diff --git a/plans/add_compiler.pp b/plans/add_compiler.pp index 7e2fbece..1a602d4a 100644 --- a/plans/add_compiler.pp +++ b/plans/add_compiler.pp @@ -70,44 +70,12 @@ # Reload pe-postgresql.service run_command('systemctl reload pe-postgresql.service', $primary_postgresql_target) - # Install the puppet agent making sure to specify an availability group letter, A or B, as an extension request. - $dns_alt_names_flag = $dns_alt_names? { - undef => [], - default => ["main:dns_alt_names=${dns_alt_names}"], - } - - # Check for and merge csr_attributes. - run_plan('peadm::util::insert_csr_extension_requests', $compiler_target, - extension_requests => { - peadm::oid('pp_auth_role') => 'pe_compiler', - peadm::oid('peadm_availability_group') => $avail_group_letter, - } - ) - - # we first assume that there is no agent installed on the node. If there is, nothing will happen. - run_task('peadm::agent_install', $compiler_target, - server => $primary_target.peadm::certname(), - install_flags => $dns_alt_names_flag + [ - '--puppet-service-ensure', 'stopped', - "main:certname=${compiler_target.peadm::certname()}", - ], - ) - - # If necessary, manually submit a CSR - # ignoring errors to simplify logic - run_task('peadm::submit_csr', $compiler_target, { '_catch_errors' => true }) - - # On primary, if necessary, sign the certificate request - run_task('peadm::sign_csr', $primary_target, { 'certnames' => [$compiler_target.peadm::certname()] }) - - # If there was already a signed cert, force the certificate extensions we want - # TODO: update peadm::util::add_cert_extensions to take care of dns alt names - run_plan('peadm::modify_certificate', $compiler_target, - primary_host => $primary_target.peadm::certname(), - add_extensions => { - peadm::oid('pp_auth_role') => 'pe_compiler', - peadm::oid('peadm_availability_group') => $avail_group_letter, - }, + # Install agent (if required) and regenerate agent certificate to add required data with peadm::subplans::component_install + run_plan('peadm::subplans::component_install', $compiler_target, + primary_host => $primary_target, + avail_group_letter => $avail_group_letter, + dns_alt_names => $dns_alt_names, + role => 'pe_compiler', ) # Source the global hiera.yaml from Primary and synchronize to new compiler @@ -120,10 +88,10 @@ run_task('peadm::puppet_runonce', $compiler_target) # On run the puppet agent - run_task('peadm::puppet_runonce', peadm::flatten_compact([ - $primary_postgresql_target, - $replica_puppetdb_target, - ])) + run_task('peadm::puppet_runonce', $primary_postgresql_target) + + # On replica puppetdb run the puppet agent + run_task('peadm::puppet_runonce', $replica_puppetdb_target) # On start puppet.service run_command('systemctl start puppet.service', peadm::flatten_compact([ diff --git a/plans/subplans/component_install.pp b/plans/subplans/component_install.pp index 80f2cd7e..df74079e 100644 --- a/plans/subplans/component_install.pp +++ b/plans/subplans/component_install.pp @@ -10,19 +10,29 @@ Peadm::SingleTargetSpec $targets, Peadm::SingleTargetSpec $primary_host, Enum['A', 'B'] $avail_group_letter, - Optional[Variant[String[1], Array]] $dns_alt_names = undef, + Optional[Variant[String[1], Array]] $dns_alt_names = undef, Optional[String[1]] $role = undef ) { $component_target = peadm::get_targets($targets, 1) $primary_target = peadm::get_targets($primary_host, 1) - run_plan('peadm::subplans::prepare_agent', $component_target, - primary_host => $primary_target, - dns_alt_names => peadm::flatten_compact([$dns_alt_names]), - certificate_extensions => { + # Set pp_auth_role instead of peadm_role for compiler role + if $role == 'pe_compiler' { + $certificate_extensions = { + peadm::oid('pp_auth_role') => 'pe_compiler', + peadm::oid('peadm_availability_group') => $avail_group_letter, + } + } else { + $certificate_extensions = { peadm::oid('peadm_role') => $role, peadm::oid('peadm_availability_group') => $avail_group_letter, } + } + + run_plan('peadm::subplans::prepare_agent', $component_target, + primary_host => $primary_target, + dns_alt_names => peadm::flatten_compact([$dns_alt_names]), + certificate_extensions => $certificate_extensions, ) # On component, run the puppet agent to finish initial configuring of component diff --git a/plans/subplans/prepare_agent.pp b/plans/subplans/prepare_agent.pp index 640f614b..50875a47 100644 --- a/plans/subplans/prepare_agent.pp +++ b/plans/subplans/prepare_agent.pp @@ -87,6 +87,7 @@ run_plan('peadm::modify_certificate', $agent_target, primary_host => $primary_target, add_extensions => $certificate_extensions, + dns_alt_names => $dns_alt_names, force_regenerate => $force_regenerate ) } diff --git a/spec/plans/add_compiler_spec.rb b/spec/plans/add_compiler_spec.rb index f28240a3..5f75b742 100644 --- a/spec/plans/add_compiler_spec.rb +++ b/spec/plans/add_compiler_spec.rb @@ -36,18 +36,18 @@ def allow_standard_non_returning_calls it 'runs successfully when no alt-names are specified' do allow_standard_non_returning_calls + expect_task('peadm::get_peadm_config').always_return(cfg) - expect_plan('peadm::modify_certificate').always_return('mock' => 'mock') - expect_task('peadm::agent_install') - .with_params({ 'server' => 'primary', - 'install_flags' => [ - '--puppet-service-ensure', 'stopped', - 'main:certname=compiler' - ] }) - # {"install_flags"=> - # ["--puppet-service-ensure", "stopped", - # "extension_requests:1.3.6.1.4.1.34380.1.3.13=pe_compiler", "extension_requests:1.3.6.1.4.1.34380.1.1.9813=A", "main:certname=compiler"], "server"=>"primary"} + # TODO: Due to difficulty mocking get_targets, with_params modifier has been commented out + expect_plan('peadm::subplans::component_install') + # .with_params({ + # 'targets' => 'compiler', + # 'primary_host' => 'primary', + # 'avail_group_letter' => 'A', + # 'dns_alt_names' => nil, + # 'role' => 'pe_compiler' + # }) expect_plan('peadm::util::copy_file').be_called_times(1) expect(run_plan('peadm::add_compiler', params)).to be_ok @@ -61,14 +61,17 @@ def allow_standard_non_returning_calls it 'runs successfully when alt-names are specified' do allow_standard_non_returning_calls expect_task('peadm::get_peadm_config').always_return(cfg) - expect_plan('peadm::modify_certificate').always_return('mock' => 'mock') - expect_task('peadm::agent_install') - .with_params({ 'server' => 'primary', - 'install_flags' => [ - 'main:dns_alt_names=foo,bar', - '--puppet-service-ensure', 'stopped', - 'main:certname=compiler' - ] }) + + # TODO: Due to difficulty mocking get_targets, with_params modifier has been commented out + expect_plan('peadm::subplans::component_install') + # .with_params({ + # 'targets' => 'compiler', + # 'primary_host' => 'primary', + # 'avail_group_letter' => 'A', + # 'dns_alt_names' => 'foo,bar', + # 'role' => 'pe_compiler' + # }) + expect_plan('peadm::util::copy_file').be_called_times(1) expect(run_plan('peadm::add_compiler', params2)).to be_ok end