Skip to content

Commit 415e1d1

Browse files
author
petergmurphy
committed
(PE-39577) Optimise legacy compiler support
This commit: - Adds the `node_group_unpin` task. - `node_group_unpin` task is called in the convert plan to remove legacy compilers from from the PE Master node group. - Legacy compilers `pp_auth_role` changed to `legacy_compiler`. - Changes the PEADM config to use the PE Certificate Authority node group.
1 parent 26c3ddf commit 415e1d1

File tree

10 files changed

+175
-38
lines changed

10 files changed

+175
-38
lines changed

‎manifests/setup/legacy_compiler_group.pp‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,26 +9,27 @@
99
}
1010

1111
node_group { 'PE Legacy Compiler':
12+
ensure => 'present',
1213
parent => 'PE Master',
13-
rule => ['and',
14-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
15-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
16-
],
14+
purge_behavior => 'classes',
15+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'legacy_compiler'],
1716
classes => {
1817
'puppet_enterprise::profile::master' => {
1918
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_b_pool_address].filter |$_| { $_ },
2019
'puppetdb_port' => [8081],
20+
'replication_mode' => 'none',
21+
'code_manager_auto_configure' => true,
2122
},
2223
},
2324
}
2425

2526
node_group { 'PE Legacy Compiler Group A':
2627
ensure => 'present',
2728
parent => 'PE Legacy Compiler',
29+
purge_behavior => 'classes',
2830
rule => ['and',
29-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
31+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'legacy_compiler'],
3032
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
31-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
3233
],
3334
classes => {
3435
'puppet_enterprise::profile::master' => {
@@ -47,10 +48,10 @@
4748
node_group { 'PE Legacy Compiler Group B':
4849
ensure => 'present',
4950
parent => 'PE Legacy Compiler',
51+
purge_behavior => 'classes',
5052
rule => ['and',
51-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
53+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'legacy_compiler'],
5254
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
53-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
5455
],
5556
classes => {
5657
'puppet_enterprise::profile::master' => {

‎manifests/setup/node_manager.pp‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -77,12 +77,16 @@
7777
parent => 'PE Infrastructure',
7878
data => $compiler_pool_address_data,
7979
variables => { 'pe_master' => true },
80+
rule => ['or',
81+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'legacy_compiler'],
82+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
83+
],
8084
}
8185

8286
# PE Compiler group comes from default PE and already has the pe compiler role
8387
node_group { 'PE Compiler':
8488
parent => 'PE Master',
85-
rule => ['and', ['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'false']],
89+
rule => ['and', ['=', ['trusted', 'extensions', peadm::oid('pp_auth_role')], 'pe_compiler']],
8690
}
8791

8892
# This group should pin the primary, and also map to any pe-postgresql nodes
@@ -121,7 +125,6 @@
121125
rule => ['and',
122126
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
123127
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
124-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'false'],
125128
],
126129
classes => {
127130
'puppet_enterprise::profile::puppetdb' => {
@@ -180,7 +183,6 @@
180183
rule => ['and',
181184
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
182185
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
183-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'false'],
184186
],
185187
classes => {
186188
'puppet_enterprise::profile::puppetdb' => {
@@ -203,10 +205,7 @@
203205

204206
node_group { 'PE Legacy Compiler':
205207
parent => 'PE Master',
206-
rule => ['and',
207-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
208-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
209-
],
208+
rule => ['=', ['trusted', 'extensions', 'pp_auth_role'], 'legacy_compiler'],
210209
classes => {
211210
'puppet_enterprise::profile::master' => {
212211
'puppetdb_host' => [$internal_compiler_a_pool_address, $internal_compiler_b_pool_address].filter |$_| { $_ },
@@ -221,9 +220,8 @@
221220
ensure => 'present',
222221
parent => 'PE Legacy Compiler',
223222
rule => ['and',
224-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
223+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'legacy_compiler'],
225224
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'A'],
226-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
227225
],
228226
classes => {
229227
'puppet_enterprise::profile::master' => {
@@ -245,9 +243,8 @@
245243
ensure => 'present',
246244
parent => 'PE Legacy Compiler',
247245
rule => ['and',
248-
['=', ['trusted', 'extensions', 'pp_auth_role'], 'pe_compiler'],
246+
['=', ['trusted', 'extensions', 'pp_auth_role'], 'legacy_compiler'],
249247
['=', ['trusted', 'extensions', peadm::oid('peadm_availability_group')], 'B'],
250-
['=', ['trusted', 'extensions', peadm::oid('peadm_legacy_compiler')], 'true'],
251248
],
252249
classes => {
253250
'puppet_enterprise::profile::master' => {

‎plans/convert.pp‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@
232232
run_plan('peadm::modify_certificate', $legacy_compiler_a_targets,
233233
primary_host => $primary_target,
234234
add_extensions => {
235-
peadm::oid('pp_auth_role') => 'pe_compiler',
235+
peadm::oid('pp_auth_role') => 'legacy_compiler',
236236
peadm::oid('peadm_availability_group') => 'A',
237237
peadm::oid('peadm_legacy_compiler') => 'true',
238238
},
@@ -242,7 +242,7 @@
242242
run_plan('peadm::modify_certificate', $legacy_compiler_b_targets,
243243
primary_host => $primary_target,
244244
add_extensions => {
245-
peadm::oid('pp_auth_role') => 'pe_compiler',
245+
peadm::oid('pp_auth_role') => 'legacy_compiler',
246246
peadm::oid('peadm_availability_group') => 'B',
247247
peadm::oid('peadm_legacy_compiler') => 'true',
248248
},
@@ -283,6 +283,16 @@
283283
284284
include peadm::setup::convert_node_manager
285285
}
286+
287+
# Unpin legacy compilers from PE Master group
288+
if $legacy_compiler_targets {
289+
$legacy_compiler_targets.each |$target| {
290+
run_task('peadm::node_group_unpin', $primary_target,
291+
node_certname => $target.peadm::certname(),
292+
group_name => 'PE Master',
293+
)
294+
}
295+
}
286296
}
287297
else {
288298
# lint:ignore:strict_indent

‎plans/subplans/component_install.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
}
2626
} elsif $role == 'pe_compiler_legacy' {
2727
$certificate_extensions = {
28-
peadm::oid('pp_auth_role') => 'pe_compiler',
28+
peadm::oid('pp_auth_role') => 'legacy_compiler',
2929
peadm::oid('peadm_availability_group') => $avail_group_letter,
3030
peadm::oid('peadm_legacy_compiler') => true,
3131
}

‎plans/subplans/install.pp‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -287,7 +287,6 @@
287287
extension_requests => {
288288
peadm::oid('pp_auth_role') => 'pe_compiler',
289289
peadm::oid('peadm_availability_group') => 'A',
290-
peadm::oid('peadm_legacy_compiler') => 'false',
291290
}
292291
)
293292
},
@@ -296,25 +295,22 @@
296295
extension_requests => {
297296
peadm::oid('pp_auth_role') => 'pe_compiler',
298297
peadm::oid('peadm_availability_group') => 'B',
299-
peadm::oid('peadm_legacy_compiler') => 'false',
300298
}
301299
)
302300
},
303301
background('compiler-a-csr.yaml') || {
304302
run_plan('peadm::util::insert_csr_extension_requests', $legacy_a_targets,
305303
extension_requests => {
306-
peadm::oid('pp_auth_role') => 'pe_compiler',
304+
peadm::oid('pp_auth_role') => 'legacy_compiler',
307305
peadm::oid('peadm_availability_group') => 'A',
308-
peadm::oid('peadm_legacy_compiler') => 'true',
309306
}
310307
)
311308
},
312309
background('compiler-b-csr.yaml') || {
313310
run_plan('peadm::util::insert_csr_extension_requests', $legacy_b_targets,
314311
extension_requests => {
315-
peadm::oid('pp_auth_role') => 'pe_compiler',
312+
peadm::oid('pp_auth_role') => 'legacy_compiler',
316313
peadm::oid('peadm_availability_group') => 'B',
317-
peadm::oid('peadm_legacy_compiler') => 'true',
318314
}
319315
)
320316
},

