-
Notifications
You must be signed in to change notification settings - Fork 4
/
TODO
1358 lines (938 loc) · 41.4 KB
/
TODO
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
- With
- Feature: add a --list option
Examples:
ssm -bf -list
ssm -of -list
ssm -list
Note: this is different from --summary. Summary checks against the system. --list simply lists elements.
- BUG:
- prescripts (postscripts?) for a file with a lower priority show as
present for a file with a higher priority if that file doesn't also have
such a script.
- Fix -> when a higher priority is found, need to nullify all prior values
before reading in new ones
- Default repo dir to /var/lib/ssm ?
- Notes to self:
Adding: Entry for "bundle.10" to a [bundlefile] stanza in config file "v-eight".
Adding: Entry for "/tmp/a10" to a [file] stanza in config file "bundle.10" as type regular.
Adding: Entry for "rsync" to a [packages] stanza in config file "bundle.10" as type [deb|rpm|flatpak|snap|pip|gem].
- ssm --rename-config-file CurrentName NewName
- ssm --list [config-files|settings|files|packages|everything]
- Choose security model for
- --add-file
- client access to certain files in repo
- New feature: action-tag (or maybe call "common-postscript"?)
#- action-tag
#- group-postscript
#- group-script
- groupscript
Alternate Concept (depends_ok):
- Simply have dependency on not just existence, but in an OK state
Concept:
- Ability to assign an "action-tag" to each file in a group of
associated files. If one or more of those files is modified
during an SSM run (installed, chowned, etc.), then that file's
action-tag is activated.
- Ability to assign an "action-tag" to packages too.
- At the end of an SSM run, if an action-tag was activated,
then the action specified by that action-tag's stanza is
executed.
[file]
name = /etc/iptables.d/chunks/monkey
type = regular
mode = 640
owner = root
group = root
action-tag = iptables-restart
[file]
name = /etc/iptables.d/chunks/soup
type = regular
mode = 640
owner = root
group = root
action-tag = iptables-restart
[action-tag]
name = iptables-restart
action = /etc/init.d/iptables restart
- Contemplate supporting multiple package types
- [packages] /* uses default package manager specified in [global] settings
- [packages pkg_mgr=pip]
- [packages pkg_mgr=flatpak]
- [packages pkg_mgr=yum]
- [packages pkg_mgr=apt]
- Add 'attributes' option
Examples:
- attributes = immutable
immutable -> put an immutable file in shared config file, then if an
addition is made on a client of the same file, then that file gets
added to that client's main config file, rather than overwriting the
immutable version.
- attributes = update-hosts=hostname.domain.name
- Add --not-ok option
- Implies --summary
- Only shows elements that are "Not OK"
- Support 'ssm -ap @xfce'
- Where @xfce is a package group on a yum system
- When there's a file conflict, show all known bundle files where the config
element exists.
- Add a file type of "merge"
#[file]
