The modules are downloaded separately.
Fundamentally, it would be something like the following:
# Command
$ puppet module install voxpupuli-selinux
# Hiera Data---selinux::enable: true
# Puppet Codeinclude selinux
Alternatively, something like:
# Command$ puppet module install voxpupuli-selinux
# Puppet Codeclass { 'selinux': enable => true }
What I'm trying to figure out is whether or not this type of thing is OK as a remediation.
The first form is preferred due to complexities.
Well..... not sure how many community members have enough Puppet
experience to have an opinion or suggestions. Thanks so much for
opening the question on the mailing list though! Hopefully someone
does :) Most we could do is likely ask guiding questions.
- What effect would this have for disconnected environments? If
someone is using Puppet, is it assumed that "puppet module
install" goes to some on-prem location?
- Could/should we put module dependencies into a Puppetfile that
gets included when puppet remediations are built?
- If multiple rules attempt to install the same module, will each
"puppet module install" attempt to redownload the same module? Or
will it say something like "already installed" and continue?