consul*/install.sls refactoring #38
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| {{ consul_template.hashicorp_gpg_key }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,6 @@ | ||
| {% from slspath + '/map.jinja' import consul_template with context %} | ||
|
|
||
| {% set version = consul_template.version %} | ||
|
|
||
| consul-template-config-dir: | ||
| file.directory: | ||
|
|
@@ -10,37 +12,57 @@ consul-template-template-dir: | |
| - makedirs: True | ||
|
|
||
| # Install template renderer | ||
| /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS: | ||
| file.managed: | ||
| - source: https://releases.hashicorp.com/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS | ||
| - makedirs: true | ||
| - skip_verify: true | ||
|
|
||
| /opt/consul-template/{{ version }}/bin: | ||
| archive.extracted: | ||
| - source: https://releases.hashicorp.com/consul-template/{{ version }}/consul-template_{{ version }}_linux_amd64.zip | ||
| - source_hash: /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS | ||
| - enforce_toplevel: false | ||
| - require: | ||
| - /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS | ||
|
|
||
| /usr/local/bin/consul-template: | ||
| file.symlink: | ||
| - target: /opt/consul-template/{{ version }}/bin/consul-template | ||
| - force: true | ||
| - require: | ||
| - /opt/consul-template/{{ version }}/bin | ||
|
|
||
| {% if consul_template.secure_download -%} | ||
| /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS.sig: | ||
| file.managed: | ||
| - source: https://releases.hashicorp.com/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS.sig | ||
| - skip_verify: true | ||
| - require: | ||
| - /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS | ||
|
|
||
|
|
||
| /tmp/hashicorp.asc: | ||
| file.managed: | ||
| - source: salt://{{ slspath }}/files/hashicorp.asc.jinja | ||
| - template: jinja | ||
| - context: | ||
| consul_template: | ||
| {{ consul_template | yaml }} | ||
|
|
||
| import key: | ||
| cmd.run: | ||
| - name: gpg --import /tmp/hashicorp.asc | ||
| - unless: gpg --list-keys {{ consul_template.hashicorp_key_id }} | ||
| - require: | ||
| - /tmp/hashicorp.asc | ||
|
|
||
| verify shasums sig: | ||
| cmd.run: | ||
| - name: gpg --verify /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS.sig /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS | ||
|
Contributor
There was a problem hiding this comment. @nledez could you try to use the verify function in the salt GPG module instead of calling a command here directly? |
||
| - require: | ||
| - /opt/consul-template/{{ version }}/consul-template_{{ version }}_SHA256SUMS.sig | ||
| - import key | ||
| - prereq: | ||
| - /usr/local/bin/consul-template | ||
| {%- endif %} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| {{ consul.hashicorp_gpg_key }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,7 @@ | ||
| {%- from slspath + '/map.jinja' import consul with context -%} | ||
|
|
||
| {% set version = consul.version %} | ||
|
|
||
| consul-dep-unzip: | ||
| pkg.installed: | ||
| - name: unzip | ||
|
|
@@ -42,37 +44,57 @@ consul-data-dir: | |
| - mode: 0750 | ||
|
|
||
| # Install agent | ||
| /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS: | ||
| file.managed: | ||
| - source: https://releases.hashicorp.com/consul/{{ version }}/consul_{{ version }}_SHA256SUMS | ||
| - makedirs: true | ||
| - skip_verify: true | ||
|
|
||
| /opt/consul/{{ version }}/bin: | ||
| archive.extracted: | ||
| - source: https://releases.hashicorp.com/consul/{{ version }}/consul_{{ version }}_linux_amd64.zip | ||
| - source_hash: /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS | ||
|
Contributor
There was a problem hiding this comment. @nledez I don't think we need to keep the checksums file around in the filesystem after we use them. You could point it to the upstream directly. However I assume you are explicitly downloading them to enforce the GPG check, right? |
||
| - enforce_toplevel: false | ||
| - require: | ||
| - /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS | ||
|
|
||
| /usr/local/bin/consul: | ||
| file.symlink: | ||
| - target: /opt/consul/{{ version }}/bin/consul | ||
| - force: true | ||
| - require: | ||
| - /opt/consul/{{ version }}/bin | ||
|
|
||
| {% if consul.secure_download -%} | ||
| /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS.sig: | ||
| file.managed: | ||
| - source: https://releases.hashicorp.com/consul/{{ version }}/consul_{{ version }}_SHA256SUMS.sig | ||
| - skip_verify: true | ||
| - require: | ||
| - /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS | ||
|
|
||
|
|
||
| /tmp/hashicorp.asc: | ||
| file.managed: | ||
| - source: salt://{{ slspath }}/files/hashicorp.asc.jinja | ||
| - template: jinja | ||
| - context: | ||
| consul: | ||
| {{ consul | yaml }} | ||
|
|
||
| import key: | ||
|
Contributor
There was a problem hiding this comment. @nledez same comment here regarding importing the GPG using using a salt state instead of running a command directly |
||
| cmd.run: | ||
| - name: gpg --import /tmp/hashicorp.asc | ||
| - unless: gpg --list-keys {{ consul.hashicorp_key_id }} | ||
| - require: | ||
| - /tmp/hashicorp.asc | ||
|
|
||
| verify shasums sig: | ||
| cmd.run: | ||
| - name: gpg --verify /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS.sig /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS | ||
|
Contributor
There was a problem hiding this comment. @nledez same comment here regarding using the Salt module instead of a command. |
||
| - require: | ||
| - /opt/consul/{{ version }}/consul_{{ version }}_SHA256SUMS.sig | ||
| - import key | ||
| - prereq: | ||
| - /usr/local/bin/consul | ||
| {%- endif %} | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@nledez could you try to use the gpg state here instead of calling the command line directly?