lib/puppet/pops/loaders.rb +4 -4
- data/lib/puppet/pops/lookup/lookup_adapter.rb +7 -66
- data/lib/puppet/pops/model/factory.rb +5 -5
- data/lib/puppet/pops/resource/resource_type_impl.rb +1 -1
- data/lib/puppet/pops/serialization/to_data_converter.rb +1 -1
- data/lib/puppet/pops/types/iterable.rb +1 -1
- data/lib/puppet/property/keyvalue.rb +3 -3
- data/lib/puppet/provider/group/aix.rb +2 -2
- data/lib/puppet/provider/nameservice/directoryservice.rb +2 -2
- data/lib/puppet/provider/package/aix.rb +1 -1
- data/lib/puppet/provider/package/apt.rb +2 -2
- data/lib/puppet/provider/package/aptitude.rb +0 -1
- data/lib/puppet/provider/package/dnfmodule.rb +1 -1
- data/lib/puppet/provider/package/nim.rb +1 -1
- data/lib/puppet/provider/package/pacman.rb +1 -2
- data/lib/puppet/provider/package/pip.rb +1 -1
- data/lib/puppet/provider/package/pip2.rb +1 -1
- data/lib/puppet/provider/package/pip3.rb +1 -1
- data/lib/puppet/provider/package/pkgdmg.rb +2 -2
- data/lib/puppet/provider/package/puppet_gem.rb +2 -2
- data/lib/puppet/provider/package/puppetserver_gem.rb +1 -1
- data/lib/puppet/provider/package/windows.rb +1 -1
- data/lib/puppet/provider/service/freebsd.rb +1 -1
- data/lib/puppet/provider/service/init.rb +5 -5
- data/lib/puppet/provider/service/launchd.rb +2 -2
- data/lib/puppet/provider/service/smf.rb +1 -1
- data/lib/puppet/provider/service/upstart.rb +2 -2
- data/lib/puppet/provider/user/aix.rb +3 -3
- data/lib/puppet/provider/user/directoryservice.rb +9 -9
- data/lib/puppet/provider/user/pw.rb +3 -3
- data/lib/puppet/provider.rb +1 -1
- data/lib/puppet/reference/configuration.rb +6 -13
- data/lib/puppet/reference/function.rb +4 -4
- data/lib/puppet/reference/indirection.rb +2 -2
- data/lib/puppet/reference/metaparameter.rb +3 -3
- data/lib/puppet/reference/providers.rb +3 -3
- data/lib/puppet/reference/report.rb +4 -4
- data/lib/puppet/reference/type.rb +2 -2
- data/lib/puppet/relationship.rb +1 -1
- data/lib/puppet/reports/http.rb +4 -4
- data/lib/puppet/reports.rb +1 -1
- data/lib/puppet/resource/catalog.rb +4 -4
- data/lib/puppet/resource/type.rb +8 -8
- data/lib/puppet/settings/base_setting.rb +2 -3
- data/lib/puppet/settings/config_file.rb +3 -3
- data/lib/puppet/settings/environment_conf.rb +3 -11
- data/lib/puppet/settings.rb +11 -51
- data/lib/puppet/ssl/certificate.rb +4 -0
- data/lib/puppet/ssl/certificate_request.rb +1 -1
- data/lib/puppet/ssl/oids.rb +1 -1
- data/lib/puppet/ssl/openssl_loader.rb +1 -1
- data/lib/puppet/ssl/ssl_provider.rb +5 -5
- data/lib/puppet/ssl/state_machine.rb +9 -3
- data/lib/puppet/syntax_checkers.rb +1 -1
- data/lib/puppet/transaction/report.rb +3 -3
- data/lib/puppet/transaction.rb +0 -1
- data/lib/puppet/type/exec.rb +20 -20
- data/lib/puppet/type/file/content.rb +10 -37
- data/lib/puppet/type/file/ensure.rb +18 -9
- data/lib/puppet/type/file/mode.rb +4 -4
- data/lib/puppet/type/file/selcontext.rb +2 -2
- data/lib/puppet/type/file/source.rb +19 -25
- data/lib/puppet/type/file.rb +22 -15
- data/lib/puppet/type/filebucket.rb +22 -8
- data/lib/puppet/type/group.rb +5 -5
- data/lib/puppet/type/notify.rb +1 -1
- data/lib/puppet/type/package.rb +4 -4
- data/lib/puppet/type/schedule.rb +11 -11
- data/lib/puppet/type/service.rb +8 -8
- data/lib/puppet/type/stage.rb +1 -1
- data/lib/puppet/type/user.rb +19 -21
- data/lib/puppet/type/whit.rb +2 -2
- data/lib/puppet/type.rb +27 -27
- data/lib/puppet/util/character_encoding.rb +3 -3
- data/lib/puppet/util/command_line.rb +1 -1
- data/lib/puppet/util/execution.rb +1 -1
- data/lib/puppet/util/filetype.rb +6 -6
- data/lib/puppet/util/log.rb +2 -2
- data/lib/puppet/util/logging.rb +3 -3
- data/lib/puppet/util/plist.rb +1 -1
- data/lib/puppet/util/profiler/around_profiler.rb +1 -1
- data/lib/puppet/util/profiler.rb +1 -1
- data/lib/puppet/util/rdoc.rb +6 -3
- data/lib/puppet/util/selinux.rb +5 -5
- data/lib/puppet/util/tag_set.rb +0 -1
- data/lib/puppet/util/windows/adsi.rb +1 -1
- data/lib/puppet/util/windows/com.rb +2 -2
- data/lib/puppet/util/windows/eventlog.rb +6 -6
- data/lib/puppet/util/windows/file.rb +2 -2
- data/lib/puppet/util/windows/security.rb +3 -3
- data/lib/puppet/util.rb +8 -3
- data/lib/puppet/version.rb +8 -8
- data/lib/puppet/x509/cert_provider.rb +1 -1
- data/lib/puppet.rb +5 -5
- data/locales/config.yaml +3 -3
- data/locales/puppet.pot +462 -464
- data/man/man5/puppet.conf.5 +122 -146
- data/man/man8/puppet-agent.8 +25 -25
- data/man/man8/puppet-apply.8 +6 -6
- data/man/man8/puppet-catalog.8 +11 -11
- data/man/man8/puppet-config.8 +7 -7
- data/man/man8/puppet-describe.8 +3 -3
- data/man/man8/puppet-device.8 +2 -2
- data/man/man8/puppet-doc.8 +5 -5
- data/man/man8/puppet-epp.8 +3 -3
- data/man/man8/puppet-facts.8 +11 -11
- data/man/man8/puppet-filebucket.8 +5 -5
- data/man/man8/puppet-generate.8 +3 -3
- data/man/man8/puppet-help.8 +3 -3
- data/man/man8/puppet-lookup.8 +8 -8
- data/man/man8/puppet-module.8 +7 -7
- data/man/man8/puppet-node.8 +11 -45
- data/man/man8/puppet-parser.8 +3 -3
- data/man/man8/puppet-plugin.8 +7 -7
- data/man/man8/puppet-report.8 +6 -6
- data/man/man8/puppet-resource.8 +5 -5
- data/man/man8/puppet-script.8 +3 -3
- data/man/man8/puppet-ssl.8 +21 -23
- data/man/man8/puppet.8 +2 -2
- metadata +5 -8
- data/lib/puppet/indirector/hiera.rb +0 -101
- data/lib/puppet/util/rdoc/generators/puppet_generator.rb +0 -902
- data/lib/puppet/util/rdoc/generators/template/puppet/puppet.rb +0 -1068
data/lib/puppet/defaults.rb
CHANGED
|
@@ -74,18 +74,18 @@ module Puppet
|
|
|
74
74
|
:confdir => {
|
|
75
75
|
:default => nil,
|
|
76
76
|
:type => :directory,
|
|
77
|
-
:desc => "The main
|
|
77
|
+
:desc => "The main OpenVox configuration directory. The default for this setting
|
|
78
78
|
is calculated based on the user. If the process is running as root or
|
|
79
|
-
the user that
|
|
79
|
+
the user that OpenVox is supposed to run as, it defaults to a system
|
|
80
80
|
directory, but if it's running as any other user, it defaults to being
|
|
81
81
|
in the user's home directory.",
|
|
82
82
|
},
|
|
83
83
|
:codedir => {
|
|
84
84
|
:default => nil,
|
|
85
85
|
:type => :directory,
|
|
86
|
-
:desc => "The main
|
|
86
|
+
:desc => "The main OpenVox code directory. The default for this setting
|
|
87
87
|
is calculated based on the user. If the process is running as root or
|
|
88
|
-
the user that
|
|
88
|
+
the user that OpenVox is supposed to run as, it defaults to a system
|
|
89
89
|
directory, but if it's running as any other user, it defaults to being
|
|
90
90
|
in the user's home directory.",
|
|
91
91
|
},
|
|
@@ -94,7 +94,7 @@ module Puppet
|
|
|
94
94
|
:type => :directory,
|
|
95
95
|
:owner => "service",
|
|
96
96
|
:group => "service",
|
|
97
|
-
:desc => "Where
|
|
97
|
+
:desc => "Where OpenVox stores dynamic and growing data. The default for this
|
|
98
98
|
setting is calculated specially, like `confdir`_.",
|
|
99
99
|
},
|
|
100
100
|
|
|
@@ -120,7 +120,7 @@ module Puppet
|
|
|
120
120
|
:default => 'notice',
|
|
121
121
|
:type => :enum,
|
|
122
122
|
:values => %w[debug info notice warning err alert emerg crit],
|
|
123
|
-
:desc => "Default logging level for messages from
|
|
123
|
+
:desc => "Default logging level for messages from OpenVox. Allowed values are:
|
|
124
124
|
|
|
125
125
|
* debug
|
|
126
126
|
* info
|
|
@@ -138,10 +138,10 @@ module Puppet
|
|
|
138
138
|
:default => [],
|
|
139
139
|
:type => :array,
|
|
140
140
|
:desc => "A comma-separated list of warning types to suppress. If large numbers
|
|
141
|
-
of warnings are making
|
|
141
|
+
of warnings are making OpenVox's logs too large or difficult to use, you
|
|
142
142
|
can temporarily silence them with this setting.
|
|
143
143
|
|
|
144
|
-
If you are preparing to upgrade
|
|
144
|
+
If you are preparing to upgrade OpenVox to a new major version, you
|
|
145
145
|
should re-enable all warnings for a while.
|
|
146
146
|
|
|
147
147
|
Valid values for this setting are:
|
|
@@ -182,7 +182,7 @@ module Puppet
|
|
|
182
182
|
:default => :error,
|
|
183
183
|
:type => :symbolic_enum,
|
|
184
184
|
:values => [:off, :warning, :error],
|
|
185
|
-
:desc => "The strictness level of
|
|
185
|
+
:desc => "The strictness level of OpenVox. Allowed values are:
|
|
186
186
|
|
|
187
187
|
* off - do not perform extra validation, do not report
|
|
188
188
|
* warning - perform extra validation, report as warning
|
|
@@ -205,7 +205,7 @@ module Puppet
|
|
|
205
205
|
:disable_i18n => {
|
|
206
206
|
:default => true,
|
|
207
207
|
:type => :boolean,
|
|
208
|
-
:desc => "If true, turns off all translations of
|
|
208
|
+
:desc => "If true, turns off all translations of OpenVox and module
|
|
209
209
|
log messages, which affects error, warning, and info log messages,
|
|
210
210
|
as well as any translations in the report and CLI.",
|
|
211
211
|
:hook => proc do |value|
|
|
@@ -224,7 +224,7 @@ module Puppet
|
|
|
224
224
|
:desc => "The scheduling priority of the process. Valid values are 'high',
|
|
225
225
|
'normal', 'low', or 'idle', which are mapped to platform-specific
|
|
226
226
|
values. The priority can also be specified as an integer value and
|
|
227
|
-
will be passed as is, e.g. -5.
|
|
227
|
+
will be passed as is, e.g. -5. OpenVox must be running as a privileged
|
|
228
228
|
user in order to increase scheduling priority.",
|
|
229
229
|
},
|
|
230
230
|
:trace => {
|
|
@@ -233,7 +233,7 @@ module Puppet
|
|
|
233
233
|
:desc => "Whether to print stack traces on some errors. Will print
|
|
234
234
|
internal Ruby stack trace interleaved with Puppet function frames.",
|
|
235
235
|
:hook => proc do |value|
|
|
236
|
-
# Enable or disable
|
|
236
|
+
# Enable or disable OpenFact's trace option too
|
|
237
237
|
Puppet.runtime[:facter].trace(value)
|
|
238
238
|
end
|
|
239
239
|
},
|
|
@@ -258,8 +258,8 @@ module Puppet
|
|
|
258
258
|
:static_catalogs => {
|
|
259
259
|
:default => true,
|
|
260
260
|
:type => :boolean,
|
|
261
|
-
:desc => "Whether to compile a [static catalog](https://
|
|
262
|
-
which occurs only on
|
|
261
|
+
:desc => "Whether to compile a [static catalog](https://docs.openvoxproject.org/openvox/latest/static_catalogs.html#enabling-or-disabling-static-catalogs),
|
|
262
|
+
which occurs only on OpenVox Server when the `code-id-command` and
|
|
263
263
|
`code-content-command` settings are configured in its `puppetserver.conf` file.",
|
|
264
264
|
},
|
|
265
265
|
:settings_catalog => {
|
|
@@ -289,7 +289,7 @@ module Puppet
|
|
|
289
289
|
:default => "$vardir/state",
|
|
290
290
|
:type => :directory,
|
|
291
291
|
:mode => "01755",
|
|
292
|
-
:desc => "The directory where
|
|
292
|
+
:desc => "The directory where OpenVox state is stored. Generally,
|
|
293
293
|
this directory can be removed without causing harm (although it
|
|
294
294
|
might result in spurious service restarts)."
|
|
295
295
|
},
|
|
@@ -299,12 +299,12 @@ module Puppet
|
|
|
299
299
|
:mode => "0755",
|
|
300
300
|
:owner => "service",
|
|
301
301
|
:group => "service",
|
|
302
|
-
:desc => "Where
|
|
302
|
+
:desc => "Where OpenVox PID files are kept."
|
|
303
303
|
},
|
|
304
304
|
:genconfig => {
|
|
305
305
|
:default => false,
|
|
306
306
|
:type => :boolean,
|
|
307
|
-
:desc => "When true, causes
|
|
307
|
+
:desc => "When true, causes OpenVox applications to print an example config file
|
|
308
308
|
to stdout and exit. The example will include descriptions of each
|
|
309
309
|
setting, and the current (or default) value of each setting,
|
|
310
310
|
incorporating any settings overridden on the CLI (with the exception
|
|
@@ -318,14 +318,6 @@ module Puppet
|
|
|
318
318
|
sense when specified on the command line as `--genmanifest`. Takes into account arguments specified
|
|
319
319
|
on the CLI.",
|
|
320
320
|
},
|
|
321
|
-
:configprint => {
|
|
322
|
-
:default => "",
|
|
323
|
-
:deprecated => :completely,
|
|
324
|
-
:desc => "Prints the value of a specific configuration setting. If the name of a
|
|
325
|
-
setting is provided for this, then the value is printed and puppet
|
|
326
|
-
exits. Comma-separate multiple values. For a list of all values,
|
|
327
|
-
specify 'all'. This setting is deprecated, the 'puppet config' command replaces this functionality.",
|
|
328
|
-
},
|
|
329
321
|
:color => {
|
|
330
322
|
:default => "ansi",
|
|
331
323
|
:type => :string,
|
|
@@ -340,8 +332,8 @@ module Puppet
|
|
|
340
332
|
:manage_internal_file_permissions => {
|
|
341
333
|
:default => ! Puppet::Util::Platform.windows?,
|
|
342
334
|
:type => :boolean,
|
|
343
|
-
:desc => "Whether
|
|
344
|
-
**Note**: For Windows agents, the default is `false
|
|
335
|
+
:desc => "Whether OpenVox should manage the owner, group, and mode of files it uses internally.
|
|
336
|
+
**Note**: For Windows agents, the default is `false`.",
|
|
345
337
|
},
|
|
346
338
|
:onetime => {
|
|
347
339
|
:default => false,
|
|
@@ -374,18 +366,18 @@ module Puppet
|
|
|
374
366
|
:libdir => {
|
|
375
367
|
:type => :directory,
|
|
376
368
|
:default => "$vardir/lib",
|
|
377
|
-
:desc => "An extra search path for
|
|
378
|
-
for those files that
|
|
369
|
+
:desc => "An extra search path for OpenVox. This is only useful
|
|
370
|
+
for those files that OpenVox will load on demand, and is only
|
|
379
371
|
guaranteed to work for those cases. In fact, the autoload
|
|
380
372
|
mechanism is responsible for making sure this directory
|
|
381
373
|
is in Ruby's search path\n"
|
|
382
374
|
},
|
|
383
375
|
:environment => {
|
|
384
376
|
:default => "production",
|
|
385
|
-
:desc => "The environment in which
|
|
377
|
+
:desc => "The environment in which OpenVox is running. For clients,
|
|
386
378
|
such as `puppet agent`, this determines the environment itself, which
|
|
387
|
-
|
|
388
|
-
this provides the default environment for nodes that
|
|
379
|
+
OpenVox uses to find modules and much more. For servers, such as OpenVox Server,
|
|
380
|
+
this provides the default environment for nodes that OpenVox knows nothing about.
|
|
389
381
|
|
|
390
382
|
When defining an environment in the `[agent]` section, this refers to the
|
|
391
383
|
environment that the agent requests from the primary server. The environment doesn't
|
|
@@ -393,13 +385,13 @@ module Puppet
|
|
|
393
385
|
primary server. This definition is used when running `puppet agent`.
|
|
394
386
|
|
|
395
387
|
When defined in the `[user]` section, the environment refers to the path that
|
|
396
|
-
|
|
388
|
+
OpenVox uses to search for code and modules related to its execution. This
|
|
397
389
|
requires the environment to exist locally on the filesystem where puppet is
|
|
398
|
-
being executed.
|
|
390
|
+
being executed. OpenVox subcommands, including `puppet module` and
|
|
399
391
|
`puppet apply`, use this definition.
|
|
400
392
|
|
|
401
393
|
Given that the context and effects vary depending on the
|
|
402
|
-
[config section](https://
|
|
394
|
+
[config section](https://docs.openvoxproject.org/openvox/latest/config_file_main.html#config-sections)
|
|
403
395
|
in which the `environment` setting is defined, do not set it globally.",
|
|
404
396
|
:short => "E"
|
|
405
397
|
},
|
|
@@ -411,7 +403,7 @@ module Puppet
|
|
|
411
403
|
|
|
412
404
|
This setting must have a value set to enable **directory environments.** The
|
|
413
405
|
recommended value is `$codedir/environments`. For more details, see
|
|
414
|
-
<https://
|
|
406
|
+
<https://docs.openvoxproject.org/openvox/latest/environments_about.html>",
|
|
415
407
|
:type => :path,
|
|
416
408
|
},
|
|
417
409
|
:report_configured_environmentpath => {
|
|
@@ -419,7 +411,7 @@ module Puppet
|
|
|
419
411
|
:default => true,
|
|
420
412
|
:desc => <<-'EOT'
|
|
421
413
|
Specifies how environment paths are reported. When the value of
|
|
422
|
-
`versioned_environment_dirs` is `true`,
|
|
414
|
+
`versioned_environment_dirs` is `true`, OpenVox applies the readlink function to
|
|
423
415
|
the `environmentpath` setting when constructing the environment's modulepath. The
|
|
424
416
|
full readlinked path is referred to as the "resolved path," and the configured
|
|
425
417
|
path potentially containing symlinks is the "configured path." When reporting
|
|
@@ -433,7 +425,7 @@ module Puppet
|
|
|
433
425
|
:type => :boolean,
|
|
434
426
|
:default => true,
|
|
435
427
|
:desc => <<-'EOT'
|
|
436
|
-
|
|
428
|
+
OpenVox saves both the initial and converged environment in the last_run_summary file.
|
|
437
429
|
If they differ, and this setting is set to true, we will use the last converged
|
|
438
430
|
environment and skip the node request.
|
|
439
431
|
|
|
@@ -444,7 +436,7 @@ module Puppet
|
|
|
444
436
|
:type => :boolean,
|
|
445
437
|
:default => true,
|
|
446
438
|
:desc => <<-'EOT'
|
|
447
|
-
Affects how we cache attempts to load
|
|
439
|
+
Affects how we cache attempts to load OpenVox resource types and features. If
|
|
448
440
|
true, then calls to `Puppet.type.<type>?` `Puppet.feature.<feature>?`
|
|
449
441
|
will always attempt to load the type or feature (which can be an
|
|
450
442
|
expensive operation) unless it has already been loaded successfully.
|
|
@@ -469,16 +461,16 @@ module Puppet
|
|
|
469
461
|
:diff => {
|
|
470
462
|
:default => (Puppet::Util::Platform.windows? ? "" : "diff"),
|
|
471
463
|
:desc => "Which diff command to use when printing differences between files. This setting
|
|
472
|
-
has no default value on Windows, as standard `diff` is not available, but
|
|
464
|
+
has no default value on Windows, as standard `diff` is not available, but OpenVox can use many
|
|
473
465
|
third-party diff tools.",
|
|
474
466
|
},
|
|
475
467
|
:show_diff => {
|
|
476
468
|
:type => :boolean,
|
|
477
469
|
:default => false,
|
|
478
470
|
:desc => "Whether to log and report a contextual diff when files are being replaced.
|
|
479
|
-
This causes partial file contents to pass through
|
|
471
|
+
This causes partial file contents to pass through OpenVox's normal
|
|
480
472
|
logging and reporting system, so this setting should be used with
|
|
481
|
-
caution if you are sending
|
|
473
|
+
caution if you are sending OpenVox's reports to an insecure
|
|
482
474
|
destination. This feature currently requires the `diff/lcs` Ruby
|
|
483
475
|
library.",
|
|
484
476
|
},
|
|
@@ -486,7 +478,7 @@ module Puppet
|
|
|
486
478
|
:type => :boolean,
|
|
487
479
|
:default => !Puppet::Util::Platform.windows?,
|
|
488
480
|
:desc => "Whether to send the process into the background. This defaults
|
|
489
|
-
to true on POSIX systems, and to false on Windows (where
|
|
481
|
+
to true on POSIX systems, and to false on Windows (where OpenVox
|
|
490
482
|
currently cannot daemonize).",
|
|
491
483
|
:short => "D",
|
|
492
484
|
:hook => proc do |value|
|
|
@@ -514,25 +506,23 @@ module Puppet
|
|
|
514
506
|
:desc => <<-'EOT',
|
|
515
507
|
Which node data plugin to use when compiling node catalogs.
|
|
516
508
|
|
|
517
|
-
When
|
|
509
|
+
When OpenVox compiles a catalog, it combines two primary sources of info: the main manifest,
|
|
518
510
|
and a node data plugin (often called a "node terminus," for historical reasons). Node data
|
|
519
511
|
plugins provide three things for a given node name:
|
|
520
512
|
|
|
521
513
|
1. A list of classes to add to that node's catalog (and, optionally, values for their
|
|
522
514
|
parameters).
|
|
523
|
-
2. Which
|
|
515
|
+
2. Which environment the node should use.
|
|
524
516
|
3. A list of additional top-scope variables to set.
|
|
525
517
|
|
|
526
518
|
The three main node data plugins are:
|
|
527
519
|
|
|
528
520
|
* `plain` --- Returns no data, so that the main manifest controls all node configuration.
|
|
529
521
|
* `exec` --- Uses an
|
|
530
|
-
[external node classifier (ENC)](https://
|
|
522
|
+
[external node classifier (ENC)](https://docs.openvoxproject.org/openvox/latest/nodes_external.html),
|
|
531
523
|
configured by the `external_nodes` setting. This lets you pull a list of Puppet classes
|
|
532
524
|
from any external system, using a small glue script to perform the request and format the
|
|
533
525
|
result as YAML.
|
|
534
|
-
* `classifier` (formerly `console`) --- Specific to Puppet Enterprise. Uses the PE console
|
|
535
|
-
for node data."
|
|
536
526
|
EOT
|
|
537
527
|
},
|
|
538
528
|
:node_cache_terminus => {
|
|
@@ -541,28 +531,6 @@ module Puppet
|
|
|
541
531
|
:desc => "How to store cached nodes.
|
|
542
532
|
Valid values are (none), 'json', 'msgpack', or 'yaml'.",
|
|
543
533
|
},
|
|
544
|
-
:data_binding_terminus => {
|
|
545
|
-
:type => :terminus,
|
|
546
|
-
:default => "hiera",
|
|
547
|
-
:desc =>
|
|
548
|
-
"This setting has been deprecated. Use of any value other than 'hiera' should instead be configured
|
|
549
|
-
in a version 5 hiera.yaml. Until this setting is removed, it controls which data binding terminus
|
|
550
|
-
to use for global automatic data binding (across all environments). By default this value is 'hiera'.
|
|
551
|
-
A value of 'none' turns off the global binding.",
|
|
552
|
-
:call_hook => :on_initialize_and_write,
|
|
553
|
-
:hook => proc do |value|
|
|
554
|
-
if Puppet[:strict] != :off
|
|
555
|
-
s_val = value.to_s # because sometimes the value is a symbol
|
|
556
|
-
unless s_val == 'hiera' || s_val == 'none' || value == '' || value.nil?
|
|
557
|
-
#TRANSLATORS 'data_binding_terminus' is a setting and should not be translated
|
|
558
|
-
message = _("Setting 'data_binding_terminus' is deprecated.")
|
|
559
|
-
#TRANSLATORS 'hiera' should not be translated
|
|
560
|
-
message += ' ' + _("Convert custom terminus to hiera 5 API.")
|
|
561
|
-
Puppet.deprecation_warning(message)
|
|
562
|
-
end
|
|
563
|
-
end
|
|
564
|
-
end
|
|
565
|
-
},
|
|
566
534
|
:hiera_config => {
|
|
567
535
|
:default => lambda do
|
|
568
536
|
config = nil
|
|
@@ -574,12 +542,12 @@ module Puppet
|
|
|
574
542
|
config = File.expand_path(File.join(settings[:confdir], 'hiera.yaml')) if config.nil?
|
|
575
543
|
config
|
|
576
544
|
end,
|
|
577
|
-
:desc => "The hiera configuration file.
|
|
545
|
+
:desc => "The hiera configuration file. OpenVox only reads this file on startup, so you must restart the OpenVox server every time you edit it.",
|
|
578
546
|
:type => :file,
|
|
579
547
|
},
|
|
580
548
|
:binder_config => {
|
|
581
549
|
:default => nil,
|
|
582
|
-
:desc => "The binder configuration file.
|
|
550
|
+
:desc => "The binder configuration file. OpenVox reads this file on each request to configure the bindings system.
|
|
583
551
|
If set to nil (the default), a $confdir/binder_config.yaml is optionally loaded. If it does not exists, a default configuration
|
|
584
552
|
is used. If the setting :binding_config is specified, it must reference a valid and existing yaml file.",
|
|
585
553
|
:type => :file,
|
|
@@ -693,41 +661,28 @@ module Puppet
|
|
|
693
661
|
:default => "15s",
|
|
694
662
|
:type => :duration,
|
|
695
663
|
:desc => "The minimum time to wait between checking for updates in
|
|
696
|
-
configuration files. This timeout determines how quickly
|
|
697
|
-
a file (such as manifests or puppet.conf) has changed on disk.
|
|
698
|
-
|
|
699
|
-
service to pick up changes to its internal configuration. Currently we do not
|
|
700
|
-
accept a value of 'unlimited'. To reparse files within an environment in
|
|
701
|
-
Puppet Server please use the environment_cache endpoint",
|
|
702
|
-
:hook => proc do |val|
|
|
703
|
-
unless [0, 15, '15s'].include?(val)
|
|
704
|
-
Puppet.deprecation_warning(<<-WARNING)
|
|
705
|
-
Fine grained control of filetimeouts is deprecated. In future
|
|
706
|
-
releases this value will only determine if file content is cached.
|
|
707
|
-
|
|
708
|
-
Valid values are 0 (never cache) and 15 (15 second minimum wait time).
|
|
709
|
-
WARNING
|
|
710
|
-
end
|
|
711
|
-
end
|
|
664
|
+
configuration files. This timeout determines how quickly OpenVox checks whether
|
|
665
|
+
a file (such as manifests or puppet.conf) has changed on disk. To reparse files
|
|
666
|
+
within an environment in OpenVox Server please use the environment_cache endpoint",
|
|
712
667
|
},
|
|
713
668
|
:environment_timeout => {
|
|
714
669
|
:default => "0",
|
|
715
670
|
:type => :ttl,
|
|
716
|
-
:desc => "How long the
|
|
671
|
+
:desc => "How long the OpenVox server should cache data it loads from an
|
|
717
672
|
environment.
