Skip to content

Commit f46ac61

Browse files
reidmvreidmv
authored
Merge pull request #235 from puppetlabs/SOLARCH-581
Solarch 581 part 1
2 parents b9d8020 + f6a7ae3 commit f46ac61

File tree

5 files changed

+109
-44
lines changed

5 files changed

+109
-44
lines changed

‎.vscode/settings.json

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"python.linting.pylintEnabled": true,
3+
"python.linting.enabled": true
4+
}

‎functions/recovery_opts_default.pp

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
function peadm::recovery_opts_default () {
2+
{
3+
'orchestrator' => true,
4+
'puppetdb' => true,
5+
'rbac' => true,
6+
'activity' => true,
7+
'ca' => false,
8+
'classifier' => true,
9+
}
10+
}

‎plans/backup.pp

+84-43
Original file line numberDiff line numberDiff line change
@@ -1,77 +1,118 @@
11
# @summary Backup the core user settings for puppet infrastructure
22
#
3-
# This plan can backup data as outlined at insert doc
3+
# This plan can backup data as outlined at insert doc
44
#
55
plan peadm::backup (
6-
Peadm::SingleTargetSpec $primary_host,
6+
# This plan should be run on the primary server
7+
Peadm::SingleTargetSpec $targets,
78

89
# Which data to backup
9-
Boolean $backup_orchestrator = true,
10-
Boolean $backup_rbac = true,
11-
Boolean $backup_activity = true,
12-
Boolean $backup_ca_ssl = true,
13-
Boolean $backup_puppetdb = false,
14-
Boolean $backup_classification = true,
15-
String $output_directory = '/tmp',
10+
Peadm::Recovery_opts $backup = {},
11+
12+
# Where to put the backup folder
13+
String $output_directory = '/tmp',
1614
) {
1715
peadm::assert_supported_bolt_version()
18-
$cluster = run_task('peadm::get_peadm_config', $primary_host).first
16+
17+
$recovery_opts = (peadm::recovery_opts_default() + $backup)
18+
$cluster = run_task('peadm::get_peadm_config', $targets).first.value
1919
$arch = peadm::assert_supported_architecture(
20-
$primary_host,
21-
$cluster['replica_host'],
22-
$cluster['primary_postgresql_host'],
23-
$cluster['replica_postgresql_host'],
24-
$cluster['compiler_hosts'],
20+
getvar('cluster.params.primary_host'),
21+
getvar('cluster.params.replica_host'),
22+
getvar('cluster.params.primary_postgresql_host'),
23+
getvar('cluster.params.replica_postgresql_host'),
24+
getvar('cluster.params.compiler_hosts'),
2525
)
2626

27-
$timestamp = Timestamp.new().strftime('%F_%T')
27+
$timestamp = Timestamp.new().strftime('%Y-%m-%dT%H%M%SZ')
2828
$backup_directory = "${output_directory}/pe-backup-${timestamp}"
2929

30-
# Create backup folder
31-
apply($primary_host){
30+
$primary_target = getvar('cluster.params.primary_host')
31+
$puppetdb_postgresql_target = getvar('cluster.params.primary_postgresql_host') ? {
32+
undef => getvar('cluster.params.primary_host'),
33+
default => getvar('cluster.params.primary_postgresql_host'),
34+
}
35+
36+
$backup_databases = {
37+
'orchestrator' => $primary_target,
38+
'activity' => $primary_target,
39+
'rbac' => $primary_target,
40+
'puppetdb' => $puppetdb_postgresql_target,
41+
}.filter |$key,$_| {
42+
$recovery_opts[$key] == true
43+
}
44+
45+
# Create backup folders
46+
apply($primary_target) {
3247
file { $backup_directory :
3348
ensure => 'directory',
3449
owner => 'root',
35-
group => 'pe-postgres',
36-
mode => '0770'
50+
group => 'root',
51+
mode => '0700'
3752
}
38-
}
3953

40-
# Create an array of the names of databases and whether they have to be backed up to use in a lambda later
41-
$database_to_backup = [ $backup_orchestrator, $backup_activity, $backup_rbac, $backup_puppetdb]
42-
$database_names = [ 'pe-orchestrator' , 'pe-activity' , 'pe-rbac' , 'pe-puppetdb' ]
54+
# Create a subdir for each backup type selected
55+
$recovery_opts.filter |$_,$val| { $val == true }.each |$dir,$_| {
56+
file { "${backup_directory}/${dir}":
57+
ensure => 'directory',
58+
owner => 'root',
59+
group => 'root',
60+
mode => '0700'
61+
}
62+
}
63+
}
4364

44-
if $backup_classification {
65+
if getvar('recovery_opts.classifier') {
4566
out::message('# Backing up classification')
46-
run_task('peadm::backup_classification', $primary_host,
47-
directory => $backup_directory,
67+
run_task('peadm::backup_classification', $primary_target,
68+
directory => "${backup_directory}/classifier",
4869
)
4970
}
5071

51-
if $backup_ca_ssl {
72+
if getvar('recovery_opts.ca') {
5273
out::message('# Backing up ca and ssl certificates')
53-
run_command("/opt/puppetlabs/bin/puppet-backup create --dir=${backup_directory} --scope=certs", $primary_host)
74+
run_command(@("CMD"), $primary_target)
75+
/opt/puppetlabs/bin/puppet-backup create --dir=${shellquote($backup_directory)}/ca --scope=certs
76+
| CMD
5477
}
5578

