puppet 5.0.0 → 6.0.0

data/lib/puppet/application/cert.rb

@@ -1,5 +1,4 @@
 require 'puppet/application'
-require 'puppet/ssl/certificate_authority/interface'
 
 class Puppet::Application::Cert < Puppet::Application
 
@@ -99,209 +98,75 @@ class Puppet::Application::Cert < Puppet::Application
     options[:yes] = true
   end
 
+  def summary
+    _("Manage certificates and requests (Disabled)")
+  end
+
   def help
-    <<-'HELP'
+     <<-HELP
+This command is no longer functional, please use `puppetserver ca` instead.
 
-puppet-cert(8) -- Manage certificates and requests
+puppet-cert(8) -- #{summary}
 ========
 
-SYNOPSIS
---------
-Standalone certificate authority. Capable of generating certificates,
-but mostly used for signing certificate requests from puppet clients.
-
-
-USAGE
------
-puppet cert <action> [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
-  [--digest <digest>] [<host>]
-
-
-DESCRIPTION
------------
-Because the puppet master service defaults to not signing client
-certificate requests, this script is available for signing outstanding
-requests. It can be used to list outstanding requests and then either
-sign them individually or sign all of them.
-
 ACTIONS
 -------
-
 Every action except 'list' and 'generate' requires a hostname to act on,
 unless the '--all' option is set.
 
-The most important actions for day-to-day use are 'list' and 'sign'.
-
 * clean:
-  Revoke a host's certificate (if applicable) and remove all files
-  related to that host from puppet cert's storage. This is useful when
-  rebuilding hosts, since new certificate signing requests will only be
-  honored if puppet cert does not have a copy of a signed certificate
-  for that host. If '--all' is specified then all host certificates,
-  both signed and unsigned, will be removed.
+  Use `puppetserver ca clean --certname NAME[,NAME...]`
 
 * fingerprint:
-  Print the DIGEST (defaults to the signing algorithm) fingerprint of a
-  host's certificate.
+  Use openssl directly:
+  `openssl x509 -noout -fingerprint -<digest> -inform pem -in certificate.crt`
 
 * generate:
-  Generate a certificate for a named client. A certificate/keypair will
-  be generated for each client named on the command line.
+  Use `puppetserver ca generate --certname NAME[,NAME...]`
 
 * list:
-  List outstanding certificate requests. If '--all' is specified, signed
-  certificates are also listed, prefixed by '+', and revoked or invalid
-  certificates are prefixed by '-' (the verification outcome is printed
-  in parenthesis). If '--human-readable' or '-H' is specified,
-  certificates are formatted in a way to improve human scan-ability. If
-  '--machine-readable' or '-m' is specified, output is formatted concisely
-  for consumption by a script.
+  Use `puppetserver ca list [--all]`
 
 * print:
-  Print the full-text version of a host's certificate.
+  Use openssl directly:
+  `openssl x509 -noout -text -in certificate.pem`
 
 * revoke:
-  Revoke the certificate of a client. The certificate can be specified either
-  by its serial number (given as a hexadecimal number prefixed by '0x') or by its
-  hostname. The certificate is revoked by adding it to the Certificate Revocation
-  List given by the 'cacrl' configuration option. Note that the puppet master
-  needs to be restarted after revoking certificates.
+  Use `puppetserver ca revoke --cerntname NAME[,NAME...]`
 
 * sign:
-  Sign an outstanding certificate request. If '--interactive' or '-i' is
-  supplied the user will be prompted to confirm that they are signing the
-  correct certificate (recommended). If '--assume-yes' or '-y' is supplied
-  the interactive prompt will assume the answer of 'yes'.
+  Use `puppetserver ca sign --cerntname NAME[,NAME...]`
 
 * verify:
-  Verify the named certificate against the local CA certificate.
+  Use `puppet ssl verify [--certname NAME]`
 
 * reinventory:
-  Build an inventory of the issued certificates. This will destroy the current
-  inventory file specified by 'cert_inventory' and recreate it from the
-  certificates found in the 'certdir'. Ensure the puppet master is stopped
-  before running this action.
+  Removed.
 
 OPTIONS
 -------
-Note that any setting that's valid in the configuration
-file is also a valid long argument. For example, 'ssldir' is a valid
-setting, so you can specify '--ssldir <directory>' as an
-argument.
-
-See the configuration file documentation at
-https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
-full list of acceptable parameters. A commented list of all
-configuration options can also be generated by running puppet cert with
-'--genconfig'.
-
-* --all:
-  Operate on all items. Currently only makes sense with the 'sign',
-  'list', and 'fingerprint' actions.
+There are a couple important notes about previously-supported options.
 
