diff --git a/Puppetfile b/Puppetfile index d958996..1d4bb6f 100644 --- a/Puppetfile +++ b/Puppetfile @@ -15,13 +15,8 @@ mod 'puppetlabs/stdlib', '9.7.0' mod 'puppetlabs/vcsrepo', '7.0.0' # yumrepo left Puppet core, so it has to be declared to exist in a compile-only # environment. Real nodes get it bundled with openvox-agent, which is why -# profile::base worked on them while onceover failed on every RedHat role. +# profile::base worked on them while onceover failed on every RedHat role with +# "Unknown resource type: 'yumrepo'". site-modules/profile/.fixtures.yml already +# declared it for the module's own specs; the control repo never shipped it. mod 'puppetlabs/yumrepo_core', '3.0.1' mod 'saz/sudo', '9.0.2' - -# Not on the Forge yet, so pinned by tag rather than floating on a branch: -# codavox exists to make code versions deterministic, and resolving its own -# module non-deterministically would undercut that. -mod 'codavox', - git: 'https://github.com/miharp/puppet-codavox.git', - tag: 'v0.2.0' diff --git a/Vagrantfile b/Vagrantfile index 54b4d44..bf7674f 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -38,7 +38,6 @@ Vagrant.configure("2") do |config| echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts - echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts # Update all packages dnf update -y @@ -46,19 +45,6 @@ Vagrant.configure("2") do |config| # Tools used by readiness checks dnf install -y curl - - # pp_role has to be in the CSR before the certificate is issued: it is an - # X.509 extension, so it cannot be added to a signed cert afterwards - # without re-issuing. Anything that authorizes on role -- codavox's - # publisher, and puppetserver's own auth.conf -- depends on it being here - # from the first boot. - install -d -m 0755 /etc/puppetlabs/puppet - tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' ---- -extension_requests: - pp_role: openvox_server -CSRYAML - # Install OpenVox repository rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm @@ -187,113 +173,6 @@ EYAML SHELL end - - # Compiler Node: runs OpenVox Server, but defers the CA to the primary. - # - # A compiler compiles catalogs and serves file content; it does not issue - # certificates. That is what makes it the node codavox exists for -- the - # publisher on the primary distributes resolved code to compilers, and each - # compiler answers which exact version it is serving. - config.vm.define "compiler" do |compiler| - compiler.vm.box = "bento/centos-stream-10" - compiler.vm.hostname = "compiler.example.com" - compiler.vm.network "private_network", ip: "192.168.56.13" - - compiler.vm.provider "parallels" do |prl| - prl.memory = 3072 - prl.cpus = 2 - end - - compiler.vm.provision "shell", inline: <<-SHELL - # Set up /etc/hosts - echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts - echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts - echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts - echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts - - dnf update -y - dnf install -y curl git - - # pp_role has to be in the CSR before the certificate is issued: it is an - # X.509 extension, so it cannot be added to a signed cert afterwards - # without re-issuing. codavox's publisher authorizes on exactly this -- - # a certificate signed by the CA only proves the peer is some enrolled - # node, and every agent in the estate clears that bar. - install -d -m 0755 /etc/puppetlabs/puppet - tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' ---- -extension_requests: - pp_role: openvox_compiler -CSRYAML - - rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm - dnf install -y openvox-server - - # Point at the primary for both catalogs and the CA before enrolling, so - # the certificate is issued by the primary's CA rather than a second one - # this node would otherwise stand up for itself. - /opt/puppetlabs/bin/puppet config set --section main server puppet.example.com - /opt/puppetlabs/bin/puppet config set --section main ca_server puppet.example.com - /opt/puppetlabs/bin/puppet config set --section main certname compiler.example.com - - systemctl enable --now firewalld - firewall-cmd --add-port=8140/tcp --permanent - firewall-cmd --reload - - # Clock sync before enrolling. A skewed clock at certificate issuance - # produces "CRL not yet valid" errors that persist until regenerated. - systemctl stop chronyd 2>/dev/null || true - chronyd -q 'pool pool.ntp.org iburst' || true - systemctl start chronyd - - # Wait for the primary's CA to be serving before requesting a certificate. - echo "Waiting for the primary..." - ok=0 - while [ "$ok" -lt 3 ]; do - if curl -k https://puppet:8140/status/v1/simple > /dev/null 2>&1; then - ok=$((ok+1)) - else - ok=0 - fi - sleep 5 - done - - # Enrol. The primary autosigns in this environment, so the signed - # certificate comes back carrying pp_role from csr_attributes.yaml. - /opt/puppetlabs/bin/puppet ssl bootstrap --waitforcert 10 || true - - # Serve catalogs with the primary's CA material, and disable this node's - # own CA service so it never issues a certificate. - SSLDIR=/etc/puppetlabs/puppet/ssl - tee /etc/puppetlabs/puppetserver/conf.d/webserver.conf > /dev/null <> /etc/hosts echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts - echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts # Update all packages dnf update -y - - # pp_role has to be in the CSR before the certificate is issued: it is an - # X.509 extension, so it cannot be added to a signed cert afterwards - # without re-issuing. Anything that authorizes on role -- codavox's - # publisher, and puppetserver's own auth.conf -- depends on it being here - # from the first boot. - install -d -m 0755 /etc/puppetlabs/puppet - tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' ---- -extension_requests: - pp_role: openvox_agent -CSRYAML - # Install OpenVox repository rpm -Uvh #{yum_release_base}/openvox8-release-el-9.noarch.rpm @@ -385,7 +250,6 @@ CSRYAML echo "192.168.56.10 puppet.example.com puppet" | sudo tee -a /etc/hosts > /dev/null echo "192.168.56.11 agent01.example.com agent01" | sudo tee -a /etc/hosts > /dev/null echo "192.168.56.12 agent02.example.com agent02" | sudo tee -a /etc/hosts > /dev/null - echo "192.168.56.13 compiler.example.com compiler" | sudo tee -a /etc/hosts > /dev/null # Update all packages sudo apt-get update -y @@ -393,19 +257,6 @@ CSRYAML # Install OpenVox repository + agent (Debian/Ubuntu) sudo apt-get install -y curl ca-certificates - - # pp_role has to be in the CSR before the certificate is issued: it is an - # X.509 extension, so it cannot be added to a signed cert afterwards - # without re-issuing. Anything that authorizes on role -- codavox's - # publisher, and puppetserver's own auth.conf -- depends on it being here - # from the first boot. - sudo install -d -m 0755 /etc/puppetlabs/puppet - sudo tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML' ---- -extension_requests: - pp_role: openvox_agent -CSRYAML - curl -fsSL -o /tmp/openvox8-release-ubuntu24.04.deb #{apt_release_base}/openvox8-release-ubuntu24.04.deb sudo dpkg -i /tmp/openvox8-release-ubuntu24.04.deb sudo apt-get update -y diff --git a/codavox-basedir/README.md b/codavox-basedir/README.md deleted file mode 100644 index 0472b22..0000000 --- a/codavox-basedir/README.md +++ /dev/null @@ -1,35 +0,0 @@ -# codavox basedir - -This is the directory `codavox publish` seals on the primary — its `basedir`, in -r10k's sense: one subdirectory per environment. - -**It deliberately does not contain `production`.** The `production` environment is -the Vagrant synced checkout of this repo, and it is the dev environment: edits to -it must show up on the next agent run with nothing in between. Pointing codavox at -it would mean either depending on r10k to deploy it, or sealing a working tree -full of build artifacts — `.onceover/` alone holds rspec-puppet fixture symlinks -whose targets are absolute macOS host paths, which codavox correctly refuses to -unpack. - -So codavox gets its own environment instead, and the dev loop keeps its -properties: - -| environment | served from | changes appear | -|---|---|---| -| `production` | the synced checkout, straight from `environmentpath` | immediately, no deploy step | -| `codavox_test` | sealed here, distributed to compilers by codavox | on the next reseal + agent poll | - -Because this directory is *also* inside the synced folder, editing `codavox_test` -here is still immediate on the primary — it just needs a reseal to reach a -compiler, which is the thing being tested: - -```console -vagrant ssh puppet -c 'sudo systemctl reload codavox-publish' -``` - -Then watch it land: - -```console -vagrant ssh puppet -c 'sudo codavox compilers' -vagrant ssh compiler -c 'codavox-code-id codavox_test' -``` diff --git a/codavox-basedir/codavox_test/environment.conf b/codavox-basedir/codavox_test/environment.conf deleted file mode 100644 index 78a763f..0000000 --- a/codavox-basedir/codavox_test/environment.conf +++ /dev/null @@ -1,4 +0,0 @@ -# Minimal environment whose only job is to exercise codavox end to end. -# modulepath is relative, so it resolves inside whichever version directory a -# compiler has unpacked this into rather than pointing back at the primary. -modulepath = modules:$basemodulepath diff --git a/codavox-basedir/codavox_test/manifests/site.pp b/codavox-basedir/codavox_test/manifests/site.pp deleted file mode 100644 index 3ccdd69..0000000 --- a/codavox-basedir/codavox_test/manifests/site.pp +++ /dev/null @@ -1,9 +0,0 @@ -# Node definitions for the codavox test environment. -# -# Kept deliberately small: this environment exists to prove that codavox -# distributes a resolved tree and that a compiler serves catalogs from the exact -# version it reports, not to configure anything real. -node default { - include codavox_demo -} - diff --git a/cspell.json b/cspell.json index d0104ea..5cfec9b 100644 --- a/cspell.json +++ b/cspell.json @@ -6,14 +6,11 @@ "basemodulepath", "bento", "certname", - "certnames", "chrony", - "codavox", - "codedir", "confdir", "cpus", - "dpkg", "dport", + "dpkg", "encryptor", "environmentpath", "eyaml", @@ -28,28 +25,27 @@ "HOCON", "inifile", "inventoryfile", - "keygen", "keypair", + "keygen", "mharp", "miharp", "modulepath", "NOPASSWD", "ntpserver", - "ntpservers", "Onceover", "onceover", + "ntpservers", "openbolt", "openvox", "openvoxdb", - "openvoxview", "operatingsystem", "operatingsystemrelease", "PGDG", + "Pupuli", "puppetdb", "Puppetfile", "puppetlabs", "puppetserver", - "Pupuli", "rspec", "stdlib", "vcsrepo", diff --git a/data/common.yaml b/data/common.yaml