#type = merge
#
#keyfield = none
#keyfield = 1
# - Number of the field to treat as the key
# - DEFAULTs to '1'.
# - With 'none' treat entire line as a unique entry to merge into target file
#
#delimiter = DELIMITER
# Where DELIMITER may be one or more characters that indicate the
# separation of fields. DELIMITER may also be a regular expression
# pattern.
#
# DEFAULTs to the first character on the first line of the file that is
# not a single quote, double quote, or an alphanumeric character. The
# chosen character will be declared on STDOUT when a file is added. Here
# is the regex used to identify that character:
#
# /^[a-zA-Z0-9"](.)/+
# ^
# | This is the character that will be selected.
#
# Examples:
# delimiter = :
# # such as for /etc/passwd, /etc/shadow, /etc/group
# delimiter = ' '
# # for a file with spaces as the delimiter
# delimiter = '\s+'
# # alternate version for files with spaces as the delimiter
# delimiter = ' "<'
# # as a more complex, multi-character example
#
[file]
type = merge
keyfield = 2 # /opt/ohpc/pub in this example
delimiter = ' ' # [[:space:]] or \s+ character
owner = root
group = root
mode = 644
values = <EOF
nfs:/opt/ohpc/pub /opt/ohpc/pub nfs nfsvers=4.1,nodev,noatime 0 0
EOF
[file]
type = merge
keyfield = 1
delimiter = :
owner = root
group = root
mode = 644
values = <EOF
dcmtk:x:123:132::/var/lib/dcmtk/db:/bin/sh
dictd:x:124:133:Dictd Server,,,:/var/lib/dictd:/bin/false
libvirt-qemu:x:125:131:Libvirt Qemu,,,:/var/lib/libvirt:/bin/false
libvirt-dnsmasq:x:126:135:Libvirt Dnsmasq,,,:/var/lib/libvirt/dnsmasq:/bin/false
postfix:x:127:136::/var/spool/postfix:/bin/false
statd:x:128:65534::/var/lib/nfs:/bin/false
sshd:x:129:65534::/var/run/sshd:/usr/sbin/nologin
EOF
When "a" is chosen to add the local file to the repository, all entries in
that file are merged into the merge file, with local file entries "winning"
when there are conflicts. A "merge" file is always additive, never
reductive. If an entry exists in the repo version, but not in the local
file, it is not removed from the repo version.
- --remove-file (no -rf abbreviation for now)
- opposite of --add-file -- comments out entry for file in config
- improvement
- ssm -rp (--remove-package) PKG1 PKG2
results in:
[packages]
PKG1 unwanted
PKG2 unwanted
A user may need to remove a package from the config that no longer exists
in the repos, so don't validate package existence in the repos prior to
marking for removal.
- improvement
- support hostnames to config files like systemimager does.
e.g.: if hostname is p3m1.lenovoguru.net, and url ends in slash (/),
then try for config files in this order:
- p3m1.lenovoguru.net (FQDN)
- p3m1 (Short hostname)
- p3m (short hostname with trailing digits removed -> this becomes the implied node class)
-
- improvement
- Add ability to ignore certain lines that may change inconsequentially.
- Apply to regular and generated file types
- Example:
ignore-line = [REGEX]
So, for the file "/etc/NetworkManager/system-connections/AI_Lab", the
following entry could be added to the file definition:
ignore-line = ^timestamp=
- improvement
- INFO: Package repo update -> skipping (updated in the last 12 hours)
- test to see if any changes have happened to the yum config files and update if yes
- improvement
- Add a "don't ask" option.
- always take a prescribed action without prompting
- Tag:
- always = any of the typical options, such as "[y|n|a]"
Perhaps it could also include [i|#|d], but not sure that would be very useful.
- bug
Variables:
- Need to support depends, so that binaries used are in place
before trying to calculate variable
- improvement
Add option "--remove-package | -rp"
Simply comments out all entries of PKG, rather than lowering it's priority.
- bug
if: -otf $file
and $file doesn't exist in definition
but $file is being called out as unwanted
we should handle gracefully
maybe:
- test
- if $file lives in a directory+contents_unwanted directory, and if so, add as unwanted in in-memory config
- else add $file to in-memory config as ignore
- improvement:
Current behavior:
[email protected]:/tmp# ssm -s
ERROR: Multiple (conflicting) definitions for:
[file]
name = /etc/yum.repos.d/CentOS-fasttrack.repo
priority = 0
...
This instance of this file was found in bundle.common
[etc...]
Target behavior:
[email protected]:/tmp# ssm -s
ERROR: Multiple (conflicting) definitions for:
[file]
name = /etc/yum.repos.d/CentOS-fasttrack.repo
priority = 0
...
Instances of this file were found in:
bundle.common
bundle.uncommon
my_fav_node.conf
[etc...]
- feature:
ssm-admin -bf bundle.mapr-common --add --target-file (CONFIG_FILE|OTHER_BUNDLE_FILE)
Add --bundlefile to --targetfile
- feature:
ssm-admin -bf bundle.common --list-elements
Print out list of elements in bundlefile.
- Automatically use UID/GID if username not available.
