Is it possible to receive a notification on the console when a package containing a file that is controlled by puppet is about to change that file? Meaning, in yum when doing yum update, is it possible to inject a custom warning?
3 Answers
Yum supports plugins, so it's entirely possible to write a plugin that reads the cached puppet manifest and warns when a transaction will overwrite a puppet-controlled file. I'm not aware of an existing plugin that does this, but I will probably write just wrote one myself as I like the idea.
The plugin checks all newly installed/upgraded/downgraded packages, tells you which puppet-managed files it will overwrite and asks for a confirmation to do so.
[root@camel ~]# yum update pam
Loaded plugins: puppet, security
Skipping security plugin, no data
Setting up Update Process
Resolving Dependencies
Skipping security plugin, no data
--> Running transaction check
---> Package pam.i386 0:0.99.6.2-12.el5 set to be updated
---> Package pam.x86_64 0:0.99.6.2-12.el5 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
===============================================================================================================================================================
Package Arch Version Repository Size
===============================================================================================================================================================
Updating:
pam i386 0.99.6.2-12.el5 base 983 k
pam x86_64 0.99.6.2-12.el5 base 982 k
Transaction Summary
===============================================================================================================================================================
Install 0 Package(s)
Upgrade 2 Package(s)
Total download size: 1.9 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): pam-0.99.6.2-12.el5.x86_64.rpm | 982 kB 00:00
(2/2): pam-0.99.6.2-12.el5.i386.rpm | 983 kB 00:00
---------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 8.7 MB/s | 1.9 MB 00:00
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing pam-0.99.6.2-12.el5.i386 overwrites puppet-managed file /etc/pam.d/system-auth
Installing pam-0.99.6.2-12.el5.i386 overwrites puppet-managed file /etc/security/access.conf
Installing pam-0.99.6.2-12.el5.i386 overwrites puppet-managed file /etc/security/limits.conf
Installing pam-0.99.6.2-12.el5.x86_64 overwrites puppet-managed file /etc/pam.d/system-auth
Installing pam-0.99.6.2-12.el5.x86_64 overwrites puppet-managed file /etc/security/access.conf
Installing pam-0.99.6.2-12.el5.x86_64 overwrites puppet-managed file /etc/security/limits.conf
Is this ok [y/N]: n
Aborting
[root@camel ~]# yum update pam
Loaded plugins: puppet, security
Skipping security plugin, no data
Setting up Update Process
Resolving Dependencies
Skipping security plugin, no data
--> Running transaction check
---> Package pam.i386 0:0.99.6.2-12.el5 set to be updated
---> Package pam.x86_64 0:0.99.6.2-12.el5 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
===============================================================================================================================================================
Package Arch Version Repository Size
===============================================================================================================================================================
Updating:
pam i386 0.99.6.2-12.el5 base 983 k
pam x86_64 0.99.6.2-12.el5 base 982 k
Transaction Summary
===============================================================================================================================================================
Install 0 Package(s)
Upgrade 2 Package(s)
Total size: 1.9 M
Is this ok [y/N]: y
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing pam-0.99.6.2-12.el5.i386 overwrites puppet-managed file /etc/pam.d/system-auth
Installing pam-0.99.6.2-12.el5.i386 overwrites puppet-managed file /etc/security/access.conf
Installing pam-0.99.6.2-12.el5.i386 overwrites puppet-managed file /etc/security/limits.conf
Installing pam-0.99.6.2-12.el5.x86_64 overwrites puppet-managed file /etc/pam.d/system-auth
Installing pam-0.99.6.2-12.el5.x86_64 overwrites puppet-managed file /etc/security/access.conf
Installing pam-0.99.6.2-12.el5.x86_64 overwrites puppet-managed file /etc/security/limits.conf
Is this ok [y/N]: y
Updating : pam 1/4
Updating : pam 2/4
Cleanup : pam 3/4
Cleanup : pam 4/4
Updated:
pam.i386 0:0.99.6.2-12.el5 pam.x86_64 0:0.99.6.2-12.el5
Complete!
The plugin itself can be found in my github hacks repository.
Nov. 8 2013 update:
As hinted at in the comments, I've now turned this into a larger project to improve the interaction between Yum and Puppet. You can find it on GitHub.
-
This is lovely. I sure wish it knew to ignore %config(noreplace) stuff, though, since those aren't actually going to be overwritten.– freiheitOct 16, 2013 at 23:54
-
Yeah, I plan to add that, and a whole lot more. This question gave me lots of ideas :) Oct 17, 2013 at 6:07
-
Wow ! You really went beyond the call of duty here. I am impressed. This is exactly what my question was trying to address. I was thinking a shell script but this is much better! Now, I installed your plugin into yum, but it won't load the puppet plugin. Any idea why? I see the .pyc file, but no .pyo file like rhnplugin and security have Oct 17, 2013 at 12:07
-
-
Yes, it's possible but it doesn't relate to the Puppet itself.
Linux systems has support for inotify mechanism which "can be used to monitor and act upon filesystem events". Besides inotify-tools
there is also incron
program which works similar to cron but it reacts to file system events. I think that you may use it for being notified about changing any file.
(BTW, if you want to watching /etc/sysctl.conf
file I suggest to check before do it -- is your Linux has support for /etc/sysctl.d
directory?)
I don't know of a way to implement such notifications. It may be possible to set something up by staging the yum transaction, determining the list of config files that might be affected, and then checking to see if puppet manages any of them.
However, in general it is not good practice to manage a file that will be updated by a package. In the case of configuration files (use rpm -qlc packagename to see if they are marked as such), if the package contains a new version it is saved as filename.rpmnew. You are then left to your own devices to merge any needed changes.
We have run into a problem where a config file was removed by puppet and then replaced by yum when the package was updated. This caused problems until the next puppet run removed the file. Our workaround for that situation was to set the content of the "removed" file to a comment so it is essentially empty. Another way to handle it would be to attempt to ensure that Package['a'] -> File['/etc/a'] so that only one puppet run is needed.
-
I tried to find some best practices on puppet that says "it is not good practice to manage a file that will be updated by a package". I manage sysctl.conf especially because there are settings in that file that I need for certain applications to run. What is the alternative then? Oct 16, 2013 at 11:51
-
1It is absolutely fine to manage configs with puppet that yum also wants to touch. RPM generally wont touch customized config files, and even if it does, puppet will restore your content. Oct 16, 2013 at 19:38
-
Configuration files will only be updated by RPM/yum if they do not exist. It is not (generally) good practice to use puppet to edit other files in the package, because your changes could break the functionality. I guess it would have been better to say "edit" than "manage" in my answer since managing can be ensuring proper permissions. If you want to edit files that are not config files, then you should also implement some sort of version locking or exclusion to ensure that packages are updated on demand, not automatically. That way you can control the entire update process.– jdkindyOct 17, 2013 at 13:39
-
@jdkindy: redhat.com/archives/rhl-list/2003-December/msg04713.html Oct 17, 2013 at 13:41
-
@0A0D: Thanks, that is the behavior I was talking about. I wish I had enough rep to comment on Dennis Kaarsemaker's post - that is the beginning of an elegant solution. Also, the configuration ".d" directories (noted by php-coder) are very easy to implement in puppet if the package supports them.– jdkindyOct 17, 2013 at 13:55