|
|
718
673
|
|
|
719
674
|
A value of `0` will disable caching. This setting can also be set to
|
|
720
675
|
`unlimited`, which will cache environments until the server is restarted
|
|
721
|
-
or told to refresh the cache. All other values will result in
|
|
676
|
+
or told to refresh the cache. All other values will result in the OpenVox
|
|
722
677
|
server evicting environments that haven't been used within the last
|
|
723
678
|
`environment_timeout` seconds.
|
|
724
679
|
|
|
725
|
-
You should change this setting once your
|
|
680
|
+
You should change this setting once your OpenVox deployment is doing
|
|
726
681
|
non-trivial work. We chose the default value of `0` because it lets new
|
|
727
682
|
users update their code without any extra steps, but it lowers the
|
|
728
|
-
performance of your
|
|
683
|
+
performance of your OpenVox server. We recommend either:
|
|
729
684
|
|
|
730
|
-
* Setting this to `unlimited` and explicitly refreshing your
|
|
685
|
+
* Setting this to `unlimited` and explicitly refreshing your OpenVox server
|
|
731
686
|
as part of your code deployment process.
|
|
732
687
|
|
|
733
688
|
* Setting this to a number that will keep your most actively used
|
|
@@ -736,34 +691,20 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
|
|
|
736
691
|
value.
|
|
737
692
|
|
|
738
693
|
Once you set `environment_timeout` to a non-zero value, you need to tell
|
|
739
|
-
|
|
740
|
-
endpoint after you deploy new code. See the docs for the
|
|
741
|
-
[administrative API](https://
|
|
694
|
+
the OpenVox server to read new code from disk using the `environment-cache` API
|
|
695
|
+
endpoint after you deploy new code. See the docs for the OpenVox Server
|
|
696
|
+
[administrative API](https://docs.openvoxproject.org/openvox-server/latest/admin-api/v1/environment-cache.html).
|
|
742
697
|
"
|
|
743
698
|
},
|
|
744
|
-
:environment_data_provider => {
|
|
745
|
-
:desc => "The name of a registered environment data provider used when obtaining environment
|
|
746
|
-
specific data. The three built in and registered providers are 'none' (no data), 'function' (data
|
|
747
|
-
obtained by calling the function 'environment::data()') and 'hiera' (data obtained using a data
|
|
748
|
-
provider configured using a hiera.yaml file in root of the environment).
|
|
749
|
-
Other environment data providers may be registered in modules on the module path. For such
|
|
750
|
-
custom data providers see the respective module documentation. This setting is deprecated.",
|
|
751
|
-
:hook => proc { |value|
|
|
752
|
-
unless value.nil? || Puppet[:strict] == :off
|
|
753
|
-
#TRANSLATORS 'environment_data_provider' is a setting and should not be translated
|
|
754
|
-
Puppet.deprecation_warning(_("Setting 'environment_data_provider' is deprecated."))
|
|
755
|
-
end
|
|
756
|
-
}
|
|
757
|
-
},
|
|
758
699
|
:prerun_command => {
|
|
759
700
|
:default => "",
|
|
760
701
|
:desc => "A command to run before every agent run. If this command returns a non-zero
|
|
761
|
-
return code, the entire
|
|
702
|
+
return code, the entire OpenVox run will fail.",
|
|
762
703
|
},
|
|
763
704
|
:postrun_command => {
|
|
764
705
|
:default => "",
|
|
765
706
|
:desc => "A command to run after every agent run. If this command returns a non-zero
|
|
766
|
-
return code, the entire
|
|
707
|
+
return code, the entire OpenVox run will be considered to have failed, even though it might have
|
|
767
708
|
performed work during the normal run.",
|
|
768
709
|
},
|
|
769
710
|
:freeze_main => {
|
|
@@ -784,8 +725,8 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
|
|
|
784
725
|
:location_trusted => {
|
|
785
726
|
:default => false,
|
|
786
727
|
:type => :boolean,
|
|
787
|
-
:desc => "This will allow sending the name + password and the cookie header to all hosts that
|
|
788
|
-
This may or may not introduce a security breach if
|
|
728
|
+
:desc => "This will allow sending the name + password and the cookie header to all hosts that OpenVox may redirect to.
|
|
729
|
+
This may or may not introduce a security breach if OpenVox redirects you to a site to which you'll send your authentication info and cookies."
|
|
789
730
|
}
|
|
790
731
|
)
|
|
791
732
|
|
|
@@ -815,19 +756,19 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
|
|
|
815
756
|
:certname => {
|
|
816
757
|
:default => -> { Puppet::Settings.default_certname.downcase },
|
|
817
758
|
:desc => "The name to use when handling certificates. When a node
|
|
818
|
-
requests a certificate from the CA
|
|
759
|
+
requests a certificate from the CA OpenVox Server, it uses the value of the
|
|
819
760
|
`certname` setting as its requested Subject CN.
|
|
820
761
|
|
|
821
762
|
This is the name used when managing a node's permissions in
|
|
822
|
-
|
|
763
|
+
OpenVox Server's [auth.conf](https://docs.openvoxproject.org/openvox-server/latest/config_file_auth.html).
|
|
823
764
|
In most cases, it is also used as the node's name when matching
|
|
824
|
-
[node definitions](https://
|
|
765
|
+
[node definitions](https://docs.openvoxproject.org/openvox/latest/lang_node_definitions.html)
|
|
825
766
|
and requesting data from an ENC. (This can be changed with the `node_name_value`
|
|
826
767
|
and `node_name_fact` settings, although you should only do so if you have
|
|
827
768
|
a compelling reason.)
|
|
828
769
|
|
|
829
770
|
A node's certname is available in Puppet manifests as `$trusted['certname']`. (See
|
|
830
|
-
[Facts and Built-In Variables](https://
|
|
771
|
+
[Facts and Built-In Variables](https://docs.openvoxproject.org/openvox/latest/lang_facts_and_builtin_vars.html)
|
|
831
772
|
for more details.)
|
|
832
773
|
|
|
833
774
|
* For best compatibility, you should limit the value of `certname` to
|
|
@@ -846,17 +787,17 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
|
|
|
846
787
|
:dns_alt_names => {
|
|
847
788
|
:default => '',
|
|
848
789
|
:desc => <<EOT,
|
|
849
|
-
A comma-separated list of alternate DNS names for
|
|
790
|
+
A comma-separated list of alternate DNS names for OpenVox Server. These are extra
|
|
850
791
|
hostnames (in addition to its `certname`) that the server is allowed to use when
|
|
851
|
-
serving agents.
|
|
852
|
-
certificate for
|
|
792
|
+
serving agents. OpenVox checks this setting when automatically creating a
|
|
793
|
+
certificate for the OpenVox agent or OpenVox Server. These can be either IP or DNS, and the type
|
|
853
794
|
should be specified and followed with a colon. Untyped inputs will default to DNS.
|
|
854
795
|
|
|
855
796
|
In order to handle agent requests at a given hostname (like
|
|
856
|
-
"puppet.example.com"),
|
|
797
|
+
"puppet.example.com"), OpenVox Server needs a certificate that proves it's
|
|
857
798
|
allowed to use that name; if a server shows a certificate that doesn't include
|
|
858
|
-
its hostname,
|
|
859
|
-
hostname for
|
|
799
|
+
its hostname, OpenVox agents will refuse to trust it. If you use a single
|
|
800
|
+
hostname for OpenVox traffic but load-balance it to multiple OpenVox Servers, each
|
|
860
801
|
of those servers needs to include the official hostname in its list of extra
|
|
861
802
|
names.
|
|
862
803
|
|
|
@@ -864,12 +805,12 @@ names.
|
|
|
864
805
|
certificate is signed. If you need to change the list later, you can't just
|
|
865
806
|
change this setting; you also need to regenerate the certificate. For more
|
|
866
807
|
information on that process, see the
|
|
867
|
-
[cert regen docs](https://
|
|
808
|
+
[cert regen docs](https://docs.openvoxproject.org/openvox/latest/ssl_regenerate_certificates.html).
|
|
868
809
|
|
|
869
810
|
To see all the alternate names your servers are using, log into your CA server
|
|
870
811
|
and run `puppetserver ca list --all`, then check the output for `(alt names: ...)`.
|
|
871
812
|
Most agent nodes should NOT have alternate names; the only certs that should
|
|
872
|
-
have them are
|
|
813
|
+
have them are OpenVox Server nodes that you want other agents to trust.
|
|
873
814
|
EOT
|
|
874
815
|
},
|
|
875
816
|
:csr_attributes => {
|
|
@@ -878,7 +819,7 @@ EOT
|
|
|
878
819
|
:desc => <<EOT
|
|
879
820
|
An optional file containing custom attributes to add to certificate signing
|
|
880
821
|
requests (CSRs). You should ensure that this file does not exist on your CA
|
|
881
|
-
|
|
822
|
+
OpenVox Server; if it does, unwanted certificate extensions may leak into
|
|
882
823
|
certificates created with the `puppetserver ca generate` command.
|
|
883
824
|
|
|
884
825
|
If present, this file must be a YAML hash containing a `custom_attributes` key
|
|
@@ -1020,8 +961,8 @@ EOT
|
|
|
1020
961
|
:ssl_trust_store => {
|
|
1021
962
|
:default => nil,
|
|
1022
963
|
:type => :file,
|
|
1023
|
-
:desc => "A file containing CA certificates in PEM format that
|
|
1024
|
-
when making HTTPS requests. This **only** applies to https requests to non-
|
|
964
|
+
:desc => "A file containing CA certificates in PEM format that OpenVox should trust
|
|
965
|
+
when making HTTPS requests. This **only** applies to https requests to non-OpenVox
|
|
1025
966
|
infrastructure, such as retrieving file metadata and content from https file sources,
|
|
1026
967
|
puppet module tool and the 'http' report processor. This setting is ignored when
|
|
1027
968
|
making requests to puppet:// URLs such as catalog and report requests.",
|
|
@@ -1042,27 +983,27 @@ EOT
|
|
|
1042
983
|
Whether certificate revocation checking should be enabled, and what level of
|
|
1043
984
|
checking should be performed.
