natemccurdy

# A WebServer role that may have a containment problem.
class role::webserver {

  include profile::base
  include profile::nginx

  # We want EVERYTHING in base to come before the nginx profile
  # but that is only possible if the base profile "contains" all of its
  # included classes.
  Class['profile::base']

natemccurdy

#!/bin/bash
#
# This script acts a replacement for the "puppet query" command.
# This uses curl and certificates to mimic the built-in query command that uses RBAC tokens.
#
# Use this script when 'puppet query' won't work because PuppetDB has been hotfixed
# and its RBAC integration is broken.
#
# Run this script from a PuppetDB node or a Compile Master that has PuppetDB on it.
#

natemccurdy

#!/opt/puppetlabs/puppet/bin/ruby
#
# This script will find any Puppet agent whose certname does NOT match the agent's FQDN.
#
require 'json'

fqdn_values = JSON.parse(`/opt/puppetlabs/puppet/bin/puppet query 'facts[certname,value] { name = "fqdn" }'`)

fqdn_values.each do |result|
  puts result['certname'] if result['certname'] != result['value']

natemccurdy

class win_power_settings (
  $power_setting = 'high_performance',
){

  case $power_setting {
    'power_saver': {
      $power_setto = 'a1841308-3541-4fab-bc81-f71556f20b4a'
    }
    'high_performance': {
      $power_setto = '8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c'

natemccurdy

define recurse_file_permissions (
  String[1]           $target_dir  = $title,
  Optional[String[1]] $file_mode   = undef,
  Optional[String[1]] $dir_mode    = undef,
  Optional[String[1]] $owner       = undef,
  Optional[String[1]] $group       = undef,
) {

  if $facts['os']['family'] == 'windows' {
    fail("${module_name} does not support Windows")

natemccurdy

Puppet Enterprise API's

Reference doc: https://puppet.com/docs/pe/2017.3/overview/api_index.html

Authentication Methods

API	Endpoint	RBAC Token	Certificate	How to whitelist a cert?
Activity	/activity-api/v1/	✅	✅	puppet_enterprise::profile::console::whitelisted_certnames
Node Classifier	/classifier-api/v1/	✅	✅	puppet_enterprise::profile::console::whitelisted_certnames

natemccurdy

Facter.add(:profiles) do
  setcode do
    require 'puppet'

    # Use the [agent] context because some agents have
    # classfile overridden in puppet.conf
    Puppet.settings.preferred_run_mode = :agent
    classfile = Puppet['classfile']

    profiles = []

natemccurdy

#!/opt/puppetlabs/puppet/bin/ruby
# This script returns an array of compile masters in JSON based on the output of `puppet infra status`.
# Useful for feeding into a task or a plan.

require 'facter'
require 'json'
require 'open3'

def puppet_infra_status
  stdout, _stderr, _status = Open3.capture3('/opt/puppetlabs/puppet/bin/puppet infra status --format json')

natemccurdy

# OPTION A
#   - Hard failure if pp_role isn't defined.
#   - No check to see if the role exists
node default {

  # Save the trusted pp_role to a shorter variable so it's easier to work with.
  $role = $trusted['extensions']['pp_role']

  case $role {
    default: {

natemccurdy

#!/usr/bin/env ruby

require 'yaml'
require 'optparse'

options = {
  file: File.expand_path('masters.yaml'),
  type: nil,
  environment: nil
}