2

How can I restrict the puppet agent commands? I need to only allow the puppet agent to run without noop against the production branch.

  • Block puppet agent --test --environment devbranch
  • Allow puppet agent --test --environment devbranch --noop
  • Allow puppet agent --test --environment production

I think some kind wizardry in auth.conf should be able to take care of this but I'm not familiar enough to do so.

Improve this question
3
  • I am tempted to believe that you could put a noop = true in the [devbranch] section, of the puppet.conf so it at least defaults to noop, but I haven't tried it.
    – Zoredache
    Sep 5, 2013 at 16:45
  • @Zoredache that sounds promising. I'm using dynamic modules paths under the [main] section so it's a bit more complicated Would a noop there and a noop=false in production potentially work?
    – Tim Brigham
    Sep 5, 2013 at 18:08
  • No idea really. I don't have a good place to test at the moment, so you'll have to try it.
    – Zoredache
    Sep 5, 2013 at 18:12

2 Answers 2

Reset to default
1

With thanks to @Zoredache I have managed to get this build the way I need.

I'm using the [main] section to dynamically create and manage branches and [production] to override the noop setting. I'm sure it could also be done in [agent] but I already had it started here. 

[main]
    logdir = /var/log/puppet
    rundir = /var/run/puppet
    confdir = /puppet/$environment
    vardir = /puppet/.$environment-var
    ssldir=/etc/puppet/ssl
    environment = production
    server = puppet.domain.org
    pluginsync = true
    noop = true
    # Disable running all branches by default

[production]
    noop = false

EDIT: Looks like I spoke too soon. The noop is bleeding through. Although the syntax above is right one of the caviats I looked over won't let this work. https://puppet.com/docs/puppet/latest/env_environments.html

.. environments have some limitations, most of which are known bugs or vagaries of implementation rather than design choices.

Puppet will only read the modulepath, manifest, manifestdir, and templatedir settings from environment config blocks; other settings in any of these blocks will be ignored in favor of settings in the [master] or [main] blocks. (Issue 7497)

Improve this answer
0

You can't do it like that, someone that have access to commandline could enforce pretty much any option.

If you want to control who can deploy what env I'd advise to use MCollective for running puppet. You can make pretty detailed ACLs there, and it can coordinate puppet on multiple nodes and do stuff like "deploy on 2 machines, if it doesn't fail, deploy on next 10, if it doesn't fail, deploy on rest".

Improve this answer
1
  • I realize that it's possible to override the noop setting if desired. It's mostly a safety thing to set the default to something sensible.
    – Tim Brigham
    Sep 17, 2013 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .