I'm looking for advice on how to manage CIS rules for EFI booting RHEL-based systems. I'm using jcpuni/efi module to determine if the server was booted in EFI mode. The CIS rule requires that I modify /etc/fstab and ensure that

fmask=0077

is added to the entry for the EFI partition (in my case /boot/efi). On all the servers, the UUID for the /boot/efi is different (as it should be). For example:

UUID=EC55-4757  /boot/efi       vfat    defaults,uid=0,gid=0,umask=077,shortname=winnt  0       2

is an entry on one of my servers. I know I can use the mount resource to manage the mount, but I'm having trouble determining how to acquire the UUID=EC55-4757 and all of the existing mount options (in my example) in order to manage the mount. I could (probably) write a very bad custom fact in order to get that information but I'm terrible at Ruby and I'm sure someone else must have this or a similar problem. I really don't want to use augeas if possible as that seems a bit dirty/hacky. Additional (possibly) helpful information:

/dev/sda1 => {

filesystem => "vfat",

label => "EFIFS",

mount => "/boot/efi",

partlabel => "EFI System Partition",

partuuid => "45f4fd67-8dab-4f7b-9d7c-f46959d28c60",

size => "1.00 GiB",

size_bytes => 1073741824,

uuid => "E0F3-019B"

},

/boot/efi => {

available => "1012.13 MiB",

available_bytes => 1061289984,

capacity => "0.97%",

device => "/dev/sda1",

filesystem => "vfat",

options => [

"rw",

"relatime",

"fmask=0077",

"dmask=0077",

"codepage=437",

"iocharset=ascii",

"shortname=winnt",

"errors=remount-ro"

],

size => "1021.99 MiB",

size_bytes => 1071632384,

used => "9.86 MiB",

used_bytes => 10342400

},

efi => true

Can anyone lend any suggestions?

factor partitions.'/dev/sda1'.uuid

doesn't match?

Match what? I don't want to make any assumptions but /boot/efi might be a safe assumption.

factor partitions.'/dev/sda1'.uuid

doesn't match?

This message was deleted.

This message was deleted.

I could use some help / advice / input on how to approach a change to a puppet module, I cannot see/think of the best way to approach it, I'm working on this Bind/named management module https://github.com/theforeman/puppet-dns/blob/master/manifests/zone.pp - I'm trying to work on the forward parameter in zone.pp that basically is an IP address of a target server to forward requests to, which feeds an EPP template with something like forwarders { @forwarders; } I want to add a new parameter that is optional, such as forwarder_port to act as an optional parameter (useful for things like service mesh resolvers) that changes the epp template to be something like forwarders [ @forwarders port @forwaders_port; ];

I'm not sure how to approach this as an optional parmater that will change the epp if it's set, and ignore it if it's not, any guidance on the best way t approach it would be really good

indeed 🧑‍🏫 Bolt is about to start up in #CFD8Z9A4T

that module looks to be using ERB templates, in one of the templates they already have an example for SOA

message has been deleted

this is the template file that I need to make the change in https://github.com/theforeman/puppet-dns/blob/master/templates/named.zone.erb - line 3 and 41 is where I need to make the changes, I couldn't see how to build the logic to put another 'unless empty.forwaders_port' and then insert it into the forwarders.join so that the join containers the value of the array and then appends port: @forwaders.join after it

businessparrot _🦊Vox Pupuli monthly sync; see calendar event for info_ is about to start up in #CFD8Z9A4T

goodnews 🧑‍🏫Puppet Core Team is about to start up in #CFD8Z9A4T

This message was deleted.

See the

puppet-unbound

module at https://forge.puppet.com/puppet/unbound?src=slack&channel=puppet

Are you sure that’s the correct module you have deployed? Line 335 is a blank line according to Github: https://github.com/voxpupuli/puppet-unbound/blob/v6.0.0/manifests/init.pp#L335

This message was deleted.

This message was deleted.

Nate, thanks for pointing out the init file. The init file was from the old module i believe. I copied from github and was able to apply the catalog.

This message was deleted.

I’d recommend, once the dust clears and the problem’s fixed, to incorporate the

r10k puppetfile check

command into their code development process. That can check for syntax errors and warn if there’s a problem. For example: https://github.com/natemccurdy/dotfiles/blob/main/home/.git_template/hooks/pre-commit#L48-L54

I'm currently using postrun to trigger https://github.com/lsst-it/foreman_envsync

something like

$forwarders.map |$x| {
  if $forwarder_port { "$x  $forwarder_port"}
  else {$x}
}.join("; ")

This message was deleted.

This message was deleted.

This message was deleted.

Hi there! I'm looking for a way to develop with Puppet locally. The PDK alone is not enough since RSpec tests don't verify the developed setup as if it were actually running on a Puppet master and Puppet agent/client. Here are the questions I have come up with: • Assuming that working on a Puppet master or agent host directly is out of scope, is it true that developing Puppet code locally (in the sense of fully being able to verify it's actually running as expected, later) is only possible with a local VM-based or Container-based setup? Are there any possibilities for lightweight, test-driven local development? • If container-based is the most lightweight approach, does anyone here know of a setup involving Podman (and Podman Compose)? I tried to run my own setup based on the official

puppetserver

and the

puppet-agent

images from Docker Hub, but they seem to mess with iptables and hence don't run with Podman (Compose) alone. https://hub.docker.com/search?q=puppet • I found two repositories that sport Puppet with Docker Compose setups, but again they don't run with Podman and I'm not sure whether they're actually targeted to developing locally (and not actually about running Puppet with Docker in production). https://github.com/puppetlabs-toy-chest/puppet-in-docker-examples/tree/master/compose (deprecated / archived), https://github.com/puppetlabs/pupperware (current)