I have recently started using Serverspec to test my Puppet modules actually produce the required configuration on real servers. In order to do this I have been using Vagrant and ServerSepc. The only problem is that Vagrant uses random ports and non standard SSH keys. In order to overcome this I have made a spec_helper that pulls the required information directly form Vagrant.
Update this has been merged with Serverspec
I was asked to give a demo at PuppetCamp Amsterdam and luckily it went down rather well. Over 150 people attended and I had an amazing time, as well as meeting some amazing people. The slides for the talk I gave are below:
{% speakerdeck 04cc2ab0828d0130ef4112313d142df9 >}} This is Puppet code and vagrant config used within the presentation.
After talking to a follow Puppetlabs employee [Chris][chris] and reading a blog post he has been writing about security issues related to class inheritance.
This got me thinking about ways to protect your code base against this. The following blog post explains the problem as well as a hackish method to try to protect yourself against it.
The problem Lets say that you have multiple teams managing multiple modules within your puppet infrastructure.
Per my previous post, that I explained the security issue relation to using facts. A colleague of mine has found out that you can’t even trust $clientcert.
Due to this I have wrote the function below to allow you to get the actual CertName, that has been validated against the certificate.
module Puppet::Parser::Functions newfunction(:certcheck, :type => :rvalue, :doc => <<-EOS Returns the actual certname EOS ) do |arguments| return host end end This allows you to use the following Puppet code to get a variable that you can trust to identify the Puppet agent.
Introduction After working with hiera from time with every growing code bases i have decided to write a super simple function. Hiera_debug this will allow the user to create a log file with information regarding each hiera lookup. This has allowed me to find out where in my manifests i am looking up variables and what they are return on each run. Its a very simple wrapper function for hiera that will output debug information into $logidr/hiera_debug_stephensmacbook.
I have been meaning to write this Blog post regarding using Hiera as sort of an ENC for a very long time but I have never got round to it. Until On a recent trip to Melbourne I suffered from jet lag so finally got round to writing it.
I believe that the best solution to a problem is normally the simplest one. For example I recently did some work for a client and will use the solution to highlight a way of driving everything from Hiera and the date we lookup for it.