distribute custom fact built from hiera data with plugin-sync

asked 2016-05-23 07:22:52 -0600

pascal
128 ●2 ●5 ●9

updated 2016-05-24 02:39:25 -0600

Hello

I need a custom fact to access resources which require user credentials unique to each agent. For contractual reasons I can not use the "normal" way of pushing a custom fact file and then do another run to read it (I also had fun with /var/lib/puppet for the same reason). What I'd like to do is have the plugin-sync mechanics evaluate a templated ruby fact on the master and populate it with the credentials based on the node name (puppet does know it, it is talking to it).

A) Any idea where to look? I could not find the point where custom facts are distributed.

B) Anybody else interested in this? I'd like to make a feature request.

UPDATE 01:

The credentials are stored in a hiera backend.

---
my_module::access:
  nodename00:
    [ <list of credentials 00 >]
  nodename01:
    [ <list of credentials 01 >]

The requirements for the agents explicitly state that management credentials must not be permanently stored on agents (don't ask, already tried; btw this makes things like the forge mysql module unusable for me). So the usual answer with two puppet runs is not an option. I already had to implement clean-up for the leftovers in /var/lib/puppet, so the fact will be gone after the run which deployed and used it.

edit retag flag offensive close merge delete

Comments

can the credentials be stored in hiera(either as yaml or another backend?) Can they be prepopulated on the instance as a file based fact during bootstrapping?

DarylW ( 2016-05-23 13:45:27 -0600 )edit

add a comment

answered 2016-05-24 14:12:04 -0600

buzzdeee
23 ●2 ●2 ●5

updated 2016-05-24 15:31:44 -0600

Hi,

Instead of using facts, how about pushing environment variables to Puppet:

In my puppet module to manage puppet, I implemented a native type so that I can push environment variables to the node, see: https://github.com/buzzdeee/buzzdeee-...

In Hiera I have:

puppet::env:
  'AWS_ACCESS_KEY_ID':
    value: 'secret'
  'AWS_SECRET_ACCESS_KEY':
    value: 'supersecret'
  'AWS_REGION':
    value: 'eu-central-1'

These I just instantiate with:

  $puppet_env = hiera_hash('puppet::env')
  create_resources(puppetenv, $puppet_env)

Then Puppet has these in the environment when it runs on the node. Just make sure you have these resources created/setup before you need them later on in your manifest ;)

hth, Sebastian

Comments

Interesting idea. I solved the problem with a custom provider which can handle credentials for my application. Unfortunately this still leaves me with the problem of getting some data from the application to know if I need to create the resource in the first place.

pascal ( 2016-08-29 04:41:33 -0600 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.