Skip to content

Commit a51980d

Browse files
kenyonkenyon
authored
Merge pull request #125 from voxpupuli/modulesync
modulesync 10.4.0
2 parents 900e90c + ddbe29d commit a51980d

6 files changed

Lines changed: 59 additions & 52 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@ permissions:
2222
jobs:
2323
puppet:
2424
name: Puppet
25-
uses: voxpupuli/gha-puppet/.github/workflows/basic.yml@v3
25+
uses: voxpupuli/gha-puppet/.github/workflows/basic.yml@v4

‎.msync.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
# Managed by modulesync - DO NOT EDIT
33
# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
44

5-
modulesync_config_version: '10.2.0'
5+
modulesync_config_version: '10.4.0'

‎Gemfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
source ENV['GEM_SOURCE'] || 'https://rubygems.org'
55

66
group :test do
7-
gem 'voxpupuli-test', '~> 12.0', :require => false
7+
gem 'voxpupuli-test', '~> 13.0', :require => false
88
gem 'puppet_metadata', '~> 5.0', :require => false
99
end
1010

@@ -18,7 +18,7 @@ group :system_tests do
1818
end
1919

2020
group :release do
21-
gem 'voxpupuli-release', '~> 4.0', :require => false
21+
gem 'voxpupuli-release', '~> 5.0', :require => false
2222
end
2323

2424
gem 'rake', :require => false

‎manifests/init.pp‎

Lines changed: 50 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
# @summary
22
# Framework for patch management as code. Works alongside the puppetlabs/pe_patch or albatrossflavour/os_patching modules
3-
#
3+
#
44
# @example Using the module with defaults, or controlling options through Hiera
55
# include patching_as_code
6-
#
6+
#
77
# @example Forcing the classification of pe_patch on PE 2019.8.0+
88
# class {'patching_as_code':
99
# classify_pe_patch => true
1010
# }
11-
#
11+
#
1212
# @example Forcing the use of albatrossflavour/os_patching on PE 2019.8.0+
1313
# class {'patching_as_code':
1414
# use_pe_patch => false
1515
# }
16-
#
16+
#
1717
# @param Variant[String,Array[String]] patch_group
1818
# Name(s) of the patch_group(s) for this node. Must match one or more of the patch groups in $patch_schedule
1919
# To assign multiple patch groups, provide this parameter as an array
@@ -107,7 +107,7 @@
107107
# When disabled (default), patches are not installed over a metered link.
108108
# @param [Optional[String]] plan_patch_fact
109109
# Reserved parameter for running `patching_as_code` via a Plan (future functionality).
110-
#
110+
#
111111
class patching_as_code (
112112
Variant[String,Array[String]] $patch_group, #lint:ignore:parameter_documentation
113113
Hash $patch_schedule,
@@ -231,32 +231,35 @@
231231
file { 'patching_configuration.json':
232232
ensure => file,
233233
path => "${facts['puppet_vardir']}/../../facter/facts.d/patching_configuration.json",
234-
content => to_json_pretty( { # lint:ignore:manifest_whitespace_opening_brace_before
235-
patching_as_code_config => {
236-
allowlist => $allowlist,
237-
blocklist => $blocklist,
238-
high_priority_list => $high_priority_list,
239-
allowlist_choco => $allowlist_choco,
240-
blocklist_choco => $blocklist_choco,
241-
high_priority_list_choco => $high_priority_list_choco,
242-
enable_patching => $enable_patching,
243-
patch_fact => $patch_fact,
244-
patch_group => $patch_groups,
245-
patch_schedule => if $active_pg in ['always', 'never'] {
246-
{ $active_pg => 'N/A' }
247-
} else {
248-
$patch_schedule.filter |$item| { $item[0] in $patch_groups }
234+
content => to_json_pretty(
235+
{
236+
patching_as_code_config => {
237+
allowlist => $allowlist,
238+
blocklist => $blocklist,
239+
high_priority_list => $high_priority_list,
240+
allowlist_choco => $allowlist_choco,
241+
blocklist_choco => $blocklist_choco,
242+
high_priority_list_choco => $high_priority_list_choco,
243+
enable_patching => $enable_patching,
244+
patch_fact => $patch_fact,
245+
patch_group => $patch_groups,
246+
patch_schedule => if $active_pg in ['always', 'never'] {
247+
{ $active_pg => 'N/A' }
248+
} else {
249+
$patch_schedule.filter |$item| { $item[0] in $patch_groups }
250+
},
251+
high_priority_patch_group => $high_priority_patch_group,
252+
post_patch_commands => $post_patch_commands,
253+
pre_patch_commands => $pre_patch_commands,
254+
pre_reboot_commands => $pre_reboot_commands,
255+
patch_on_metered_links => $patch_on_metered_links,
256+
security_only => $security_only,
257+
patch_choco => $patch_choco,
258+
unsafe_process_list => $unsafe_process_list,
249259
},
250-
high_priority_patch_group => $high_priority_patch_group,
251-
post_patch_commands => $post_patch_commands,
252-
pre_patch_commands => $pre_patch_commands,
253-
pre_reboot_commands => $pre_reboot_commands,
254-
patch_on_metered_links => $patch_on_metered_links,
255-
security_only => $security_only,
256-
patch_choco => $patch_choco,
257-
unsafe_process_list => $unsafe_process_list,
258260
},
259-
}, false),
261+
false,
262+
),
260263
show_diff => false,
261264
}
262265

