How to pass multiple values in exec command resource in puppet? - linux

Question

I want to deploy certs in default keystore using puppet
I have two files root.crt and intermediateca.crt managed by puppet. I will have many alias and cert file in future
Alias could be rootca, intermediateca.This alias and filepath should be passed to exec command.
alias=rootca, intermediateca
filecert= "/var/lib/certs/rootca", "/var/lib/certs/intermediateca.crt"
Now I am running an exec command which takes alias and crt file as an argument in exec command resource.
'/var/lib/certs':
ensure => directory;
'/var/lib/certs/root.crt':
source => "puppet:///modules/${module_name}/sonarqube/${::env}/var/lib/certs/root.crt",
mode => '0644',
notify => Exec['markitrootca'];
'/var/lib/certs/intermediateca.crt':
source => "puppet:///modules/${module_name}/sonarqube/${::env}/var/lib/certs/intermediateca.crt",
mode => '0644',
notify => Exec['markitintermediateca'];
}
exec {
'markitrootca':
path => "/usr/bin",
command => "keytool -importcert -keystore ${keystore} -alias markitrootca -file /var/lib/certs/root.crt -storepass ${storepass} -noprompt 2>/dev/null",
provider => shell,
refreshonly => true;
'markitintermediateca':
path => "/usr/bin",
command => "keytool -importcert -keystore ${keystore} -alias markitintermediateca -file /var/lib/certs/intermediateca.crt/ -storepass ${storepass} -noprompt 2>/dev/null",
provider => shell,
refreshonly => true;
}
The above solution is working fine but I want to write only one exec for multiple alias and filepaths. How can i achieve that?

Answer 1

What it sounds like you are asking here is how to iterate over a hash and have each resource in the iteration notify an exec resource. Given that, you can use a lambda iterator on the hash. If this is not true, then please clarify the question with terminology and details. First you construct the hash with your keys:
$certs = { 'rootca' => '/var/lib/certs/rootca',
'intermediateca' => '/var/lib/certs/intermediateca.crt' }
Then you can iterate over the hash with the each method.
$certs.each |String $cert, String $loc| {
# code here
}
Populating the body of the lambda would look like this for your situation:
$certs.each |String $cert, String $loc| {
file { $loc:
source => "puppet:///modules/${module_name}/sonarqube/${::env}${loc}",
mode => '0644',
notify => Exec['install_cert'];
}
}
Note that in your question it looked like you were doing per-resource default attributes, but it is unclear since the rest of the body is missing, so I converted it to a conventional resource.
The entire body of code would look like:
$certs = { 'rootca' => '/var/lib/certs/rootca',
'intermediateca' => '/var/lib/certs/intermediateca.crt' }
$certs.each |String $cert, String $loc| {
file { $loc:
source => "puppet:///modules/${module_name}/sonarqube/${::env}${loc}",
mode => '0644',
notify => Exec['install_cert'];
}
}
exec { 'install_cert':
path => "/usr/bin",
command => "keytool -importcert -keystore ${keystore} -alias $alias -storepass ${storepass} -noprompt -trustcacerts",
provider => linux,
subscribe => File['/var/lib/certs/'],
refreshonly => true;
}
Since you did not mention in the question what keystore and storepass are, I will have to assume you are defining them elsewhere. Also you are subscribing to File['/var/lib/certs/'] which I also have to assume is somewhere else.
There are other improvements you can make here, including:
Not specifying the provider in the exec.
Not using the path in the exec since it is a string and not an array of search paths and instead providing the full path to keytool.
Not subscribing to File['/var/lib/certs/'] since the exec does not care about that directory and the notify are providing the necessary functionality.
Not specifying the path to the certs since they are always in the same location, so you can use a single array instead of a hash.
env looks like a fact and not a global variable, so it should be specified as such.
Not having a deep source for your file resources and instead just storing them inside the env directory.
Helpful documentation on lambda iterators can be found here.

Answer 2

There is a much better way to do this. you can simple define a hierayaml file with an array of objects/task or just write it directly in.
instead of code such as
# Run Start Script*
exec { 'run script':
command => "somecmdhere",
provider => shell,
cwd => 'dir',
refreshonly => false,
logoutput => true
}
exec { 'run installation script':
command => "${target_dir}/${start_service_script}",
provider => shell,
cwd => $target_dir,
refreshonly => false,
logoutput => $cmdlogoutput
}
you can use create resource with arguments TYPE and Objects to create
create_resources('package', )
in this case we would use
#goes and looks for yaml file with variable exec scripts. This can be done by also defining it in puppet.
$listofExecCommands = hiera_hash('execScripts::allscripts)
create_resources('exec', $listofExecCommands)
Then where ever you define your YAML file you can re-use it with no code changes.
you can use this for RPMS NPM packages its great! ps make sure your yaml is correct*
#RPM packages to be installed
execScripts::allscripts:
'script1':
command: 'installed'
provider: 'yum'
cwd: 'somedir'
'script2':
command: 'installed'
provider: 'yum'
cwd: 'somedir'