Add certname option to pe_agent provisioner #106
Conversation
Previous to this commit, the frictionless agent installer used by the pe_agent provisioniner defaulted to the FQDN of the VM. This can cause inconsistent VM certnames based on what network the user is on. This commit introduces a new role config parameter called 'certname' that accepts three possible values: * hostname - uses the value of host's hostname setting in Vagrant * vm_name - uses the VM's name as set in Vagrant * fqdn - uses the host's fqdn
lib/pe_build/config/pe_agent.rb
Outdated
| @@ -51,6 +57,7 @@ def finalize! | |||
| @autosign = (not @master_vm.nil?) if @autosign == UNSET_VALUE | |||
| @autopurge = (not @master_vm.nil?) if @autopurge == UNSET_VALUE | |||
| @version = 'current' if @version == UNSET_VALUE | |||
| @certname = 'vm_name' if @certname = UNSET_VALUE | |||
There was a problem hiding this comment.
This doesn't include validation. Is that intentional?
There was a problem hiding this comment.
I just saw how validation and defaults are intended to be done. I'll update my PR when I get a chance
|
This does have some overlap with #96, as the certname could be handled using frictionless installer options: I'm kind of leaning towards handling this there, as it would be good to introduce users to the existence of the install options --- that way they know how to handle this situation when it pops up outside of a Vagrant environment. |
|
Ah, which is precisely how this PR ends up implementing it. However, I still think that if we do one install option, we might as well do them all unless there is a benefit to singling out the certname. |
|
@Sharpie, I started out doing just that, but it gets messy. In an ideal world, you'll use PE to modify any other agent configs. This is one, along with CSR atributes, that really must be set during install. |
|
@Sharpie To elaborate, the certname can't (and shouldn't) be a static string setting since you'll want to set its value in the VM's role. Since roles are reused, and certname must be unique, you'll need a dynamic way of determing the certname's value. This behavior is unique to certname, which is why it should be its own setting. |
Previous to this commit, defaults were not being set using the set_default provided set_default method. Also, the certname option for the pe_agent config builder was not being validated. This commit sets all default values for the pe_agent config build parameters using the PEBuild::ConfigDefault#set_default method. This commit also validates the value of the certname parameter matches one of *vm_name*, *hostname*, or *fqdn*.
Previous to this commit, if a bad value for certname somehow made it passed validation, the PEBuild::Provisioner::PEAgent#provsion_posix_agent method would simply accept it, causing the default behavior for the pe_frictionless_installer.sh script to be used. While not catastrophic, this could cause considerable confusion. This commit throws an exception if a bad value makes it passed validation. It also prints output showing what value of certname is being used, if the value can be predetermined.
|
@adrienthebo and @Sharpie, take a look at this PR now. |
|
Ok, I see the use for a static token that gets dynamically transformed into a machine-specific value. However, I still think we'll end up needing a generic Would something like the following work? roles:
- name: pe-agent
provisioners:
- type: pe-agent
install_options:
agent:
certname: :vm_name # Or :hostname |
Previous to this commit, the frictionless agent installer used by the
pe_agent provisioniner defaulted to the FQDN of the VM. This can cause
inconsistent VM certnames based on what network the user is on.
This commit introduces a new role config parameter called 'certname'
that accepts three possible values: