|
14 | 14 | # use_pe_patch => false |
15 | 15 | # } |
16 | 16 | # |
17 | | -# @param [String] patch_group |
18 | | -# Name of the patch_group for this node. Must match one of the patch groups in $patch_schedule |
| 17 | +# @param Variant[String,Array[String]] patch_group |
| 18 | +# Name(s) of the patch_group(s) for this node. Must match one or more of the patch groups in $patch_schedule |
| 19 | +# To assign multiple patch groups, provide this parameter as an array |
19 | 20 | # @param [Hash] patch_schedule |
20 | 21 | # Hash of available patch_schedules. Default schedules are in /data/common.yaml of this module |
21 | 22 | # @option patch_schedule [String] :day_of_week |
22 | 23 | # Day of the week to patch, valid options: 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday' |
23 | | -# @option patch_schedule [Integer] :count_of_week |
24 | | -# Which week in the month to patch, use a number between 1 and 4 |
| 24 | +# @option patch_schedule [Variant[Integer,Array[Integer]]] :count_of_week |
| 25 | +# Which week(s) in the month to patch, use number(s) between 1 and 5 |
25 | 26 | # @option patch_schedule [String] :hours |
26 | 27 | # Which hours on patch day to patch, define a range as 'HH:MM - HH:MM' |
27 | 28 | # @option patch_schedule [String] :max_runs |
|
74 | 75 | # When disabled (default), patches are not installed over a metered link. |
75 | 76 | # |
76 | 77 | class patching_as_code( |
77 | | - String $patch_group, |
78 | | - Hash $patch_schedule, |
79 | | - Array $blocklist, |
80 | | - Array $allowlist, |
81 | | - Array $unsafe_process_list, |
82 | | - Hash $pre_patch_commands, |
83 | | - Hash $post_patch_commands, |
84 | | - Hash $pre_reboot_commands, |
85 | | - Optional[String] $plan_patch_fact = undef, |
86 | | - Optional[Boolean] $enable_patching = true, |
87 | | - Optional[Boolean] $security_only = false, |
88 | | - Optional[Boolean] $use_pe_patch = true, |
89 | | - Optional[Boolean] $classify_pe_patch = false, |
90 | | - Optional[Boolean] $patch_on_metered_links = false, |
| 78 | + Variant[String,Array[String]] $patch_group, |
| 79 | + Hash $patch_schedule, |
| 80 | + Array $blocklist, |
| 81 | + Array $allowlist, |
| 82 | + Array $unsafe_process_list, |
| 83 | + Hash $pre_patch_commands, |
| 84 | + Hash $post_patch_commands, |
| 85 | + Hash $pre_reboot_commands, |
| 86 | + Optional[String] $plan_patch_fact = undef, |
| 87 | + Optional[Boolean] $enable_patching = true, |
| 88 | + Optional[Boolean] $security_only = false, |
| 89 | + Optional[Boolean] $use_pe_patch = true, |
| 90 | + Optional[Boolean] $classify_pe_patch = false, |
| 91 | + Optional[Boolean] $patch_on_metered_links = false, |
91 | 92 | ) { |
92 | | - # Verify the $patch_group value points to a valid patch schedule |
93 | | - unless $patch_schedule[$patch_group] or $patch_group in ['always', 'never'] { |
94 | | - fail("Patch group ${patch_group} is not valid as no associated schedule was found! |
95 | | - Ensure the patching_as_code::patch_schedule parameter contains a schedule for this patch group.") |
| 93 | + # Ensure we work with a $patch_groups array for further processing |
| 94 | + $patch_groups = Array($patch_group, true) |
| 95 | + |
| 96 | + # Verify if all of $patch_groups point to a valid patch schedule |
| 97 | + $patch_groups.each |$pg| { |
| 98 | + unless $patch_schedule[$pg] or $pg in ['always', 'never'] { |
| 99 | + fail("Patch group ${pg} is not valid as no associated schedule was found! |
| 100 | + Ensure the patching_as_code::patch_schedule parameter contains a schedule for this patch group.") |
| 101 | + } |
96 | 102 | } |
97 | 103 |
|
98 | 104 | # Verify the puppet_confdir from the puppetlabs/puppet_agent module is present |
|
123 | 129 | if $classify_pe_patch { |
124 | 130 | # Only classify pe_patch if $classify_pe_patch == true |
125 | 131 | class { 'pe_patch': |
126 | | - patch_group => $patch_group, |
| 132 | + patch_group => join($patch_groups, ' '), |
127 | 133 | } |
128 | 134 | } |
129 | 135 | } else { |
130 | 136 | $patch_fact = 'os_patching' |
131 | 137 | class { 'os_patching': |
132 | | - patch_window => $patch_group, |
| 138 | + patch_window => join($patch_groups, ' '), |
133 | 139 | } |
