From 935fd6789aafffaad498c08fa00c32bca08055f5 Mon Sep 17 00:00:00 2001 From: Michael Harp Date: Sat, 25 Jul 2026 11:47:36 -0400 Subject: [PATCH] Add a compiler VM, and put pp_role in every certificate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two changes that only make sense together. Every node's certificate now carries a pp_role, written into csr_attributes.yaml before enrolment: openvox_server on the primary, openvox_compiler on the new node, openvox_agent on the agents. It has to happen there because pp_role is an X.509 extension — it cannot be added to a signed certificate afterwards without re-issuing it, which on the primary means replacing the certificate puppetserver is currently serving with. Provisioning it from first boot makes a rebuilt estate correct by construction rather than needing a repair step. That matters because authorization by role is the only thing separating 'this node holds a certificate from our CA' from 'this node is allowed to do X', and every agent in the estate clears the first bar. The immediate consumer is codavox, whose publisher refuses a peer without an allowed pp_role, but auth.conf works the same way. The compiler runs the same openvox-server package as the primary and differs in what it may do: its CA service is disabled and it enrols against the primary, so the estate keeps exactly one authority. That setup happens in provisioning because it has to be in place before the node holds a certificate at all. Modelled on codavox's own integration harness, which stands up the same shape and is known to work. onceover covers it: role::compiler compiles against a new factset derived from the primary's, since they are the same OS and architecture, with the identity facts and the pp_role trusted extension corrected. All five roles still pass. Not included: the compiler is absent from inventory.yaml, because Bolt validation targets the agents and reaching the compiler would also need the bolt key authorization the agent provisioners do. Add both together if that is wanted. The role module's pre-existing whitespace lint errors are untouched and unrelated; compiler.pp contributes none. Co-Authored-By: Claude Opus 5 --- Vagrantfile | 149 +++++ data/nodes/compiler.example.com.yaml | 6 + site-modules/role/manifests/compiler.pp | 19 + spec/factsets/compiler.example.com.json | 729 ++++++++++++++++++++++++ spec/onceover.yaml | 9 + 5 files changed, 912 insertions(+) create mode 100644 data/nodes/compiler.example.com.yaml create mode 100644 site-modules/role/manifests/compiler.pp create mode 100644 spec/factsets/compiler.example.com.json diff --git a/Vagrantfile b/Vagrantfile index bf7674f..54b4d44 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -38,6 +38,7 @@ Vagrant.configure("2") do |config| echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts + echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts # Update all packages dnf update -y @@ -45,6 +46,19 @@ Vagrant.configure("2") do |config| # Tools used by readiness checks dnf install -y curl + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. Anything that authorizes on role -- codavox's + # publisher, and puppetserver's own auth.conf -- depends on it being here + # from the first boot. + install -d -m 0755 /etc/puppetlabs/puppet + tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_server +CSRYAML + # Install OpenVox repository rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm @@ -173,6 +187,113 @@ EYAML SHELL end + + # Compiler Node: runs OpenVox Server, but defers the CA to the primary. + # + # A compiler compiles catalogs and serves file content; it does not issue + # certificates. That is what makes it the node codavox exists for -- the + # publisher on the primary distributes resolved code to compilers, and each + # compiler answers which exact version it is serving. + config.vm.define "compiler" do |compiler| + compiler.vm.box = "bento/centos-stream-10" + compiler.vm.hostname = "compiler.example.com" + compiler.vm.network "private_network", ip: "192.168.56.13" + + compiler.vm.provider "parallels" do |prl| + prl.memory = 3072 + prl.cpus = 2 + end + + compiler.vm.provision "shell", inline: <<-SHELL + # Set up /etc/hosts + echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts + echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts + echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts + echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts + + dnf update -y + dnf install -y curl git + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. codavox's publisher authorizes on exactly this -- + # a certificate signed by the CA only proves the peer is some enrolled + # node, and every agent in the estate clears that bar. + install -d -m 0755 /etc/puppetlabs/puppet + tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_compiler +CSRYAML + + rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm + dnf install -y openvox-server + + # Point at the primary for both catalogs and the CA before enrolling, so + # the certificate is issued by the primary's CA rather than a second one + # this node would otherwise stand up for itself. + /opt/puppetlabs/bin/puppet config set --section main server puppet.example.com + /opt/puppetlabs/bin/puppet config set --section main ca_server puppet.example.com + /opt/puppetlabs/bin/puppet config set --section main certname compiler.example.com + + systemctl enable --now firewalld + firewall-cmd --add-port=8140/tcp --permanent + firewall-cmd --reload + + # Clock sync before enrolling. A skewed clock at certificate issuance + # produces "CRL not yet valid" errors that persist until regenerated. + systemctl stop chronyd 2>/dev/null || true + chronyd -q 'pool pool.ntp.org iburst' || true + systemctl start chronyd + + # Wait for the primary's CA to be serving before requesting a certificate. + echo "Waiting for the primary..." + ok=0 + while [ "$ok" -lt 3 ]; do + if curl -k https://puppet:8140/status/v1/simple > /dev/null 2>&1; then + ok=$((ok+1)) + else + ok=0 + fi + sleep 5 + done + + # Enrol. The primary autosigns in this environment, so the signed + # certificate comes back carrying pp_role from csr_attributes.yaml. + /opt/puppetlabs/bin/puppet ssl bootstrap --waitforcert 10 || true + + # Serve catalogs with the primary's CA material, and disable this node's + # own CA service so it never issues a certificate. + SSLDIR=/etc/puppetlabs/puppet/ssl + tee /etc/puppetlabs/puppetserver/conf.d/webserver.conf > /dev/null <> /etc/hosts echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts + echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts # Update all packages dnf update -y + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. Anything that authorizes on role -- codavox's + # publisher, and puppetserver's own auth.conf -- depends on it being here + # from the first boot. + install -d -m 0755 /etc/puppetlabs/puppet + tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_agent +CSRYAML + # Install OpenVox repository rpm -Uvh #{yum_release_base}/openvox8-release-el-9.noarch.rpm @@ -250,6 +385,7 @@ EYAML echo "192.168.56.10 puppet.example.com puppet" | sudo tee -a /etc/hosts > /dev/null echo "192.168.56.11 agent01.example.com agent01" | sudo tee -a /etc/hosts > /dev/null echo "192.168.56.12 agent02.example.com agent02" | sudo tee -a /etc/hosts > /dev/null + echo "192.168.56.13 compiler.example.com compiler" | sudo tee -a /etc/hosts > /dev/null # Update all packages sudo apt-get update -y @@ -257,6 +393,19 @@ EYAML # Install OpenVox repository + agent (Debian/Ubuntu) sudo apt-get install -y curl ca-certificates + + # pp_role has to be in the CSR before the certificate is issued: it is an + # X.509 extension, so it cannot be added to a signed cert afterwards + # without re-issuing. Anything that authorizes on role -- codavox's + # publisher, and puppetserver's own auth.conf -- depends on it being here + # from the first boot. + sudo install -d -m 0755 /etc/puppetlabs/puppet + sudo tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' +--- +extension_requests: + pp_role: openvox_agent +CSRYAML + curl -fsSL -o /tmp/openvox8-release-ubuntu24.04.deb #{apt_release_base}/openvox8-release-ubuntu24.04.deb sudo dpkg -i /tmp/openvox8-release-ubuntu24.04.deb sudo apt-get update -y diff --git a/data/nodes/compiler.example.com.yaml b/data/nodes/compiler.example.com.yaml new file mode 100644 index 0000000..180d633 --- /dev/null +++ b/data/nodes/compiler.example.com.yaml @@ -0,0 +1,6 @@ +--- +# Node-specific configuration for the compiler. + +# Same server package as the primary; the difference is that its CA service is +# disabled and it enrols against the primary's CA, which provisioning sets up. +profile::openvox_server::version: '8.15.1' diff --git a/site-modules/role/manifests/compiler.pp b/site-modules/role/manifests/compiler.pp new file mode 100644 index 0000000..e96d9b4 --- /dev/null +++ b/site-modules/role/manifests/compiler.pp @@ -0,0 +1,19 @@ +# @summary Role for a compiler: an OpenVox Server that compiles catalogs but issues no certificates. +# +# A compiler runs the same server package as the primary, and differs in what it +# is allowed to do rather than what it installs: its CA service is disabled and +# it enrols against the primary's CA, so the estate has exactly one authority. +# That split is set up during provisioning, because it has to happen before the +# node holds a certificate at all. +# +# The node's certificate carries `pp_role: openvox_compiler`, written into +# `csr_attributes.yaml` before enrolment. Anything that authorizes on role reads +# that extension, so it cannot be added afterwards without re-issuing the +# certificate. +# +# @example +# include role::compiler +class role::compiler { + include profile::base + include profile::openvox_server +} diff --git a/spec/factsets/compiler.example.com.json b/spec/factsets/compiler.example.com.json new file mode 100644 index 0000000..caf640e --- /dev/null +++ b/spec/factsets/compiler.example.com.json @@ -0,0 +1,729 @@ +{ + "name": "compiler.example.com", + "trusted": { + "authenticated": "remote", + "certname": "compiler.example.com", + "domain": "example.com", + "extensions": { + "pp_role": "openvox_compiler" + }, + "hostname": "compiler" + }, + "values": { + "aio_agent_version": "8.28.0", + "augeas": { + "version": "1.14.1" + }, + "clientcert": "compiler.example.com", + "clientnoop": false, + "clientversion": "8.28.0", + "disks": { + "sda": { + "model": "harddisk1 