Re: General questions and problems with exec...

Juri Rischel Jensen
Tue, 10 Oct 2006 14:20:44 -0000

On Oct 9, 2006, at 22:45, Luke Kanies wrote:

> Juri Rischel Jensen wrote:

<snip>
> During installs, just start puppetd with --ignoreschedules.  This will
> cause it to, well, ignore schedules.  In other words, all objects will
> run, whether they match their schedule or not.

This got me thinking: What about general security updates, eg. for
all the libraries, dependency programs etc? Can puppet handle them as
well...? Or do I have to make an exec statement of some sort to
handle that...?

One more question that comes to mind: Does puppet run "apt-get
update" before every run with "package" statements...?

>> 2. Do puppet have any feature that resembles cfengines SplayTime
>> function?
>
> It does not, although it could be added relatively easily.  I decided
> against implementing it because it has such a negative impact on
> usability -- e.g., every time you need to run cfagent, you have to
> disable splaytime, and it affects even smaller sites that won''t
have
> performance problems.
>
> Instead, Puppet relies on the fact that puppetd is a long-running
> daemon, and each of your daemons will tend to start at slightly
> different times, and they will thus tend to spread their load over the
> run interval.

Ok. This seems reasonable to me, and should be Good Enough For Me
(tm)... ;-)

<snip>

> I recommend creating a definition for this, since it''s a repeating
> pattern:
>
>      define swconfig {
>          configfile { "/etc/shorewall/$name":
>              mode        => 0640,
>              source      => [
>                  "config/apps/shorewall/$name.$host",
>                  "config/apps/shorewall/$name"
>              ]
>          }
>      }
>
> Note I got rid of the require; you''ll need that before you install
the
> rules, but not to copy the files down.
>
> Then you can just use that:
>
>      # Call the swconfig with no attributes
>      swconfig { [infaces, zones, policy]: }
>
> Instead of all the different calls to ''configfile'' you
have.

Wauv, that really cut down on the size of that file! Just what I
want: To be able to type less to do more... ;-) Thanks!

<snip>
>> And the Makefile:
>>
>> <snip>
>> RULEFILES       := $(shell ls /etc/shorewall/rulefiles/*.rules)
>>
>> all: rules
>>
>> rules: $(RULEFILES)
>>          @echo "Updating rules file..."
>>          @cat $(CONFDIR)/rulefiles/*.rules > rules
>>
>> <snap>
>
> Where is CONFDIR set?

Actually the line should read "@cat /etc/shorewall/rulefiles/*.rules
 > rules" as I suspected that exact variable to be causing the
problem; but it weren''t. It still doesn''t work.

>> Apparently the exec part runs as it should, but it results in an
>> empty rules file. And I can''t see why. If I run make manually
in /
>> etc/
>> shorewall, the rules file is created correctly. I hope someone can
>> shed some light on where I''ve done wrong.
>
> Is it possible that CONFDIR is set in your shell environment, but make
> doesn''t know what that directory is when it is run out of Puppet?

No, unfortunately not.