|
|
1044
985
|
|
|
1045
|
-
When certificate revocation is enabled,
|
|
986
|
+
When certificate revocation is enabled, OpenVox expects the contents of its CRL
|
|
1046
987
|
to be one or more PEM-encoded CRLs concatenated together. When using a cert
|
|
1047
988
|
bundle, CRLs for all CAs in the chain of trust must be included in the crl file.
|
|
1048
989
|
The chain should be ordered from least to most authoritative, with the first CRL
|
|
1049
990
|
listed being for the root of the chain and the last being for the leaf CA.
|
|
1050
991
|
|
|
1051
|
-
When certificate_revocation is set to 'true' or 'chain',
|
|
992
|
+
When certificate_revocation is set to 'true' or 'chain', OpenVox ensures
|
|
1052
993
|
that each CA in the chain of trust has not been revoked by its issuing CA.
|
|
1053
994
|
|
|
1054
|
-
When certificate_revocation is set to 'leaf',
|
|
995
|
+
When certificate_revocation is set to 'leaf', OpenVox verifies certs against
|
|
1055
996
|
the issuing CA's revocation list, but it does not verify the revocation status
|
|
1056
997
|
of the issuing CA or any CA above it within the chain of trust.
|
|
1057
998
|
|
|
1058
|
-
When certificate_revocation is set to 'false',
|
|
999
|
+
When certificate_revocation is set to 'false', OpenVox disables all
|
|
1059
1000
|
certificate revocation checking and does not attempt to download the CRL.
|
|
1060
1001
|
EOT
|
|
1061
1002
|
},
|
|
1062
1003
|
:ciphers => {
|
|
1063
1004
|
:default => 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256',
|
|
1064
1005
|
:type => :string,
|
|
1065
|
-
:desc => "The list of ciphersuites for TLS connections initiated by
|
|
1006
|
+
:desc => "The list of ciphersuites for TLS connections initiated by OpenVox. The
|
|
1066
1007
|
default value is chosen to support TLS 1.0 and up, but can be made
|
|
1067
1008
|
more restrictive if needed. The ciphersuites must be specified in OpenSSL
|
|
1068
1009
|
format, not IANA."
|
|
@@ -1167,18 +1108,18 @@ EOT
|
|
|
1167
1108
|
:default => "$confdir/autosign.conf",
|
|
1168
1109
|
:type => :autosign,
|
|
1169
1110
|
:desc => "Whether (and how) to autosign certificate requests. This setting
|
|
1170
|
-
is only relevant on
|
|
1111
|
+
is only relevant on an OpenVox Server acting as a certificate authority (CA).
|
|
1171
1112
|
|
|
1172
1113
|
Valid values are true (autosigns all certificate requests; not recommended),
|
|
1173
1114
|
false (disables autosigning certificates), or the absolute path to a file.
|
|
1174
1115
|
|
|
1175
1116
|
The file specified in this setting may be either a **configuration file**
|
|
1176
|
-
or a **custom policy executable.**
|
|
1177
|
-
what it is: If the
|
|
1117
|
+
or a **custom policy executable.** OpenVox will automatically determine
|
|
1118
|
+
what it is: If the OpenVox user (see the `user` setting) can execute the
|
|
1178
1119
|
file, it will be treated as a policy executable; otherwise, it will be
|
|
1179
1120
|
treated as a config file.
|
|
1180
1121
|
|
|
1181
|
-
If a custom policy executable is configured, the CA
|
|
1122
|
+
If a custom policy executable is configured, the CA OpenVox Server will run it
|
|
1182
1123
|
every time it receives a CSR. The executable will be passed the subject CN of the
|
|
1183
1124
|
request _as a command line argument,_ and the contents of the CSR in PEM format
|
|
1184
1125
|
_on stdin._ It should exit with a status of 0 if the cert should be autosigned
|
|
@@ -1189,7 +1130,7 @@ EOT
|
|
|
1189
1130
|
the request.
|
|
1190
1131
|
|
|
1191
1132
|
For info on autosign configuration files, see
|
|
1192
|
-
[the guide to
|
|
1133
|
+
[the guide to OpenVox's config files](https://docs.openvoxproject.org/openvox/latest/config_file_autosign.html).",
|
|
1193
1134
|
},
|
|
1194
1135
|
:allow_duplicate_certs => {
|
|
1195
1136
|
:default => false,
|
|
@@ -1207,7 +1148,7 @@ EOT
|
|
|
1207
1148
|
:ca_refresh_interval => {
|
|
1208
1149
|
:default => "1d",
|
|
1209
1150
|
:type => :duration,
|
|
1210
|
-
:desc => "How often the
|
|
1151
|
+
:desc => "How often the OpenVox agent refreshes its local CA
|
|
1211
1152
|
certificates. By default, CA certificates are refreshed every 24 hours. If a
|
|
1212
1153
|
different interval is specified, the agent refreshes its CA certificates during
|
|
1213
1154
|
the next agent run if the elapsed time since the certificates were last
|
|
@@ -1226,10 +1167,10 @@ EOT
|
|
|
1226
1167
|
:crl_refresh_interval => {
|
|
1227
1168
|
:default => "1d",
|
|
1228
1169
|
:type => :duration,
|
|
1229
|
-
:desc => "How often the
|
|
1170
|
+
:desc => "How often the OpenVox agent refreshes its local Certificate
|
|
1230
1171
|
Revocation List (CRL). By default, the CRL is refreshed every 24 hours. If
|
|
1231
1172
|
a different interval is specified, the agent refreshes its CRL on the next
|
|
1232
|
-
|
|
1173
|
+
OpenVox agent run if the elapsed time since the CRL was last refreshed
|
|
1233
1174
|
exceeds the specified interval.
|
|
1234
1175
|
|
|
1235
1176
|
In general, the interval should be greater than the `runinterval` value.
|
|
@@ -1244,7 +1185,7 @@ EOT
|
|
|
1244
1185
|
:hostcert_renewal_interval => {
|
|
1245
1186
|
:default => "30d",
|
|
1246
1187
|
:type => :duration,
|
|
1247
|
-
:desc => "How often the
|
|
1188
|
+
:desc => "How often the OpenVox agent renews its client certificate. By
|
|
1248
1189
|
default, the client certificate is renewed 30 days before the certificate
|
|
1249
1190
|
expires. If a different interval is specified, the agent renews its client
|
|
1250
1191
|
certificate during the next agent run, assuming that the client certificate has
|
|
@@ -1277,19 +1218,19 @@ EOT
|
|
|
1277
1218
|
:config_file_name => {
|
|
1278
1219
|
:type => :string,
|
|
1279
1220
|
:default => Puppet::Settings.default_config_file_name,
|
|
1280
|
-
:desc => "The name of the
|
|
1221
|
+
:desc => "The name of the OpenVox config file.",
|
|
1281
1222
|
},
|
|
1282
1223
|
:config => {
|
|
1283
1224
|
:type => :file,
|
|
1284
1225
|
:default => "$confdir/${config_file_name}",
|
|
1285
|
-
:desc => "The configuration file for the current
|
|
1226
|
+
:desc => "The configuration file for the current OpenVox application.",
|
|
1286
1227
|
},
|
|
1287
1228
|
:pidfile => {
|
|
1288
1229
|
:type => :file,
|
|
1289
1230
|
:default => "$rundir/${run_mode}.pid",
|
|
1290
1231
|
:desc => "The file containing the PID of a running process.
|
|
1291
1232
|
This file is intended to be used by service management frameworks
|
|
1292
|
-
and monitoring systems to determine if
|
|
1233
|
+
and monitoring systems to determine if an OpenVox process is still in
|
|
1293
1234
|
the process table.",
|
|
1294
1235
|
},
|
|
1295
1236
|
:sourceaddress => {
|
|
@@ -1303,7 +1244,7 @@ EOT
|
|
|
1303
1244
|
:default => nil,
|
|
1304
1245
|
:type => :file_or_directory,
|
|
1305
1246
|
:desc => "The entry-point manifest for the primary server. This can be one file
|
|
1306
|
-
or a directory of manifests to be evaluated in alphabetical order.
|
|
1247
|
+
or a directory of manifests to be evaluated in alphabetical order. OpenVox manages
|
|
1307
1248
|
this path as a directory if one exists or if the path ends with a / or \\.
