Skip to content

Commit 513d6c1

Browse files
committed
Upgrade puppetcore* rpm from yum-puppetcore.puppet.com
Add optional username and password parameters to the `puppet_agent` class. If `manage_repo` is true, then add the credentials to the repo config (for RPM platforms other than SLES) with secure permissions. For SLES, add credentials to /etc/zypp/credentials.d/PuppetcoreCreds with secure permissions. Also include auth=basic and credentials=PuppetcoreCreds to the baseurl. Update the Dockerfile to install 7.34.0 from yum.puppet.com and upgrade to 8.11.0 from yum-puppetcore, to verify the module can upgrade agents on amazon 2023, fedora 40, rocky 8 and sles 15. export PUPPET_FORGE_TOKEN=... docker/bin/upgrade.sh [platform] [from] [to] where platform is one of amazon, fedora, rocky or sles and from/to are puppet-agent versions. The password is passed to the `docker run` command as an environment variable, so that it's not persisted in the docker image.
1 parent e6f817c commit 513d6c1

File tree

11 files changed

+261
-25
lines changed

11 files changed

+261
-25
lines changed

REFERENCE.md

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@ The following parameters are available in the `puppet_agent` class:
9898
* [`version_file_path`](#-puppet_agent--version_file_path)
9999
* [`skip_if_unavailable`](#-puppet_agent--skip_if_unavailable)
100100
* [`disable_proxy`](#-puppet_agent--disable_proxy)
101+
* [`username`](#-puppet_agent--username)
102+
* [`password`](#-puppet_agent--password)
101103

102104
##### <a name="-puppet_agent--arch"></a>`arch`
103105

@@ -371,6 +373,22 @@ Data type: `Boolean`
371373

372374
Default value: `false`
373375

376+
##### <a name="-puppet_agent--username"></a>`username`
377+
378+
Data type: `Optional`
379+
380+
The username to use when downloading from a source location requiring authentication.
381+
382+
Default value: `undef`
383+
384+
##### <a name="-puppet_agent--password"></a>`password`
385+
386+
Data type: `Optional[Sensitive]`
387+
388+
The password to use when downloading from a source location requiring authentication.
389+
390+
Default value: `undef`
391+
374392
### <a name="puppet_agent--configure"></a>`puppet_agent::configure`
375393

376394
It does not require management of the agent package.
@@ -843,7 +861,7 @@ The version of puppet-agent to install (defaults to latest when no agent is inst
843861

844862
##### `collection`
845863

846-
Data type: `Optional[Enum[puppet7, puppet8, puppet, puppet7-nightly, puppet8-nightly, puppet-nightly]]`
864+
Data type: `Optional[Enum[puppet7, puppet8, puppet, puppet7-nightly, puppet8-nightly, puppet-nightly, puppetcore7, puppetcore8]]`
847865

848866
The Puppet collection to install from (defaults to puppet, which maps to the latest collection released)
849867

@@ -895,6 +913,18 @@ Data type: `Optional[Integer]`
895913

896914
The number of retries in case of network connectivity failures
897915

916+
##### `username`
917+
918+
Data type: `Optional[String]`
919+
920+
The username to use when downloading from a source location requiring authentication
921+
922+
##### `password`
923+
924+
Data type: `Optional[String]`
925+
926+
The password to use when downloading from a source location requiring authentication
927+
898928
### <a name="install_powershell"></a>`install_powershell`
899929

900930
Install the Puppet agent package
@@ -979,7 +1009,7 @@ The version of puppet-agent to install
9791009

9801010
##### `collection`
9811011

982-
Data type: `Optional[Enum[puppet7, puppet8, puppet, puppet7-nightly, puppet8-nightly, puppet-nightly]]`
1012+
Data type: `Optional[Enum[puppet7, puppet8, puppet, puppet7-nightly, puppet8-nightly, puppet-nightly, puppetcore7, puppetcore8]]`
9831013

9841014
The Puppet collection to install from (defaults to puppet, which maps to the latest collection released)
9851015

@@ -1031,6 +1061,18 @@ Data type: `Optional[Integer]`
10311061

10321062
The number of retries in case of network connectivity failures
10331063

1064+
##### `username`
1065+
1066+
Data type: `Optional[String]`
1067+
1068+
The username to use when downloading from a source location requiring authentication
1069+
1070+
##### `password`
1071+
1072+
Data type: `Optional[String]`
1073+
1074+
The password to use when downloading from a source location requiring authentication
1075+
10341076
### <a name="run"></a>`run`
10351077

