How can a puppet resource check for a data source on the puppetmaster without failing to compile?

问题

I am writing a puppet Ceph deployment module and need to generate keys on an admin node and distribute them to the monitor nodes. I have written server-side functions to retrieve the keys once they are generated, but would like to only distribute those keys once they exist.

The manifest for the admin node generates the cluster keys
Manifests for the monitor and management nodes need to include those keys as file resources
The manifests should not fail to compile (or generate undue log volume) if they keys have not yet been generated
The file resources need to be named as they are per-requisites for other resources

n.b. The examples are from Puppet3 so no Ruby dispatch :(

What is the philosophically pure approach to gather and distribute keys?

Sample code: manifests/admin_node.pp:

exec { "make_${cluster[name]}_${name}_keyring":
    command     => "/usr/bin/ceph-authtool --create-keyring ${ring[file]} --gen-key -n ${ring[name]} ${ring[auth]}",
    require     => [ File[$confdir, $bootdir], Package['ceph-common'], ],
    creates     => $ring[file],
}

lib/puppet/parser/functions/get_remote_file.rb:

module Puppet::Parser::Functions
    newfunction(:get_remote_file, :type => :rvalue) do |args|
        return "Error 3: " + args.length.to_s + " arguments were provided to get_remote_file.rb.  Required is 3 to 5." if args.length < 3 or args.length > 5
        remote_host = args[0]
        remote_path = args[1]
        local_path  = args[2]
        local_user  = (args.length > 3) ? 'runuser -l ' + args[3] + ' ' : ''
        remote_user = (args.length > 4) ? args[4] + '@' : ''

        # Is the file already down?
        return 0 if File.exist?(local_path)

        `"#{local_user}bash -c 'scp #{remote_user}#{remote_host}:#{remote_path} #{local_path} 2> /dev/null'"`
        return $?.exitstatus
    end
end

manifests/monitor_node.pp:

unless file_exists($master_key) {
    get_remote_file($adm_node, $monitor_keyring, $master_key)
}
exec { "check_${cluster[name]}.mon.keyring":
    command => '/bin/yes',
    onlyif  => "/usr/bin/test -e $master_key",
}
file { "$libdir/${cluster[name]}.mon.keyring":
    ensure  => $f_action,
    source  => "puppet:///modules/ceph$libdir/${cluster[name]}.mon.keyring",
    require => Exec["check_${cluster[name]}.mon.keyring"],
}

Thanks for any ideas on how to tackle this. I understand that this is... dis-incentivized in Puppet. What is a good approach?

来源：https://stackoverflow.com/questions/53347866/how-can-a-puppet-resource-check-for-a-data-source-on-the-puppetmaster-without-fa

标签

puppet