Puppet eval variable only once

Question

I generate password for new users with apg

Simple:

$password = generate('/etc/puppet/utils/gen_password')

The only problem with this command is that I need it only once, but it's evaluated every time puppet is run.

This variable is used inside of one Exec declaration.

Is there any possibility, to evaluate varable only if it's necessary? For example if it's used first time.

Answer 1

You can use several options to run exec conditionally. Choose which one suits your needs:

• unless - If this parameter is set, then this exec will run unless the command returns 0.
• creates - A file to look for before running the command. The command will only run if the file doesn’t exist.
• onlyif - If this parameter is set, then this exec will only run if the command returns 0.
• refreshonly - The command should only be run as a refresh mechanism for when a dependent object is changed.

Answer 2

If you are not using the password in an Exec, then the methods suggested by Kazimieras Aliulis may not work for you.

If it were me, I would probably just modify the /etc/puppet/utils/gen_password script to always return the same password per-service/host. You would have puppet call the generte like this generate("/etc/puppet/utils/gen_password $::clientcert").

Then in the script you would check to see if a password had been generated for that system, and if it had return it. If not then generate a new one, store it in and return it.

If at all possible don't store and return the unecrypted password. Instead generate and return the salted password hash.

Of course if you could skip using passwords altogether and instead use certificates or keys for authentication that would be even better.