10361078
Run the Puppet agent. This task may cause problems if run in Puppet Enterprise.

docker/bin/helpers/run-upgrade.sh

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
#!/usr/bin/env bash
22

3-
# Run upgrades on a container. The default upgrade TO argument will be 8.10.0 if
3+
# Run upgrades on a container. The default upgrade TO argument will be 8.11.0 if
44
# no arguments are passed to this script.
55
set -e
66

7-
to_version=${1:-8.10.0}
7+
to_version=${1:-8.11.0}
88
# Calculate which collection should be used. This is derived from the puppet
99
# version.
1010
puppet_version=( ${to_version//./ } )
@@ -20,7 +20,12 @@ case $puppet_major in
2020
echo "Invalid version supplied" 1>&2
2121
exit 1
2222
esac
23-
FACTER_to_version=${1:-8.10.0} FACTER_to_collection=${to_collection} /opt/puppetlabs/puppet/bin/puppet apply --debug --trace --modulepath /tmp/modules /tmp/upgrade.pp
23+
FACTER_to_version=${to_version} \
24+
FACTER_to_collection=${to_collection} \
25+
FACTER_forge_username=forge-key \
26+
FACTER_forge_password="${PUPPET_FORGE_TOKEN}" \
27+
/opt/puppetlabs/puppet/bin/puppet apply --debug --trace --modulepath /tmp/modules /tmp/upgrade.pp
28+
2429
# Make e.g. `puppet --version` work out of the box.
2530
PATH=/opt/puppetlabs/bin:$PATH \
2631
read -p "Explore the upgraded container? [y/N]: " choice && \

docker/bin/upgrade.sh

Lines changed: 51 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,65 @@
88
# - PLATFORM: The platform on which the upgrade should occur. This also
99
# supports comma-separated lists. Available:
1010
# - `ubuntu`
11-
# - `centos`
11+
# - `amazon`
12+
# - `fedora`
1213
# - `rocky`
14+
# - `sles`
1315
# Default: `ubuntu`
1416
# - BEFORE: The puppet-agent package version that is installed prior to upgrade.
15-
# Default: 1.10.14
17+
# Default: 7.34.0
1618
# - AFTER: The puppet-agent package version that should exist after upgrade.
17-
# Default: 6.2.0
19+
# Default: 8.1.0
1820
set -e
1921

22+
if [ -z "${PUPPET_FORGE_TOKEN}" ]; then
23+
echo "Environment variable PUPPET_FORGE_TOKEN must be set"
24+
exit 1
25+
fi
26+
2027
cd "$(dirname "$0")/../.."
21-
platforms=${1:-ubuntu}
28+
platforms=${1:-rocky}
2229
before=${2:-7.34.0}
23-
after=${3:-8.10.0}
30+
after=${3:-8.11.0}
2431
for platform in ${platforms//,/ }
2532
do
26-
docker build --rm -f docker/$platform/Dockerfile . -t pa-dev:$platform \
27-
--build-arg before=${before}
28-
docker run --rm -ti pa-dev:$platform ${after}
33+
dockerfile='docker/upgrade/dnf/Dockerfile'
34+
35+
# REMIND: if (7.35 <= before && before < 8.0) OR (8.11.0 <= before), then install release
36+
# package from yum-puppetcore.
37+
case $platform in
38+
amazon)
39+
base_image='amazonlinux:2023'
40+
release_package='http://yum.puppet.com/puppet7-release-amazon-2023.noarch.rpm'
41+
;;
42+
43+
fedora)
44+
base_image='fedora:40'
45+
release_package='http://yum.puppet.com/puppet7-release-fedora-40.noarch.rpm'
46+
;;
47+
48+
rocky)
49+
base_image='rockylinux/rockylinux:8'
50+
release_package='http://yum.puppet.com/puppet7-release-el-8.noarch.rpm'
51+
;;
52+
53+
sles)
54+
base_image='registry.suse.com/suse/sle15:15.6'
55+
release_package='http://yum.puppet.com/puppet7-release-sles-15.noarch.rpm'
56+
dockerfile='docker/upgrade/sles/Dockerfile'
57+
;;
58+
59+
*)
60+
echo "$0: Usage upgrade.sh [amazon|fedora|rocky|sles] [before] [after]"
61+
exit 1
62+
;;
63+
esac
64+
65+
docker build --rm -f ${dockerfile} . -t pa-dev:$platform \
66+
--build-arg before=${before} \
67+
--build-arg BASE_IMAGE=${base_image} \
68+
--build-arg RELEASE_PACKAGE=${release_package}
69+
70+
docker run -e PUPPET_FORGE_TOKEN --rm -ti pa-dev:$platform ${after}
2971
done
30-
echo Complete
72+
echo Complete

docker/upgrade.pp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,7 @@
88
# process.
99
service_names => [],
1010
collection => $facts['to_collection'],
11+
username => $facts['forge_username'],
12+
password => Sensitive($facts['forge_password']),
1113
}
1214
}

docker/rocky/Dockerfile renamed to docker/upgrade/dnf/Dockerfile

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,24 +24,26 @@
2424
# Arguments:
2525
# - before: The version to do upgrade FROM. Default: "7.34.0"
2626