index 24c4904..b11b302 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -4,37 +4,3 @@ profile::base::release: 8 profile::openvox_agent::version: '8.28.1' - -# --- codavox: versioned code distribution to compilers --------------------- -# -# Estate-wide settings live here so a node running both the publisher and an -# agent still resolves one consistent `codavox` class. Node-specific values are -# in data/nodes/. - -# Where the agent deploys code and code-id reads from. Deliberately not the stock -# /etc/puppetlabs/code/environments: a fresh OpenVox Server ships a populated -# production skeleton there, and rename(2) cannot replace a real directory with a -# symlink. PE moves its codedir for the same reason when versioned deploys are on. -codavox::environmentpath: '/opt/puppetlabs/codavox/environments' - -# The publisher every compiler polls. One URL for the whole estate. -codavox::agent_publisher: 'https://puppet.example.com:8150' - -# codavox has no package repository yet (miharp/codavox#42), so the package is -# installed straight from a release asset. Written out as a literal rather than -# assembled from a version and an architecture fact: a URL a profile builds is a -# URL nobody can grep for, and this is data, not logic. -# -# Both codavox nodes here are aarch64 (Apple silicon Parallels), so arm64 is -# right for this estate. A node on another architecture overrides this key in -# data/nodes/.yaml. The module already picks the rpm/dpkg provider by -# OS family, which is what installing from a file requires. -codavox::package_source: 'https://github.com/miharp/codavox/releases/download/v0.5.0/codavox_0.5.0_linux_arm64.rpm' - -# Compilers are authorized by the pp_role in their certificate, which -# csr_attributes.yaml writes before enrolment — see role::compiler. An estate -# whose compiler certificates predate codavox would list them under -# codavox::publish_allow_certnames instead, since pp_role cannot be added to an -# already-issued certificate. -codavox::publish_allow_roles: - - 'openvox_compiler' diff --git a/data/nodes/compiler.example.com.yaml b/data/nodes/compiler.example.com.yaml deleted file mode 100644 index 13ff096..0000000 --- a/data/nodes/compiler.example.com.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -# Node-specific configuration for the compiler. - -# Same server package as the primary; the difference is that its CA service is -# disabled and it enrols against the primary's CA, which provisioning sets up. -profile::openvox_server::version: '8.15.1' - -# codavox agent. wire_server stays false until this node has converged: pointing -# OpenVox Server at codavox before code-id can answer fails every catalog -# compile. Confirm with `codavox code-id production` here and `codavox compilers` -# on the primary, then flip it. -profile::codavox::agent::wire_server: false diff --git a/data/nodes/puppet.example.com.yaml b/data/nodes/puppet.example.com.yaml index 8d7b86a..bd1f29c 100644 --- a/data/nodes/puppet.example.com.yaml +++ b/data/nodes/puppet.example.com.yaml @@ -30,18 +30,3 @@ postgresql::globals::datadir: '/var/lib/pgsql/data' postgresql::globals::confdir: '/var/lib/pgsql/data' postgresql::globals::bindir: '/usr/bin' postgresql::globals::service_name: 'postgresql' - -# codavox publisher. `basedir` holds one subdirectory per environment, and codavox -# only reads it — it writes nothing there and keeps no copy. -# -# Deliberately NOT /etc/puppetlabs/code/environments. That holds `production`, -# the Vagrant synced checkout of this repo and the dev environment: edits there -# must appear on the next agent run with no deploy step, so it cannot be made to -# depend on r10k or on a codavox reseal. Sealing it also fails outright — a -# working tree carries build artifacts, and .onceover/ holds rspec-puppet fixture -# symlinks whose targets are absolute macOS host paths, which codavox refuses to -# unpack. -# -# So codavox gets its own environment. See codavox-basedir/README.md. -codavox::basedir: '/etc/puppetlabs/code/environments/production/codavox-basedir' -codavox::publish_listen: ':8150' diff --git a/manifests/site.pp b/manifests/site.pp index b9480b6..7553933 100644 --- a/manifests/site.pp +++ b/manifests/site.pp @@ -34,11 +34,3 @@ node 'puppet.example.com' { include role::puppet_master } - -# Without this the compiler falls into `node default` and gets profile::base -# only, so role::compiler never runs on it — which is how it stayed for the whole -# life of the compiler VM. Onceover compiles role::compiler happily, because -# compiling a role proves nothing about whether a node is classified into it. -node 'compiler.example.com' { - include role::compiler -} diff --git a/site-modules/profile/.fixtures.yml b/site-modules/profile/.fixtures.yml index c6cf358..944094d 100644 --- a/site-modules/profile/.fixtures.yml +++ b/site-modules/profile/.fixtures.yml @@ -7,9 +7,6 @@ fixtures: openvoxview: repo: "https://github.com/voxpupuli/puppet-openvoxview.git" ref: "v1.3.0" - codavox: - repo: "https://github.com/miharp/puppet-codavox.git" - ref: "v0.2.0" forge_modules: inifile: repo: puppetlabs/inifile diff --git a/site-modules/profile/manifests/codavox/agent.pp b/site-modules/profile/manifests/codavox/agent.pp deleted file mode 100644 index 14181c1..0000000 --- a/site-modules/profile/manifests/codavox/agent.pp +++ /dev/null @@ -1,46 +0,0 @@ -# @summary Pulls versioned code onto this compiler, and optionally serves from it. -# -# The agent polls the publisher, verifies each artifact against its `code_id`, and -# swaps the environment symlink atomically. Compilers poll rather than being pushed -# to, so a compiler that was down across a deploy catches up on its own with no -# event replayed to it. -# -# The publisher URL and everything else come from Hiera under `codavox::*` — see -# `data/common.yaml`. codavox itself fails with a clear message if -# `codavox::agent_publisher` is unset, so there is nothing to re-validate here. -# -# @param wire_server -# Whether to point OpenVox Server at codavox — `environmentpath`, -# `static_catalogs`, and the two versioned-code commands. -# -# **Deliberately false by default.** codavox has no fallback: once OpenVox -# Server is pointed at it, catalog compilation depends on the agent having -# deployed code there. Wiring a compiler before its agent has converged fails -# every catalog compile — loudly, which is correct, but it fails. So the safe -# order is to install and converge first, confirm with `codavox code-id -# production` on this node and `codavox compilers` on the publisher, and only -# then set this true. -# -# Leaving it false is not a half-configured state: the agent keeps this node's -# codavox tree current either way, so flipping it later is a restart rather than -# a wait. -# -# @example Stage 1 — converge, without touching catalog compilation -# include profile::codavox::agent -# -# @example Stage 2 — serve from it, once code-id answers -# profile::codavox::agent::wire_server: true -class profile::codavox::agent ( - Boolean $wire_server = false, -) { - include codavox - include codavox::agent - - if $wire_server { - # Left at the default service_manage => true on purpose: nothing else on a - # compiler declares the puppetserver service — profile::openvox_server manages - # only the package — so codavox has to declare it for the wiring change to - # restart anything. - include codavox::server - } -} diff --git a/site-modules/profile/manifests/codavox/publisher.pp b/site-modules/profile/manifests/codavox/publisher.pp deleted file mode 100644 index f73fe32..0000000 --- a/site-modules/profile/manifests/codavox/publisher.pp +++ /dev/null @@ -1,36 +0,0 @@ -# @summary Runs the codavox publisher, which serves versioned code to compilers. -# -# OpenVox Server ships without Puppet Enterprise's Code Manager and file sync, so -# nothing gets resolved code onto a compiler or lets a compiler say which version -# it is serving. [codavox](https://github.com/miharp/codavox) fills that gap. -# -# This profile belongs on the node where r10k runs, because the publisher reads -# r10k's output directory locally. It seals each environment into a -# content-addressed `code_id` and serves the result to compilers over mutual TLS, -# reusing the Puppet CA material already on the node — there is no second PKI to -# provision. -# -# Settings come from Hiera under `codavox::*` rather than from parameters here, so -# a node that ends up running both the publisher and an agent cannot declare the -# `codavox` class twice with different data. See `data/common.yaml`. -# -# @param port -# The port the publisher listens on, used for the firewall rule. Must agree -# with `codavox::publish_listen`, which is what codavox actually reads. -# -# @example -# include profile::codavox::publisher -class profile::codavox::publisher ( - Stdlib::Port $port = 8150, -) { - include codavox - include codavox::publish - - # Compilers dial in; nothing connects out to them. This is the only inbound - # rule codavox needs anywhere in the estate. - firewall { '100 allow codavox publisher': - dport => $port, - proto => 'tcp', - jump => 'ACCEPT', - } -} diff --git a/site-modules/profile/spec/classes/codavox/agent_spec.rb b/site-modules/profile/spec/classes/codavox/agent_spec.rb deleted file mode 100644 index 65e21e2..0000000 --- a/site-modules/profile/spec/classes/codavox/agent_spec.rb +++ /dev/null @@ -1,38 +0,0 @@ -# frozen_string_literal: true - -require 'spec_helper' - -describe 'profile::codavox::agent' do - on_supported_os.each do |os, os_facts| - context "on #{os}" do - let(:facts) { os_facts } - # In the control repo this comes from data/common.yaml; the spec has no - # hiera, so supply it the same way the class receives it. - let(:pre_condition) do - "class { 'codavox': agent_publisher => 'https://puppet.example.com:8150' }" - end - - context 'with default parameters' do - it { is_expected.to compile.with_all_deps } - it { is_expected.to contain_class('codavox::agent') } - - # The whole point of the default: an agent that converges this node - # without touching how OpenVox Server compiles catalogs. Wiring before - # the agent has deployed code fails every compile. - it { is_expected.not_to contain_class('codavox::server') } - end - - context 'with wire_server enabled' do - let(:params) { { wire_server: true } } - - it { is_expected.to compile.with_all_deps } - it { is_expected.to contain_class('codavox::server') } - - # Nothing else on a compiler declares this service — profile::openvox_server - # manages only the package — so codavox has to, or the wiring change - # restarts nothing. - it { is_expected.to