Module
# == Class: sdiff
#
# This class adds a wrapper for the diff command puppet uses.
# It introduces the ability to suppress diff output, useful for encrypted data.
#
# This module requires changes to the puppet.conf file that is on the agents,
# suggest under the [main] section.
#
# diff=/usr/local/bin/cdiff
# diff_args=-u
#
# === Parameters
#
# [*ensure*]
# String. Controls if the managed resources shall be <tt>present</tt> or
# <tt>absent</tt>. If set to <tt>absent</tt>:
# * System modifications (if any) will be reverted as good as possible
# (e.g. removal of created users, services, changed log settings, ...).
# * This is thus destructive and should be used with care.
# Defaults to <tt>present</tt>.
#
# [*color*]
# Boolean. Optionally color line in diff output (red for deletions, green for
# insertions).
# Defaults to <tt>true</tt>.
#
# [*file_pattern*]
# String. The pattern that is used to determine which files not to show
# diffs for. This value can be configured in hiera using the cdiff::file_pattern
# key.
# Defaults to <tt>false</tt>.
#
# [*line_pattern*]
# String. The pattern that is used to determine lines in a diff to not
# show diffs for. This value can be configured in hiera using the
# cdiff::line_pattern key.
#
# Example:
# cdiff::line_pattern: 'MERCHANT_ID=.*\|PRIVATE_KEY=.*\$'
#
# Defaults to <tt>false</tt>.
class sdiff(
$ensure = present,
$color = hiera('sdiff::color',true),
$file_pattern = hiera('sdiff::file_pattern',false),
$line_pattern = hiera('sdiff::line_pattern',false),
) {
$file_ensure = $ensure ? {
present => file,
default => present,
}
file { '/usr/local/bin/sdiff':
ensure => $file_ensure,
owner => 'root',
group => 'root',
mode => '0755',
content => template('sdiff/sdiff.erb'),
}
}
Script template
#!/bin/bash
<%- if @color -%>
red="$(tput setaf 1)$(tput bold)"
green="$(tput setaf 2)$(tput bold)"
yellow="$(tput setaf 3)$(tput bold)"
reset="$(tput sgr0)"
<%- else -%>
red=""
green=""
yellow=""
reset=""
<%- end -%>
<%- if @file_pattern -%>
if [[ $* =~ <%= @file_pattern %> ]]; then
echo "${yellow}Suppressing potentially sensitive diff of ${2} vs ${3}.${reset}"
exit
fi
<%- end -%>
/usr/bin/diff $@ | \
<%- if @line_pattern -%>
sed 's/<%= @line_pattern %>/'$yellow'Suppressing potentially sensitive diff.'$reset'/' | \
<%- end -%>
<%- if @color -%>
sed 's/^\([^+-]\)/'$reset'\1/' | \
sed 's/^\(+.*\)$/'$green'\1'$reset'/' | \
sed 's/^\(-.*\)$/'$red'\1'$reset'/'
<%- end -%>
cat
How to use in a node
include sdiff
If you wanted to override the modules pattern, or disable color, add this into Hiera:
---
sdiff::file_pattern: '\.[eyaml|etxt|ejson]'
sdiff::line_pattern: 'MERCHANT_ID=.*\|PRIVATE_KEY=.*\$'
sdiff::color: false