Noissue - Allow for using Puppet tags without sudo password

Noissue - Allow for using Puppet tags without sudo password

[mathias, 2017-04-09 22:12:46]

Assuming you've confirmed kick.py always putting the tags at the end..

However, given that those wild-cards are not limited to a single argument, hence
effectively assuming trust in all folks who are permitted to execute puppet
agent, I think we could just white-list 'puppet agent --test *'. That would
allow for more flexibility during manual operations, be more compatible with
possible updates to the script, and still ensure the '--test' flag is issued to
the agent is not started in daemon mode. 

Thoughts?

[Fred, 2017-04-10 08:31:09]

> agent, I think we could just white-list 'puppet agent --test *'. That would

Sounds reasonable to me.

[f.lopez, 2017-04-10 15:54:59]

On 2017/04/09 22:12:46, mathias wrote:
> Assuming you've confirmed kick.py always putting the tags at the end..
> 
> However, given that those wild-cards are not limited to a single argument,
hence
> effectively assuming trust in all folks who are permitted to execute puppet
> agent, I think we could just white-list 'puppet agent --test *'. That would
> allow for more flexibility during manual operations, be more compatible with
> possible updates to the script, and still ensure the '--test' flag is issued
to
> the agent is not started in daemon mode. 
> 
> Thoughts?

Sounds good enough to me, I tested it and gonna send a new patch

[f.lopez, 2017-04-10 15:57:21]

On 2017/04/10 15:56:05, f.lopez wrote:

Btw, the '*' must be next to the '--test' string, otherwise it would always
expect a space

[mathias, 2017-04-10 17:34:34]

LGTM.