contain_service('puppetserver') } - end - end - end -end diff --git a/site-modules/profile/spec/classes/codavox/publisher_spec.rb b/site-modules/profile/spec/classes/codavox/publisher_spec.rb deleted file mode 100644 index 6739130..0000000 --- a/site-modules/profile/spec/classes/codavox/publisher_spec.rb +++ /dev/null @@ -1,38 +0,0 @@ -# frozen_string_literal: true - -require 'spec_helper' - -describe 'profile::codavox::publisher' do - on_supported_os.each do |os, os_facts| - context "on #{os}" do - let(:facts) { os_facts } - # In the control repo this comes from data/nodes/puppet.example.com.yaml. - # codavox refuses to start a publisher with no basedir, so the class cannot - # compile without it either. - let(:pre_condition) do - "class { 'codavox': basedir => '/etc/puppetlabs/code/environments' }" - end - - context 'with default parameters' do - it { is_expected.to compile.with_all_deps } - it { is_expected.to contain_class('codavox::publish') } - - # A compiler that cannot reach the publisher converges on nothing, and - # the failure looks like a codavox bug rather than a firewall rule. - it { - is_expected.to contain_firewall('100 allow codavox publisher') - .with_dport(8150) - .with_proto('tcp') - .with_jump('ACCEPT') - } - end - - context 'with a non-default port' do - let(:params) { { port: 9150 } } - - it { is_expected.to compile.with_all_deps } - it { is_expected.to contain_firewall('100 allow codavox publisher').with_dport(9150) } - end - end - end -end diff --git a/site-modules/role/manifests/compiler.pp b/site-modules/role/manifests/compiler.pp deleted file mode 100644 index 8429695..0000000 --- a/site-modules/role/manifests/compiler.pp +++ /dev/null @@ -1,24 +0,0 @@ -# @summary Role for a compiler: an OpenVox Server that compiles catalogs but issues no certificates. -# -# A compiler runs the same server package as the primary, and differs in what it -# is allowed to do rather than what it installs: its CA service is disabled and -# it enrols against the primary's CA, so the estate has exactly one authority. -# That split is set up during provisioning, because it has to happen before the -# node holds a certificate at all. -# -# The node's certificate carries `pp_role: openvox_compiler`, written into -# `csr_attributes.yaml` before enrolment. Anything that authorizes on role reads -# that extension, so it cannot be added afterwards without re-issuing the -# certificate. -# -# @example -# include role::compiler -# It pulls code with the codavox agent. Whether OpenVox Server actually *serves* -# from that code is a separate switch — `profile::codavox::agent::wire_server` — -# because pointing a compiler at codavox before its agent has converged fails -# every catalog compile. -class role::compiler { - include profile::base - include profile::openvox_server - include profile::codavox::agent -} diff --git a/site-modules/role/manifests/puppet_master.pp b/site-modules/role/manifests/puppet_master.pp index 2478a24..68f5838 100644 --- a/site-modules/role/manifests/puppet_master.pp +++ b/site-modules/role/manifests/puppet_master.pp @@ -11,5 +11,4 @@ include profile::openbolt include profile::static_catalogs include profile::openvoxview - include profile::codavox::publisher } diff --git a/spec/factsets/compiler.example.com.json b/spec/factsets/compiler.example.com.json deleted file mode 100644 index caf640e..0000000 --- a/spec/factsets/compiler.example.com.json +++ /dev/null @@ -1,729 +0,0 @@ -{ - "name": "compiler.example.com", - "trusted": { - "authenticated": "remote", - "certname": "compiler.example.com", - "domain": "example.com", - "extensions": { - "pp_role": "openvox_compiler" - }, - "hostname": "compiler" - }, - "values": { - "aio_agent_version": "8.28.0", - "augeas": { - "version": "1.14.1" - }, - "clientcert": "compiler.example.com", - "clientnoop": false, - "clientversion": "8.28.0", - "disks": { - "sda": { - "model": "harddisk1 SSD", - "serial": "9NPBBZ9188A4KFE66BFK", - "size": "64.00 GiB", - "size_bytes": 68719476736, - "type": "ssd", - "vendor": "ATA" - }, - "sr0": { - "model": "Virtual DVD-ROM", - "serial": "-_31415B265", - "size": "1.00 GiB", - "size_bytes": 1073741312, - "type": "ssd", - "vendor": "" - } - }, - "dmi": { - "bios": { - "release_date": "Thu, 11 Jun 2026 22:26:59", - "vendor": "Parallels International GmbH.", - "version": "26.4.0 (57513)" - }, - "board": { - "manufacturer": "Parallels ARM Virtual Machine", - "product": "Parallels ARM Virtual Platform" - }, - "manufacturer": "Parallels International GmbH.", - "product": { - "name": "Parallels ARM Virtual Machine", - "serial_number": "Parallels-0F 20 0C 90 BB 84 41 97 B6 3D 2B A2 80 CD 2F EF", - "uuid": "0f200c90-bb84-4197-b63d-2ba280cd2fef", - "version": "0.1" - } - }, - "facterversion": "5.6.1", - "filesystems": "vfat,xfs", - "fips_enabled": false, - "identity": { - "gid": 0, - "group": "root", - "privileged": true, - "uid": 0, - "user": "root" - }, - "implementation": "openvox", - "ip6tables_version": "1.8.11", - "iptables_version": "1.8.11", - "is_pe": false, - "is_virtual": true, - "kernel": "Linux", - "kernelmajversion": "6.12", - "kernelrelease": "6.12.0-233.el10.aarch64", - "kernelversion": "6.12.0", - "load_averages": { - "15m": 0.21, - "1m": 0.23, - "5m": 0.2 - }, - "memory": { - "swap": { - "available": "3.87 