Puppet Class: profile::zuul::executor

Defined in:
modules/profile/manifests/zuul/executor.pp

Overview

SPDX-License-Identifier: Apache-2.0 new zuul (T393873) - executors

Parameters:

  • finger_port (Stdlib::Port) (defaults to: lookup('profile::zuul::executor::finger_port'))
  • main_nodes (Array[Stdlib::Fqdn]) (defaults to: lookup('zuul_main_nodes'))
  • image (String) (defaults to: lookup('profile::zuul::executor::image'))
  • service_ensure (Wmflib::Ensure) (defaults to: lookup('profile::zuul::executor::service_ensure'))
  • tls_config_dir (Stdlib::Unixpath) (defaults to: lookup('profile::zuul::executor::tls_config_dir'))
  • http_proxy (Optional[Stdlib::HTTPUrl]) (defaults to: lookup('profile::zuul::executor::http_proxy'))
  • no_proxy (Array[Stdlib::Host]) (defaults to: lookup('profile::zuul::executor::no_proxy'))
  • skip_domains (Array[Stdlib::Host]) (defaults to: lookup('profile::zuul::executor::skip_domains')) 


3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'modules/profile/manifests/zuul/executor.pp', line 3

class profile::zuul::executor(
    Stdlib::Port $finger_port = lookup('profile::zuul::executor::finger_port'),
    Array[Stdlib::Fqdn] $main_nodes = lookup('zuul_main_nodes'),
    String $image = lookup('profile::zuul::executor::image'),
    Wmflib::Ensure $service_ensure = lookup('profile::zuul::executor::service_ensure'),
    Stdlib::Unixpath $tls_config_dir = lookup('profile::zuul::executor::tls_config_dir'),
    Optional[Stdlib::HTTPUrl] $http_proxy = lookup('profile::zuul::executor::http_proxy'),
    Array[Stdlib::Host] $no_proxy = lookup('profile::zuul::executor::no_proxy'),
    Array[Stdlib::Host] $skip_domains = lookup('profile::zuul::executor::skip_domains'),
){

    wmflib::dir::mkdir_p('/etc/zuul/ssh')

    file { '/etc/zuul/ssh/id_rsa':
        ensure  => present,
        owner   => 'root',
        group   => 'root',
        mode    => '0400',
        content => secret('zuul/id_rsa'),
    }

    $host_ip = $facts['networking']['ip']

    firewall::service { 'zuul-finger-from-main-nodes':
        proto  => 'tcp',
        port   => $finger_port,
        srange => $main_nodes,
    }

    $no_proxy_domains = $no_proxy - $skip_domains

    systemd::service { 'zuul-executor':
        ensure    => $service_ensure,
        content   => systemd_template('zuul-executor'),
        require   => File['/etc/zuul/zuul.conf'],
        subscribe => File['/etc/zuul/zuul.conf'],
    }

    # build full chain of trust with Root CA, Intermediate CA and cert
    $zookeeper_tls_fullchain = "${tls_config_dir}/zuul_full_chain.pem"

    concat { $zookeeper_tls_fullchain:
        owner => 'zuul',
        group => 'zuul',
        mode  => '0444',
    }

    # add Zuul client cert
    concat::fragment { 'zuul_client_cert':
        target => $zookeeper_tls_fullchain,
        source => "${tls_config_dir}/zuul__zuul.pem",
        order  => '00',
    }

    # add Intermediate CA
    concat::fragment { 'zuul_intermediate':
        target => $zookeeper_tls_fullchain,
        source => "${tls_config_dir}/zuul__zuul.chain.pem",
        order  => '01',
    }

    # add Root CA
    concat::fragment { 'wmf_root':
        target => $zookeeper_tls_fullchain,
        source => '/etc/ssl/certs/Wikimedia_Internal_Root_CA.pem',
        order  => '02',
    }
}