5679
# Check if /etc/puppetlabs/console-services/conf.d/secrets/keys.json exists and if so back it up
57-
out::message('# Backing up ldap secret key if it exists')
58-
run_command("test -f /etc/puppetlabs/console-services/conf.d/secrets/keys.json && cp -rp /etc/puppetlabs/console-services/conf.d/secrets/keys.json ${backup_directory} || echo secret ldap key doesnt exist" , $primary_host) # lint:ignore:140chars
80+
if getvar('recovery_opts.rbac') {
81+
out::message('# Backing up ldap secret key if it exists')
82+
run_command(@("CMD"/L), $primary_target)
83+
test -f /etc/puppetlabs/console-services/conf.d/secrets/keys.json \
84+
&& cp -rp /etc/puppetlabs/console-services/conf.d/secrets ${shellquote($backup_directory)}/rbac/ \
85+
|| echo secret ldap key doesnt exist
86+
| CMD
87+
}
5988

6089
# IF backing up orchestrator back up the secrets too /etc/puppetlabs/orchestration-services/conf.d/secrets/
61-
if $backup_orchestrator {
90+
if getvar('recovery_opts.orchestrator') {
6291
out::message('# Backing up orchestrator secret keys')
63-
run_command("cp -rp /etc/puppetlabs/orchestration-services/conf.d/secrets ${backup_directory}/", $primary_host)
92+
run_command(@("CMD"), $primary_target)
93+
cp -rp /etc/puppetlabs/orchestration-services/conf.d/secrets ${shellquote($backup_directory)}/orchestrator/
94+
| CMD
6495
}
6596

66-
$database_to_backup.each |Integer $index, Boolean $value | {
67-
if $value {
68-
out::message("# Backing up database ${database_names[$index]}")
69-
# If the primary postgresql host is set then pe-puppetdb needs to be remotely backed up to primary.
70-
if $database_names[$index] == 'pe-puppetdb' and $cluster['primary_postgresql_host'] {
71-
run_command("sudo -u pe-puppetdb /opt/puppetlabs/server/bin/pg_dump \"sslmode=verify-ca host=${cluster['primary_postgresql_host']} sslcert=/etc/puppetlabs/puppetdb/ssl/${primary_host}.cert.pem sslkey=/etc/puppetlabs/puppetdb/ssl/${primary_host}.private_key.pem sslrootcert=/etc/puppetlabs/puppet/ssl/certs/ca.pem dbname=pe-puppetdb\" -f /tmp/puppetdb_$(date +%F_%T).bin" , $primary_host) # lint:ignore:140chars
72-
} else {
73-
run_command("sudo -u pe-postgres /opt/puppetlabs/server/bin/pg_dump -Fc \"${database_names[$index]}\" -f \"${backup_directory}/${database_names[$index]}_$(date +%F_%T).bin\"" , $primary_host) # lint:ignore:140chars
74-
}
75-
}
97+
$backup_databases.each |$name,$database_target| {
98+
run_command(@("CMD"/L), $primary_target)
99+
/opt/puppetlabs/server/bin/pg_dump -Fd -Z3 -j4 \
100+
-f ${shellquote($backup_directory)}/${shellquote($name)}/pe-${shellquote($name)}.dump.d \
101+
"sslmode=verify-ca \
102+
host=${shellquote($database_target.peadm::certname())} \
103+
user=pe-${shellquote($name)} \
104+
sslcert=/etc/puppetlabs/puppetdb/ssl/${shellquote($primary_target.peadm::certname())}.cert.pem \
105+
sslkey=/etc/puppetlabs/puppetdb/ssl/${shellquote($primary_target.peadm::certname())}.private_key.pem \
106+
sslrootcert=/etc/puppetlabs/puppet/ssl/certs/ca.pem \
107+
dbname=pe-${shellquote($name)}"
108+
| CMD
76109
}
110+
111+
run_command(@("CMD"/L), $primary_target)
112+
umask 0077 \
113+
&& tar -czf ${shellquote($backup_directory)}.tar.gz ${shellquote($backup_directory)} \
114+
&& rm -rf ${shellquote($backup_directory)}
115+
| CMD
116+
117+
return({'path' => "${backup_directory}.tar.gz"})
77118
}

‎spec/plans/backup_spec.rb

+3-1
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,12 @@
66

77
it 'runs with default params' do
88
allow_apply
9+
pending('a lack of support for functions requires a workaround to be written')
910
expect_task('peadm::get_peadm_config').always_return({ 'primary_postgresql_host' => 'postgres' })
1011
expect_out_message.with_params('# Backing up ca and ssl certificates')
11-
# The commands all have a timestamp in them and frankly its prooved to hard with bolt spec to work this out
12+
# The commands all have a timestamp in them and frankly its proved to hard with bolt spec to work this out
1213
allow_any_command
14+
allow_apply
1315
expect_out_message.with_params('# Backing up database pe-orchestrator')
1416
expect_out_message.with_params('# Backing up database pe-activity')
1517
expect_out_message.with_params('# Backing up database pe-rbac')

‎types/recovery_opts.pp

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
type Peadm::Recovery_opts = Struct[{
2+
'orchestrator' => Optional[Boolean],
3+
'puppetdb' => Optional[Boolean],
4+
'rbac' => Optional[Boolean],
5+
'activity' => Optional[Boolean],
6+
'ca' => Optional[Boolean[false]],
7+
'classifier' => Optional[Boolean],
8+
}]

0 commit comments

Comments
 (0)