134 | 140 | } |
135 | 141 | } |
136 | 142 | 'pe_patch': { |
137 | 143 | # Received the patch_fact from a plan run, use it directly |
138 | 144 | $patch_fact = 'pe_patch' |
139 | 145 | class { 'pe_patch': |
140 | | - patch_group => $patch_group, |
| 146 | + patch_group => join($patch_groups, ' '), |
141 | 147 | } |
142 | 148 | } |
143 | 149 | 'os_patching': { |
144 | 150 | # Received the patch_fact from a plan run, use it directly |
145 | 151 | $patch_fact = 'os_patching' |
146 | 152 | class { 'os_patching': |
147 | | - patch_window => $patch_group, |
| 153 | + patch_window => join($patch_groups, ' '), |
148 | 154 | } |
149 | 155 | } |
150 | 156 | default: { fail('Unsupported value for plan_patch_fact parameter!') } |
|
155 | 161 | ensure_packages('yum-utils') |
156 | 162 | } |
157 | 163 |
|
158 | | - # Determine if today is Patch Day for this node's $patch_group |
159 | | - case $patch_group { |
160 | | - 'always': { |
161 | | - $bool_patch_day = true |
162 | | - schedule { 'Patching as Code - Patch Window': |
163 | | - range => '00:00 - 23:59', |
164 | | - repeat => 1440 |
165 | | - } |
166 | | - $_reboot = 'ifneeded' |
| 164 | + # Determine if today is Patch Day for this node's $patch_groups |
| 165 | + if 'never' in $patch_groups { |
| 166 | + $bool_patch_day = false |
| 167 | + schedule { 'Patching as Code - Patch Window': |
| 168 | + period => 'never', |
167 | 169 | } |
168 | | - 'never': { |
169 | | - $bool_patch_day = false |
170 | | - schedule { 'Patching as Code - Patch Window': |
171 | | - period => 'never', |
| 170 | + $_reboot = 'never' |
| 171 | + $active_pg = 'never' |
| 172 | + } elsif 'always' in $patch_groups { |
| 173 | + $bool_patch_day = true |
| 174 | + schedule { 'Patching as Code - Patch Window': |
| 175 | + range => '00:00 - 23:59', |
| 176 | + repeat => 1440 |
| 177 | + } |
| 178 | + $_reboot = 'ifneeded' |
| 179 | + $active_pg = 'always' |
| 180 | + } else { |
| 181 | + $pg_info = $patch_groups.map |$pg| { |
| 182 | + { |
| 183 | + 'name' => $pg, |
| 184 | + 'is_patch_day' => patching_as_code::is_patchday( |
| 185 | + $patch_schedule[$pg]['day_of_week'], |
| 186 | + $patch_schedule[$pg]['count_of_week'] |
| 187 | + ) |
172 | 188 | } |
173 | | - $_reboot = 'never' |
174 | 189 | } |
175 | | - default: { |
176 | | - $bool_patch_day = patching_as_code::is_patchday( |
177 | | - $patch_schedule[$patch_group]['day_of_week'], |
178 | | - $patch_schedule[$patch_group]['count_of_week'] |
179 | | - ) |
| 190 | + $active_pg = $pg_info.reduce(undef) |$memo, $value| { |
| 191 | + if $value['is_patch_day'] == true { $value['name'] } else { $memo } |
| 192 | + } |
| 193 | + $bool_patch_day = type($active_pg,'generalized') ? { |
| 194 | + Type[String] => true, |
| 195 | + default => false |
| 196 | + } |
| 197 | + if $bool_patch_day { |
180 | 198 | schedule { 'Patching as Code - Patch Window': |
181 | | - range => $patch_schedule[$patch_group]['hours'], |
182 | | - weekday => $patch_schedule[$patch_group]['day_of_week'], |
183 | | - repeat => $patch_schedule[$patch_group]['max_runs'] |
| 199 | + range => $patch_schedule[$active_pg]['hours'], |
| 200 | + weekday => $patch_schedule[$active_pg]['day_of_week'], |
| 201 | + repeat => $patch_schedule[$active_pg]['max_runs'] |
184 | 202 | } |
185 | | - $_reboot = $patch_schedule[$patch_group]['reboot'] |
| 203 | + $_reboot = $patch_schedule[$active_pg]['reboot'] |
186 | 204 | } |
187 | 205 | } |
188 | 206 |
|
|
196 | 214 | blocklist => $blocklist, |
197 | 215 | enable_patching => $enable_patching, |
198 | 216 | patch_fact => $patch_fact, |
199 | | - patch_group => $patch_group, |
200 | | - patch_schedule => if $patch_schedule[$patch_group] == undef { 'none' } |
201 | | - else { $patch_schedule[$patch_group] }, |
| 217 | + patch_group => $patch_groups, |
| 218 | + patch_schedule => if $active_pg in ['always', 'never'] { |
| 219 | + { $active_pg => 'N/A' } |
| 220 | + } else { |
| 221 | + $patch_schedule.filter |$item| { $item[0] in $patch_groups } |
| 222 | + }, |
202 | 223 | post_patch_commands => $post_patch_commands, |
203 | 224 | pre_patch_commands => $pre_patch_commands, |
204 | 225 | pre_reboot_commands => $pre_reboot_commands, |
|
0 commit comments