Issue 122 - Puppet ENC via Hiera

modules/filtermaster/manifests/init.pp

 class filtermaster {
   Cron {
     environment => ['MAILTO=admins@adblockplus.org', 'PYTHONPATH=/opt/sitescripts'],
   }
 
+  include ssh

[Wladimir Palant, 2014/11/17 16:43:36]

That change shouldn't be necessary, is that a rebase artifact?

[mathias, 2014/11/27 00:30:18]

No it is not, that one is actually intentional:

tl;dr -- As denoted in the comments for patch set 1; the implicit inclusion of
class `ssh` in `base` does not guarantee that it has been processed before
concat::fragment for `sshd_max_limits` here.

-vvv -- When using an ENC (doesn't have to be Hiera), one can use either a list
of classes or a hash/map/dict (see
https://docs.puppetlabs.com/guides/external_nodes.html#enc-output-format). Since
we're merging our YAML role files with precedences over each other, we can't use
the list version but have to rely on the maps (otherwise merging would become
really complicated and prone to error). Unfortunately, this also implies that we
cannot control in which order the classes are applied (due to hash maps not
reflecting the insertion order) - in contrast to before, where this was
determined implicitly by the include in the node's manifest.

We have various ideas how to circumvent this in another fashion than the
explicit include here. However, testing alternatives is something we're planning
to do while migrating the affected classes to be integrated with ENC/Hiera. This
include should be a fine solution for now, at least.

+
   concat::fragment {'sshd_max_limits':
     target => 'sshd_config',
     order => '50',
     content => '
       MaxSessions 50
       MaxStartups 50
     '
   }
 
   concat::fragment {'sshd_user_rsync':
@@ skipping 120 matching lines @@
       User['rsync'],
       File['/home/rsync/update_repos.sh']
     ],
     minute  => '8-58/10'
   }
 
   class {'sitescripts':
     sitescriptsini_source => 'puppet:///modules/filtermaster/sitescripts'
   }
 }