diff --git a/Vagrantfile b/Vagrantfile index bf7674f..54b4d44 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -38,6 +38,7 @@ Vagrant.configure("2") do |config| echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts + echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts # Update all packages dnf update -y @@ -45,6 +46,19 @@ Vagrant.configure("2") do |config| # Tools used by readiness checks dnf install -y curl + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. Anything that authorizes on role -- codavox's + # publisher, and puppetserver's own auth.conf -- depends on it being here + # from the first boot. + install -d -m 0755 /etc/puppetlabs/puppet + tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_server +CSRYAML + # Install OpenVox repository rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm @@ -173,6 +187,113 @@ EYAML SHELL end + + # Compiler Node: runs OpenVox Server, but defers the CA to the primary. + # + # A compiler compiles catalogs and serves file content; it does not issue + # certificates. That is what makes it the node codavox exists for -- the + # publisher on the primary distributes resolved code to compilers, and each + # compiler answers which exact version it is serving. + config.vm.define "compiler" do |compiler| + compiler.vm.box = "bento/centos-stream-10" + compiler.vm.hostname = "compiler.example.com" + compiler.vm.network "private_network", ip: "192.168.56.13" + + compiler.vm.provider "parallels" do |prl| + prl.memory = 3072 + prl.cpus = 2 + end + + compiler.vm.provision "shell", inline: <<-SHELL + # Set up /etc/hosts + echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts + echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts + echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts + echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts + + dnf update -y + dnf install -y curl git + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. codavox's publisher authorizes on exactly this -- + # a certificate signed by the CA only proves the peer is some enrolled + # node, and every agent in the estate clears that bar. + install -d -m 0755 /etc/puppetlabs/puppet + tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_compiler +CSRYAML + + rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm + dnf install -y openvox-server + + # Point at the primary for both catalogs and the CA before enrolling, so + # the certificate is issued by the primary's CA rather than a second one + # this node would otherwise stand up for itself. + /opt/puppetlabs/bin/puppet config set --section main server puppet.example.com + /opt/puppetlabs/bin/puppet config set --section main ca_server puppet.example.com + /opt/puppetlabs/bin/puppet config set --section main certname compiler.example.com + + systemctl enable --now firewalld + firewall-cmd --add-port=8140/tcp --permanent + firewall-cmd --reload + + # Clock sync before enrolling. A skewed clock at certificate issuance + # produces "CRL not yet valid" errors that persist until regenerated. + systemctl stop chronyd 2>/dev/null || true + chronyd -q 'pool pool.ntp.org iburst' || true + systemctl start chronyd + + # Wait for the primary's CA to be serving before requesting a certificate. + echo "Waiting for the primary..." + ok=0 + while [ "$ok" -lt 3 ]; do + if curl -k https://puppet:8140/status/v1/simple > /dev/null 2>&1; then + ok=$((ok+1)) + else + ok=0 + fi + sleep 5 + done + + # Enrol. The primary autosigns in this environment, so the signed + # certificate comes back carrying pp_role from csr_attributes.yaml. + /opt/puppetlabs/bin/puppet ssl bootstrap --waitforcert 10 || true + + # Serve catalogs with the primary's CA material, and disable this node's + # own CA service so it never issues a certificate. + SSLDIR=/etc/puppetlabs/puppet/ssl + tee /etc/puppetlabs/puppetserver/conf.d/webserver.conf > /dev/null <> /etc/hosts echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts + echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts # Update all packages dnf update -y + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. Anything that authorizes on role -- codavox's + # publisher, and puppetserver's own auth.conf -- depends on it being here + # from the first boot. + install -d -m 0755 /etc/puppetlabs/puppet + tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_agent +CSRYAML + # Install OpenVox repository rpm -Uvh #{yum_release_base}/openvox8-release-el-9.noarch.rpm @@ -250,6 +385,7 @@ EYAML echo "192.168.56.10 puppet.example.com puppet" | sudo tee -a /etc/hosts > /dev/null echo "192.168.56.11 agent01.example.com agent01" | sudo tee -a /etc/hosts > /dev/null echo "192.168.56.12 agent02.example.com agent02" | sudo tee -a /etc/hosts > /dev/null + echo "192.168.56.13 compiler.example.com compiler" | sudo tee -a /etc/hosts > /dev/null # Update all packages sudo apt-get update -y @@ -257,6 +393,19 @@ EYAML # Install OpenVox repository + agent (Debian/Ubuntu) sudo apt-get install -y curl ca-certificates + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. Anything that authorizes on role -- codavox's + # publisher, and puppetserver's own auth.conf -- depends on it being here + # from the first boot. + sudo install -d -m 0755 /etc/puppetlabs/puppet + sudo tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_agent +CSRYAML + curl -fsSL -o /tmp/openvox8-release-ubuntu24.04.deb #{apt_release_base}/openvox8-release-ubuntu24.04.deb sudo dpkg -i /tmp/openvox8-release-ubuntu24.04.deb sudo apt-get update -y diff --git a/data/nodes/compiler.example.com.yaml b/data/nodes/compiler.example.com.yaml new file mode 100644 index 0000000..180d633 --- /dev/null +++ b/data/nodes/compiler.example.com.yaml @@ -0,0 +1,6 @@ +--- +# Node-specific configuration for the compiler. + +# Same server package as the primary; the difference is that its CA service is +# disabled and it enrols against the primary's CA, which provisioning sets up. +profile::openvox_server::version: '8.15.1' diff --git a/site-modules/role/manifests/compiler.pp b/site-modules/role/manifests/compiler.pp new file mode 100644 index 0000000..e96d9b4 --- /dev/null +++ b/site-modules/role/manifests/compiler.pp @@ -0,0 +1,19 @@ +# @summary Role for a compiler: an OpenVox Server that compiles catalogs but issues no certificates. +# +# A compiler runs the same server package as the primary, and differs in what it +# is allowed to do rather than what it installs: its CA service is disabled and +# it enrols against the primary's CA, so the estate has exactly one authority. +# That split is set up during provisioning, because it has to happen before the +# node holds a certificate at all. +# +# The node's certificate carries `pp_role: openvox_compiler`, written into +# `csr_attributes.yaml` before enrolment. Anything that authorizes on role reads +# that extension, so it cannot be added afterwards without re-issuing the +# certificate. +# +# @example +# include role::compiler +class role::compiler { + include profile::base + include profile::openvox_server +} diff --git a/spec/factsets/compiler.example.com.json b/spec/factsets/compiler.example.com.json new file mode 100644 index 0000000..caf640e --- /dev/null +++ b/spec/factsets/compiler.example.com.json @@ -0,0 +1,729 @@ +{ + "name": "compiler.example.com", + "trusted": { + "authenticated": "remote", + "certname": "compiler.example.com", + "domain": "example.com", + "extensions": { + "pp_role": "openvox_compiler" + }, + "hostname": "compiler" + }, + "values": { + "aio_agent_version": "8.28.0", + "augeas": { + "version": "1.14.1" + }, + "clientcert": "compiler.example.com", + "clientnoop": false, + "clientversion": "8.28.0", + "disks": { + "sda": { + "model": "harddisk1 SSD", + "serial": "9NPBBZ9188A4KFE66BFK", + "size": "64.00 GiB", + "size_bytes": 68719476736, + "type": "ssd", + "vendor": "ATA" + }, + "sr0": { + "model": "Virtual DVD-ROM", + "serial": "-_31415B265", + "size": "1.00 GiB", + "size_bytes": 1073741312, + "type": "ssd", + "vendor": "" + } + }, + "dmi": { + "bios": { + "release_date": "Thu, 11 Jun 2026 22:26:59", + "vendor": "Parallels International GmbH.", + "version": "26.4.0 (57513)" + }, + "board": { + "manufacturer": "Parallels ARM Virtual Machine", + "product": "Parallels ARM Virtual Platform" + }, + "manufacturer": "Parallels International GmbH.", + "product": { + "name": "Parallels ARM Virtual Machine", + "serial_number": "Parallels-0F 20 0C 90 BB 84 41 97 B6 3D 2B A2 80 CD 2F EF", + "uuid": "0f200c90-bb84-4197-b63d-2ba280cd2fef", + "version": "0.1" + } + }, + "facterversion": "5.6.1", + "filesystems": "vfat,xfs", + "fips_enabled": false, + "identity": { + "gid": 0, + "group": "root", + "privileged": true, + "uid": 0, + "user": "root" + }, + "implementation": "openvox", + "ip6tables_version": "1.8.11", + "iptables_version": "1.8.11", + "is_pe": false, + "is_virtual": true, + "kernel": "Linux", + "kernelmajversion": "6.12", + "kernelrelease": "6.12.0-233.el10.aarch64", + "kernelversion": "6.12.0", + "load_averages": { + "15m": 0.21, + "1m": 0.23, + "5m": 0.2 + }, + "memory": { + "swap": { + "available": "3.87 GiB", + "available_bytes": 4157136896, + "capacity": "1.55%", + "total": "3.93 GiB", + "total_bytes": 4222611456, + "used": "62.44 MiB", + "used_bytes": 65474560 + }, + "system": { + "available": "236.34 MiB", + "available_bytes": 247816192, + "capacity": "91.99%", + "total": "2.88 GiB", + "total_bytes": 3095457792, + "used": "2.65 GiB", + "used_bytes": 2847641600 + } + }, + "mountpoints": { + "/": { + "available": "55.70 GiB", + "available_bytes": 59803131904, + "capacity": "6.26%", + "device": "/dev/sda3", + "filesystem": "xfs", + "options": [ + "rw", + "seclabel", + "relatime", + "attr2", + "inode64", + "logbufs=8", + "logbsize=32k", + "noquota" + ], + "size": "59.42 GiB", + "size_bytes": 63798509568, + "used": "3.72 GiB", + "used_bytes": 3995377664 + }, + "/boot/efi": { + "available": "585.88 MiB", + "available_bytes": 614342656, + "capacity": "2.16%", + "device": "/dev/sda1", + "filesystem": "vfat", + "options": [ + "rw", + "relatime", + "fmask=0077", + "dmask=0077", + "codepage=437", + "iocharset=ascii", + "shortname=winnt", + "errors=remount-ro" + ], + "size": "598.79 MiB", + "size_bytes": 627875840, + "used": "12.91 MiB", + "used_bytes": 13533184 + }, + "/dev": { + "available": "1.42 GiB", + "available_bytes": 1520545792, + "capacity": "0%", + "device": "devtmpfs", + "filesystem": "devtmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "size=1484908k", + "nr_inodes=371227", + "mode=755", + "inode64" + ], + "size": "1.42 