[email protected]:/var/lib/ssm/repos# ssm -af /var/www/html/REPOs/SAPHanaVora/config/mapr/vora_default_settings.sh
Configuration File: file:///var/lib/ssm/repos/ipa1.lenovoguru.net
Adding: Entry for "/var/www/html/REPOs/SAPHanaVora/config/mapr/vora_default_settings.sh" in configuration file "ipa1.lenovoguru.net" as type regular.
-------------------------------
Added 1 files.
Encountered 0 errors.
[email protected]:/var/lib/ssm/repos# tail ipa1.lenovoguru.net
[file]
name = /var/www/html/REPOs/SAPHanaVora/config/mapr/vora_default_settings.sh
comment = From ipa1.lenovoguru.net on 2017-05-23 19:34:02
type = regular
mode = 0755
md5sum = c789a2734ba0a8aff8aec1fd7ca04f16 # 2017-05-23 19:34:02
NOTE: no user / group info in the entry
[email protected]:/var/lib/ssm/repos# ls -l /var/www/html/REPOs/SAPHanaVora/config/mapr/vora_default_settings.sh
-rwxr-xr-x. 1 56141 1005 5632 Mar 30 15:54 /var/www/html/REPOs/SAPHanaVora/config/mapr/vora_default_settings.sh
NOTE: UID/GID above
- Allow for global_option to use UID/GID instead of username/groupname
- Existing entries that specify username/groupnanme will still function
properly, but new entries added via SSM (ssm -af) will be added with
uid/gid.
Contempation: should updated entries be tweaked to use uid/gid?
- For faster work, add this variable (or something like it):
- $invalidate_installed_pkg_cache
Boolean. If set, re-load installed package cache in each package
section. If not set, no need to reload. :-)
- Add "--move-to-bundle BUNDLENAME"
Say you have added /etc/hosts, assuming it's in bundle.common, but
it ends up in xcat1.domain.com. You could then do:
ssm --move-to-bundle bundle.common --file /etc/hosts [FILE ...]
Alternates:
ssm --move-to-bundle bundle.common --package zsh [PKG ...]
ssm --move-to-bundle bundle.common --bundle bundle.bond-10g [BUNDLE ...]
- Add "--priority NN" option to --add-file and --add-pkg directives
- Add "--add-bundlefile BUNDLEFILE" and "--remove-bundlefile BUNDLEFILE" options.
- Add "--modify" option to work in conjunction with --priority and --depends options.
Examples:
ssm --modify --priority NN --file /etc/hosts
ssm --modify --depends "PKG1 /filename1 [[PKG ...][FILE ...]]" --file /etc/hosts
ssm --modify --add-bundlefile bundle.evolution
ssm --modify --remove-bundlefile bundle.evolution
- Add "--show-details" option to show details for any configuration element:
Examples:
$ ssm --show-details --file /etc/hosts
#
# In bundle: bundle.common
#
[file]
name = /etc/hosts
comment = From ipa1.lenovoguru.net on 2017-02-20 13:26:36
type = regular
owner = root
group = root
mode = 0644
md5sum = 87f107b00bb8557ce09daae38f16cb45 # 2017-02-20 13:26:36
$ ssm --show-details --package kvm
#
# In bundle: bundle.hypervisor
#
[packages]
kvm priority=7
- Handle this gracefully:
ssm -ap packagename
# adds package (duh)
ssm -rp packagename
# -rp == --remove-package (new argument)
# - comments out existing entry w/timestamp
# - adds new entry with packagename set to unwanted
ssm -ap packagename
# - should comment out the remove-package entry with a timestamp, and
# add a new entry called "add package"
- on summary output, include bundle for each element off to the right
- on diff screens, show timestamp of local and repo versions
- Bug:
W: --force-yes is deprecated, use one of the options starting with --allow instead.
W: --force-yes is deprecated, use one of the options starting with --allow instead.
- Bug: if a package is 'unwanted' and doesn't exist as an "available" package,
then ignore it and don't error out saying can't find it.