SSD", + "serial": "9NPBBZ9188A4KFE66BFK", + "size": "64.00 GiB", + "size_bytes": 68719476736, + "type": "ssd", + "vendor": "ATA" + }, + "sr0": { + "model": "Virtual DVD-ROM", + "serial": "-_31415B265", + "size": "1.00 GiB", + "size_bytes": 1073741312, + "type": "ssd", + "vendor": "" + } + }, + "dmi": { + "bios": { + "release_date": "Thu, 11 Jun 2026 22:26:59", + "vendor": "Parallels International GmbH.", + "version": "26.4.0 (57513)" + }, + "board": { + "manufacturer": "Parallels ARM Virtual Machine", + "product": "Parallels ARM Virtual Platform" + }, + "manufacturer": "Parallels International GmbH.", + "product": { + "name": "Parallels ARM Virtual Machine", + "serial_number": "Parallels-0F 20 0C 90 BB 84 41 97 B6 3D 2B A2 80 CD 2F EF", + "uuid": "0f200c90-bb84-4197-b63d-2ba280cd2fef", + "version": "0.1" + } + }, + "facterversion": "5.6.1", + "filesystems": "vfat,xfs", + "fips_enabled": false, + "identity": { + "gid": 0, + "group": "root", + "privileged": true, + "uid": 0, + "user": "root" + }, + "implementation": "openvox", + "ip6tables_version": "1.8.11", + "iptables_version": "1.8.11", + "is_pe": false, + "is_virtual": true, + "kernel": "Linux", + "kernelmajversion": "6.12", + "kernelrelease": "6.12.0-233.el10.aarch64", + "kernelversion": "6.12.0", + "load_averages": { + "15m": 0.21, + "1m": 0.23, + "5m": 0.2 + }, + "memory": { + "swap": { + "available": "3.87 GiB", + "available_bytes": 4157136896, + "capacity": "1.55%", + "total": "3.93 GiB", + "total_bytes": 4222611456, + "used": "62.44 MiB", + "used_bytes": 65474560 + }, + "system": { + "available": "236.34 MiB", + "available_bytes": 247816192, + "capacity": "91.99%", + "total": "2.88 GiB", + "total_bytes": 3095457792, + "used": "2.65 GiB", + "used_bytes": 2847641600 + } + }, + "mountpoints": { + "/": { + "available": "55.70 GiB", + "available_bytes": 59803131904, + "capacity": "6.26%", + "device": "/dev/sda3", + "filesystem": "xfs", + "options": [ + "rw", + "seclabel", + "relatime", + "attr2", + "inode64", + "logbufs=8", + "logbsize=32k", + "noquota" + ], + "size": "59.42 GiB", + "size_bytes": 63798509568, + "used": "3.72 GiB", + "used_bytes": 3995377664 + }, + "/boot/efi": { + "available": "585.88 MiB", + "available_bytes": 614342656, + "capacity": "2.16%", + "device": "/dev/sda1", + "filesystem": "vfat", + "options": [ + "rw", + "relatime", + "fmask=0077", + "dmask=0077", + "codepage=437", + "iocharset=ascii", + "shortname=winnt", + "errors=remount-ro" + ], + "size": "598.79 MiB", + "size_bytes": 627875840, + "used": "12.91 MiB", + "used_bytes": 13533184 + }, + "/dev": { + "available": "1.42 GiB", + "available_bytes": 1520545792, + "capacity": "0%", + "device": "devtmpfs", + "filesystem": "devtmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "size=1484908k", + "nr_inodes=371227", + "mode=755", + "inode64" + ], + "size": "1.42 GiB", + "size_bytes": 1520545792, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/hugepages": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "hugetlbfs", + "filesystem": "hugetlbfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "relatime", + "pagesize=2M" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/mqueue": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "mqueue", + "filesystem": "mqueue", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "noexec", + "relatime" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/pts": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "devpts", + "filesystem": "devpts", + "options": [ + "rw", + "seclabel", + "nosuid", + "noexec", + "relatime", + "gid=5", + "mode=620", + "ptmxmode=000" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + }, + "/dev/shm": { + "available": "1.44 GiB", + "available_bytes": 1546649600, + "capacity": "0.07%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "inode64", + "usrquota" + ], + "size": "1.44 GiB", + "size_bytes": 1547726848, + "used": "1.03 MiB", + "used_bytes": 1077248 + }, + "/etc/puppetlabs/code/environments/production": { + "available": "64.73 GiB", + "available_bytes": 69504139264, + "capacity": "85.94%", + "device": "etc_puppetlabs_code_environments_production", + "filesystem": "fuse.prl_fsd", + "options": [ + "rw", + "nosuid", + "nodev", + "relatime", + "user_id=0", + "group_id=0", + "default_permissions", + "allow_other" + ], + "size": "460.43 GiB", + "size_bytes": 494384795648, + "used": "395.70 GiB", + "used_bytes": 424880656384 + }, + "/run": { + "available": "577.74 MiB", + "available_bytes": 605802496, + "capacity": "2.15%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "size=604584k", + "nr_inodes=819200", + "mode=755", + "inode64" + ], + "size": "590.41 MiB", + "size_bytes": 619094016, + "used": "12.68 MiB", + "used_bytes": 13291520 + }, + "/run/credentials/getty@tty1.service": { + "available": "1.00 MiB", + "available_bytes": 1048576, + "capacity": "0%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "ro", + "seclabel", + "nosuid", + "nodev", + "noexec", + "relatime", + "nosymfollow", + "size=1024k", + "nr_inodes=1024", + "mode=700", + "inode64", + "noswap" + ], + "size": "1.00 MiB", + "size_bytes": 1048576, + "used": "0 bytes", + "used_bytes": 0 + }, + "/run/credentials/systemd-journald.service": { + "available": "1.00 MiB", + "available_bytes": 1048576, + "capacity": "0%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "ro", + "seclabel", + "nosuid", + "nodev", + "noexec", + "relatime", + "nosymfollow", + "size=1024k", + "nr_inodes=1024", + "mode=700", + "inode64", + "noswap" + ], + "size": "1.00 MiB", + "size_bytes": 1048576, + "used": "0 bytes", + "used_bytes": 0 + }, + "/run/user/1000": { + "available": "295.19 MiB", + "available_bytes": 309530624, + "capacity": "0.00%", + "device": "tmpfs", + "filesystem": "tmpfs", + "options": [ + "rw", + "seclabel", + "nosuid", + "nodev", + "relatime", + "size=302288k", + "nr_inodes=75572", + "mode=700", + "uid=1000", + "gid=1000", + "inode64" + ], + "size": "295.20 MiB", + "size_bytes": 309542912, + "used": "12.00 KiB", + "used_bytes": 12288 + }, + "/var/lib/nfs/rpc_pipefs": { + "available": "0 bytes", + "available_bytes": 0, + "capacity": "100%", + "device": "rpc_pipefs", + "filesystem": "rpc_pipefs", + "options": [ + "rw", + "relatime" + ], + "size": "0 bytes", + "size_bytes": 0, + "used": "0 bytes", + "used_bytes": 0 + } + }, + "networking": { + "domain": "example.com", + "fqdn": "compiler.example.com", + "hostname": "compiler", + "interfaces": { + "enp0s5": { + "bindings": [ + { + "address": "10.211.55.129", + "netmask": "255.255.255.0", + "network": "10.211.55.0" + } + ], + "bindings6": [ + { + "address": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", + "flags": [], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fdb2:2c26:f4e4::", + "scope6": "global" + }, + { + "address": "fe80::21c:42ff:fe6f:138d", + "flags": [ + "permanent" + ], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fe80::", + "scope6": "link" + } + ], + "duplex": "unknown", + "ip": "10.211.55.129", + "ip6": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", + "mac": "00:1c:42:6f:13:8d", + "mtu": 1500, + "netmask": "255.255.255.0", + "netmask6": "ffff:ffff:ffff:ffff::", + "network": "10.211.55.0", + "network6": "fdb2:2c26:f4e4::", + "operational_state": "up", + "physical": true, + "scope6": "global", + "speed": -1 + }, + "enp0s6": { + "bindings": [ + { + "address": "192.168.56.13", + "netmask": "255.255.255.0", + "network": "192.168.56.0" + } + ], + "bindings6": [ + { + "address": "fdb2:2c26:f4e4:2:a7c0:56a4:e562:6b64", + "flags": [], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fdb2:2c26:f4e4:2::", + "scope6": "global" + }, + { + "address": "fe80::d248:9dd9:86bd:8735", + "flags": [ + "permanent" + ], + "netmask": "ffff:ffff:ffff:ffff::", + "network": "fe80::", + "scope6": "link" + } + ], + "duplex": "unknown", + "ip": "192.168.56.13", + "ip6": "fdb2:2c26:f4e4:2:a7c0:56a4:e562:6b64", + "mac": "00:1c:42:56:ee:da", + "mtu": 1500, + "netmask": "255.255.255.0", + "netmask6": "ffff:ffff:ffff:ffff::", + "network": "192.168.56.0", + "network6": "fdb2:2c26:f4e4:2::", + "operational_state": "up", + "physical": true, + "scope6": "global", + "speed": -1 + }, + "lo": { + "bindings": [ + { + "address": "127.0.0.1", + "netmask": "255.0.0.0", + "network": "127.0.0.0" + } + ], + "bindings6": [ + { + "address": "::1", + "flags": [ + "permanent" + ], + "netmask": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", + "network": "::1", + "scope6": "host" + } + ], + "ip": "127.0.0.1", + "ip6": "::1", + "mtu": 65536, + "netmask": "255.0.0.0", + "netmask6": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", + "network": "127.0.0.0", + "network6": "::1", + "operational_state": "unknown", + "physical": false, + "scope6": "host" + } + }, + "ip": "10.211.55.129", + "ip6": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", + "mac": "00:1c:42:6f:13:8d", + "mtu": 1500, + "netmask": "255.255.255.0", + "netmask6": "ffff:ffff:ffff:ffff::", + "network": "10.211.55.0", + "network6": "fdb2:2c26:f4e4::", + "primary": "enp0s5", + "scope6": "global" + }, + "openvoxdb_version": "8.13.0.SNAPSHOT.2026.04.24T1629", + "os": { + "architecture": "aarch64", + "distro": { + "codename": "Coughlan", + "description": "CentOS Stream release 10 (Coughlan)", + "id": "CentOSStream", + "release": { + "full": "10", + "major": "10" + } + }, + "family": "RedHat", + "hardware": "aarch64", + "name": "CentOS", + "release": { + "full": "10", + "major": "10" + }, + "selinux": { + "config_mode": "enforcing", + "config_policy": "targeted", + "current_mode": "enforcing", + "enabled": true, + "enforced": true, + "policy_version": "33" + } + }, + "package_provider": "dnf", + "partitions": { + "/dev/sda1": { + "filesystem": "vfat", + "mount": "/boot/efi", + "partlabel": "EFI System Partition", + "parttype": "c12a7328-f81f-11d2-ba4b-00a0c93ec93b", + "partuuid": "ab44db70-dfeb-4136-880a-062ae4fde5cc", + "size": "600.00 MiB", + "size_bytes": 629145600, + "uuid": "F0F8-A0A2" + }, + "/dev/sda2": { + "filesystem": "swap", + "parttype": "0657fd6d-a4ab-43c4-84e5-0933c84b4f4f", + "partuuid": "42ab67fa-48a0-4e5d-bdaf-dfc197227543", + "size": "3.93 