 * --allow-dns-alt-names:
-  Sign a certificate request even if it contains one or more alternate DNS
-  names. If this option isn't specified, 'puppet cert sign' will ignore any
-  requests that contain alternate names.
-
-  In general, ONLY certs intended for a Puppet master server should include
-  alternate DNS names, since Puppet agent relies on those names for identifying
-  its rightful server.
-
-  You can make Puppet agent request a certificate with alternate names by
-  setting 'dns_alt_names' in puppet.conf or specifying '--dns_alt_names' on the
-  command line. The output of 'puppet cert list' shows any requested alt names
-  for pending certificate requests.
+  In order to sign certificates with subject alternative names using
+  `puppetserver ca sign`, the `allow-subject-alt-names` setting must be
+  set to true in the `certificate-authority` section of Puppet Server's
+  config.
 
 * --allow-authorization-extensions:
-  Enable the signing of a request with authorization extensions. Such requests
-  are sensitive because they can be used to write access rules in Puppet Server.
-  Currently, this is the only means by which such requests can be signed.
-
-* --digest:
-  Set the digest for fingerprinting (defaults to the digest used when
-  signing the cert). Valid values depends on your openssl and openssl ruby
-  extension version.
-
-* --debug:
-  Enable full debugging.
-
-* --help:
-  Print this help message
-
-* --verbose:
-  Enable verbosity.
-
-* --version:
-  Print the puppet version number and exit.
-
-
-EXAMPLE
--------
-    $ puppet cert list
-    culain.madstop.com
-    $ puppet cert sign culain.madstop.com
-
-
-AUTHOR
-------
-Luke Kanies
-
-
-COPYRIGHT
----------
-Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
-
-    HELP
+  In order to sign certificates with authorization extensions using
+  `puppetserver ca sign`, the `allow-authorization-extensions` setting must be
+  set to true in the `certificate-authority` section of Puppet Server's
+  config.
+HELP
   end
 
   def main
-    if @all
-      hosts = :all
-    elsif @signed
-      hosts = :signed
-    else
-      hosts = command_line.args.collect { |h| h.downcase }
-    end
-    begin
-      apply(@ca, :revoke, options.merge(:to => hosts)) if subcommand == :destroy
-      apply(@ca, subcommand, options.merge(:to => hosts, :digest => @digest))
-    rescue => detail
-      Puppet.log_exception(detail)
-      exit(24)
-    end
+    help
   end
 
   def setup
-    require 'puppet/ssl/certificate_authority'
-    exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
-
-    Puppet::SSL::Oids.register_puppet_oids
-    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])
-
-    Puppet::Util::Log.newdestination :console
-
-    if [:generate, :destroy].include? subcommand
-      Puppet::SSL::Host.ca_location = :local
-    else
-      Puppet::SSL::Host.ca_location = :only
-    end
-
-    # If we are generating, and the option came from the CLI, it gets added to
-    # the data.  This will do the right thing for non-local certificates, in
-    # that the command line but *NOT* the config file option will apply.
-    if subcommand == :generate
-      if Puppet.settings.set_by_cli?(:dns_alt_names)
-        options[:dns_alt_names] = Puppet[:dns_alt_names]
-      end
-    end
-
-    begin
-      @ca = Puppet::SSL::CertificateAuthority.new
-    rescue => detail
-      Puppet.log_exception(detail)
-      exit(23)
-    end
+    deprecate
   end
 
   def parse_options
@@ -318,13 +183,4 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
     result
   end
-
-  # Create and run an applicator.  I wanted to build an interface where you could do
-  # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
-  def apply(ca, method, options)
-    raise ArgumentError, _("You must specify the hosts to apply to; valid values are an array or the symbol :all") unless options[:to]
-    applier = Puppet::SSL::CertificateAuthority::Interface.new(method, options)
-    applier.apply(ca)
-  end
-
 end

data/lib/puppet/application/config.rb

@@ -1,4 +1,5 @@
 require 'puppet/application/face_base'
 
 class Puppet::Application::Config < Puppet::Application::FaceBase
+  environment_mode :not_required
 end

data/lib/puppet/application/describe.rb

@@ -37,7 +37,6 @@ class Formatter
   def scrub(text)
     # For text with no carriage returns, there's nothing to do.
     return text if text !~ /\n/
-    indent = nil
 
     # If we can match an indentation, then just remove that same level of
     # indent from every line.
@@ -178,10 +177,14 @@ class Puppet::Application::Describe < Puppet::Application
   option("--list", "-l")
   option("--meta","-m")
 
+  def summary
+    _("Display help about resource types")
+  end
+
   def help
-    <<-'HELP'
+    <<-HELP
 
-puppet-describe(8) -- Display help about resource types
+puppet-describe(8) -- #{summary}
 ========
 
 SYNOPSIS

data/lib/puppet/application/device.rb

@@ -24,13 +24,17 @@ class Puppet::Application::Device < Puppet::Application
     end
 
     {
+      :apply => nil,
       :waitforcert => nil,
       :detailed_exitcodes => false,
       :verbose => false,
       :debug => false,
       :centrallogs => false,
       :setdest => false,
+      :resource => false,
+      :facts => false,
       :target => nil,
+      :to_yaml => false,
     }.each do |opt,val|
       options[opt] = val
     end
@@ -40,12 +44,19 @@ class Puppet::Application::Device < Puppet::Application
 
   option("--centrallogging")
   option("--debug","-d")
+  option("--resource","-r")
+  option("--facts","-f")
+  option("--to_yaml","-y")
   option("--verbose","-v")
 
   option("--detailed-exitcodes") do |arg|
     options[:detailed_exitcodes] = true
   end
 
+  option("--apply MANIFEST") do |arg|
+    options[:apply] = arg.to_s
+  end
+
   option("--logdest DEST", "-l DEST") do |arg|
     handle_logdest_arg(arg)
   end
@@ -62,59 +73,67 @@ class Puppet::Application::Device < Puppet::Application
     options[:target] = arg.to_s
   end
 
-    def help
-      <<-'HELP'
+  def summary
+    _("Manage remote network devices")
+  end
 
-puppet-device(8) -- Manage remote network devices
+  def help
+      <<-HELP
+
+puppet-device(8) -- #{summary}
 ========
 
 SYNOPSIS
 --------
-Retrieves all configurations from the puppet master and apply
-them to the remote devices configured in /etc/puppetlabs/puppet/device.conf.
+Retrieves catalogs from the Puppet master and applies them to remote devices.
+
+This subcommand can be run manually; or periodically using cron,
+a scheduled task, or a similar tool.
 
-Currently must be run out periodically, using cron or something similar.
 
 USAGE
 -----
   puppet device [-d|--debug] [--detailed-exitcodes] [--deviceconfig <file>]
                 [-h|--help] [-l|--logdest syslog|<file>|console]
-                [-v|--verbose] [-w|--waitforcert <seconds>]
-                [-t|--target <device>] [-V|--version]
+                [-v|--verbose] [-w|--waitforcert <seconds>] [-f|--facts]
+                [-a|--apply <file>] [-r|--resource <type> [name]]
+                [-t|--target <device>] [--user=<user>] [-V|--version]
 
 
 DESCRIPTION
 -----------
-Once the client has a signed certificate for a given remote device, it will
-retrieve its configuration and apply it.
+Devices require a proxy Puppet agent to request certificates, collect facts,
+retrieve and apply catalogs, and store reports.
+
 
 USAGE NOTES
 -----------
-One need a /etc/puppetlabs/puppet/device.conf file with the following content:
+Devices managed by the puppet-device subcommand on a Puppet agent are
+configured in device.conf, which is located at $confdir/device.conf by default,
+and is configurable with the $deviceconfig setting.
+
+The device.conf file is an INI-like file, with one section per device:
+
+[<DEVICE_CERTNAME>]
+type <TYPE>
+url <URL>
+debug
+
+The section name specifies the certname of the device.
 
-[remote.device.fqdn]
-type <type>
-url <url>
+The values for the type and url properties are specific to each type of device.
 
-where:
- * type: the current device type (the only value at this time is cisco)
- * url: an url allowing to connect to the device
+The optional debug property specifies transport-level debugging,
+and is limited to telnet and ssh transports.
 
-Supported url must conforms to:
- scheme://user:password@hostname/?query
+See https://puppet.com/docs/puppet/latest/config_file_device.html for details.
 
- with:
-  * scheme: either ssh or telnet
-  * user: username, can be omitted depending on the switch/router configuration
-  * password: the connection password
-  * query: this is device specific. Cisco devices supports an enable parameter whose
-  value would be the enable password.
 
 OPTIONS
 -------
-Note that any setting that's valid in the configuration file
-is also a valid long argument.  For example, 'server' is a valid configuration
-parameter, so you can specify '--server <servername>' as an argument.
+Note that any setting that's valid in the configuration file is also a valid
+long argument. For example, 'server' is a valid configuration parameter, so
+you can specify '--server <servername>' as an argument.
 