27-
FROM rockylinux/rockylinux:8
27+
ARG BASE_IMAGE=rocky:8
28+
FROM ${BASE_IMAGE}
2829

2930
# Use this to force a cache reset (e.g. for output purposes)
3031
#COPY $0 /tmp/Dockerfile
3132

3233
# Install some other dependencies for ease of life.
3334
RUN dnf update -y \
34-
&& dnf install -y wget git \
35+
&& dnf install -y git \
3536
&& dnf clean all
3637

3738
ARG before=7.34.0
3839
LABEL before=${before}
3940

41+
ARG RELEASE_PACKAGE
42+
4043
# Install proper FROM repo pupet 7
4144
RUN if [[ ${before} == 7.* ]]; then \
4245
echo Installing puppet7 repo; \
43-
wget -O puppet7.rpm http://yum.puppet.com/puppet7-release-el-8.noarch.rpm && \
44-
rpm -i puppet7.rpm; \
46+
rpm -Uvh ${RELEASE_PACKAGE}; \
4547
else echo no; \
4648
fi
4749

@@ -50,7 +52,8 @@ RUN if [[ ${before} == 7.* ]]; then \
5052

5153
# Install FROM version of puppet-agent.
5254
RUN dnf -y update && \
53-
dnf install -y puppet-agent-${before}-1.el8
55+
dnf install -y puppet-agent-${before} && \
56+
dnf clean all
5457

5558
# This is also duplicated in the docker/bin/helpers/run-upgrade.sh.
5659
ENV module_path=/tmp/modules