GiB", + "size_bytes": 4222615552, + "uuid": "d3e9bdac-fbcb-4940-830e-0d7f15e54831" + }, + "/dev/sda3": { + "filesystem": "xfs", + "mount": "/", + "parttype": "b921b045-1df0-41c3-af44-4c6f280d3fae", + "partuuid": "690e6a7e-a901-4f54-8a00-dd83f1ae60e0", + "size": "59.48 GiB", + "size_bytes": 63865618432, + "uuid": "85b4dc90-a967-493a-a6aa-da96b60c5075" + } + }, + "path": "/sbin:/bin:/usr/sbin:/usr/bin:/opt/puppetlabs/bin", + "processors": { + "cores": 2, + "count": 2, + "extensions": [ + "aarch64" + ], + "isa": "aarch64", + "models": [], + "physicalcount": 1, + "threads": 1 + }, + "puppet_environmentpath": "/etc/puppetlabs/code/environments", + "puppet_server": "puppet", + "puppet_vardir": "/opt/puppetlabs/puppet/cache", + "puppetversion": "8.28.0", + "root_home": "/root", + "ruby": { + "platform": "aarch64-linux", + "sitedir": "/opt/puppetlabs/puppet/lib/ruby/site_ruby/3.2.0", + "version": "3.2.11" + }, + "service_provider": "systemd", + "ssh": { + "ecdsa": { + "fingerprints": { + "sha1": "SSHFP 3 1 8a0cb93a91295f9fe0fb80d246f79c0589b67837", + "sha256": "SSHFP 3 2 107c5c1c926d682dd2db5934a1ae6a95954385f70d8719b85602946b0ce51bef" + }, + "key": "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB66+Qgw+zd8utLX12VqfQk4HqgF46UivAnqDmyzh9/pMKEeq5ud/UaiLIStWqotGiASPaOpedDxiSoTA/wLJik=", + "type": "ecdsa-sha2-nistp256" + }, + "ed25519": { + "fingerprints": { + "sha1": "SSHFP 4 1 8d36c7b0c146d2de8fdebf04354ee169d3d9cdee", + "sha256": "SSHFP 4 2 fbec89c062b17e90a71aca6d893a7f3b4e76c235af723e38b47816ac66330753" + }, + "key": "AAAAC3NzaC1lZDI1NTE5AAAAIE67AxXfBX+WjkOaKhI2AnmyTY/GoUksR3A0lExxDXUY", + "type": "ssh-ed25519" + }, + "rsa": { + "fingerprints": { + "sha1": "SSHFP 1 1 215dc30e07631ebdb587166b387fd44f89be0b8f", + "sha256": "SSHFP 1 2 7b9ac533db8f26b60a9b6acc8680d680115f9a9dda533adb9f0192b2ae23be2a" + }, + "key": "AAAAB3NzaC1yc2EAAAADAQABAAABgQCnG23J0gEm5W7IrpG4lmN1gOkD0ShnO/H5E5SBj4W6hrHOO1D5rbwFROTiCS4CMYd16qnb+fs9/lVZKGi6fuXtmpOZTL5/OK2kMfIsgouhiuuLytHJ9ukX7M8dVyL+TUACr2zKJ/6QyBScOCfjEC87y0NbCB5ifwENCeCUGgCL4cCVrovd0rd6JlKyzpamMZFzamdETbyeYdZorh/MKyTKDFc8VmFnpRa1Y+Q2LuQG5e+OYmJ5kHOLduEWnQ2eAZB8OafRL2T4wHEr2uUpi8SMqUpr0p/svvqqXDDdPDmDu9cUXMiB+lgpiZdKKiXuO8AbgAMaqc3zcvIQLXeiqCLQs/LlMEiEHbuPFkAc+CQYLy0uzp0wOxOHELq3ffkVWjca0ugtZaQ4b1uvnepJnysMQQjLrGS/TX8pL5VUTyvvcQPna/CWfi3J+NlLl+j2QN1Hj+jEHOF81VWS4tbz+ZlsEMAqk0pVR9Lb+LLEFpu6s3CM854zppOQ3BoOdiDeZjs=", + "type": "ssh-rsa" + } + }, + "sudoversion": "1.9.17p2", + "system_uptime": { + "days": 1, + "hours": 28, + "seconds": 103309, + "uptime": "1 day" + }, + "systemd": true, + "systemd_internal_services": { + "systemd-boot-check-no-failures.service": "disabled", + "systemd-boot-update.service": "disabled", + "systemd-confext.service": "enabled", + "systemd-network-generator.service": "enabled", + "systemd-pcrlock-file-system.service": "disabled", + "systemd-pcrlock-firmware-code.service": "disabled", + "systemd-pcrlock-firmware-config.service": "disabled", + "systemd-pcrlock-machine-id.service": "disabled", + "systemd-pcrlock-make-policy.service": "disabled", + "systemd-pcrlock-secureboot-authority.service": "disabled", + "systemd-pcrlock-secureboot-policy.service": "disabled", + "systemd-pstore.service": "enabled", + "systemd-remount-fs.service": "enabled-runtime", + "systemd-sysext.service": "enabled", + "systemd-sysupdate-reboot.service": "indirect", + "systemd-sysupdate.service": "indirect", + "systemd-udev-load-credentials.service": "disabled", + "systemd-userdbd.service": "indirect" + }, + "systemd_version": "257", + "timezone": "CDT", + "vcsrepo_svn_ver": "", + "virtual": "parallels", + "yum_has_updates": true, + "yum_package_updates": [ + "buildah.aarch64", + "centos-gpg-keys.noarch", + "centos-stream-release.noarch", + "centos-stream-repos.noarch", + "clevis.aarch64", + "clevis-luks.aarch64", + "cockpit.aarch64", + "cockpit-bridge.noarch", + "cockpit-packagekit.noarch", + "cockpit-podman.noarch", + "cockpit-storaged.noarch", + "cockpit-system.noarch", + "cockpit-ws.aarch64", + "cockpit-ws-selinux.aarch64", + "conmon.aarch64", + "container-selinux.noarch", + "coreutils.aarch64", + "coreutils-common.aarch64", + "device-mapper.aarch64", + "device-mapper-event.aarch64", + "device-mapper-event-libs.aarch64", + "device-mapper-libs.aarch64", + "dnf.noarch", + "dnf-data.noarch", + "firewalld.noarch", + "firewalld-filesystem.noarch", + "grub2-common.noarch", + "grub2-efi-aa64.aarch64", + "grub2-efi-aa64-cdboot.aarch64", + "grub2-tools.aarch64", + "grub2-tools-extra.aarch64", + "grub2-tools-minimal.aarch64", + "hwdata.noarch", + "libcap-ng.aarch64", + "libcap-ng-python3.aarch64", + "libdnf.aarch64", + "libpng.aarch64", + "libusb1.aarch64", + "libxml2.aarch64", + "lvm2.aarch64", + "lvm2-libs.aarch64", + "man-pages.noarch", + "netavark.aarch64", + "nspr.aarch64", + "nss.aarch64", + "nss-softokn.aarch64", + "nss-softokn-freebl.aarch64", + "nss-sysinit.aarch64", + "nss-util.aarch64", + "openbolt.aarch64", + "openvox-server.noarch", + "openvoxdb.noarch", + "openvoxdb-termini.noarch", + "passt.aarch64", + "passt-selinux.noarch", + "podman.aarch64", + "podman-sequoia.aarch64", + "python3-dnf.noarch", + "python3-firewall.noarch", + "python3-hawkey.aarch64", + "python3-libdnf.aarch64", + "python3-rpm.aarch64", + "python3-urllib3.noarch", + "rpm.aarch64", + "rpm-build-libs.aarch64", + "rpm-libs.aarch64", + "rpm-plugin-audit.aarch64", + "rpm-plugin-selinux.aarch64", + "rpm-plugin-systemd-inhibit.aarch64", + "rpm-sign-libs.aarch64", + "selinux-policy.noarch", + "selinux-policy-targeted.noarch", + "shadow-utils.aarch64", + "shadow-utils-subid.aarch64", + "shim-aa64.aarch64", + "sudo.aarch64", + "sudo-python-plugin.aarch64", + "systemd.aarch64", + "systemd-libs.aarch64", + "systemd-pam.aarch64", + "systemd-udev.aarch64", + "tuned.noarch", + "xfsdump.aarch64", + "yum.noarch" + ], + "yum_reboot_required": false, + "yum_updates": 84 + } +} diff --git a/spec/onceover.yaml b/spec/onceover.yaml index 21b5292..be67048 100644 --- a/spec/onceover.yaml +++ b/spec/onceover.yaml @@ -11,6 +11,7 @@ # Roles under test. classes: - role::puppet_master + - role::compiler - role::database_server - role::webserver - role::example @@ -19,6 +20,7 @@ classes: # so that trusted.certname resolves the right nodes/%{trusted.certname}.yaml). nodes: - puppet.example.com + - compiler.example.com - agent01.example.com - agent02.example.com @@ -27,6 +29,8 @@ nodes: class_groups: master_role: - role::puppet_master + compiler_role: + - role::compiler base_roles: - role::database_server - role::webserver @@ -35,6 +39,8 @@ class_groups: node_groups: master: - puppet.example.com + compiler: + - compiler.example.com agents: - agent01.example.com - agent02.example.com @@ -47,6 +53,9 @@ test_matrix: - master: classes: master_role tests: spec + - compiler: + classes: compiler_role + tests: spec - agents: classes: base_roles tests: spec