GiB", - "available_bytes": 4157136896, - "capacity": "1.55%", - "total": "3.93 GiB", - "total_bytes": 4222611456, - "used": "62.44 MiB", - "used_bytes": 65474560 - }, - "system": { - "available": "236.34 MiB", - "available_bytes": 247816192, - "capacity": "91.99%", - "total": "2.88 GiB", - "total_bytes": 3095457792, - "used": "2.65 GiB", - "used_bytes": 2847641600 - } - }, - "mountpoints": { - "/": { - "available": "55.70 GiB", - "available_bytes": 59803131904, - "capacity": "6.26%", - "device": "/dev/sda3", - "filesystem": "xfs", - "options": [ - "rw", - "seclabel", - "relatime", - "attr2", - "inode64", - "logbufs=8", - "logbsize=32k", - "noquota" - ], - "size": "59.42 GiB", - "size_bytes": 63798509568, - "used": "3.72 GiB", - "used_bytes": 3995377664 - }, - "/boot/efi": { - "available": "585.88 MiB", - "available_bytes": 614342656, - "capacity": "2.16%", - "device": "/dev/sda1", - "filesystem": "vfat", - "options": [ - "rw", - "relatime", - "fmask=0077", - "dmask=0077", - "codepage=437", - "iocharset=ascii", - "shortname=winnt", - "errors=remount-ro" - ], - "size": "598.79 MiB", - "size_bytes": 627875840, - "used": "12.91 MiB", - "used_bytes": 13533184 - }, - "/dev": { - "available": "1.42 GiB", - "available_bytes": 1520545792, - "capacity": "0%", - "device": "devtmpfs", - "filesystem": "devtmpfs", - "options": [ - "rw", - "seclabel", - "nosuid", - "size=1484908k", - "nr_inodes=371227", - "mode=755", - "inode64" - ], - "size": "1.42 GiB", - "size_bytes": 1520545792, - "used": "0 bytes", - "used_bytes": 0 - }, - "/dev/hugepages": { - "available": "0 bytes", - "available_bytes": 0, - "capacity": "100%", - "device": "hugetlbfs", - "filesystem": "hugetlbfs", - "options": [ - "rw", - "seclabel", - "nosuid", - "nodev", - "relatime", - "pagesize=2M" - ], - "size": "0 bytes", - "size_bytes": 0, - "used": "0 bytes", - "used_bytes": 0 - }, - "/dev/mqueue": { - "available": "0 bytes", - "available_bytes": 0, - "capacity": "100%", - "device": "mqueue", - "filesystem": "mqueue", - "options": [ - "rw", - "seclabel", - "nosuid", - "nodev", - "noexec", - "relatime" - ], - "size": "0 bytes", - "size_bytes": 0, - "used": "0 bytes", - "used_bytes": 0 - }, - "/dev/pts": { - "available": "0 bytes", - "available_bytes": 0, - "capacity": "100%", - "device": "devpts", - "filesystem": "devpts", - "options": [ - "rw", - "seclabel", - "nosuid", - "noexec", - "relatime", - "gid=5", - "mode=620", - "ptmxmode=000" - ], - "size": "0 bytes", - "size_bytes": 0, - "used": "0 bytes", - "used_bytes": 0 - }, - "/dev/shm": { - "available": "1.44 GiB", - "available_bytes": 1546649600, - "capacity": "0.07%", - "device": "tmpfs", - "filesystem": "tmpfs", - "options": [ - "rw", - "seclabel", - "nosuid", - "nodev", - "inode64", - "usrquota" - ], - "size": "1.44 GiB", - "size_bytes": 1547726848, - "used": "1.03 MiB", - "used_bytes": 1077248 - }, - "/etc/puppetlabs/code/environments/production": { - "available": "64.73 GiB", - "available_bytes": 69504139264, - "capacity": "85.94%", - "device": "etc_puppetlabs_code_environments_production", - "filesystem": "fuse.prl_fsd", - "options": [ - "rw", - "nosuid", - "nodev", - "relatime", - "user_id=0", - "group_id=0", - "default_permissions", - "allow_other" - ], - "size": "460.43 GiB", - "size_bytes": 494384795648, - "used": "395.70 GiB", - "used_bytes": 424880656384 - }, - "/run": { - "available": "577.74 MiB", - "available_bytes": 605802496, - "capacity": "2.15%", - "device": "tmpfs", - "filesystem": "tmpfs", - "options": [ - "rw", - "seclabel", - "nosuid", - "nodev", - "size=604584k", - "nr_inodes=819200", - "mode=755", - "inode64" - ], - "size": "590.41 MiB", - "size_bytes": 619094016, - "used": "12.68 MiB", - "used_bytes": 13291520 - }, - "/run/credentials/getty@tty1.service": { - "available": "1.00 MiB", - "available_bytes": 1048576, - "capacity": "0%", - "device": "tmpfs", - "filesystem": "tmpfs", - "options": [ - "ro", - "seclabel", - "nosuid", - "nodev", - "noexec", - "relatime", - "nosymfollow", - "size=1024k", - "nr_inodes=1024", - "mode=700", - "inode64", - "noswap" - ], - "size": "1.00 MiB", - "size_bytes": 1048576, - "used": "0 bytes", - "used_bytes": 0 - }, - "/run/credentials/systemd-journald.service": { - "available": "1.00 MiB", - "available_bytes": 1048576, - "capacity": "0%", - "device": "tmpfs", - "filesystem": "tmpfs", - "options": [ - "ro", - "seclabel", - "nosuid", - "nodev", - "noexec", - "relatime", - "nosymfollow", - "size=1024k", - "nr_inodes=1024", - "mode=700", - "inode64", - "noswap" - ], - "size": "1.00 MiB", - "size_bytes": 1048576, - "used": "0 bytes", - "used_bytes": 0 - }, - "/run/user/1000": { - "available": "295.19 MiB", - "available_bytes": 309530624, - "capacity": "0.00%", - "device": "tmpfs", - "filesystem": "tmpfs", - "options": [ - "rw", - "seclabel", - "nosuid", - "nodev", - "relatime", - "size=302288k", - "nr_inodes=75572", - "mode=700", - "uid=1000", - "gid=1000", - "inode64" - ], - "size": "295.20 MiB", - "size_bytes": 309542912, - "used": "12.00 KiB", - "used_bytes": 12288 - }, - "/var/lib/nfs/rpc_pipefs": { - "available": "0 bytes", - "available_bytes": 0, - "capacity": "100%", - "device": "rpc_pipefs", - "filesystem": "rpc_pipefs", - "options": [ - "rw", - "relatime" - ], - "size": "0 bytes", - "size_bytes": 0, - "used": "0 bytes", - "used_bytes": 0 - } - }, - "networking": { - "domain": "example.com", - "fqdn": "compiler.example.com", - "hostname": "compiler", - "interfaces": { - "enp0s5": { - "bindings": [ - { - "address": "10.211.55.129", - "netmask": "255.255.255.0", - "network": "10.211.55.0" - } - ], - "bindings6": [ - { - "address": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", - "flags": [], - "netmask": "ffff:ffff:ffff:ffff::", - "network": "fdb2:2c26:f4e4::", - "scope6": "global" - }, - { - "address": "fe80::21c:42ff:fe6f:138d", - "flags": [ - "permanent" - ], - "netmask": "ffff:ffff:ffff:ffff::", - "network": "fe80::", - "scope6": "link" - } - ], - "duplex": "unknown", - "ip": "10.211.55.129", - "ip6": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", - "mac": "00:1c:42:6f:13:8d", - "mtu": 1500, - "netmask": "255.255.255.0", - "netmask6": "ffff:ffff:ffff:ffff::", - "network": "10.211.55.0", - "network6": "fdb2:2c26:f4e4::", - "operational_state": "up", - "physical": true, - "scope6": "global", - "speed": -1 - }, - "enp0s6": { - "bindings": [ - { - "address": "192.168.56.13", - "netmask": "255.255.255.0", - "network": "192.168.56.0" - } - ], - "bindings6": [ - { - "address": "fdb2:2c26:f4e4:2:a7c0:56a4:e562:6b64", - "flags": [], - "netmask": "ffff:ffff:ffff:ffff::", - "network": "fdb2:2c26:f4e4:2::", - "scope6": "global" - }, - { - "address": "fe80::d248:9dd9:86bd:8735", - "flags": [ - "permanent" - ], - "netmask": "ffff:ffff:ffff:ffff::", - "network": "fe80::", - "scope6": "link" - } - ], - "duplex": "unknown", - "ip": "192.168.56.13", - "ip6": "fdb2:2c26:f4e4:2:a7c0:56a4:e562:6b64", - "mac": "00:1c:42:56:ee:da", - "mtu": 1500, - "netmask": "255.255.255.0", - "netmask6": "ffff:ffff:ffff:ffff::", - "network": "192.168.56.0", - "network6": "fdb2:2c26:f4e4:2::", - "operational_state": "up", - "physical": true, - "scope6": "global", - "speed": -1 - }, - "lo": { - "bindings": [ - { - "address": "127.0.0.1", - "netmask": "255.0.0.0", - "network": "127.0.0.0" - } - ], - "bindings6": [ - { - "address": "::1", - "flags": [ - "permanent" - ], - "netmask": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", - "network": "::1", - "scope6": "host" - } - ], - "ip": "127.0.0.1", - "ip6": "::1", - "mtu": 65536, - "netmask": "255.0.0.0", - "netmask6": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", - "network": "127.0.0.0", - "network6": "::1", - "operational_state": "unknown", - "physical": false, - "scope6": "host" - } - }, - "ip": "10.211.55.129", - "ip6": "fdb2:2c26:f4e4:0:21c:42ff:fe6f:138d", - "mac": "00:1c:42:6f:13:8d", - "mtu": 1500, - "netmask": "255.255.255.0", - "netmask6": "ffff:ffff:ffff:ffff::", - "network": "10.211.55.0", - "network6": "fdb2:2c26:f4e4::", - "primary": "enp0s5", - "scope6": "global" - }, - "openvoxdb_version": "8.13.0.SNAPSHOT.2026.04.24T1629", - "os": { - "architecture": "aarch64", - "distro": { - "codename": "Coughlan", - "description": "CentOS Stream release 10 (Coughlan)", - "id": "CentOSStream", - "release": { - "full": "10", - "major": "10" - } - }, - "family": "RedHat", - "hardware": "aarch64", - "name": "CentOS", - "release": { - "full": "10", - "major": "10" - }, - "selinux": { - "config_mode": "enforcing", - "config_policy": "targeted", - "current_mode": "enforcing", - "enabled": true, - "enforced": true, - "policy_version": "33" - } - }, - "package_provider": "dnf", - "partitions": { - "/dev/sda1": { - "filesystem": "vfat", - "mount": "/boot/efi", - "partlabel": "EFI System Partition", - "parttype": "c12a7328-f81f-11d2-ba4b-00a0c93ec93b", - "partuuid": "ab44db70-dfeb-4136-880a-062ae4fde5cc", - "size": "600.00 MiB", - "size_bytes": 629145600, - "uuid": "F0F8-A0A2" - }, - "/dev/sda2": { - "filesystem": "swap", - "parttype": "0657fd6d-a4ab-43c4-84e5-0933c84b4f4f", - "partuuid": "42ab67fa-48a0-4e5d-bdaf-dfc197227543", - "size": "3.93 GiB", - "size_bytes": 4222615552, - "uuid": "d3e9bdac-fbcb-4940-830e-0d7f15e54831" - }, - "/dev/sda3": { - "filesystem": "xfs", - "mount": "/", - "parttype": "b921b045-1df0-41c3-af44-4c6f280d3fae", - "partuuid": "690e6a7e-a901-4f54-8a00-dd83f1ae60e0", - "size": "59.48 GiB", - "size_bytes": 63865618432, - "uuid": "85b4dc90-a967-493a-a6aa-da96b60c5075" - } - }, - "path": "/sbin:/bin:/usr/sbin:/usr/bin:/opt/puppetlabs/bin", - "processors": { - "cores": 2, - "count": 2, - "extensions": [ - "aarch64" - ], - "isa": "aarch64", - "models": [], - "physicalcount": 1, - "threads": 1 - }, - "puppet_environmentpath": "/etc/puppetlabs/code/environments", - "puppet_server": "puppet", - "puppet_vardir": "/opt/puppetlabs/puppet/cache", - "puppetversion": "8.28.0", - "root_home": "/root", - "ruby": { - "platform": "aarch64-linux", - "sitedir": "/opt/puppetlabs/puppet/lib/ruby/site_ruby/3.2.0", - "version": "3.2.11" - }, - "service_provider": "systemd", - "ssh": { - "ecdsa": { - "fingerprints": { - "sha1": "SSHFP 3 1 8a0cb93a91295f9fe0fb80d246f79c0589b67837", - "sha256": "SSHFP 3 2 107c5c1c926d682dd2db5934a1ae6a95954385f70d8719b85602946b0ce51bef" - }, - "key": "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB66+Qgw+zd8utLX12VqfQk4HqgF46UivAnqDmyzh9/pMKEeq5ud/UaiLIStWqotGiASPaOpedDxiSoTA/wLJik=", - "type": "ecdsa-sha2-nistp256" - }, - "ed25519": { - "fingerprints": { - "sha1": "SSHFP 4 1 8d36c7b0c146d2de8fdebf04354ee169d3d9cdee", - "sha256": "SSHFP 4 2 