- Add a "diff arguments" global setting
default to -uN
- Allow 'd' for diff when prompted to remove unwanted file
- Add "--export | -e" feature.
Example use:
--export EXPORT_DIR
Creates a copy of the configuration in EXPORT_DIR that matches the
current configuration state.
DEFAULTS: As the primary goal of this option is for sharing of config
data, it is designed to be "safe" by default, by ONLY including the
current state of the configuration. Historical elements, such as
earlier versions of files, time stamps, etc. are stripped out, leaving
a pristine sharable config. For elements with multiple instances and
prioritization, only the element with winning priority is included.
- Add "--forget FILE" option
Doesn't remove FILE, but stops tracking it and "forgets" about it.
- Allow --comment with --add-package
- Add "--config-diff" CONFIG_FILE_1 CONFIG_FILE_2
--
- --export qualifying options to add later, maybe...
--bundle-file BUNDLEFILE
--interactive
Iterate through all config elements to allow a Y/N (export or not)
choice.
--timestamp TIMESTAMP
Export configuration as of TIMESTAMP. Useful for audit purposes.
--export-config-file EXPORT_CONFIG_FILE
Merges all export data into a single config file.
Where EXPORT_CONFIG_FILE is a non-pathed file name that will be created
inside EXPORT_DIR.
--file-regex REGEX
Only include files that match REGEX in export.
--history
Display all history for specified configuration elements. This
includes prior file versions and each declaration of a config element,
not just the one with the winning priority. (json output available)
--json
Display output in JSON format. Only applies to certain options
indicated with "(json output available)".
--export will create a distributable copy of your SSM repository
that _only_ includes the bits and pieces actually used by the
config_file you specify.
Export the identified configuration to the target repo directory:
- may be cumulative by exporting from multiple config files into
the target directory.
- exports the main config file and all bundle files it
references, maintaining their relative location in the repo
(if they're in directories).
- exports each file defined by the config, but _only_ the
currently referenced version.
- has the net effect of producing a trimmed repo that is ready
for distribution to others or point-in-time archival.
--
- Consider an unwanted file as existing in the definition:
[email protected]:/install/ssm# psh wn0103 ssm --summary | grep -i 'not ok' | xcoll
====================================
wn0103
====================================
Not OK: Regular file /etc/group
Not OK: Regular file /etc/passwd
Not OK: Regular file /etc/shadow
Not OK: Unwanted: /etc/yum.repos.d/.bu_backups
[email protected]:/install/ssm# psh wn0103 ssm --summary -otf /etc/yum.repos.d/.bu_backups
wn0103:
wn0103: ERROR: The following files were specified with --only-this-file, but do
wn0103: not exist in the definition:
wn0103:
wn0103: /etc/yum.repos.d/.bu_backups
wn0103:
wn0103: *** ssh exited with error code 1.
- Add bzip2 to dep list
- Add a '--rollback DATESTAMP' feature that ties into the "audit" capability.
- Add an audit=on global option that automatically creates and checks things into a local git repo.
- Add a '--list THINGY' option, where THINGY can be:
- packages
- files
- bundles
- Consider this syntax and arguments for apt-get operations:
apt-get --only-upgrade install xcat*
- Use /var/log/ssm/ directory for log files
- If Improper [file] definition due to unknown owner or group, then set as dependency not met, but handle gracefully. No error message during conf file ingest.
--
- Allow non-root use
- only require root when it's actually needed:
- for accessing/changing a file
- for accessing/changing a repo
- Add ability to do partial match of file names, such as:
ssm --summary -of "/path/to/files/*"
- Add ability to comment out '#' packages, when SSM says "need to install ...".
--
Hello Brian,
Thanks for working on managing files with restricted access in SSM.
Here is a possible improvement that I mentioned before you took off.
Topic: Adding test or matching for a variable (like hostname) for applying packages to a host or a class of hosts. Two use cases are
(a) Globus host certs for fast transfer nodes (FTN). Both FTN nodes share the same SSM config file, but each FTN has its own X509 host certs. I can scp host cert files for each FTN from postscript. It might be easier to do so (with change tracking) from SSM.
