From c53f550476bd3fe3a3652e0f150808a3a9fe42c6 Mon Sep 17 00:00:00 2001 From: Oleksandr Kuzminskyi Date: Wed, 22 Apr 2026 10:11:06 -0700 Subject: [PATCH] Manage ssm-user sudoers in production and sandbox The sudoers drop-in for ssm-user was only declared in development's sudo::configs. Because saz/sudo defaults to purge => true, puppet was wiping SSM agent's own /etc/sudoers.d/ssm-agent-users on every run in prod and sandbox, leaving ssm-user with no sudo grant. Add the same sudo::configs entry to prod and sandbox so puppet owns the grant end-to-end across all environments. Co-Authored-By: Claude Opus 4.7 (1M context) --- debian/changelog | 6 ++++++ environments/production/data/common.yaml | 3 +++ environments/sandbox/data/common.yaml | 3 +++ 3 files changed, 12 insertions(+) diff --git a/debian/changelog b/debian/changelog index 12fd44c..c002cc7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +puppet-code (0.1.0-1build304) noble; urgency=medium + + * commit event. see changes history in git log + + -- root Wed, 22 Apr 2026 17:11:08 +0000 + puppet-code (0.1.0-1build303) noble; urgency=medium * commit event. see changes history in git log diff --git a/environments/production/data/common.yaml b/environments/production/data/common.yaml index d921925..90548a7 100644 --- a/environments/production/data/common.yaml +++ b/environments/production/data/common.yaml @@ -2,3 +2,6 @@ sudo::configs: 'admin': 'content' : '%admin ALL=(ALL) NOPASSWD: ALL' 'priority' : 10 + 'ssm-user': + 'content' : 'ssm-user ALL=(ALL) NOPASSWD: ALL' + 'priority' : 10 diff --git a/environments/sandbox/data/common.yaml b/environments/sandbox/data/common.yaml index d921925..90548a7 100644 --- a/environments/sandbox/data/common.yaml +++ b/environments/sandbox/data/common.yaml @@ -2,3 +2,6 @@ sudo::configs: 'admin': 'content' : '%admin ALL=(ALL) NOPASSWD: ALL' 'priority' : 10 + 'ssm-user': + 'content' : 'ssm-user ALL=(ALL) NOPASSWD: ALL' + 'priority' : 10