For a control repo, is it better to have two distinct repos for production and development or just different braches, which would make rebasing easier?

This message was deleted.

if you do one repo, you very very carefully need to design the PR/merge systems to prevent splitbrain of the branches

honestly, we actually do something very different, we only have a main branch, and we have separate puppetmasters per tier

This message was deleted.

message has been deleted

restructured some stuff and got r10k set up, quite nice it is.

Do people usually setup r10k to run on a gitlab-runner trigger or on a scheduled basis via CRON ?

use a post-receive hook

Can that be applied at the group level, E. G. whenever something lands in the "main" branch of one of the child repos it triggers r10k

Can that be applied at the group level, E. G. whenever something lands in the "main" branch of one of the child repos it triggers r10k

This message was deleted.

we always use rspec-puppet for unit tests and beaker with serverspec for acceptancetests/integrationtests

@CVQuesty, I meant branches of the same code in the same repo

What you are talking about - reusing PowerCLI scripts - is not possible with Ansible?

generally, rspec-beaker / serverspec tests are more definitive that rspec-puppet. If beaker tests pass, you probably have a working manifest. The same can not be said for rspec-puppet... is is very easy to have working unit tests but the code won't work on a live system. However, it usually isn't practical to test everything with beaker if you want the CI run to finish the same business day.

generally, rspec-beaker / serverspec tests are more definitive that rspec-puppet. If beaker tests pass, you probably have a working manifest. The same can not be said for rspec-puppet... is is very easy to have working unit tests but the code won't work on a live system. However, it usually isn't practical to test everything with beaker if you want the CI run to finish the same business day.

This message was deleted.

Above is Linux example. I’m not too savvy with windows

Would what I did within this module/class normally be done with a combination of the environment level common.yaml to set defaults and hiera for exceptions?

# @summary A short summary of the purpose of this class
#
# Configures the sshd service for my homelab
# Requires the ssh module from puppet forge
# <https://forge.puppet.com/modules/saz/ssh>
#
# @example
#   include sshd_config::configure_sshd
class config_sshd (
  String $ssh_protocol,
  String $ssh_Port,
  String $ssh_PasswordAuthentication,
  String $ssh_PermitRootLogin,
  String $ssh_ChallengeResponseAuthentication,
  String $ssh_ChrootDirectory,
  String $ssh_UsePAM,
  String $ssh_AllowTcpForwarding,
  String $ssh_X11Forwarding,
  String $ssh_LoginGraceTime,
  String $ssh_MaxAuthTries,
  String $ssh_MaxSessions,
  String $ssh_MaxStartups,
  String $ssh_KexAlgorithms,
  String $ssh_ciphers,
  String $ssh_PrintMotd,
  # String $ssh_Include,
  ) {

  if $::osfamily =~ /^(Debian|RedHat)$/ {
   
    # load the ssh module 
    class { 'ssh':
      storeconfigs_enabled => false,
      server_options => {
        'protocol'                        => $config_sshd::ssh_protocol,
        'Port'                            => $config_sshd::ssh_Port,
        'PasswordAuthentication'          => $config_sshd::ssh_PasswordAuthentication,
        'PermitRootLogin'                 => $config_sshd::ssh_PermitRootLogin,
        'ChallengeResponseAuthentication' => $config_sshd::ssh_ChallengeResponseAuthentication,
        # 'ChrootDirectory'                 => $config_sshd::ssh_ChrootDirectory,
        'UsePAM'                          => $config_sshd::ssh_UsePAM,
        'AllowTcpForwarding'              => $config_sshd::ssh_AllowTcpForwarding,
        'X11Forwarding'                   => $config_sshd::ssh_X11Forwarding,
        'LoginGraceTime'                  => $config_sshd::ssh_LoginGraceTime,
        'MaxAuthTries'                    => $config_sshd::ssh_MaxAuthTries,
        'MaxSessions'                     => $config_sshd::ssh_MaxSessions,
        'MaxStartups'                     => $config_sshd::ssh_MaxStartups,
        'KexAlgorithms'                   => $config_sshd::ssh_KexAlgorithms,
        'ciphers'                         => $config_sshd::ssh_ciphers,
        'PrintMotd'                       => $config_sshd::ssh_PrintMotd,
        # 'Include'                         => $config_sshd::ssh_Include,
      },
    }
  }
}

Would what I did within this module/class normally be done with a combination of the environment level common.yaml to set defaults and hiera for exceptions?

# @summary A short summary of the purpose of this class
#
# Configures the sshd service for my homelab
# Requires the ssh module from puppet forge
# <https://forge.puppet.com/modules/saz/ssh>
#
# @example
#   include sshd_config::configure_sshd
class config_sshd (
  String $ssh_protocol,
  String $ssh_Port,
  String $ssh_PasswordAuthentication,
  String $ssh_PermitRootLogin,
  String $ssh_ChallengeResponseAuthentication,
  String $ssh_ChrootDirectory,
  String $ssh_UsePAM,
  String $ssh_AllowTcpForwarding,
  String $ssh_X11Forwarding,
  String $ssh_LoginGraceTime,
  String $ssh_MaxAuthTries,
  String $ssh_MaxSessions,
  String $ssh_MaxStartups,
  String $ssh_KexAlgorithms,
  String $ssh_ciphers,
  String $ssh_PrintMotd,
  # String $ssh_Include,
  ) {

  if $::osfamily =~ /^(Debian|RedHat)$/ {
   
    # load the ssh module 
    class { 'ssh':
      storeconfigs_enabled => false,
      server_options => {
        'protocol'                        => $config_sshd::ssh_protocol,
        'Port'                            => $config_sshd::ssh_Port,
        'PasswordAuthentication'          => $config_sshd::ssh_PasswordAuthentication,
        'PermitRootLogin'                 => $config_sshd::ssh_PermitRootLogin,
        'ChallengeResponseAuthentication' => $config_sshd::ssh_ChallengeResponseAuthentication,
        # 'ChrootDirectory'                 => $config_sshd::ssh_ChrootDirectory,
        'UsePAM'                          => $config_sshd::ssh_UsePAM,
        'AllowTcpForwarding'              => $config_sshd::ssh_AllowTcpForwarding,
        'X11Forwarding'                   => $config_sshd::ssh_X11Forwarding,
        'LoginGraceTime'                  => $config_sshd::ssh_LoginGraceTime,
        'MaxAuthTries'                    => $config_sshd::ssh_MaxAuthTries,
        'MaxSessions'                     => $config_sshd::ssh_MaxSessions,
        'MaxStartups'                     => $config_sshd::ssh_MaxStartups,
        'KexAlgorithms'                   => $config_sshd::ssh_KexAlgorithms,
        'ciphers'                         => $config_sshd::ssh_ciphers,
        'PrintMotd'                       => $config_sshd::ssh_PrintMotd,
        # 'Include'                         => $config_sshd::ssh_Include,
      },
    }
  }
}

yeah we just do

include ssh

(via a list of classes in hiera) and set

ssh::server_options

in

common.yaml

This message was deleted.

could you show me an example of what a hiera config file for a node looks like, I've not done a module/class include in that way before.

could you show me an example of what a hiera config file for a node looks like, I've not done a module/class include in that way before.

This message was deleted.

This message was deleted.

This message was deleted.

This message was deleted.

Ah, ok. Thanks Jeremy.