On 2/17/20 8:31 PM, Trevor Vaughan wrote:
The modules are downloaded separately.
Fundamentally, it would be something like the following:
# Command
$ puppet module install voxpupuli-selinux
# Hiera Data
---
selinux::enable: true
# Puppet Code
include selinux
Alternatively, something like:
# Command
$ puppet module install voxpupuli-selinux
# Puppet Code
class { 'selinux': enable => true }
What I'm trying to figure out is whether or not this type of thing is
OK as a remediation.
The first form is preferred due to complexities.
Well..... not sure how many community members have enough Puppet
experience to have an opinion or suggestions. Thanks so much for opening
the question on the mailing list though! Hopefully someone does :) Most
we could do is likely ask guiding questions.
- What effect would this have for disconnected environments? If someone
is using Puppet, is it assumed that "puppet module install" goes to some
on-prem location?
- Could/should we put module dependencies into a Puppetfile that gets
included when puppet remediations are built?
- If multiple rules attempt to install the same module, will each
"puppet module install" attempt to redownload the same module? Or will
it say something like "already installed" and continue?