(b) The content for /etc/sysconfig/network-scripts/ifcfg-eth0 for some hosts is "generated" within SSM. With a hostname matching rule, this config file can be managed as a regular file.
- Mark
--
Bug:
- remove unnecessary cruft from file types
ssm -af testy # regular
ssm -af testy # now it's a softlink, but the definition still includes mode
--
When doing an --ap, also allow a --comment "adding in support of project x"
--
Bug:
- need to be able to specify
--bundle NEW-BUNDLE and --add-packages pgk1 pkg2
at the same time in a single run, and have NEW-BUNDLE created and the
packages added to it.
--
Pkg Interactions
1) On "ssm -ap pkg1", verify that the package name exists in the upstream repository before adding it to the list. With apt-get/dpkg, verify that it's an installable package, and not just virtual:
┌─[bfinley@xbob] ~/
└─[$] apt-cache show dictd-dictionary
N: Can't select versions from package 'dictd-dictionary' as it is purely virtual
N: No packages found
2) Add "ssm -rm pkg1" to remove packages
--
Idea: capture_pkg_changes = [yes|no]
- capture pkg changes that happen through use of the native tools (by way
of detecting changes to the tools native database) and offer to add them
to the SSM state
- commands that happen later (chronologically) have a higher priority
e.g.:
Native pkg commands:
$ yum install thingy
$ yum install other-thingy
$ yum remove thingy
Result:
$ rpm -qa | grep thingy
other-thingy
--
Idea! To implement "action-tags":
Phase I -- Reading the Config:
A new argument that can be included in a file or packages stanza:
[file]
name = /tmp/testy
...
actiontag = $actionTag
#
# where $actionTag can be any text string
#
[packages]
hpc-goodies-cpu actiontag=$actionTag
A new stanza type is added to specify the action that should be
taken if $actionTag needs to be run.
[actiontag]
actiontag = $actionTag
postscript = $postScript
[actiontag]
actiontag = $actionTag_Too
postscript = $postScript
As the config file(s) are read in, files or packages that specify an
actiontag are added as dependencies of that actiontag.
Phase II -- Examining the System:
As the system is examined, for any file or package that is "Not OK",
it's actiontag (if any) is also marked as "Not OK".
XXX: Perhaps we have a file on the system
(/var/state/ssm/$actionTag) that indicates that action needs to be
taken? Survives cancels, reboots? If --only-packages is run, but
includes actiontags for files, then we can't verify and execute the
action tag until run with both packages and files, and this allows
us to capture the need for the action in a persistent way. :-)
NOTE: Only one file or package that is "Not OK" is required to
trigger an actiontag.
Phase III - Executing actions:
??? Should we have an "stage = [post-files|post-packages]" for action
tags? Or just run after packages (if packages are run at all)?
Actiontags are processed after all files and packages.
XXX: If only packages or files are processed... do we ignore action
tags?
--
Add a "apt-get -f install" bit at the appropriate point.
--
- Consider:
- Allow non-root invocation
- If action requires root privs, use sudo for that one action
- If action->install file && owner != EUID, then "sudo"
- If action->pkg-mgr && EUID != 0, then "sudo"
- Track timestamps for entries with both:
a) last modified time of the file
b) time file was added to SSM
--
- On debian based systems, consider adding 'apt-get install -f' after all other
package processing, if any package processing has happened.
- Test to see if any repo conf files are newer than when the repo was last updated, and if so, then update again.
--
- for packages entries, allow dependency on a file
hal "depends=/etc/apt/sources.list.d/mjblenner-ubuntu-ppa-hal-vivid.list"
And in this case, /etc/apt/sources.list.d/mjblenner-ubuntu-ppa-hal-vivid.list might have a prescript of "add-apt-repository -y ppa:mjblenner/ppa-hal"
--
- for --add-packages, make "unwanted" and "remove" synonyms
- output
add a dot for each line of text that comes across during 'pkgmgr update' operations, etc.