@@ -434,7 +437,7 @@
434437
# Run pre-patch commands if provided
435438
if ($updates_to_install.count + $choco_updates_to_install.count > 0) {
436439
$pre_patch_commands.each | $cmd, $cmd_opts | {
437-
exec { "Patching as Code - Before patching - ${cmd}":
440+
exec { "Patching as Code - Before patching - ${cmd}": # lint:ignore:exec_idempotency
438441
* => delete($cmd_opts, ['before', 'schedule', 'tag']),
439442
before => Class["patching_as_code::${0}::patchday"],
440443
schedule => 'Patching as Code - Patch Window',
@@ -444,7 +447,7 @@
444447
}
445448
if ($high_prio_updates_to_install.count + $high_prio_choco_updates_to_install.count > 0) {
446449
$pre_patch_commands.each | $cmd, $cmd_opts | {
447-
exec { "Patching as Code - Before patching (High Priority) - ${cmd}":
450+
exec { "Patching as Code - Before patching (High Priority) - ${cmd}": # lint:ignore:exec_idempotency
448451
* => delete($cmd_opts, ['before', 'schedule', 'tag']),
449452
before => Class["patching_as_code::${0}::patchday"],
450453
schedule => 'Patching as Code - High Priority Patch Window',
@@ -475,10 +478,12 @@
475478
ensure => file,
476479
path => "${facts['puppet_vardir']}/../../patching_as_code/last_run",
477480
show_diff => false,
478-
content => Deferred('patching_as_code::last_run', [
479-
$updates_to_install.unique,
480-
$choco_updates_to_install.unique,
481-
]),
481+
content => Deferred('patching_as_code::last_run',
482+
[
483+
$updates_to_install.unique,
484+
$choco_updates_to_install.unique,
485+
],
486+
),
482487
schedule => 'Patching as Code - Patch Window',
483488
require => File["${facts['puppet_vardir']}/../../patching_as_code"],
484489
before => Anchor['patching_as_code::post'],
@@ -494,10 +499,12 @@
494499
ensure => file,
495500
path => "${facts['puppet_vardir']}/../../patching_as_code/high_prio_last_run",
496501
show_diff => false,
497-
content => Deferred('patching_as_code::high_prio_last_run', [
498-
$high_prio_updates_to_install.unique,
499-
$high_prio_choco_updates_to_install.unique,
500-
]),
502+
content => Deferred('patching_as_code::high_prio_last_run',
503+
[
504+
$high_prio_updates_to_install.unique,
505+
$high_prio_choco_updates_to_install.unique,
506+
],
507+
),
501508
schedule => 'Patching as Code - High Priority Patch Window',
502509
require => File["${facts['puppet_vardir']}/../../patching_as_code"],
503510
before => Anchor['patching_as_code::post'],
@@ -528,7 +535,7 @@
528535
# Perform post-patching Execs
529536
if ($updates_to_install.count + $choco_updates_to_install.count > 0) and $reboot {
530537
$post_patch_commands.each | $cmd, $cmd_opts | {
531-
exec { "Patching as Code - After patching - ${cmd}":
538+
exec { "Patching as Code - After patching - ${cmd}": # lint:ignore:exec_idempotency
532539
* => delete($cmd_opts, ['require', 'before', 'schedule', 'tag']),
533540
require => Anchor['patching_as_code::post'],
534541
schedule => 'Patching as Code - Patch Window',
@@ -538,7 +545,7 @@
538545
}
539546
if ($high_prio_updates_to_install.count + $high_prio_choco_updates_to_install.count > 0) and $high_prio_reboot {
540547
$post_patch_commands.each | $cmd, $cmd_opts | {
541-
exec { "Patching as Code - After patching (High Priority) - ${cmd}":
548+
exec { "Patching as Code - After patching (High Priority) - ${cmd}": # lint:ignore:exec_idempotency
542549
* => delete($cmd_opts, ['require', 'before', 'schedule', 'tag']),
543550
require => Anchor['patching_as_code::post'],
544551
schedule => 'Patching as Code - High Priority Patch Window',
@@ -610,7 +617,7 @@
610617
# Do not reboot after patching, just run post_patch commands if given
611618
if ($updates_to_install.count + $choco_updates_to_install.count > 0) {
612619
$post_patch_commands.each | $cmd, $cmd_opts | {
613-
exec { "Patching as Code - After patching - ${cmd}":
620+
exec { "Patching as Code - After patching - ${cmd}": # lint:ignore:exec_idempotency
614621
* => delete($cmd_opts, ['require', 'schedule', 'tag']),
615622
require => Anchor['patching_as_code::post'],
616623
schedule => 'Patching as Code - Patch Window',
@@ -620,7 +627,7 @@
620627
}
621628
if ($high_prio_updates_to_install.count + $high_prio_choco_updates_to_install.count > 0) {
622629
$post_patch_commands.each | $cmd, $cmd_opts | {
623-
exec { "Patching as Code - After patching (High Priority)- ${cmd}":
630+
exec { "Patching as Code - After patching (High Priority)- ${cmd}": # lint:ignore:exec_idempotency
624631
* => delete($cmd_opts, ['require', 'schedule', 'tag']),
625632
require => Anchor['patching_as_code::post'],
626633
schedule => 'Patching as Code - High Priority Patch Window',

‎manifests/kb.pp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# define patching_as_code::kb
2-
#
2+
#
33
# @summary
44
# This define gets called by init.pp to install Windows KB patches.
55
# @param [String] ensure
@@ -20,7 +20,7 @@
2020
case $kb {
2121
'KB890830', 'KB2267602', 'KB2461484', 'KB4052623': {
2222
#Don't skip recurring monthly updates (Malicious Software Removal Tool, Windows Defender/SCEP updates)
23-
exec { "Install ${kb}":
23+
exec { "Install ${kb}": # lint:ignore:exec_idempotency
2424
command => template('patching_as_code/install_kb.ps1.erb'),
2525
provider => 'powershell',
2626
timeout => 14400,

‎manifests/linux/patchday.pp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Class: patching_as_code::linux::patchday
2-
#
2+
#
33
# @summary
44
# This class gets called by init.pp to perform the actual patching on Linux.
55
# @param [Array] updates
@@ -40,7 +40,7 @@
4040
}
4141

4242
if $updates.count > 0 {
43-
exec { 'Patching as Code - Clean Cache':
43+
exec { 'Patching as Code - Clean Cache': # lint:ignore:exec_idempotency
4444
command => $cmd,
4545
path => $cmd_path,
4646
schedule => 'Patching as Code - Patch Window',
@@ -56,7 +56,7 @@
5656
}
5757

5858
if $high_prio_updates.count > 0 {
59-
exec { 'Patching as Code - Clean Cache (High Priority)':
59+
exec { 'Patching as Code - Clean Cache (High Priority)': # lint:ignore:exec_idempotency
6060
command => $cmd,
6161
path => $cmd_path,
6262
schedule => 'Patching as Code - High Priority Patch Window',

0 commit comments

Comments
 (0)