docker/upgrade/sles/Dockerfile

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# This Dockerfile enables an iterative development workflow where you can make
2+
# a change and test it out quickly. The majority of commands in this file will
3+
# be cached, making the feedback loop typically quite short. The workflow is
4+
# as follows:
5+
# 1. Set up pre-conditions for the system in puppet code using `deploy.pp`.
6+
# 2. Make a change to the module.
7+
# 3. Run `docker build -f docker/Dockerfile .` or
8+
# `./docker/bin/upgrade.sh rocky` from the project directory. If you would
9+
# like to test specific version upgrades, you can add run this like so:
10+
# `docker build -f docker/rocky/Dockerfile . \
11+
# -t pa-dev:rocky --build-arg before=1.10.14`
12+
# 4. Upgrade the container by running the image:
13+
# `docker run -it pa-dev:rocky`
14+
# Specify your upgrade TO version as an argument to the `docker run`
15+
# command.
16+
# 5. Review the output. Repeat steps 2-5 as needed.
17+
#
18+
# At the end of execution, you will see a line like:
19+
#
20+
# Notice: /Stage[main]/Puppet_agent::Install/Package[puppet-agent]/ensure: ensure changed '1.10.14-1.el8' to '6.2.0'
21+
#
22+
# This specifies the versions that were used for upgrade.
23+
#
24+
# Arguments:
25+
# - before: The version to do upgrade FROM. Default: "7.34.0"
26+
27+
ARG BASE_IMAGE=registry.suse.com/suse/sle15:15.6
28+
FROM ${BASE_IMAGE}
29+
30+
# Use this to force a cache reset (e.g. for output purposes)
31+
#COPY $0 /tmp/Dockerfile
32+
33+
# Install some other dependencies for ease of life.
34+
RUN zypper install --no-confirm wget git-core
35+
36+
ARG before=7.34.0
37+
LABEL before=${before}
38+
39+
ARG RELEASE_PACKAGE
40+
41+
# Install proper FROM repo pupet 7
42+
RUN if [[ ${before} == 7.* ]]; then \
43+
wget -O puppet7.rpm ${RELEASE_PACKAGE} && \
44+
rpm -i puppet7.rpm; \
45+
else echo no; \
46+
fi
47+
48+
# Install FROM version of puppet-agent.
49+
RUN rpm --import https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406 && \
50+
zypper install --no-confirm --oldpackage --no-recommends --no-confirm puppet-agent-${before}
51+
52+
# This is also duplicated in the docker/bin/helpers/run-upgrade.sh.
53+
ENV module_path=/tmp/modules
54+
WORKDIR "${module_path}/puppet_agent"
55+
COPY metadata.json ./
56+
57+
# Dependency installation: Forge or source? The former is what the user will
58+
# have downloaded, but the latter allows testing of version bumps.
59+
# Install module dependencies from the Forge using Puppet Module Tool (PMT).
60+
RUN /opt/puppetlabs/puppet/bin/puppet module install --modulepath $module_path --target-dir .. puppetlabs-stdlib
61+
RUN /opt/puppetlabs/puppet/bin/puppet module install --modulepath $module_path --target-dir .. puppetlabs-inifile
62+
RUN /opt/puppetlabs/puppet/bin/puppet module install --modulepath $module_path --target-dir .. puppetlabs-apt
63+
RUN /opt/puppetlabs/puppet/bin/puppet module install --modulepath $module_path --target-dir .. puppetlabs-facts
64+
65+
# Installing dependencies from source. These versions should be within the range
66+
# of `dependencies` in metadata.json.
67+
#RUN git clone https://github.com/puppetlabs/puppetlabs-stdlib ../stdlib --branch 9.7.0
68+
#RUN git clone https://github.com/puppetlabs/puppetlabs-inifile ../inifile --branch 6.2.0
69+
#RUN git clone https://github.com/puppetlabs/puppetlabs-apt ../apt --branch 10.0.1
70+
#RUN git clone https://github.com/puppetlabs/puppetlabs-facts ../facts --branch 1.7.0
71+
72+
# Check that all dependencies are installed.
73+
RUN /opt/puppetlabs/puppet/bin/puppet module --modulepath $module_path list --tree
74+
COPY docker/deploy.pp /tmp/deploy.pp
75+
RUN ["sh", "-c", "/opt/puppetlabs/puppet/bin/puppet apply --modulepath $module_path /tmp/deploy.pp"]
76+
77+
# Now move the project directory's files into the image. That way, if these
78+
# files change, caching will skip everything before this.
79+
COPY docker/bin/helpers/run-upgrade.sh /tmp/bin/run-upgrade.sh
80+
COPY files/ ./files/
81+
COPY locales/ ./locales/
82+
COPY spec/ ./spec/
83+
COPY task_spec/ ./task_spec/
84+
COPY tasks/ ./tasks/
85+
COPY templates/ ./templates
86+
COPY types/ ./types/
87+
COPY Gemfile Gemfile.lock Rakefile ./
88+
COPY lib/ ./lib/
89+
COPY manifests/ ./manifests/
90+
91+
COPY docker/upgrade.pp /tmp/upgrade.pp
92+
93+
# Perform the upgrade.
94+
ENTRYPOINT ["/tmp/bin/run-upgrade.sh"]

manifests/init.pp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,8 @@
103103
# @param skip_if_unavailable
104104
# For yum-based repositories, set the skip_if_unavailable option of the `yumrepo` type.
105105
# @param disable_proxy
106+
# @param username The username to use when downloading from a source location requiring authentication.
107+
# @param password The password to use when downloading from a source location requiring authentication.
106108
class puppet_agent (
107109
String $arch = $facts['os']['architecture'],
108110
String $collection = $puppet_agent::params::collection,
@@ -131,7 +133,9 @@
131133
Optional $wait_for_pxp_agent_exit = undef,
132134
Optional $wait_for_puppet_run = undef,
133135
Array[Puppet_agent::Config] $config = [],
134-
Stdlib::Absolutepath $version_file_path = '/opt/puppetlabs/puppet/VERSION'
136+
Stdlib::Absolutepath $version_file_path = '/opt/puppetlabs/puppet/VERSION',
137+
Optional $username = undef,
138+
Optional[Sensitive] $password = undef,
135139
) inherits puppet_agent::params {
136140
# The configure class uses $puppet_agent::config to manage settings in
137141
# puppet.conf, and will always be present. It does not require management of

manifests/osfamily/redhat.pp

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,14 @@
175175
sslclientcert => $_sslclientcert_path,
176176
sslclientkey => $_sslclientkey_path,
177177
skip_if_unavailable => $puppet_agent::skip_if_unavailable,
178+
username => $puppet_agent::username,
179+
password => $puppet_agent::password,
180+
}
181+
file { '/etc/yum.repos.d/pc_repo.repo':
182+
ensure => file,
183+
owner => 0,
184+
group => 0,
185+
mode => '0600',
178186
}
179187
}
180188
}

0 commit comments

Comments
 (0)