unkin-agent
55af4b2f16
catalog-diff compiles a host's catalog in two environments and diffs them to validate puppet-prod changes before merge, which means compiling catalogs on behalf of other nodes via POST /puppet/v4/catalog. The compilers run the image default auth.conf, where that endpoint is denied. - add a compiler auth.conf allowing catalog-diff.main.unkin.net to POST /puppet/v4/catalog - add a pre-default entrypoint script seeding it into conf.d, failing hard if the source is absent - mount both onto the compiler deployment via configMapGenerator Reviewed-on: #462 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
15 lines
419 B
Bash
Executable File
15 lines
419 B
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
SRC=/configmaps/auth.conf
|
|
DST=/etc/puppetlabs/puppetserver/conf.d/auth.conf
|
|
|
|
# Copied rather than mounted: the entrypoint chowns conf.d and rewrites auth.conf,
|
|
# both of which fail on a read-only configmap mount and abort container startup.
|
|
if [ ! -s "$SRC" ]; then
|
|
echo "FATAL: $SRC missing or empty; refusing to start on the image default auth.conf" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cp "$SRC" "$DST"
|