fbec89c062b17e90a71aca6d893a7f3b4e76c235af723e38b47816ac66330753" - }, - "key": "AAAAC3NzaC1lZDI1NTE5AAAAIE67AxXfBX+WjkOaKhI2AnmyTY/GoUksR3A0lExxDXUY", - "type": "ssh-ed25519" - }, - "rsa": { - "fingerprints": { - "sha1": "SSHFP 1 1 215dc30e07631ebdb587166b387fd44f89be0b8f", - "sha256": "SSHFP 1 2 7b9ac533db8f26b60a9b6acc8680d680115f9a9dda533adb9f0192b2ae23be2a" - }, - "key": "AAAAB3NzaC1yc2EAAAADAQABAAABgQCnG23J0gEm5W7IrpG4lmN1gOkD0ShnO/H5E5SBj4W6hrHOO1D5rbwFROTiCS4CMYd16qnb+fs9/lVZKGi6fuXtmpOZTL5/OK2kMfIsgouhiuuLytHJ9ukX7M8dVyL+TUACr2zKJ/6QyBScOCfjEC87y0NbCB5ifwENCeCUGgCL4cCVrovd0rd6JlKyzpamMZFzamdETbyeYdZorh/MKyTKDFc8VmFnpRa1Y+Q2LuQG5e+OYmJ5kHOLduEWnQ2eAZB8OafRL2T4wHEr2uUpi8SMqUpr0p/svvqqXDDdPDmDu9cUXMiB+lgpiZdKKiXuO8AbgAMaqc3zcvIQLXeiqCLQs/LlMEiEHbuPFkAc+CQYLy0uzp0wOxOHELq3ffkVWjca0ugtZaQ4b1uvnepJnysMQQjLrGS/TX8pL5VUTyvvcQPna/CWfi3J+NlLl+j2QN1Hj+jEHOF81VWS4tbz+ZlsEMAqk0pVR9Lb+LLEFpu6s3CM854zppOQ3BoOdiDeZjs=", - "type": "ssh-rsa" - } - }, - "sudoversion": "1.9.17p2", - "system_uptime": { - "days": 1, - "hours": 28, - "seconds": 103309, - "uptime": "1 day" - }, - "systemd": true, - "systemd_internal_services": { - "systemd-boot-check-no-failures.service": "disabled", - "systemd-boot-update.service": "disabled", - "systemd-confext.service": "enabled", - "systemd-network-generator.service": "enabled", - "systemd-pcrlock-file-system.service": "disabled", - "systemd-pcrlock-firmware-code.service": "disabled", - "systemd-pcrlock-firmware-config.service": "disabled", - "systemd-pcrlock-machine-id.service": "disabled", - "systemd-pcrlock-make-policy.service": "disabled", - "systemd-pcrlock-secureboot-authority.service": "disabled", - "systemd-pcrlock-secureboot-policy.service": "disabled", - "systemd-pstore.service": "enabled", - "systemd-remount-fs.service": "enabled-runtime", - "systemd-sysext.service": "enabled", - "systemd-sysupdate-reboot.service": "indirect", - "systemd-sysupdate.service": "indirect", - "systemd-udev-load-credentials.service": "disabled", - "systemd-userdbd.service": "indirect" - }, - "systemd_version": "257", - "timezone": "CDT", - "vcsrepo_svn_ver": "", - "virtual": "parallels", - "yum_has_updates": true, - "yum_package_updates": [ - "buildah.aarch64", - "centos-gpg-keys.noarch", - "centos-stream-release.noarch", - "centos-stream-repos.noarch", - "clevis.aarch64", - "clevis-luks.aarch64", - "cockpit.aarch64", - "cockpit-bridge.noarch", - "cockpit-packagekit.noarch", - "cockpit-podman.noarch", - "cockpit-storaged.noarch", - "cockpit-system.noarch", - "cockpit-ws.aarch64", - "cockpit-ws-selinux.aarch64", - "conmon.aarch64", - "container-selinux.noarch", - "coreutils.aarch64", - "coreutils-common.aarch64", - "device-mapper.aarch64", - "device-mapper-event.aarch64", - "device-mapper-event-libs.aarch64", - "device-mapper-libs.aarch64", - "dnf.noarch", - "dnf-data.noarch", - "firewalld.noarch", - "firewalld-filesystem.noarch", - "grub2-common.noarch", - "grub2-efi-aa64.aarch64", - "grub2-efi-aa64-cdboot.aarch64", - "grub2-tools.aarch64", - "grub2-tools-extra.aarch64", - "grub2-tools-minimal.aarch64", - "hwdata.noarch", - "libcap-ng.aarch64", - "libcap-ng-python3.aarch64", - "libdnf.aarch64", - "libpng.aarch64", - "libusb1.aarch64", - "libxml2.aarch64", - "lvm2.aarch64", - "lvm2-libs.aarch64", - "man-pages.noarch", - "netavark.aarch64", - "nspr.aarch64", - "nss.aarch64", - "nss-softokn.aarch64", - "nss-softokn-freebl.aarch64", - "nss-sysinit.aarch64", - "nss-util.aarch64", - "openbolt.aarch64", - "openvox-server.noarch", - "openvoxdb.noarch", - "openvoxdb-termini.noarch", - "passt.aarch64", - "passt-selinux.noarch", - "podman.aarch64", - "podman-sequoia.aarch64", - "python3-dnf.noarch", - "python3-firewall.noarch", - "python3-hawkey.aarch64", - "python3-libdnf.aarch64", - "python3-rpm.aarch64", - "python3-urllib3.noarch", - "rpm.aarch64", - "rpm-build-libs.aarch64", - "rpm-libs.aarch64", - "rpm-plugin-audit.aarch64", - "rpm-plugin-selinux.aarch64", - "rpm-plugin-systemd-inhibit.aarch64", - "rpm-sign-libs.aarch64", - "selinux-policy.noarch", - "selinux-policy-targeted.noarch", - "shadow-utils.aarch64", - "shadow-utils-subid.aarch64", - "shim-aa64.aarch64", - "sudo.aarch64", - "sudo-python-plugin.aarch64", - "systemd.aarch64", - "systemd-libs.aarch64", - "systemd-pam.aarch64", - "systemd-udev.aarch64", - "tuned.noarch", - "xfsdump.aarch64", - "yum.noarch" - ], - "yum_reboot_required": false, - "yum_updates": 84 - } -} diff --git a/spec/onceover.yaml b/spec/onceover.yaml index be67048..21b5292 100644 --- a/spec/onceover.yaml +++ b/spec/onceover.yaml @@ -11,7 +11,6 @@ # Roles under test. classes: - role::puppet_master - - role::compiler - role::database_server - role::webserver - role::example @@ -20,7 +19,6 @@ classes: # so that trusted.certname resolves the right nodes/%{trusted.certname}.yaml). nodes: - puppet.example.com - - compiler.example.com - agent01.example.com - agent02.example.com @@ -29,8 +27,6 @@ nodes: class_groups: master_role: - role::puppet_master - compiler_role: - - role::compiler base_roles: - role::database_server - role::webserver @@ -39,8 +35,6 @@ class_groups: node_groups: master: - puppet.example.com - compiler: - - compiler.example.com agents: - agent01.example.com - agent02.example.com @@ -53,9 +47,6 @@ test_matrix: - master: classes: master_role tests: spec - - compiler: - classes: compiler_role - tests: spec - agents: classes: base_roles tests: spec