- add feature
[global]
pkg-mgr = autodetect
# make default
--
- Send highest level statements to syslog
- Not OK
- OK
- Fixing
- Packages OK
- Packages upgrading/installing/removing
- --ap and --af Adding file / Adding package
(basically any modifying action should be logged)
- repo mod
- updating a file on a managed node
- updating a package on a managed node
-- add an --audit feature
- historical & forensic audit of repo
- historical & forensic audit of changes per node
$ ssm --audit --dates 2014-09-21:2014-10-31 --diff --only-this-file /etc/hosts
name = /etc/hosts
comment = From xbob on 2015-01-27 09:39:17
type = regular
md5sum = 156ad013dd74381017ad83ccf5933ac0 # 2014-09-21 23:09:46
# md5sum = e53b9c5a9ef7056e40a198b2239afa49 # 2014-09-21 23:11:22
# md5sum = 192ae0682fcb36869e53df479aa0ea67 # 2014-09-21 23:12:12
# md5sum = 2a19c6f7b40552ad9609da0c9b2caba3 # 2014-09-21 23:14:54
# md5sum = 1111879832a1dd104c89df5844c822f6 # 2014-10-31 13:35:49
- How to handle sensitive files in repo. Can extend later if necessary...
- General assumptions:
- File metadata is not sensitive
- File contents may be sensitive
- Initial Implementation
- Each file can have a repo-location override setting
- Most files can be accessed via http
#
# Default is the name of the repo that gets used by default.
#
# [repo]
# name = default
# url = http://hostname/install/ssm_repo
[repo]
name = secure
url = ssh://hostname/ssm_repo.secure
[file]
name = /etc/default/grub
type = regular
md5sum = 038c1c68801ef42ad81fa4d00f67fbc1 # 2014-06-04 13:11:55
owner = root
group = root
mode = 0644
repo = secure
- A future implementation may use SSL certs
-- Improve diff function
-- Add to --add-file a "--type" flag for types that can't be autodetected,
such as hard links, unwanted, etc.
-- Add "read-only" feature for bundles
- If a bundle is included as "read-only", it will not be modified with
updates handled by the client. Rather, the updates will be put into the
base config file as "higher priority" than the priority of the element in
the bundle file
-- add a
WARNING: Configuration file in /etc/ssm/default is $CONF_FILE,
but $EXPLICIT_CONF is being used instead...
- Make bundles read-only be default, so that when doing an --add-file from one
node class, you don't overwrite settings for a more general node class.
Make the add-file function (and similar functions) auto-raise the
priority of the file element to +1 over the priority of the
pre-existing element in a sub-bundle.
[bundles]
bundle.rhel7-nodes read-write
Alternately, perhaps just add an option that modifies the --add-file
behavior to say "--put-updates-into-existing-bundles'
Example:
Given the following layout, if running on a storage node and you do
"a" to add a local file to update the config, and that file happens
to be in bundle.common-files, then you've updated that file for all
nodes, when it's probably most appropriate that it actually be added
to storage-node.conf directly with a higher priority.
In "storage-node.conf":
[bundles]
bundle.rhel7-nodes
In "bundle.rhel7-nodes":
[bundles]
bundle.common-files
- Auto decrement the priority of bundles by 1. Is this a good idea?
(Prolly not on reflection... -BEF-)
Example:
In "storage-node.conf":
[bundles]
bundle.rhel7-nodes
In "bundle.rhel7-nodes":
[bundles]
bundle.common-files
With a default priority for everything (0), this would result in:
- All elements in bundle.rhel7-nodes would be assigned a priority
of -1.
- All elements in bundle.common-files would be assigned a priority
of -2.
- When /tmp/nest is also defined, but not specified on the command line...