 * --debug:
   Enable full debugging.
@@ -143,10 +162,27 @@ parameter, so you can specify '--server <servername>' as an argument.
   appending nature of logging. It must be appended manually to make the content
   valid JSON.
 
+* --apply:
+  Apply a manifest against a remote target. Target must be specified.
+
+* --facts:
+  Displays the facts of a remote target. Target must be specified.
+
+* --resource:
+  Displays a resource state as Puppet code, roughly equivalent to
+  `puppet resource`.  Can be filterd by title. Requires --target be specified.
+
 * --target:
   Target a specific device/certificate in the device.conf. Doing so will perform a
   device run against only that device/certificate.
 
+* --to_yaml:
+  Output found resources in yaml format, suitable to use with Hiera and
+  create_resources.
+
+* --user:
+  The user to run as.
+
 * --verbose:
   Turn on verbose reporting.
 
@@ -155,12 +191,12 @@ parameter, so you can specify '--server <servername>' as an argument.
   and it is enabled by default, with a value of 120 (seconds).  This causes
   +puppet agent+ to connect to the server every 2 minutes and ask it to sign a
   certificate request.  This is useful for the initial setup of a puppet
-  client.  You can turn off waiting for certificates by specifying a time
-  of 0.
+  client.  You can turn off waiting for certificates by specifying a time of 0.
+
 
 EXAMPLE
 -------
-      $ puppet device --server puppet.domain.com
+      $ puppet device --target remotehost --verbose
 
 AUTHOR
 ------
@@ -172,10 +208,20 @@ COPYRIGHT
 Copyright (c) 2011 Puppet Inc., LLC
 Licensed under the Apache 2.0 License
       HELP
-    end
+  end
 
 
   def main
+    if options[:resource] and !options[:target]
+      raise _("resource command requires target")
+    end
+    if options[:facts] and !options[:target]
+      raise _("facts command requires target")
+    end
+    unless options[:apply].nil?
+      raise _("missing argument: --target is required when using --apply") if options[:target].nil?
+      raise _("%{file} does not exist, cannot apply") % { file: options[:apply] } unless File.file?(options[:apply])
+    end
     vardir = Puppet[:vardir]
     confdir = Puppet[:confdir]
     certname = Puppet[:certname]
@@ -190,7 +236,7 @@ Licensed under the Apache 2.0 License
       end
       if devices.empty?
         if options[:target]
-          Puppet.err _("Target device / certificate '%{target}' not found in %{config}") % { target: options[:target], config: Puppet[:deviceconfig] }
+          raise _("Target device / certificate '%{target}' not found in %{config}") % { target: options[:target], config: Puppet[:deviceconfig] }
         else
           Puppet.err _("No device found in %{config}") % { config: Puppet[:deviceconfig] }
           exit(1)
@@ -202,27 +248,69 @@ Licensed under the Apache 2.0 License
           # Handle nil scheme & port
           scheme = "#{device_url.scheme}://" if device_url.scheme
           port = ":#{device_url.port}" if device_url.port
-          Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
 
           # override local $vardir and $certname
           Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
           Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
           Puppet[:certname] = device.name
 
-          # this will reload and recompute default settings and create the devices sub vardir, or we hope so :-)
-          Puppet.settings.use :main, :agent, :ssl
-
           # this init the device singleton, so that the facts terminus
           # and the various network_device provider can use it
           Puppet::Util::NetworkDevice.init(device)
 
-          # ask for a ssl cert if needed, but at least
-          # setup the ssl system for this device.
-          setup_host
-
-          require 'puppet/configurer'
-          configurer = Puppet::Configurer.new
-          configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync?)
+          if options[:resource]
+            type, name = parse_args(command_line.args)
+            Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            resources = find_resources(type, name)
+            if options[:to_yaml]
+              text = resources.map do |resource|
+                resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
+              end.join("\n")
+              text.prepend("#{type.downcase}:\n")
+            else
+              text = resources.map do |resource|
+                resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
+              end.join("\n")
+            end
+            (puts text)
+            0
+          elsif options[:facts]
+            Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
+            # Give a proper name to the facts
+            remote_facts.name = remote_facts.values['clientcert']
+            renderer = Puppet::Network::FormatHandler.format(:console)
+            puts renderer.render(remote_facts)
+            0
+          elsif options[:apply]
+            # ensure we have a cache folder structure exists for the device
+            FileUtils.mkdir_p(Puppet[:statedir]) unless File.directory?(Puppet[:statedir])
+            # avoid reporting to server
+            Puppet::Transaction::Report.indirection.terminus_class = :yaml
+            Puppet::Resource::Catalog.indirection.cache_class = nil
+
+            require 'puppet/application/apply'
+            begin
+              Puppet[:node_terminus] = :plain
+              Puppet[:catalog_terminus] = :compiler
+              Puppet[:catalog_cache_terminus] = nil
+              Puppet[:facts_terminus] = :network_device
+              Puppet.override(:network_device => true) do
+                Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
+              end
+            end
+          else
+            Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            # this will reload and recompute default settings and create the devices sub vardir
+            Puppet.settings.use :main, :agent, :ssl
+            # ask for a ssl cert if needed, but at least
+            # setup the ssl system for this device.
+            setup_host
+
+            require 'puppet/configurer'
+            configurer = Puppet::Configurer.new
+            configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync?)
+          end
         rescue => detail
           Puppet.log_exception(detail)
           # If we rescued an error, then we return 1 as the exit code
@@ -248,6 +336,24 @@ Licensed under the Apache 2.0 License
     end
   end
 
+  def parse_args(args)
+    type = args.shift or raise _("You must specify the type to display")
+    Puppet::Type.type(type) or raise _("Could not find type %{type}") % { type: type }
+    name = args.shift
+
+    [type, name]
+  end
+
+  def find_resources(type, name)
+    key = [type, name].join('/')
+
+    if name
+      [ Puppet::Resource.indirection.find( key ) ]
+    else
+      Puppet::Resource.indirection.search( key, {} )
+    end
+  end
+
   def setup_host
     @host = Puppet::SSL::Host.new
     waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
@@ -256,26 +362,25 @@ Licensed under the Apache 2.0 License
 
   def setup
     setup_logs
+    if options[:apply] || options[:facts] || options[:resource]
+      Puppet::Util::Log.newdestination(:console)
+      Puppet.settings.use :main, :agent, :ssl
+    else
+      args[:Server] = Puppet[:server]
+      if options[:centrallogs]
+        logdest = args[:Server]
 
-    args[:Server] = Puppet[:server]
-    if options[:centrallogs]
-      logdest = args[:Server]
-
-      logdest += ":" + args[:Port] if args.include?(:Port)
-      Puppet::Util::Log.newdestination(logdest)
-    end
-
-    Puppet.settings.use :main, :agent, :device, :ssl
+        logdest += ":" + args[:Port] if args.include?(:Port)
+        Puppet::Util::Log.newdestination(logdest)
+      end
 
-    # We need to specify a ca location for all of the SSL-related
-    # indirected classes to work; in fingerprint mode we just need
-    # access to the local files and we don't need a ca.
-    Puppet::SSL::Host.ca_location = :remote
+      Puppet.settings.use :main, :agent, :device, :ssl
 
-    Puppet::Transaction::Report.indirection.terminus_class = :rest
+      Puppet::Transaction::Report.indirection.terminus_class = :rest
 
-    if Puppet[:catalog_cache_terminus]
-      Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus].intern
+      if Puppet[:catalog_cache_terminus]
+        Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus].intern
+      end
     end
   end
 end

data/lib/puppet/application/doc.rb

@@ -40,7 +40,8 @@ class Puppet::Application::Doc < Puppet::Application
 
   option("--list", "-l") do |arg|
     require 'puppet/util/reference'
-    puts Puppet::Util::Reference.references.collect { |r| Puppet::Util::Reference.reference(r).doc }.join("\n")
+    refs = Puppet::Util::Reference.references(Puppet.lookup(:current_environment))
+    puts refs.collect { |r| Puppet::Util::Reference.reference(r).doc }.join("\n")
     exit(0)
   end
 
@@ -48,10 +49,14 @@ class Puppet::Application::Doc < Puppet::Application
     options[:references] << arg.intern
   end
 
+  def summary
+    _("Generate Puppet references")
+  end
+
   def help
-    <<-'HELP'
+    <<-HELP
 
-puppet-doc(8) -- Generate Puppet references
+puppet-doc(8) -- #{summary}
 ========
 
 SYNOPSIS
@@ -194,7 +199,8 @@ HELP
     if options[:all]
       # Don't add dynamic references to the "all" list.
       require 'puppet/util/reference'
-      options[:references] = Puppet::Util::Reference.references.reject do |ref|
+      refs = Puppet::Util::Reference.references(Puppet.lookup(:current_environment))
+      options[:references] = refs.reject do |ref|
         Puppet::Util::Reference.reference(ref).dynamic?
       end
     end