‎plans/upgrade.pp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,8 +172,8 @@
172172
$compiler_m1_nonlegacy_targets = $compiler_targets.filter |$target| {
173173
($cert_extensions.dig($target.peadm::certname, peadm::oid('peadm_availability_group'))
174174
== $cert_extensions.dig($primary_target[0].peadm::certname, peadm::oid('peadm_availability_group'))) and
175-
($cert_extensions.dig($target.peadm::certname, peadm::oid('peadm_legacy_compiler'))
176-
== 'false')
175+
($cert_extensions.dig($target.peadm::certname, peadm::oid('pp_auth_role'))
176+
== 'pe_compiler')
177177
}
178178

179179
$compiler_m2_targets = $compiler_targets.filter |$target| {
@@ -184,8 +184,8 @@
184184
$compiler_m2_nonlegacy_targets = $compiler_targets.filter |$target| {
185185
($cert_extensions.dig($target.peadm::certname, peadm::oid('peadm_availability_group'))
186186
== $cert_extensions.dig($replica_target[0].peadm::certname, peadm::oid('peadm_availability_group'))) and
187-
($cert_extensions.dig($target.peadm::certname, peadm::oid('peadm_legacy_compiler'))
188-
== 'false')
187+
($cert_extensions.dig($target.peadm::certname, peadm::oid('pp_auth_role'))
188+
== 'pe_compiler')
189189
}
190190

191191
peadm::plan_step('preparation') || {

‎spec/plans/convert_spec.rb‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
end
1010

1111
let(:params) do
12-
{ 'primary_host' => 'primary' }
12+
{ 'primary_host' => 'primary', 'legacy_compiler_host' => 'legacy_compiler' }
1313
end
1414

1515
it 'single primary no dr valid' do
@@ -21,6 +21,7 @@
2121
expect_task('peadm::cert_data').return_for_targets('primary' => trustedjson)
2222
expect_task('peadm::read_file').always_return({ 'content' => '2021.7.9' })
2323
expect_task('peadm::get_group_rules').return_for_targets('primary' => { '_output' => '{"rules": []}' })
24+
expect_task('peadm::node_group_unpin').with_targets('primary').with_params({ 'node_certname' => 'legacy_compiler', 'group_name' => 'PE Master' })
2425

2526
# For some reason, expect_plan() was not working??
2627
allow_plan('peadm::modify_certificate').always_return({})

‎tasks/get_peadm_config.rb‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ def execute!
2222

2323
def config
2424
# Compute values
25-
primary = groups.pinned('PE Master')
25+
primary = groups.pinned('PE Certificate Authority')
2626
replica = groups.pinned('PE HA Replica')
2727
server_a = server('puppet/server', 'A', [primary, replica].compact)
2828
server_b = server('puppet/server', 'B', [primary, replica].compact)
@@ -94,8 +94,7 @@ def groups
9494
def compilers
9595
@compilers ||=
9696
pdb_query('inventory[certname,trusted.extensions] {
97-
trusted.extensions.pp_auth_role = "pe_compiler" and
98-
trusted.extensions."1.3.6.1.4.1.34380.1.1.9814" = "false"
97+
trusted.extensions.pp_auth_role = "pe_compiler"
9998
}').map do |c|
10099
{
101100
'certname' => c['certname'],
@@ -108,8 +107,7 @@ def compilers
108107
def legacy_compilers
109108
@legacy_compilers ||=
110109
pdb_query('inventory[certname,trusted.extensions] {
111-
trusted.extensions.pp_auth_role = "pe_compiler" and
112-
trusted.extensions."1.3.6.1.4.1.34380.1.1.9814" = "true"
110+
trusted.extensions.pp_auth_role = "legacy_compiler"
113111
}').map do |c|
114112
{
115113
'certname' => c['certname'],

‎tasks/node_group_unpin.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"description": "Unpins a node from a specified PE node group",
3+
"parameters": {
4+
"node_certname": {
5+
"type": "String",
6+
"description": "The certname of the node to unpin"
7+
},
8+
"group_name": {
9+
"type": "String",
10+
"description": "The name of the node group to unpin the node from"
11+
}
12+
},
13+
"input_method": "stdin",
14+
"implementations": [
15+
{"name": "node_group_unpin.rb"}
16+
]
17+
}

