| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Since the indirector state persists across tests, we were seeing order
dependent test failures with tests that assumed the default indirector
settings.
Specifically, if the following tests were run in order, the first
would cause failures in the second two:
spec/unit/application/apply_spec.rb
spec/unit/node_spec.rb
spec/integration/node_spec.rb
To protect against this state leakage, we now:
- reset the Puppet::Node terminus before each test in
spec/integration/node_spec.rb to ensure we are testing a clean
environment.
- reset the Puppet::Node, and Puppet::Node::Facts terminus, and
cache class after each test in spec/unit/application/apply_spec.rb
to prevent leakage into other tests.
Since the cache class has the same state leakage problem as the
terminus class, but does not have the same ability to lazily populate
the default when set to nil, we remove the test. Testing the default
for the cache class would require running the test before all other
tests to ensure there is no state pollution.n
|
| |\
| |
| | |
(#8808) Fail Augeas resource when unable to save changes
|
| | |
| |
| |
| |
| | |
Raise a failure when Augeas changes cannot be saved (due to invalid layout of
the tree, permissions etc). Fixes a regression.
|
| |\ \
| | |
| | | |
Maint/2.7.x/minor docs fixes
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Unlike several other tools that accept a number of seconds between runs,
puppet agent doesn't use 0 as a special value representing "never;" instead,
it takes this as an instruction to run continuously. As this has caused some
user confusion, this commit updates runinterval's description to explain this,
and points to the correct method to make puppet agent do nothing.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
alphabetically
Puppet agent's man text was missing the --no-client option in its command
synopsis, and the long text for --no-client cut off weirdly in the middle of a
sentence. This commit fixes both problems, and arranges all the options
alphabetically so they're easier to reference.
|
| |\ \ \
| | | |
| | | |
| | | |
| | | |
| | | | |
* 2.6.x:
(#8302) Improve documentation of exec providers
Add document outlining preferred contribution methods
|
| | |\ \ \
| | | | |
| | | | | |
Ticket/2.6.x/8302 exec provider docs
|
| | |/ / /
| | | |
| | | |
| | | |
| | | |
| | | | |
The documentation for the shell and posix providers didn't fully explain the
differences between them or the security implications of each. This commit
improves the documentation of both providers.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
We have historically had the preferred contribution process on the
Redmine wiki, however this is not obvious to people that don't already
know it is there. By adding this document to the repository itself,
it becomes much easier for new contributors to find what the preferred
contribution methods are.
By having the preferred contribution method in the repository also
means that it becomes a "curated" document, which must go through the
same submission/review process that other changes to the repositories
go through.
Reviewed-by: Nick Fagerlund <nick.fagerlund@puppetlabs.com>
Reviewed-by: Nick Lewis <nick@puppetlabs.com>
|
| |\ \ \ \
| |_|/ /
|/| | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Merge branch 'maint/2.7.x/misc_doc_fixes' into 2.7.x
* maint/2.7.x/misc_doc_fixes:
(#7853) Clarify and complete docs for the tagmail report processor
Maint: Mention that audit metaparameter will accept "all"
Maint: Adjust wording for file type's content parameter
Maint: Fix poor documentation for versioncmp function.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The tagmail report docs did not mention that you could use log levels as
tags, and was unclear in several other minor ways. This commit improves that
documentation.
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
Previously, `audit => all` wasn't documented anywhere. This commit adds
a note on it to the metaparameter reference.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The content parameter's doc string said: "The primary purpose of this
parameter is to provide a kind of limited templating... This attribute
is especially useful when used with templating." This commit clarifies
said awkward wording.
|
| |/ / /
| | |
| | |
| | |
| | |
| | | |
The versioncmp function's documentation was missing punctuation and was
unnecessarily vague. This commit clarifies the return data and makes the
documentation more legible at a glance.
|
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
* ticket/2.7.x/maint-fix_inspect_help:
maint: Fix case sensitive require
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Mac's filesystems aren't case sensitive, so developing this change
didn't catch the issue with requiring filenames that had been
uppercased.
Reviewed-by: Nick Lewis <nick@puppetlabs.com>
|
| |\| | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* ticket/2.7.x/maint-fix_inspect_help:
maint: Add inspect app options to help
maint: Fix inspect help
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Inspect wasn't documenting the only two options it has, archive_files
and archive_file_server. Now it does.
