Question

我正在尝试使用此模块与puppet：https://github.com/duritong/puppet-shorewall

按照示例我的规则工作

node xy {
    class{'config::site_shorewall':
      startup => "0"  # create shorewall ruleset but don't startup
  }
    shorewall::rule {
        'incoming-ssh': source => 'all', destination => '$FW',  action  => 'SSH(ACCEPT)', order => 200;
        'incoming-puppetmaster': source => 'all', destination => '$FW',  action  => 'Puppetmaster(ACCEPT)', order => 300;
        'incoming-imap': source => 'all', destination => '$FW',  action  => 'IMAP(ACCEPT)', order => 300;
        'incoming-smtp': source => 'all', destination => '$FW',  action  => 'SMTP(ACCEPT)', order => 300;
    }
}

现在我想将其打包成hiera。通过一些研究，我在这里解释了如何将不同的变量转换为hiera哈希：http://puppetlunch.com/puppet/hiera.html

现在，当原始示例转换为hiera时，它应该如下所示，如果我没有错（hiera中只有2个示例）：

---                                                                                                                    
classes:
  - shorewall

shorewall::rule:
    incoming-ssh:
        source:   'all'
        destination: '$FW'
        action:   'SSH(ACCEPT)'
        order:    '200'
    incoming-puppetmaster:
        source:     'all'
        destination:    '$FW'
        action:     'Puppetmaster(ACCEPT)'
        order:      200

除了配置文件中的页眉和页脚之外没有数据可能会出现什么问题？

cat / etc / shorewall / puppet / rules

#
# Shorewall version 3.4 - Rules File
#
# For information on the settings in this file, type "man shorewall-rules"
#
# See http://shorewall.net/Documentation.htm#Rules for additional information.
#
#############################################################################################################
#ACTION SOURCE          DEST            PROTO   DEST    SOURCE          ORIGINAL        RATE            USER/   MARK
#                                               PORT    PORT(S)         DEST            LIMIT           GROUP
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

Answer 1

对Hiera中的资源建模只是蛋糕的一半。您必须指示Puppet将此数据转换回实际资源。

$data = hiera('shorewall::rule', {})
create_resources('shorewall::rule', $data)

键是create_resources function。

您不应该使用shorewall::rule作为Hiera密钥的名称，这会产生误导。使用与实际语法不相似的名称，例如

shorewall_rules:
    incoming-ssh:
       ...

在清单中

$data = hiera('shorewall_rules', {})

使用duritong / puppet-shorewall与Puppet和Hiera不能正常工作

1 个答案: