On 2/17/20 8:31 PM, Trevor Vaughan wrote:
The modules are downloaded separately.

Fundamentally, it would be something like the following:


# Command
$ puppet module install voxpupuli-selinux

# Hiera Data
---
selinux::enable: true

# Puppet Code
include selinux

Alternatively, something like:

# Command
$ puppet module install voxpupuli-selinux

# Puppet Code
class { 'selinux': enable => true }

What I'm trying to figure out is whether or not this type of thing is OK as a remediation.

The first form is preferred due to complexities.


Well..... not sure how many community members have enough Puppet experience to have an opinion or suggestions. Thanks so much for opening the question on the mailing list though! Hopefully someone does :) Most we could do is likely ask guiding questions.

- What effect would this have for disconnected environments? If someone is using Puppet, is it assumed that "puppet module install" goes to some on-prem location?
- Could/should we put module dependencies into a Puppetfile that gets included when puppet remediations are built?
- If multiple rules attempt to install the same module, will each "puppet module install" attempt to redownload the same module? Or will it say something like "already installed" and continue?