Reviewed-by: Nick Lewis <nick@puppetlabs.com>
|
| |/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Running `puppet help inspect` did not result in help:
Unable to find application 'inspect'.
err: exit
err: Try 'puppet help help help' for usage
It turned out that the only reason applications were getting required so
that their help could be found was the LegacyName conversion table in
lib/puppet/util/command_line.rb:7. Inspect never had a legacy name, so
the help system couldn't find it since it never got required. Now
instead of checking for the class constant to see if the application has
been loaded, we try to require the application and exit if it's not
found.
Reviewed-by: Nick Lewis <nick@puppetlabs.com>
|
| | | |
| | |
| | |
| | | |
Signed-off-by: Michael Stahnke <stahnma@puppetlabs.com>
|
| | | | |
|
| |\ \ \
| | |/
| |/| |
|
| | |\ \
| | | |
| | | |
| | | |
| | | | |
daniel-pittman/bug/2.7.x/4762-ensure-that-clients-on-the-moon-can-successfully-connect
Bug/2.7.x/4762 ensure that clients on the moon can successfully connect
|
| | |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Previously, we only allowed Puppet Clients at a maximum distance of somewhere
between 7,494 and 14,988 kilometers from the master, depending on the variance
in local conditions.
While this gave us good data security against hostile clients connecting from
the dark side of the moon, real world testing shows the moon folks are likely
to just take over a local staging host and attack that way.
So, instead, allow clients sufficient time they should be comfortable able to
connect to a master from the moon. We still refuse clients further out, like
Mars, since it seems unlikely that Puppet management over that distance should
work.
We advise the manned Mars expedition to deploy a local Puppet Master to manage
infrastructure in their base, and to watch out for the martians.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
We have historically had the preferred contribution process on the
Redmine wiki, however this is not obvious to people that don't already
know it is there. By adding this document to the repository itself,
it becomes much easier for new contributors to find what the preferred
contribution methods are.
By having the preferred contribution method in the repository also
means that it becomes a "curated" document, which must go through the
same submission/review process that other changes to the repositories
go through.
Reviewed-by: Nick Fagerlund <nick.fagerlund@puppetlabs.com>
Reviewed-by: Nick Lewis <nick@puppetlabs.com>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
vcsrepo is available in a module of its own, is missing tests, and
goes against the long-term goal of moving "extra" types out of core
puppet into modules (an example of this is the nagios types).
This reverts commit 25b967559dfa39eb094008c7a3952c4ee885530b, reversing
changes made to b87a1dea704ed981f2f0af728afac2c63e87b5a8.
Reviewed-by: Michael Stahnke <mike@puppetlabs.com>
|
| | |\ \ |
|
| | |\ \ \
| | | | |
| | | | |
| | | | |
| | | | | |
* ticket/2.7.x/8704-fileserverconf_parse_errors:
(#8704) Give better errors for invalid fileserver.conf
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
If you tried to just put an allow or deny line in the fileserver.conf
without a mount point, you got a really confusing error message:
lib/puppet/network/handler/fileserver.rb:285:in `readconfig': undefined method `info' for nil:NilClass (NoMethodError)
Now instead we give an error saying no mount point was specified.
Reviewed-by: Josh Cooper <josh@puppetlabs.com>
|
| | |\ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* tickets/2.7.x/1886:
(Maint.) Disable cleaning of storeconfigs.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This feature (and the corresponding tests) were causing intermittent
failures which we were unable to trace. We will reintroduce this
behavior when we can do so without test fragility.
Reviewed-By: Matt Robinson
|
| | |/ / / /
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
When we introduced verification of options, we forgot to handle the case that
global options from the Puppet settings system could be passed to the face.
This, in turn, means that the system would fail if you used any of those.
This remediates that, and now these work as expected.
Reviewed-By: Pieter van de Bruggen <pieter@puppetlabs.com>
|
| | |\ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* tickets/2.7.x/1886:
(Maint.) Fix spec failures related to leaking state.
|
| | |/ / / /
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
The `node clean` code has introduced a systematic change in
state which is not uniformly protected against by the tests.
As these order dependent failures arise, we should refactor
the tests to be more robust.
Reviewed-By: Matt Robinson
|
| | |\ \ \ \
| | |/ / /
| |/| | |
| | | | |
| | | | |
| | | | | |
* feature/2.7.x/1886:
(#1886) Clean up `node clean` for merge.
