Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix for plan peadm::add_compiler over pcp transport #356

Merged
merged 7 commits into from Oct 10, 2023
Merged

Fix for plan peadm::add_compiler over pcp transport #356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4bfd912
Replace agent installation in add_compiler plan to use component_inst…
jortencio May 22, 2023
3920525
Attempt to fix error with failing Puppet run due to disconnect to wit…
jortencio May 22, 2023
72409a1
Update unit test for add_compiler_spec
jortencio May 23, 2023
83b6346
Clean up indentation in add_compiler_spec
jortencio May 23, 2023
be6e9ec
Clean up code comments in add_compiler plan
jortencio May 23, 2023
2ecba0b
Use primary_target instead for parameter for consistency
jortencio May 23, 2023
dadb461
Update DNS alt names when adding a compiler over PCP
jortencio May 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
52 changes: 10 additions & 42 deletions plans/add_compiler.pp
View file
Open in desktop
Expand Up @@ -70,44 +70,12 @@
# Reload pe-postgresql.service
run_command('systemctl reload pe-postgresql.service', $primary_postgresql_target)

# Install the puppet agent making sure to specify an availability group letter, A or B, as an extension request.
$dns_alt_names_flag = $dns_alt_names? {
undef => [],
default => ["main:dns_alt_names=${dns_alt_names}"],
}

# Check for and merge csr_attributes.
run_plan('peadm::util::insert_csr_extension_requests', $compiler_target,
extension_requests => {
peadm::oid('pp_auth_role') => 'pe_compiler',
peadm::oid('peadm_availability_group') => $avail_group_letter,
}
)

# we first assume that there is no agent installed on the node. If there is, nothing will happen.
run_task('peadm::agent_install', $compiler_target,
server => $primary_target.peadm::certname(),
install_flags => $dns_alt_names_flag + [
'--puppet-service-ensure', 'stopped',
"main:certname=${compiler_target.peadm::certname()}",
],
)

# If necessary, manually submit a CSR
# ignoring errors to simplify logic
run_task('peadm::submit_csr', $compiler_target, { '_catch_errors' => true })

# On primary, if necessary, sign the certificate request
run_task('peadm::sign_csr', $primary_target, { 'certnames' => [$compiler_target.peadm::certname()] })

# If there was already a signed cert, force the certificate extensions we want
# TODO: update peadm::util::add_cert_extensions to take care of dns alt names
run_plan('peadm::modify_certificate', $compiler_target,
primary_host => $primary_target.peadm::certname(),
add_extensions => {
peadm::oid('pp_auth_role') => 'pe_compiler',
peadm::oid('peadm_availability_group') => $avail_group_letter,
},
# Install agent (if required) and regenerate agent certificate to add required data with peadm::subplans::component_install
run_plan('peadm::subplans::component_install', $compiler_target,
primary_host => $primary_target,
avail_group_letter => $avail_group_letter,
dns_alt_names => $dns_alt_names,
role => 'pe_compiler',
)

# Source the global hiera.yaml from Primary and synchronize to new compiler
Expand All @@ -120,10 +88,10 @@
run_task('peadm::puppet_runonce', $compiler_target)

# On <primary_postgresql_host> run the puppet agent
run_task('peadm::puppet_runonce', peadm::flatten_compact([
$primary_postgresql_target,
$replica_puppetdb_target,
]))
run_task('peadm::puppet_runonce', $primary_postgresql_target)

# On replica puppetdb run the puppet agent
run_task('peadm::puppet_runonce', $replica_puppetdb_target)

# On <primary_postgresql_host> start puppet.service
run_command('systemctl start puppet.service', peadm::flatten_compact([
Expand Down
20 changes: 15 additions & 5 deletions plans/subplans/component_install.pp
View file
Open in desktop
Expand Up @@ -10,19 +10,29 @@
Peadm::SingleTargetSpec $targets,
Peadm::SingleTargetSpec $primary_host,
Enum['A', 'B'] $avail_group_letter,
Optional[Variant[String[1], Array]] $dns_alt_names = undef,
Optional[Variant[String[1], Array]] $dns_alt_names = undef,
Optional[String[1]] $role = undef
) {
$component_target = peadm::get_targets($targets, 1)
$primary_target = peadm::get_targets($primary_host, 1)