|
|
1308
1249
|
|
|
1309
1250
|
Setting a global value for `manifest` in puppet.conf is not allowed
|
|
@@ -1311,7 +1252,7 @@ EOT
|
|
|
1311
1252
|
directory environments instead. If you need to use something other than the
|
|
1312
1253
|
environment's `manifests` directory as the main manifest, you can set
|
|
1313
1254
|
`manifest` in environment.conf. For more info, see
|
|
1314
|
-
<https://
|
|
1255
|
+
<https://docs.openvoxproject.org/openvox/latest/environments_about.html>",
|
|
1315
1256
|
},
|
|
1316
1257
|
:modulepath => {
|
|
1317
1258
|
:default => "",
|
|
@@ -1325,7 +1266,7 @@ EOT
|
|
|
1325
1266
|
directory environments instead. If you need to use something other than the
|
|
1326
1267
|
default modulepath of `<ACTIVE ENVIRONMENT'S MODULES DIR>:$basemodulepath`,
|
|
1327
1268
|
you can set `modulepath` in environment.conf. For more info, see
|
|
1328
|
-
<https://
|
|
1269
|
+
<https://docs.openvoxproject.org/openvox/latest/environments_about.html>",
|
|
1329
1270
|
},
|
|
1330
1271
|
:config_version => {
|
|
1331
1272
|
:default => "",
|
|
@@ -1337,22 +1278,22 @@ EOT
|
|
|
1337
1278
|
Setting a global value for config_version in puppet.conf is not allowed
|
|
1338
1279
|
(but it can be overridden from the commandline). Please set a
|
|
1339
1280
|
per-environment value in environment.conf instead. For more info, see
|
|
1340
|
-
<https://
|
|
1281
|
+
<https://docs.openvoxproject.org/openvox/latest/environments_about.html>",
|
|
1341
1282
|
}
|
|
1342
1283
|
)
|
|
1343
1284
|
|
|
1344
1285
|
settings.define_settings(:server,
|
|
1345
1286
|
:user => {
|
|
1346
1287
|
:default => "puppet",
|
|
1347
|
-
:desc => "The user
|
|
1288
|
+
:desc => "The user OpenVox Server will run as. Used to ensure
|
|
1348
1289
|
the agent side processes (agent, apply, etc) create files and
|
|
1349
|
-
directories readable by
|
|
1290
|
+
directories readable by OpenVox Server when necessary.",
|
|
1350
1291
|
},
|
|
1351
1292
|
:group => {
|
|
1352
1293
|
:default => "puppet",
|
|
1353
|
-
:desc => "The group
|
|
1294
|
+
:desc => "The group OpenVox Server will run as. Used to ensure
|
|
1354
1295
|
the agent side processes (agent, apply, etc) create files and
|
|
1355
|
-
directories readable by
|
|
1296
|
+
directories readable by OpenVox Server when necessary.",
|
|
1356
1297
|
},
|
|
1357
1298
|
:default_manifest => {
|
|
1358
1299
|
:default => "./manifests",
|
|
@@ -1363,7 +1304,7 @@ EOT
|
|
|
1363
1304
|
|
|
1364
1305
|
This setting's value can be an absolute or relative path. An absolute path
|
|
1365
1306
|
will make all environments default to the same main manifest; a relative
|
|
1366
|
-
path will allow each environment to use its own manifest, and
|
|
1307
|
+
path will allow each environment to use its own manifest, and OpenVox will
|
|
1367
1308
|
resolve the path relative to each environment's main directory.
|
|
1368
1309
|
|
|
1369
1310
|
In either case, the path can point to a single file or to a directory of
|
|
@@ -1373,7 +1314,7 @@ EOT
|
|
|
1373
1314
|
:default => false,
|
|
1374
1315
|
:type => :boolean,
|
|
1375
1316
|
:desc => "Whether to disallow an environment-specific main manifest. When set
|
|
1376
|
-
to `true`,
|
|
1317
|
+
to `true`, OpenVox will use the manifest specified in the `default_manifest` setting
|
|
1377
1318
|
for all environments. If an environment specifies a different main manifest in its
|
|
1378
1319
|
`environment.conf` file, catalog requests for that environment will fail with an error.
|
|
1379
1320
|
|
|
@@ -1388,14 +1329,14 @@ EOT
|
|
|
1388
1329
|
:code => {
|
|
1389
1330
|
:default => "",
|
|
1390
1331
|
:desc => "Code to parse directly. This is essentially only used
|
|
1391
|
-
by `puppet`, and should only be set if you're writing your own
|
|
1332
|
+
by `puppet`, and should only be set if you're writing your own OpenVox
|
|
1392
1333
|
executable.",
|
|
1393
1334
|
},
|
|
1394
1335
|
:masterport => {
|
|
1395
1336
|
:default => 8140,
|
|
1396
1337
|
:type => :port,
|
|
1397
1338
|
:desc => "The default port puppet subcommands use to communicate
|
|
1398
|
-
with
|
|
1339
|
+
with OpenVox Server. (eg `puppet facts upload`, `puppet agent`). May be
|
|
1399
1340
|
overridden by more specific settings (see `ca_port`, `report_port`).",
|
|
1400
1341
|
},
|
|
1401
1342
|
:serverport => {
|
|
@@ -1425,7 +1366,7 @@ EOT
|
|
|
1425
1366
|
These are the modules that will be used by _all_ environments. Note that
|
|
1426
1367
|
the `modules` directory of the active environment will have priority over
|
|
1427
1368
|
any global directories. For more info, see
|
|
1428
|
-
<https://
|
|
1369
|
+
<https://docs.openvoxproject.org/openvox/latest/environments_about.html>",
|
|
1429
1370
|
},
|
|
1430
1371
|
:vendormoduledir => {
|
|
1431
1372
|
:default => -> { default_vendormoduledir },
|
|
@@ -1439,7 +1380,7 @@ EOT
|
|
|
1439
1380
|
:default => "HTTP_X_CLIENT_DN",
|
|
1440
1381
|
:desc => "The header containing an authenticated client's SSL DN.
|
|
1441
1382
|
This header must be set by the proxy to the authenticated client's SSL
|
|
1442
|
-
DN (e.g., `/CN=puppet.puppetlabs.com`).
|
|
1383
|
+
DN (e.g., `/CN=puppet.puppetlabs.com`). OpenVox will parse out the Common
|
|
1443
1384
|
Name (CN) from the Distinguished Name (DN) and use the value of the CN
|
|
1444
1385
|
field for authorization.
|
|
1445
1386
|
|
|
@@ -1477,12 +1418,12 @@ EOT
|
|
|
1477
1418
|
:mode => "0750",
|
|
1478
1419
|
:desc => "The directory in which serialized data is stored, usually in a subdirectory."},
|
|
1479
1420
|
:reports => {
|
|
1480
|
-
:default => "
|
|
1421
|
+
:default => "none",
|
|
1481
1422
|
:desc => "The list of report handlers to use. When using multiple report handlers,
|
|
1482
1423
|
their names should be comma-separated, with whitespace allowed. (For example,
|
|
1483
1424
|
`reports = http, store`.)
|
|
1484
1425
|
|
|
1485
|
-
This setting is relevant to puppet server and puppet apply. The primary
|
|
1426
|
+
This setting is relevant to puppet server and puppet apply. The primary OpenVox
|
|
1486
1427
|
server will call these report handlers with the reports it receives from
|
|
1487
1428
|
agent nodes, and puppet apply will call them with its own report. (In
|
|
1488
1429
|
all cases, the node applying the catalog must have `report = true`.)
|
|
@@ -1545,14 +1486,14 @@ EOT
|
|
|
1545
1486
|
:desc => "The explicit value used for the node name for all requests the agent
|
|
1546
1487
|
makes to the primary server. WARNING: This setting is mutually exclusive with
|
|
1547
1488
|
node_name_fact. Changing this setting also requires changes to
|
|
1548
|
-
|
|
1489
|
+
OpenVox Server's default [auth.conf](https://docs.openvoxproject.org/openvox-server/latest/config_file_auth.html)."
|
|
1549
1490
|
},
|
|
1550
1491
|
:node_name_fact => {
|
|
1551
1492
|
:default => "",
|
|
1552
1493
|
:desc => "The fact name used to determine the node name used for all requests the agent
|
|
1553
1494
|
makes to the primary server. WARNING: This setting is mutually exclusive with
|
|
1554
1495
|
node_name_value. Changing this setting also requires changes to
|
|
1555
|
-
|
|
1496
|
+
OpenVox Server's default [auth.conf](https://docs.openvoxproject.org/openvox-server/latest/config_file_auth.html).",
|
|
1556
1497
|
:hook => proc do |value|
|
|
1557
1498
|
if !value.empty? and Puppet[:node_name_value] != Puppet[:certname]
|
|
1558
1499
|
raise "Cannot specify both the node_name_value and node_name_fact settings"
|
|
@@ -1563,15 +1504,15 @@ EOT
|
|
|
1563
1504
|
:default => "$statedir/state.yaml",
|
|
1564
1505
|
:type => :file,
|
|
1565
1506
|
:mode => "0640",
|
|
1566
|
-
:desc => "Where
|
|
1567
|
-
with the running configuration. In the case of
|
|
1507
|
+
:desc => "Where the OpenVox agent and OpenVox Server store state associated
|
|
1508
|
+
with the running configuration. In the case of OpenVox Server,
|
|
1568
1509
|
this file reflects the state discovered through interacting
|
|
1569
1510
|
with clients."
|
|
1570
1511
|
},
|
|
1571
1512
|
:statettl => {
|
|
1572
1513
|
:default => "32d",
|
|
1573
1514
|
:type => :ttl,
|
|
1574
|
-
:desc => "How long the
|
|
1515
|
+
:desc => "How long the OpenVox agent should cache when a resource was last checked or synced.
|
|
1575
1516
|
#{AS_DURATION}
|
|
1576
1517
|
A value of `0` or `unlimited` will disable cache pruning.
|
|
1577
1518
|
|
|
@@ -1629,7 +1570,7 @@ EOT
|
|
|
1629
1570
|
:owner => "root",
|
|
1630
1571
|
:mode => "0640",
|
|
1631
1572
|
:desc => "The fallback log file. This is only used when the `--logdest` option
|
|
1632
|
-
is not specified AND
|
|
1573
|
+
is not specified AND OpenVox is running on an operating system where both
|
|
1633
1574
|
the POSIX syslog service and the Windows Event Log are unavailable. (Currently,
|
|
1634
1575
|
no supported operating systems match that description.)
|
|
1635
1576
|
|
|
@@ -1639,7 +1580,7 @@ EOT
|
|
|
1639
1580
|
For control over logging destinations, see the `--logdest` command line
|
|
1640
1581
|
option in the manual pages for puppet server, puppet agent, and puppet
|
|
1641
1582
|
apply. You can see man pages by running `puppet <SUBCOMMAND> --help`,
|
|
1642
|
-
or read them online at https://
|
|
1583
|
+
or read them online at https://docs.openvoxproject.org/openvox/latest/man/."