‎tasks/node_group_unpin.rb‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/opt/puppetlabs/puppet/bin/ruby
2+
# frozen_string_literal: true
3+
4+
require 'json'
5+
require 'yaml'
6+
require 'net/https'
7+
require 'puppet'
8+
9+
# NodeGroupUnpin task class
10+
class NodeGroupUnpin
11+
def initialize(params)
12+
@params = params
13+
raise "Missing required parameter 'node_certname'" unless @params['node_certname']
14+
raise "Missing required parameter 'group_name'" unless @params['group_name']
15+
@auth = YAML.load_file('/etc/puppetlabs/puppet/classifier.yaml')
16+
rescue Errno::ENOENT
17+
raise 'Could not find classifier.yaml at /etc/puppetlabs/puppet/classifier.yaml'
18+
end
19+
20+
def https_client
21+
client = Net::HTTP.new(Puppet.settings[:certname], 4433)
22+
client.use_ssl = true
23+
client.cert = @cert ||= OpenSSL::X509::Certificate.new(File.read(Puppet.settings[:hostcert]))
24+
client.key = @key ||= OpenSSL::PKey::RSA.new(File.read(Puppet.settings[:hostprivkey]))
25+
client.verify_mode = OpenSSL::SSL::VERIFY_PEER
26+
client.ca_file = Puppet.settings[:localcacert]
27+
client
28+
end
29+
30+
def groups
31+
@groups ||= begin
32+
net = https_client
33+
res = net.get('/classifier-api/v1/groups')
34+
35+
unless res.code == '200'
36+
raise "Failed to fetch groups: HTTP #{res.code} - #{res.body}"
37+
end
38+
39+
NodeGroup.new(JSON.parse(res.body))
40+
rescue JSON::ParserError => e
41+
raise "Invalid JSON response from server: #{e.message}"
42+
rescue StandardError => e
43+
raise "Error fetching groups: #{e.message}"
44+
end
45+
end
46+
47+
def unpin_node(group, node)
48+
raise 'Invalid group object' unless group.is_a?(Hash) && group['id'] && group['name']
49+
50+
net = https_client
51+
begin
52+
data = { "nodes": [node] }.to_json
53+
url = "/classifier-api/v1/groups/#{group['id']}/unpin"
54+
55+
req = Net::HTTP::Post.new(url)
56+
req['Content-Type'] = 'application/json'
57+
req.body = data
58+
59+
res = net.request(req)
60+
61+
case res.code
62+
when '204'
63+
puts "Successfully unpinned node '#{node}' from group '#{group['name']}'"
64+
else
65+
begin
66+
error_body = JSON.parse(res.body.to_s)
67+
raise "Failed to unpin node: #{error_body['kind'] || error_body}"
68+
rescue JSON::ParserError
69+
raise "Invalid response from server (status #{res.code}): #{res.body}"
70+
end
71+
end
72+
rescue StandardError => e
73+
raise "Error during unpin request: #{e.message}"
74+
end
75+
end
76+
77+
# Utility class to aid in retrieving useful information from the node group
78+
# data
79+
class NodeGroup
80+
attr_reader :data
81+
82+
def initialize(data)
83+
@data = data
84+
end
85+
86+
# Aids in digging into node groups by name, rather than UUID
87+
def dig(name, *args)
88+
group = @data.find { |obj| obj['name'] == name }
89+
if group.nil?
90+
nil
91+
elsif args.empty?
92+
group
93+
else
94+
group.dig(*args)
95+
end
96+
end
97+
end
98+
99+
def execute!
100+
group_name = @params['group_name']
101+
node_certname = @params['node_certname']
102+
group = groups.dig(group_name)
103+
if group
104+
unpin_node(group, node_certname)
105+
puts "Unpinned #{node_certname} from #{group_name}"
106+
else
107+
puts "Group #{group_name} not found"
108+
end
109+
end
110+
end
111+
112+
# Run the task unless an environment flag has been set
113+
unless ENV['RSPEC_UNIT_TEST_MODE']
114+
Puppet.initialize_settings
115+
task = NodeGroupUnpin.new(JSON.parse(STDIN.read))
116+
task.execute!
117+
end

0 commit comments

Comments
 (0)