Andrew Bogott has uploaded a new change for review.
https://gerrit.wikimedia.org/r/202924
Change subject: For cert names, use the fqdn instead of the ec2id if
use_dnsmasq is lowered.
......................................................................
For cert names, use the fqdn instead of the ec2id if use_dnsmasq is lowered.
Bug T95480
Change-Id: Ifb387bffcb23c8fa9dcfba3fb602b2c97d8cb263
---
M manifests/role/ipsec.pp
M manifests/role/salt.pp
M modules/base/manifests/init.pp
M modules/labs_bootstrapvz/manifests/init.pp
M modules/labs_vmbuilder/manifests/init.pp
M modules/puppet/manifests/self/config.pp
M modules/puppet/manifests/self/master.pp
7 files changed, 84 insertions(+), 17 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/24/202924/1
diff --git a/manifests/role/ipsec.pp b/manifests/role/ipsec.pp
index 73eb4af..64c2d06 100644
--- a/manifests/role/ipsec.pp
+++ b/manifests/role/ipsec.pp
@@ -1,8 +1,19 @@
class role::ipsec ($hosts = undef) {
case $::realm {
'labs': {
- # labs nodes use their EC2 ID as their puppet cert name
- $puppet_certname = "${::ec2id}.${::domain}"
+ $use_dnsmasq_server = hiera('use_dnsmasq', $::use_dnsmasq)
+ if $use_dnsmasq_server {
+ # If using the dnsmasq naming, scheme, we need
+ # to use the unique ec2id rather than just the hostname.
+ if($::ec2id == '') {
+ fail('Failed to fetch instance ID')
+ }
+ $puppet_certname = "${::ec2id}.${::domain}"
+ } else {
+ # With the new dns scheme, fqdn is unique and less
+ # confusing.
+ $puppet_certname = $::fqdn
+ }
}
default: {
$puppet_certname = $::fqdn
diff --git a/manifests/role/salt.pp b/manifests/role/salt.pp
index 655f218..9e9e298 100644
--- a/manifests/role/salt.pp
+++ b/manifests/role/salt.pp
@@ -83,7 +83,20 @@
$labs_finger = 'c5:b1:35:45:3e:0a:19:70:aa:5f:3a:cf:bf:a0:61:dd'
$master = pick($salt_master, $labs_masters)
$master_finger = pick($salt_finger, $labs_finger)
- $client_id = "${::ec2id}.${::domain}"
+
+ $use_dnsmasq_server = hiera('use_dnsmasq', $::use_dnsmasq)
+ if $use_dnsmasq_server {
+ # If using the dnsmasq naming, scheme, we need
+ # to use the unique ec2id rather than just the hostname.
+ if($::ec2id == '') {
+ fail('Failed to fetch instance ID')
+ }
+ $client_id = "${::ec2id}.${::domain}"
+ } else {
+ # With the new dns scheme, fqdn is unique and less
+ # confusing.
+ $client_id = $::fqdn
+ }
salt::grain { 'instanceproject':
value => $::instanceproject,
diff --git a/modules/base/manifests/init.pp b/modules/base/manifests/init.pp
index 20b5aba..933d67d 100644
--- a/modules/base/manifests/init.pp
+++ b/modules/base/manifests/init.pp
@@ -14,13 +14,19 @@
}
if ($::realm == 'labs') {
- # For labs, use instanceid.domain rather than the fqdn
- # to ensure we're always using a unique certname.
- # $::ec2id is a fact that queries the instance metadata
- if($::ec2id == '') {
- fail('Failed to fetch instance ID')
+ $use_dnsmasq_server = hiera('use_dnsmasq', $::use_dnsmasq)
+ if $use_dnsmasq_server {
+ # If using the dnsmasq naming, scheme, we need
+ # to use the unique ec2id rather than just the hostname.
+ if($::ec2id == '') {
+ fail('Failed to fetch instance ID')
+ }
+ $certname = "${::ec2id}.${::domain}"
+ } else {
+ # With the new dns scheme, fqdn is unique and less
+ # confusing.
+ $certname = $::fqdn
}
- $certname = "${::ec2id}.${::domain}"