|
|
1643
1584
|
},
|
|
1644
1585
|
:deviceconfdir => {
|
|
1645
1586
|
:default => "$confdir/devices",
|
|
@@ -1650,15 +1591,15 @@ EOT
|
|
|
1650
1591
|
:desc => "The root directory of devices' $confdir.",
|
|
1651
1592
|
},
|
|
1652
1593
|
:server => {
|
|
1653
|
-
:default =>
|
|
1654
|
-
:desc => "The primary
|
|
1594
|
+
:default => Puppet.features.root? ? 'puppet' : '', # use an empty string so dependent settings can resolve without crashing
|
|
1595
|
+
:desc => "The primary OpenVox server to which the OpenVox agent should connect. This setting is ignored when `server_list` is specified.",
|
|
1655
1596
|
},
|
|
1656
1597
|
:server_list => {
|
|
1657
1598
|
:default => [],
|
|
1658
1599
|
:type => :server_list,
|
|
1659
|
-
:desc => "The list of primary
|
|
1600
|
+
:desc => "The list of primary OpenVox servers to which the OpenVox agent should connect,
|
|
1660
1601
|
in the order that they will be tried. Each value should be a fully qualified domain name, followed by an optional ':' and port number.
|
|
1661
|
-
If a port is omitted,
|
|
1602
|
+
If a port is omitted, OpenVox uses the `serverport` setting for that host. This setting takes precedence over `server`.",
|
|
1662
1603
|
},
|
|
1663
1604
|
:use_srv_records => {
|
|
1664
1605
|
:default => false,
|
|
@@ -1690,22 +1631,22 @@ EOT
|
|
|
1690
1631
|
:noop => {
|
|
1691
1632
|
:default => false,
|
|
1692
1633
|
:type => :boolean,
|
|
1693
|
-
:desc => "Whether to apply catalogs in noop mode, which allows
|
|
1634
|
+
:desc => "Whether to apply catalogs in noop mode, which allows OpenVox to
|
|
1694
1635
|
partially simulate a normal run. This setting affects puppet agent and
|
|
1695
1636
|
puppet apply.
|
|
1696
1637
|
|
|
1697
|
-
When running in noop mode,
|
|
1638
|
+
When running in noop mode, OpenVox will check whether each resource is in sync,
|
|
1698
1639
|
like it does when running normally. However, if a resource attribute is not in
|
|
1699
|
-
the desired state (as declared in the catalog),
|
|
1640
|
+
the desired state (as declared in the catalog), OpenVox will take no
|
|
1700
1641
|
action, and will instead report the changes it _would_ have made. These
|
|
1701
|
-
simulated changes will appear in the report sent to the primary
|
|
1642
|
+
simulated changes will appear in the report sent to the primary OpenVox server, or
|
|
1702
1643
|
be shown on the console if running puppet agent or puppet apply in the
|
|
1703
1644
|
foreground. The simulated changes will not send refresh events to any
|
|
1704
|
-
subscribing or notified resources, although
|
|
1645
|
+
subscribing or notified resources, although OpenVox will log that a refresh
|
|
1705
1646
|
event _would_ have been sent.
|
|
1706
1647
|
|
|
1707
1648
|
**Important note:**
|
|
1708
|
-
[The `noop` metaparameter](https://
|
|
1649
|
+
[The `noop` metaparameter](https://docs.openvoxproject.org/openvox/latest/metaparameter.html#noop)
|
|
1709
1650
|
allows you to apply individual resources in noop mode, and will override
|
|
1710
1651
|
the global value of the `noop` setting. This means a resource with
|
|
1711
1652
|
`noop => false` _will_ be changed if necessary, even when running puppet
|
|
@@ -1723,7 +1664,7 @@ EOT
|
|
|
1723
1664
|
:default => "1h",
|
|
1724
1665
|
:type => :duration,
|
|
1725
1666
|
:desc => "The maximum amount of time an agent run is allowed to take.
|
|
1726
|
-
|
|
1667
|
+
An OpenVox agent run that exceeds this timeout will be aborted. A value
|
|
1727
1668
|
of 0 disables the timeout. Defaults to 1 hour. #{AS_DURATION}",
|
|
1728
1669
|
},
|
|
1729
1670
|
:ca_server => {
|
|
@@ -1754,8 +1695,8 @@ EOT
|
|
|
1754
1695
|
:default => false,
|
|
1755
1696
|
:type => :boolean,
|
|
1756
1697
|
:desc => "Whether to allow PSON serialization. When unable to serialize to
|
|
1757
|
-
JSON or other formats,
|
|
1758
|
-
configuration management service responses of
|
|
1698
|
+
JSON or other formats, OpenVox falls back to PSON. This option affects the
|
|
1699
|
+
configuration management service responses of OpenVox Server and the process by
|
|
1759
1700
|
which the agent saves its cached catalog. With a default value of `false`, this
|
|
1760
1701
|
option is useful in preventing the loss of data because rich data cannot be
|
|
1761
1702
|
serialized via PSON.",
|
|
@@ -1819,10 +1760,10 @@ EOT
|
|
|
1819
1760
|
:default => false,
|
|
1820
1761
|
:type => :boolean,
|
|
1821
1762
|
:desc => "Whether to only use the cached catalog rather than compiling a new catalog
|
|
1822
|
-
on every run.
|
|
1823
|
-
disabled when a recompile is desired. Because
|
|
1763
|
+
on every run. OpenVox can be run with this enabled by default and then selectively
|
|
1764
|
+
disabled when a recompile is desired. Because an OpenVox agent using cached catalogs
|
|
1824
1765
|
does not contact the primary server for a new catalog, it also does not upload facts at
|
|
1825
|
-
the beginning of the
|
|
1766
|
+
the beginning of the OpenVox run.",
|
|
1826
1767
|
},
|
|
1827
1768
|
:ignoremissingtypes => {
|
|
1828
1769
|
:default => false,
|
|
@@ -1859,7 +1800,7 @@ EOT
|
|
|
1859
1800
|
If you restart an agent's puppet service with `splay` enabled, it
|
|
1860
1801
|
recalculates its splay period and delays its first agent run after
|
|
1861
1802
|
restarting for this new period. If you simultaneously restart a group of
|
|
1862
|
-
|
|
1803
|
+
OpenVox agents with `splay` enabled, their checkins to your primary servers
|
|
1863
1804
|
can be distributed more evenly.",
|
|
1864
1805
|
},
|
|
1865
1806
|
:clientbucketdir => {
|
|
@@ -1888,7 +1829,7 @@ EOT
|
|
|
1888
1829
|
:desc => "Whether the 'http' report processor should include the system
|
|
1889
1830
|
certificate store when submitting reports to HTTPS URLs. If false, then
|
|
1890
1831
|
the 'http' processor will only trust HTTPS report servers whose certificates
|
|
1891
|
-
are issued by the
|
|
1832
|
+
are issued by the OpenVox CA or one of its intermediate CAs. If true, the
|
|
1892
1833
|
processor will additionally trust CA certificates in the system's
|
|
1893
1834
|
certificate store."
|
|
1894
1835
|
},
|
|
@@ -1896,19 +1837,19 @@ EOT
|
|
|
1896
1837
|
:default => false,
|
|
1897
1838
|
:type => :boolean,
|
|
1898
1839
|
:desc => "Whether to send updated facts after every transaction. By default
|
|
1899
|
-
|
|
1900
|
-
catalog. Since
|
|
1901
|
-
may change after
|
|
1840
|
+
OpenVox only submits facts at the beginning of the transaction before applying a
|
|
1841
|
+
catalog. Since OpenVox can modify the state of the system, the value of the facts
|
|
1842
|
+
may change after OpenVox finishes. Therefore, any facts stored in OpenVoxDB may not
|
|
1902
1843
|
be consistent until the agent next runs, typically in 30 minutes. If this feature
|
|
1903
|
-
is enabled,
|
|
1904
|
-
for the node stored in
|
|
1905
|
-
submission load on
|
|
1844
|
+
is enabled, OpenVox will resubmit facts after applying its catalog, ensuring facts
|
|
1845
|
+
for the node stored in OpenVoxDB are current. However, this will double the fact
|
|
1846
|
+
submission load on OpenVoxDB, so it is disabled by default.",
|
|
1906
1847
|
},
|
|
1907
1848
|
:publicdir => {
|
|
1908
1849
|
:default => nil,
|
|
1909
1850
|
:type => :directory,
|
|
1910
1851
|
:mode => "0755",
|
|
1911
|
-
:desc => "Where
|
|
1852
|
+
:desc => "Where OpenVox stores public files."
|
|
1912
1853
|
},
|
|
1913
1854
|
:lastrunfile => {
|
|
1914
1855
|
:default => "$publicdir/last_run_summary.yaml",
|
|
@@ -1920,9 +1861,9 @@ EOT
|
|
|
1920
1861
|
:default => "$statedir/last_run_report.yaml",
|
|
1921
1862
|
:type => :file,
|
|
1922
1863
|
:mode => "0640",
|
|
1923
|
-
:desc => "Where
|
|
1864
|
+
:desc => "Where the OpenVox agent stores the last run report, by default, in yaml format.
|
|
1924
1865
|
The format of the report can be changed by setting the `cache` key of the `report` terminus
|
|
1925
|
-
in the [routes.yaml](https://
|
|
1866
|
+
in the [routes.yaml](https://docs.openvoxproject.org/openvox/latest/config_file_routes.html) file.
|
|
1926
1867
|
To avoid mismatches between content and file extension, this setting needs to be
|
|
1927
1868
|
manually updated to reflect the terminus changes."