Issue:
# sudo ssm -otf /tmp/nest/monkey --sync -d
>> regular_file_interactive(/tmp/nest/monkey)
>>> Dependencies for /tmp/nest/monkey: /tmp/nest
>>>> Checking on status of /tmp/nest
>>>>> /tmp/nest exists, but isn't considered 'fixed'
Not OK: File /tmp/nest/monkey -> Unmet Dependencies:
/tmp/nest
ERROR_LEVEL: 1
SimpleStateManager::take_file_action()
SimpleStateManager::take_file_action() ( /tmp/nest/monkey, null, n# )
>>> Dependencies for /tmp/nest/monkey: /tmp/nest /tmp/nest
>>>> Checking on status of /tmp/nest
>>>>> /tmp/nest exists, but isn't considered 'fixed'
>>>> Checking on status of /tmp/nest
>>>>> /tmp/nest exists, but isn't considered 'fixed'
NOTE: Options limited due to Unmet Dependencies
SimpleStateManager::do_you_want_me_to()
do_you_want_me_to(): #
Resolution:
- pull in dependency (/tmp/nest)
or
- ignore dependency
- consider testing for the following file, and indicating to the user that a
reboot is required to finish applying updates:
- /var/run/reboot-required
(on Ubuntu 14.10)
- add an optional "notice = SOME TEXT GOES HERE" that can be added for
any file. The notice will be displayed in interactive mode when a
user is presented with a decision on how to handle a "Not OK" file.
- ssm -ar, --add-recipe RECIPEFILE
- RECIPEFILE defines file(s) and/or packages it affects
or
- -ag, --add-generated-file 'FILENAME' --gen, --generator-file FILE_CONTAINING_GENERATOR_SCRIPT
- And, allow 'generator' FILENAMEs to be specified with a wild card:
- /var/lib/bluetooth/*:*:*:*:*:*/config
Each name (as they match on that node's file system) is expanded into
the active config state, and the generator is executed once for each
FILENAME.
Need some way to expand file 'name' as a variable to be used by the
generator.
[file]
name = /var/lib/bluetooth/E8:B1:FC:C1:A0:E2/config
comment = From xbob on 2015-04-05 13:29:22
type = generated
owner = root
group = root
mode = 0644
#md5sum = e794b418aefc3e5604112abef32f7de9 # 2015-04-05 13:29:22
generator = <EOF
#!/bin/bash
#
# Recipe Name: bluetooth to hostname
# Description:
#
# Set bluetooth device instances to use $hostname when the
# advertise themselves.
#
# 2015.04.05 Brian Elliott Finley
# - created
#
cat $SSM_FILENAME | perl -p -e "s/^name .*-(\d+)$/name $hostname-\$1/"
EOF
--
- Handle "E: Unmet dependencies. Try using -f."
- Handle pkgs that have license acceptance needs, such as "oracle-java7-installer".
- perhaps we catch pkg-mgr complaints and re-direct to an SSM website URL with guidance
- for oracle-java7-installer, this worked: https://gist.github.com/mugli/8720670
- perhaps we add a per-package option of prescript="script"
- perhaps we add a per-package option of actiontag=TAGNAME
--
[email protected]:~% sudo ssm -ap build-essential -ap libssh2-1 -ap libssh2-1-dev -ap cmake -ap libgpg-error-dev -bf bundle.redmine_git_hosting
Configuration File: file:///etc/ssm/ssm_repo/redmine_server.conf
Bundle: bundle.redmine.packages
Bundle: bundle.dmsf_plugin_packages
Adding: The following bundles stanza to configuration file "redmine_server.conf".
[bundles]
bundle.redmine_git_hosting
ERROR: The bundlefile you specified, bundle.redmine_git_hosting, exists in the
repository, but is not currently referenced by this config. It
might be used by a different config, in which case it could be
dangerous to the other config if we change it, and it's existing
contents could be dangerous to this config.
Please specify either a totally new bundlefile or one that is
already in use by this config. -The Mgmt
-- add a --chroot DIR option
-- allow non-root operation
- users to manage config files for their own environment
-- add a --capture-state DIRECTORY [-bf newbundlefile]
- Match all files in DIRECTORY to packages
- validate state of files, and find changed files