# Labs instances /var is quite small, provide our own default
# to keep less records (bug 69604).
diff --git a/modules/labs_bootstrapvz/manifests/init.pp
b/modules/labs_bootstrapvz/manifests/init.pp
index e84e744..139cdc4 100644
--- a/modules/labs_bootstrapvz/manifests/init.pp
+++ b/modules/labs_bootstrapvz/manifests/init.pp
@@ -47,7 +47,8 @@
}
$projectregex = "s/${instanceproject}/_PROJECT_/g"
- $fqdnregex = "s/${::ec2id}.${::domain}/_FQDN_/g"
+ $oldfqdnregex = "s/${::ec2id}.${::domain}/_FQDN_/g"
+ $fqdnregex = "s/${::fqdn}/_FQDN_/g"
$masterregex = "s/${servername}/_MASTER_/g"
Exec { path => '/bin' }
@@ -80,6 +81,9 @@
exec { "sed -i '${fqdnregex}' ${bootstrap_filepath}/puppet/puppet.conf":
} ~>
+ exec { "sed -i '${oldfqdnregex}' ${bootstrap_filepath}/puppet/puppet.conf":
+ } ~>
+
exec { "sed -i '${masterregex}' ${bootstrap_filepath}/puppet/puppet.conf":
}
diff --git a/modules/labs_vmbuilder/manifests/init.pp
b/modules/labs_vmbuilder/manifests/init.pp
index 37f0345..8fed11a 100644
--- a/modules/labs_vmbuilder/manifests/init.pp
+++ b/modules/labs_vmbuilder/manifests/init.pp
@@ -60,7 +60,8 @@
}
$projectregex = "s/${instanceproject}/_PROJECT_/g"
- $fqdnregex = "s/${::ec2id}.${::domain}/_FQDN_/g"
+ $oldfqdnregex = "s/${::ec2id}.${::domain}/_FQDN_/g"
+ $fqdnregex = "s/${::fqdn}/_FQDN_/g"
$masterregex = "s/${servername}/_MASTER_/g"
Exec { path => '/bin' }
@@ -93,6 +94,9 @@
exec { "sed -i '${projectregex}' ${vmbuilder_filepath}/puppet.conf":
} ~>
+ exec { "sed -i '${oldfqdnregex}' ${vmbuilder_filepath}/puppet.conf":
+ } ~>
+
exec { "sed -i '${fqdnregex}' ${vmbuilder_filepath}/puppet.conf":
} ~>
diff --git a/modules/puppet/manifests/self/config.pp
b/modules/puppet/manifests/self/config.pp
index ba420e2..2966f3d 100644
--- a/modules/puppet/manifests/self/config.pp
+++ b/modules/puppet/manifests/self/config.pp
@@ -11,21 +11,37 @@
# Unused if $is_puppetmaster is false.
# $puppet_client_subnet - Network from which to allow fileserver connections.
# Unused if $is_puppetmaster is false.
-# $certname - Name of the puppet CA certificate. Default:
"$ec2id.$domain", e.g. the labs instance name: i-00000699.pmtpa.wmflabs.
+# $certname - Name of the puppet CA certificate. Default:
"$ec2id.$domain" or $fqdn on new systems
#
class puppet::self::config(
$server,
$is_puppetmaster = false,
$bindaddress = undef,
$puppet_client_subnet = undef,
- $certname = "${::ec2id}.${::domain}",
- $enc_script_path = undef,
+ $certname = undef
+ $enc_script_path = undef,
) inherits base::puppet {
include ldap::role::config::labs
$ldapconfig = $ldap::role::config::labs::ldapconfig
$basedn = $ldapconfig['basedn']
+ if $certname == undef {
+ $use_dnsmasq_server = hiera('use_dnsmasq', $::use_dnsmasq)
+ if $use_dnsmasq_server {
+ # If using the dnsmasq naming, scheme, we need
+ # to use the unique ec2id rather than just the hostname.
+ if($::ec2id == '') {
+ fail('Failed to fetch instance ID')
+ }
+ $certname = "${::ec2id}.${::domain}"
+ } else {
+ # With the new dns scheme, fqdn is unique and less
+ # confusing.
+ $certname = $::fqdn
+ }
+ }
+
if $enc_script_path {
$config = {
'node_terminus' => 'exec',
diff --git a/modules/puppet/manifests/self/master.pp
b/modules/puppet/manifests/self/master.pp
index bda5818..bb022b2 100644
--- a/modules/puppet/manifests/self/master.pp
+++ b/modules/puppet/manifests/self/master.pp
@@ -45,9 +45,22 @@
# If localhost, then just name the cert 'localhost'.
# Else certname should be the labs instanceid. ($::ec2id comes from
instance metadata.)
- $certname = $server ? {
- 'localhost' => 'localhost',
- default => "${::ec2id}.${::domain}"
+ if $server = 'localhost' {
+ $certname = 'localhost'
+ } else {
+ $use_dnsmasq_server = hiera('use_dnsmasq', $::use_dnsmasq)
+ if $use_dnsmasq_server {
+ # If using the dnsmasq naming, scheme, we need
+ # to use the unique ec2id rather than just the hostname.
+ if($::ec2id == '') {
+ fail('Failed to fetch instance ID')
+ }
+ $certname = "${::ec2id}.${::domain}"
+ } else {
+ # With the new dns scheme, fqdn is unique and less
+ # confusing.
+ $certname = $::fqdn
+ }
}
# We'd best be sure that our ldap config is set up properly
--
To view, visit https://gerrit.wikimedia.org/r/202924
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ifb387bffcb23c8fa9dcfba3fb602b2c97d8cb263
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Andrew Bogott <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