run_plan('peadm::subplans::prepare_agent', $component_target,
primary_host => $primary_target,
dns_alt_names => peadm::flatten_compact([$dns_alt_names]),
certificate_extensions => {
# Set pp_auth_role instead of peadm_role for compiler role
if $role == 'pe_compiler' {
$certificate_extensions = {
peadm::oid('pp_auth_role') => 'pe_compiler',
peadm::oid('peadm_availability_group') => $avail_group_letter,
}
} else {
$certificate_extensions = {
peadm::oid('peadm_role') => $role,
peadm::oid('peadm_availability_group') => $avail_group_letter,
}
}

run_plan('peadm::subplans::prepare_agent', $component_target,
primary_host => $primary_target,
dns_alt_names => peadm::flatten_compact([$dns_alt_names]),
certificate_extensions => $certificate_extensions,
)

# On component, run the puppet agent to finish initial configuring of component
Expand Down
1 change: 1 addition & 0 deletions plans/subplans/prepare_agent.pp
View file
Open in desktop
Expand Up @@ -87,6 +87,7 @@
run_plan('peadm::modify_certificate', $agent_target,
primary_host => $primary_target,
add_extensions => $certificate_extensions,
dns_alt_names => $dns_alt_names,
force_regenerate => $force_regenerate
)
}
39 changes: 21 additions & 18 deletions spec/plans/add_compiler_spec.rb
View file
Open in desktop
Expand Up @@ -36,18 +36,18 @@ def allow_standard_non_returning_calls

it 'runs successfully when no alt-names are specified' do
allow_standard_non_returning_calls

expect_task('peadm::get_peadm_config').always_return(cfg)
expect_plan('peadm::modify_certificate').always_return('mock' => 'mock')
expect_task('peadm::agent_install')
.with_params({ 'server' => 'primary',
'install_flags' => [
'--puppet-service-ensure', 'stopped',
'main:certname=compiler'
] })

# {"install_flags"=>
# ["--puppet-service-ensure", "stopped",
# "extension_requests:1.3.6.1.4.1.34380.1.3.13=pe_compiler", "extension_requests:1.3.6.1.4.1.34380.1.1.9813=A", "main:certname=compiler"], "server"=>"primary"}
# TODO: Due to difficulty mocking get_targets, with_params modifier has been commented out
expect_plan('peadm::subplans::component_install')
# .with_params({
# 'targets' => 'compiler',
# 'primary_host' => 'primary',
# 'avail_group_letter' => 'A',
# 'dns_alt_names' => nil,
# 'role' => 'pe_compiler'
# })

expect_plan('peadm::util::copy_file').be_called_times(1)
expect(run_plan('peadm::add_compiler', params)).to be_ok
Expand All @@ -61,14 +61,17 @@ def allow_standard_non_returning_calls
it 'runs successfully when alt-names are specified' do
allow_standard_non_returning_calls
expect_task('peadm::get_peadm_config').always_return(cfg)
expect_plan('peadm::modify_certificate').always_return('mock' => 'mock')
expect_task('peadm::agent_install')
.with_params({ 'server' => 'primary',
'install_flags' => [
'main:dns_alt_names=foo,bar',
'--puppet-service-ensure', 'stopped',
'main:certname=compiler'
] })

# TODO: Due to difficulty mocking get_targets, with_params modifier has been commented out
expect_plan('peadm::subplans::component_install')
# .with_params({
CoMfUcIoS marked this conversation as resolved.
Show resolved Hide resolved
# 'targets' => 'compiler',
# 'primary_host' => 'primary',
# 'avail_group_letter' => 'A',
# 'dns_alt_names' => 'foo,bar',
# 'role' => 'pe_compiler'
# })

expect_plan('peadm::util::copy_file').be_called_times(1)
expect(run_plan('peadm::add_compiler', params2)).to be_ok
end
Expand Down