GiB", + "size_bytes": 1520545792, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/hugepages": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "hugetlbfs", + "filesystem": "hugetlbfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "relatime", + "pagesize=2M" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/mqueue": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "mqueue", + "filesystem": "mqueue", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "noexec", + "relatime" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/pts": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "devpts", + "filesystem": "devpts", + "options": [ + "rw", + "seclabel", + "nosuid", + "noexec", + "relatime", + "gid=5", + "mode=620", + "ptmxmode=000" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/shm": { + "available": "1.44 GiB", + "available_bytes": 1546649600, + "capacity": "0.07%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "inode64", + "usrquota" + ], + "size": "1.44 GiB", + "size_bytes": 1547726848, + "used": "1.03 MiB", + "used_bytes": 1077248 + }, + "/etc/puppetlabs/code/environments/production": { + "available": "64.73 GiB", + "available_bytes": 69504139264, + "capacity": "85.94%", + "device": "etc_puppetlabs_code_environments_production", + "filesystem": "fuse.prl_fsd", + "options": [ + "rw", + "nosuid", + "nodev", + "relatime", + "user_id=0", + "group_id=0", + "default_permissions", + "allow_other" + ], + "size": "460.43 GiB", + "size_bytes": 494384795648, + "used": "395.70 GiB", + "used_bytes": 424880656384 + }, + "/run": { + "available": "577.74 MiB", + "available_bytes": 605802496, + "capacity": "2.15%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "size=604584k", + "nr_inodes=819200", + "mode=755", + "inode64" + ], + "size": "590.41 MiB", + "size_bytes": 619094016, + "used": "12.68 MiB", + "used_bytes": 13291520 + }, + "/run/credentials/getty@tty1.service": { + "available": "1.00 MiB", + "available_bytes": 1048576, + "capacity": "0%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "ro", + "seclabel", + "nosuid", + "nodev", + "noexec", + "relatime", + "nosymfollow", + "size=1024k", + "nr_inodes=1024", + "mode=700", + "inode64", + "noswap" + ], + "size": "1.00 MiB", + "size_bytes": 1048576, + "used": "0 bytes", + "used_bytes": 0 + }, + "/run/credentials/systemd-journald.service": { + "available": "1.00 MiB", + "available_bytes": 1048576, + "capacity": "0%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "ro", + "seclabel", + "nosuid", + "nodev", + "noexec", + "relatime", + "nosymfollow", + "size=1024k", + "nr_inodes=1024", + "mode=700", + "inode64", + "noswap" + ], + "size": "1.00 MiB", + "size_bytes": 1048576, + "used": "0 bytes", + "used_bytes": 0 + }, + "/run/user/1000": { + "available": "295.19 MiB", + "available_bytes": 309530624, + "capacity": "0.00%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "relatime", + "size=302288k", + "nr_inodes=75572", + "mode=700", + "uid=1000", + "gid=1000", + "inode64" + ], + "size": "295.20 MiB", + "size_bytes": 309542912, + "used": "12.00 KiB", + "used_bytes": 12288 + }, + "/var/lib/nfs/rpc_pipefs": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "rpc_pipefs", + "filesystem": "rpc_pipefs", + "options": [ + "rw", + "relatime" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + } + }, + "networking": { + "domain": "example.com", + "fqdn": "compiler.example.com", + "hostname": "compiler", + "interfaces": { + "enp0s5": { + "bindings": [ + { + "address": "10.211.55.129", + "netmask": "255.255.255.0", + "network": "10.211.55.0" + } + ], + "bindings6": [ + { + "address": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", + "flags": [], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fdb2:2c26:f4e4::", + "scope6": "global" + }, + { + "address": "fe80::21c:42ff:fe6f:138d", + "flags": [ + "permanent" + ], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fe80::", + "scope6": "link" + } + ], + "duplex": "unknown", + "ip": "10.211.55.129", + "ip6": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", + "mac": "00:1c:42:6f:13:8d", + "mtu": 1500, + "netmask": "255.255.255.0", + "netmask6": "ffff:ffff:ffff:ffff::", + "network": "10.211.55.0", + "network6": "fdb2:2c26:f4e4::", + "operational_state": "up", + "physical": true, + "scope6": "global", + "speed": -1 + }, + "enp0s6": { + "bindings": [ + { + "address": "192.168.56.13", + "netmask": "255.255.255.0", + "network": "192.168.56.0" + } + ], + "bindings6": [ + { + "address": "fdb2:2c26:f4e4:2:a7c0:56a4:e562:6b64", + "flags": [], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fdb2:2c26:f4e4:2::", + "scope6": "global" + }, + { + "address": "fe80::d248:9dd9:86bd:8735", + "flags": [ + "permanent" + ], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fe80::", + "scope6": "link" + } + ], + "duplex": "unknown", + "ip": "192.168.56.13", + "ip6": "fdb2:2c26:f4e4:2:a7c0:56a4:e562:6b64", + "mac": "00:1c:42:56:ee:da", + "mtu": 1500, + "netmask": "255.255.255.0", + "netmask6": "ffff:ffff:ffff:ffff::", + "network": "192.168.56.0", + "network6": "fdb2:2c26:f4e4:2::", + "operational_state": "up", + "physical": true, + "scope6": "global", + "speed": -1 + }, + "lo": { + "bindings": [ + { + "address": "127.0.0.1", + "netmask": "255.0.0.0", + "network": "127.0.0.0" + } + ], + "bindings6": [ + { + "address": "::1", + "flags": [ + "permanent" + ], + "netmask": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", + "network": "::1", + "scope6": "host" + } + ], + "ip": "127.0.0.1", + "ip6": "::1", + "mtu": 65536, + "netmask": "255.0.0.0", + "netmask6": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", + "network": "127.0.0.0", + "network6": "::1", + "operational_state": "unknown", + "physical": false, + "scope6": "host" + } + }, + "ip": "10.211.55.129", + "ip6": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", + "mac": "00:1c:42:6f:13:8d", + "mtu": 1500, + "netmask": "255.255.255.0", + "netmask6": "ffff:ffff:ffff:ffff::", + "network": "10.211.55.0", + "network6": "fdb2:2c26:f4e4::", + "primary": "enp0s5", + "scope6": "global" + }, + "openvoxdb_version": "8.13.0.SNAPSHOT.2026.04.24T1629", + "os": { + "architecture": "aarch64", + "distro": { + "codename": "Coughlan", + "description": "CentOS Stream release 10 (Coughlan)", + "id": "CentOSStream", + "release": { + "full": "10", + "major": "10" + } + }, + "family": "RedHat", + "hardware": "aarch64", + "name": "CentOS", + "release": { + "full": "10", + "major": "10" + }, + "selinux": { + "config_mode": "enforcing", + "config_policy": "targeted", + "current_mode": "enforcing", + "enabled": true, + "enforced": true, + "policy_version": "33" + } + }, + "package_provider": "dnf", + "partitions": { + "/dev/sda1": { + "filesystem": "vfat", + "mount": "/boot/efi", + "partlabel": "EFI System Partition", + "parttype": "c12a7328-f81f-11d2-ba4b-00a0c93ec93b", + "partuuid": "ab44db70-dfeb-4136-880a-062ae4fde5cc", + "size": "600.00 MiB", + "size_bytes": 629145600, + "uuid": "F0F8-A0A2" + }, + "/dev/sda2": { + "filesystem": "swap", + "parttype": "0657fd6d-a4ab-43c4-84e5-0933c84b4f4f", + "partuuid": "42ab67fa-48a0-4e5d-bdaf-dfc197227543", + "size": "3.93 GiB", + "size_bytes": 4222615552, + "uuid": "d3e9bdac-fbcb-4940-830e-0d7f15e54831" + }, + "/dev/sda3": { + "filesystem": "xfs", + "mount": "/", + "parttype": "b921b045-1df0-41c3-af44-4c6f280d3fae", + "partuuid": "690e6a7e-a901-4f54-8a00-dd83f1ae60e0", + "size": "59.48 GiB", + "size_bytes": 63865618432, + "uuid": "85b4dc90-a967-493a-a6aa-da96b60c5075" + } + }, + "path": "/sbin:/bin:/usr/sbin:/usr/bin:/opt/puppetlabs/bin", + "processors": { + "cores": 2, + "count": 2, + "extensions": [ + "aarch64" + ], + "isa": "aarch64", + "models": [], + "physicalcount": 1, + "threads": 1 + }, + "puppet_environmentpath": "/etc/puppetlabs/code/environments", + "puppet_server": "puppet", + "puppet_vardir": "/opt/puppetlabs/puppet/cache", + "puppetversion": "8.28.0", + "root_home": "/root", + "ruby": { + "platform": "aarch64-linux", + "sitedir": "/opt/puppetlabs/puppet/lib/ruby/site_ruby/3.2.0", + "version": "3.2.11" + }, + "service_provider": "systemd", + "ssh": { + "ecdsa": { + "fingerprints": { + "sha1": "SSHFP 3 1 8a0cb93a91295f9fe0fb80d246f79c0589b67837", + "sha256": "SSHFP 3 2 107c5c1c926d682dd2db5934a1ae6a95954385f70d8719b85602946b0ce51bef" + }, + "key": "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB66+Qgw+zd8utLX12VqfQk4HqgF46UivAnqDmyzh9/pMKEeq5ud/UaiLIStWqotGiASPaOpedDxiSoTA/wLJik=", + "type": "ecdsa-sha2-nistp256" + }, + "ed25519": { + "fingerprints": { + "sha1": "SSHFP 4 1 8d36c7b0c146d2de8fdebf04354ee169d3d9cdee", + "sha256": "SSHFP 4 2 fbec89c062b17e90a71aca6d893a7f3b4e76c235af723e38b47816ac66330753" + }, + "key": "AAAAC3NzaC1lZDI1NTE5AAAAIE67AxXfBX+WjkOaKhI2AnmyTY/GoUksR3A0lExxDXUY", + "type": "ssh-ed25519" + }, + "rsa": { + "fingerprints": { + "sha1": "SSHFP 1 1 215dc30e07631ebdb587166b387fd44f89be0b8f", + "sha256": "SSHFP 1 2 7b9ac533db8f26b60a9b6acc8680d680115f9a9dda533adb9f0192b2ae23be2a" + }, + "key": "AAAAB3NzaC1yc2EAAAADAQABAAABgQCnG23J0gEm5W7IrpG4lmN1gOkD0ShnO/H5E5SBj4W6hrHOO1D5rbwFROTiCS4CMYd16qnb+fs9/lVZKGi6fuXtmpOZTL5/OK2kMfIsgouhiuuLytHJ9ukX7M8dVyL+TUACr2zKJ/6QyBScOCfjEC87y0NbCB5ifwENCeCUGgCL4cCVrovd0rd6JlKyzpamMZFzamdETbyeYdZorh/MKyTKDFc8VmFnpRa1Y+Q2LuQG5e+OYmJ5kHOLduEWnQ2eAZB8OafRL2T4wHEr2uUpi8SMqUpr0p/svvqqXDDdPDmDu9cUXMiB+lgpiZdKKiXuO8AbgAMaqc3zcvIQLXeiqCLQs/LlMEiEHbuPFkAc+CQYLy0uzp0wOxOHELq3ffkVWjca0ugtZaQ4b1uvnepJnysMQQjLrGS/TX8pL5VUTyvvcQPna/CWfi3J+NlLl+j2QN1Hj+jEHOF81VWS4tbz+ZlsEMAqk0pVR9Lb+LLEFpu6s3CM854zppOQ3BoOdiDeZjs=", + "type": "ssh-rsa" + } + }, + "sudoversion": "1.9.17p2", + "system_uptime": { + "days": 1, + "hours": 28, + "seconds": 103309, + "uptime": "1 day" + }, + "systemd": true, + "systemd_internal_services": { + "systemd-boot-check-no-failures.service": "disabled", + "systemd-boot-update.service": "disabled", + "systemd-confext.service": "enabled", + "systemd-network-generator.service": "enabled", + "systemd-pcrlock-file-system.service": "disabled", + "systemd-pcrlock-firmware-code.service": "disabled", + "systemd-pcrlock-firmware-config.service": "disabled", + "systemd-pcrlock-machine-id.service": "disabled", + "systemd-pcrlock-make-policy.service": "disabled", + "systemd-pcrlock-secureboot-authority.service": "disabled", + "systemd-pcrlock-secureboot-policy.service": "disabled", + "systemd-pstore.service": "enabled", + "systemd-remount-fs.service": "enabled-runtime", + "systemd-sysext.service": "enabled", + "systemd-sysupdate-reboot.service": "indirect", + "systemd-sysupdate.service": "indirect", + "systemd-udev-load-credentials.service": "disabled", + "systemd-userdbd.service": "indirect" + }, + "systemd_version": "257", + "timezone": "CDT", + "vcsrepo_svn_ver": "", + "virtual": "parallels", + "yum_has_updates": true, + "yum_package_updates": [ + "buildah.aarch64", + "centos-gpg-keys.noarch", + "centos-stream-release.noarch", + "centos-stream-repos.noarch", + "clevis.aarch64", + "clevis-luks.aarch64", + "cockpit.aarch64", + "cockpit-bridge.noarch", + "cockpit-packagekit.noarch", + "cockpit-podman.noarch", + "cockpit-storaged.noarch", + "cockpit-system.noarch", + "cockpit-ws.aarch64", + "cockpit-ws-selinux.aarch64", + "conmon.aarch64", + "container-selinux.noarch", + "coreutils.aarch64", + "coreutils-common.aarch64", + "device-mapper.aarch64", + "device-mapper-event.aarch64", + "device-mapper-event-libs.aarch64", + "device-mapper-libs.aarch64", + "dnf.noarch", + "dnf-data.noarch", + "firewalld.noarch", + "firewalld-filesystem.noarch", + "grub2-common.noarch", + "grub2-efi-aa64.aarch64", + "grub2-efi-aa64-cdboot.aarch64", + "grub2-tools.aarch64", + "grub2-tools-extra.aarch64", + "grub2-tools-minimal.aarch64", + "hwdata.noarch", + "libcap-ng.aarch64", + "libcap-ng-python3.aarch64", + "libdnf.aarch64", + "libpng.aarch64", + "libusb1.aarch64", + "libxml2.aarch64", + "lvm2.aarch64", + "lvm2-libs.aarch64", + "man-pages.noarch", + "netavark.aarch64", + "nspr.aarch64", + "nss.aarch64", + "nss-softokn.aarch64", + "nss-softokn-freebl.aarch64", + "nss-sysinit.aarch64", + "nss-util.aarch64", + "openbolt.aarch64", + "openvox-server.noarch", + "openvoxdb.noarch", + "openvoxdb-termini.noarch", + "passt.aarch64", + "passt-selinux.noarch", + "podman.aarch64", + "podman-sequoia.aarch64", + "python3-dnf.noarch", + "python3-firewall.noarch", + "python3-hawkey.aarch64", + "python3-libdnf.aarch64", + "python3-rpm.aarch64", + "python3-urllib3.noarch", + "rpm.aarch64", + "rpm-build-libs.aarch64", + "rpm-libs.aarch64", + "rpm-plugin-audit.aarch64", + "rpm-plugin-selinux.aarch64", + "rpm-plugin-systemd-inhibit.aarch64", + "rpm-sign-libs.aarch64", + "selinux-policy.noarch", + "selinux-policy-targeted.noarch", + "shadow-utils.aarch64", + "shadow-utils-subid.aarch64", + "shim-aa64.aarch64", + "sudo.aarch64", + "sudo-python-plugin.aarch64", + "systemd.aarch64", + "systemd-libs.aarch64", + "systemd-pam.aarch64", + "systemd-udev.aarch64", + "tuned.noarch", + "xfsdump.aarch64", + "yum.noarch" + ], + "yum_reboot_required": false, + "yum_updates": 84 + } +} diff --git a/spec/onceover.yaml b/spec/onceover.yaml index 21b5292..be67048 100644 --- a/spec/onceover.yaml +++ b/spec/onceover.yaml @@ -11,6 +11,7 @@ # Roles under test. classes: - role::puppet_master + - role::compiler - role::database_server - role::webserver - role::example @@ -19,6 +20,7 @@ classes: # so that trusted.certname resolves the right nodes/%{trusted.certname}.yaml). nodes: - puppet.example.com + - compiler.example.com - agent01.example.com - agent02.example.com @@ -27,6 +29,8 @@ nodes: class_groups: master_role: - role::puppet_master + compiler_role: + - role::compiler base_roles: - role::database_server - role::webserver @@ -35,6 +39,8 @@ class_groups: node_groups: master: - puppet.example.com + compiler: + - compiler.example.com agents: - agent01.example.com - agent02.example.com @@ -47,6 +53,9 @@ test_matrix: - master: classes: master_role tests: spec + - compiler: + classes: compiler_role + tests: spec - agents: classes: base_roles tests: spec