Fix #1886 - Add node cleanup capability
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
This includes various style changes, and assorted fixes to testing.
Paired-With: Matt Robinson
|
| | |/ / /
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Here is a changeset that adds a new action to the puppet node face.
This application removes all traces of a node on the puppetmaster
(including certs, cached facts and nodes, reports, and storedconfig
entries).
Furthermore it is capable of unexporting exported resources of a
host so that consumers of these resources can remove the exported
resources and we will safely remove the node from our
infrastructure.
Usage:
puppet node clean [--unexport] <host> [<host2> ...]
To achieve this we add different destroy methods to the different
parts of the indirector. So for example for yaml indirections we
already offer read access for the yaml, this changeset adds
the destroy handler which only removes the yaml file for
a request. This can be used to remove cached entries.
This work is based on the initial work of Brice Figureau
<brice-puppet@daysofwonder.com>
|
| | |\ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
* tickets/2.7.x/5777:
Deprecate RestAuthConfig#allowed? in favor of #check_authorization
Fix #6026 - security file should support inline comments
Fix #5010 - Allow leading whitespace in auth.conf
Fix #5777 - rule interpolation broke auth.conf CIDR rules
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
#allowed? was a poorly named method since it isn't actually a predicate
method. Instead of returning a boolean, this methods throws an
exception when the access is denied (in order to keep the full context
of what ACE triggered the deny).
Given that #allowed? was overriding the behavior from AuthConfig, we
leave a version of #allowed? in place that will issue a deprecation
warning before delegating to #check_authorization. Once support for
XML-RPC agents is removed from the master, we will be able to remove
this delegation, since there should no longer be a reason for a
distinction between AuthConfig and RestAuthConfig.
Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
Signed-off-by: Jacob Helwig <jacob@puppetlabs.com>
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Auth.conf, namespaceauth.conf and fileserver.conf were not supporting
trailing inlined comments.
Also this commit fixes some indentation and error management.
Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
The regex used to detect ACE is too lax and would allow trailing
spaces to sneak in, which in turn would confuse the ACE parser.
Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
|
| | |/ / /
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Due to the interpolation performed to support regex back-references,
various type of rules (mainly IP CIDR notations and wildcard hosts)
were not working anymore.
This patch adds an auth.conf integration test that covers most
of the various rules types.
Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
|
| | |\ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
2.7.x
* ticket/2.7.x/maint-show_help_for_cert_without_subcommand:
maint: Fix cert app to print help and exit if no subcommand
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
In 2.6.x this was the behavior, but the changes to the way options
parsing worked in 2.7.x to support faces changed the behavior of how
help was called.
This resulted in the follow unhelpful error message when you just called
`puppet cert`:
/Users/matthewrobinson/work/puppet/lib/puppet/ssl/certificate_authority/interface.rb:85:in `method='
Invalid method to apply
Reviewed-by: Pieter van de Bruggen <pieter@puppetlabs.com>
|
| | |\ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* ticket/2.7.x/maint-improve_ssl_error:
maint: Suggest where to start troubleshooting SSL error message
|
| | |/ / / /
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Much like the infamous "hostname was not match" error message, there's
another SSL error that people run into that isn't clear how to
troubleshoot.
err: Could not send report: SSL_connect returned=1 errno=0
state=SSLv3 read server certificate B: certificate verify failed.
As far as I can tell this only ever happens when the clock is off on the
master or client. People seem to think it will happen other times, but
I haven't been able to reproduce it other ways - missing private key,
revoked cert, offline CA all have their own errors. I googled around
and the only thing I've seen for this error in relation to puppet is the
time sync problem.
So the error message text just has some additional info to suggest you
check your clocks.
Reviewed-by: Nick Lewis <nick@puppetlabs.com>
|
| | |\ \ \ \
| | |/ / /
| |/| | /
| | | |/
| | |/| |
|
| | | |\ \ |
|
| | | |/ /
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The introduction of composite namevars caused the resource title used in
resource aliases to be set as an array, even when the resource only had one
namevar. This would fail to conflict with non-alias entries in the resource
table, which used a string for the title, even though the single element array
contained the same string.
Now, we flatten the key used in the resource table, so that single element
arrays are represented as strings, and will properly conflict with resource
titles.
Paired-With: Jacob Helwig <jacob@puppetlabs.com>
|