|
|
1928
1869
|
},
|
|
@@ -1930,7 +1871,7 @@ EOT
|
|
|
1930
1871
|
:default => false,
|
|
1931
1872
|
:type => :boolean,
|
|
1932
1873
|
:desc => "Whether to create .dot graph files, which let you visualize the
|
|
1933
|
-
dependency and containment relationships in
|
|
1874
|
+
dependency and containment relationships in OpenVox's catalog. You
|
|
1934
1875
|
can load and view these files with tools like
|
|
1935
1876
|
[OmniGraffle](http://www.omnigroup.com/applications/omnigraffle/) (OS X)
|
|
1936
1877
|
or [graphviz](http://www.graphviz.org/) (multi-platform).
|
|
@@ -1938,8 +1879,8 @@ EOT
|
|
|
1938
1879
|
Graph files are created when _applying_ a catalog, so this setting
|
|
1939
1880
|
should be used on nodes running `puppet agent` or `puppet apply`.
|
|
1940
1881
|
|
|
1941
|
-
The `graphdir` setting determines where
|
|
1942
|
-
that we don't save graphs for historical runs;
|
|
1882
|
+
The `graphdir` setting determines where OpenVox will save graphs. Note
|
|
1883
|
+
that we don't save graphs for historical runs; OpenVox will replace the
|
|
1943
1884
|
previous .dot files with new ones every time it applies a catalog.
|
|
1944
1885
|
|
|
1945
1886
|
See your graphing software's documentation for details on opening .dot
|
|
@@ -1958,10 +1899,10 @@ EOT
|
|
|
1958
1899
|
|
|
1959
1900
|
When starting for the first time, puppet agent will submit a certificate
|
|
1960
1901
|
signing request (CSR) to the server named in the `ca_server` setting
|
|
1961
|
-
(usually the primary
|
|
1902
|
+
(usually the primary OpenVox server); this may be autosigned, or may need to be
|
|
1962
1903
|
approved by a human, depending on the CA server's configuration.
|
|
1963
1904
|
|
|
1964
|
-
|
|
1905
|
+
The OpenVox agent cannot apply configurations until its approved certificate is
|
|
1965
1906
|
available. Since the certificate may or may not be available immediately,
|
|
1966
1907
|
puppet agent will repeatedly try to fetch it at this interval. You can
|
|
1967
1908
|
turn off waiting for certificates by specifying a time of 0, or a maximum
|
|
@@ -1972,7 +1913,7 @@ EOT
|
|
|
1972
1913
|
:maxwaitforcert => {
|
|
1973
1914
|
:default => "unlimited",
|
|
1974
1915
|
:type => :ttl,
|
|
1975
|
-
:desc => "The maximum amount of time the
|
|
1916
|
+
:desc => "The maximum amount of time the OpenVox agent should wait for its
|
|
1976
1917
|
certificate request to be signed. A value of `unlimited` will cause puppet agent
|
|
1977
1918
|
to ask for a signed certificate indefinitely.
|
|
1978
1919
|
#{AS_DURATION}",
|
|
@@ -2005,19 +1946,19 @@ EOT
|
|
|
2005
1946
|
:plugindest => {
|
|
2006
1947
|
:type => :directory,
|
|
2007
1948
|
:default => "$libdir",
|
|
2008
|
-
:desc => "Where
|
|
1949
|
+
:desc => "Where OpenVox should store plugins that it pulls down from the central
|
|
2009
1950
|
server.",
|
|
2010
1951
|
},
|
|
2011
1952
|
:pluginsource => {
|
|
2012
1953
|
:default => "puppet:///plugins",
|
|
2013
|
-
:desc => "From where to retrieve plugins. The standard
|
|
1954
|
+
:desc => "From where to retrieve plugins. The standard OpenVox `file` type
|
|
2014
1955
|
is used for retrieval, so anything that is a valid file source can
|
|
2015
1956
|
be used here.",
|
|
2016
1957
|
},
|
|
2017
1958
|
:pluginfactdest => {
|
|
2018
1959
|
:type => :directory,
|
|
2019
1960
|
:default => "$vardir/facts.d",
|
|
2020
|
-
:desc => "Where
|
|
1961
|
+
:desc => "Where OpenVox should store external facts that are being handled by pluginsync",
|
|
2021
1962
|
},
|
|
2022
1963
|
:pluginfactsource => {
|
|
2023
1964
|
:default => "puppet:///pluginfacts",
|
|
@@ -2026,25 +1967,15 @@ EOT
|
|
|
2026
1967
|
:localedest => {
|
|
2027
1968
|
:type => :directory,
|
|
2028
1969
|
:default => "$vardir/locales",
|
|
2029
|
-
:desc => "Where
|
|
1970
|
+
:desc => "Where OpenVox should store translation files that it pulls down from the central
|
|
2030
1971
|
server.",
|
|
2031
1972
|
},
|
|
2032
1973
|
:localesource => {
|
|
2033
1974
|
:default => "puppet:///locales",
|
|
2034
|
-
:desc => "From where to retrieve translation files. The standard
|
|
1975
|
+
:desc => "From where to retrieve translation files. The standard OpenVox `file` type
|
|
2035
1976
|
is used for retrieval, so anything that is a valid file source can
|
|
2036
1977
|
be used here.",
|
|
2037
1978
|
},
|
|
2038
|
-
:pluginsync => {
|
|
2039
|
-
:default => true,
|
|
2040
|
-
:type => :boolean,
|
|
2041
|
-
:desc => "Whether plugins should be synced with the central server. This setting is
|
|
2042
|
-
deprecated.",
|
|
2043
|
-
:hook => proc { |_value|
|
|
2044
|
-
#TRANSLATORS 'pluginsync' is a setting and should not be translated
|
|
2045
|
-
Puppet.deprecation_warning(_("Setting 'pluginsync' is deprecated."))
|
|
2046
|
-
}
|
|
2047
|
-
},
|
|
2048
1979
|
:pluginsignore => {
|
|
2049
1980
|
:default => ".svn CVS .git .hg",
|
|
2050
1981
|
:desc => "What files to ignore when pulling down plugins.",
|
|
@@ -2052,7 +1983,7 @@ EOT
|
|
|
2052
1983
|
:ignore_plugin_errors => {
|
|
2053
1984
|
:default => false,
|
|
2054
1985
|
:type => :boolean,
|
|
2055
|
-
:desc => "Whether the
|
|
1986
|
+
:desc => "Whether the OpenVox run should ignore errors during pluginsync. If the setting
|
|
2056
1987
|
is false and there are errors during pluginsync, then the agent will abort the run and
|
|
2057
1988
|
submit a report containing information about the failed run."
|
|
2058
1989
|
}
|
|
@@ -2065,7 +1996,7 @@ EOT
|
|
|
2065
1996
|
:factpath => {
|
|
2066
1997
|
:type => :path,
|
|
2067
1998
|
:default => "$vardir/lib/facter#{File::PATH_SEPARATOR}$vardir/facts",
|
|
2068
|
-
:desc => "Where
|
|
1999
|
+
:desc => "Where OpenVox should look for facts. Multiple directories should
|
|
2069
2000
|
be separated by the system path separator character. (The POSIX path
|
|
2070
2001
|
separator is ':', and the Windows path separator is ';'.)",
|
|
2071
2002
|
|
|
@@ -2102,11 +2033,11 @@ EOT
|
|
|
2102
2033
|
:preprocess_deferred => {
|
|
2103
2034
|
:default => true,
|
|
2104
2035
|
:type => :boolean,
|
|
2105
|
-
:desc => "Whether
|
|
2036
|
+
:desc => "Whether OpenVox should call deferred functions before applying
|
|
2106
2037
|
the catalog. If set to `true`, all prerequisites required for the
|
|
2107
|
-
deferred function must be satisfied before the
|
|
2108
|
-
`false`, deferred functions follow
|
|
2109
|
-
ordering. In this way,
|
|
2038
|
+
deferred function must be satisfied before the OpenVox run. If set to
|
|
2039
|
+
`false`, deferred functions follow OpenVox relationships and
|
|
2040
|
+
ordering. In this way, OpenVox can install the prerequisites required for a
|
|
2110
2041
|
deferred function and call the deferred function in the same run.
|
|
2111
2042
|
Please note that many functions that return complex datatypes will fail
|
|
2112
2043
|
when disabling preprocessing and this option may be removed in the future.",
|
|
@@ -2123,7 +2054,7 @@ EOT
|
|
|
2123
2054
|
:external_nodes => {
|
|
2124
2055
|
:default => "none",
|
|
2125
2056
|
:desc => "The external node classifier (ENC) script to use for node data.
|
|
2126
|
-
|
|
2057
|
+
OpenVox combines this data with the main manifest to produce node catalogs.
|
|
2127
2058
|
|
|
2128
2059
|
To enable this setting, set the `node_terminus` setting to `exec`.
|
|
2129
2060
|
|
|
@@ -2141,7 +2072,7 @@ EOT
|
|
|
2141
2072
|
|
|
2142
2073
|
Generally, an ENC script makes requests to an external data source.
|
|
2143
2074
|
|
|
2144
|
-
For more info, see [the ENC documentation](https://
|
|
2075
|
+
For more info, see [the ENC documentation](https://docs.openvoxproject.org/openvox/latest/nodes_external.html).",
|
|
2145
2076
|
}
|
|
2146
2077
|
)
|
|
2147
2078
|
|
|
@@ -2243,7 +2174,7 @@ EOT
|
|
|
2243
2174
|
:type => :terminus,
|
|
2244
2175
|
:default => "puppetdb",
|
|
2245
2176
|
:desc => "Configure the backend terminus used for StoreConfigs.
|
|
2246
|
-
By default, this uses the
|
|
2177
|
+
By default, this uses the OpenVoxDB store, which must be installed
|
|
2247
2178
|
and configured before turning on StoreConfigs."
|
|
2248
2179
|
}
|
|
2249
2180
|
)
|