Pro Puppet (55 page)

In this section we're going to show you a slightly more complex type and provider used to manage HTTP authentication password files. It's a similarly ensureable type and provider, but with some more sophisticated components.

Let's start by looking at the
httpauth
type shown in
Listing 10-10
.

In the
httpauth
type we're managing a number of attributes, principally the user, password and password file. We also provide some associated information, like the realm (A HTTP Digest Authentication value) and the mechanism we're going to use, Basic or Digest Authentication.

First, notice that we've added some code to our
ensurable
method. In this case, we're telling Puppet some specifics about the operation of our
ensure
attribute. We're specifying that for each state,
present
and
absent
, exactly which method in the provider should be called, here
create
and
destroy,
respectively. We're also specifying the default behavior of the
ensure
attribute. This means that if we omit the
ensure
attribute that the
httpauth
resource will assume
present
as the value. The resource will then check for the presence of the user we want to manage, and if it doesn't exist, then it will create that user.

We've also used some other useful methods. The first is the
defaultto
method that specifies a default value for a parameter or property. If the resource does not specify this attribute, then Puppet will use to this default value to populate it. The other is the
newvalues
method that allows you to specify the values that the parameter or property will accept. In
Listing 10-10
, you can see the
mechanism
parameter that the
newvalues
method specifies will take the values of
basic
or
digest
.

Lastly, you can see that we used the
validate
method to return an error if the
httpauth
resource is specified without the
password
attribute.

Now let's look at the provider for the
httpauth
type, shown in
Listing 10-11
.

This provider is more complex than what we've seen before. We've still got the methods that handle Puppet's ensurable capabilities:
create
,
destroy
and
exists?
. In addition, though, we've got additional methods that manipulate our password files.

Our provider first checks for the existence of the Webrick library, which it needs in order to manipulate HTTP password files. The provider will fail to run if this library is not present. Fortunately, Webrick is commonly present in most Ruby distributions (and indeed, is used by Puppet as its basic server framework, as we learned in 2).

Our provider then has the three ensurable methods. The
create
and
destroy
methods are relatively simple. They use methods from the Webrick library to either set or delete a password specified in the HTTP password file managed by the resource. The file being referred to here using the
resource[:file]
value which is controlled by setting the
file
attribute in the
httpauth
resource, for example:

Lastly, you'll also see in the
create
and
destroy
methods that we call the
flush
method. This flushes the buffer and writes out our changes.

The
exists?
method is more complex and calls several helper methods to check whether the user and password already exist, and if they do, whether the current and proposed passwords match.

Like facts, you can test your types and providers. The best way to do this is add them to a module in your development or testing environment and enable pluginsync to test them there before using them in your production environment, for example let's add our HTTPAuth type to a module called httpauth, first adding the required directories:

Then copying in the type and provider to the requisite directories.

When Puppet is run (and pluginsync enabled) it will find your types and providers in these directories, deploy them and make them available to be used in your Puppet manifests.

The last type of custom Puppet code we're going to look at is the function. You've seen a number of functions in this book already, for example:
include
,
notice
and
template
are all functions we've used. But you can extend the scope of the available functions by writing your own.

There are two types of functions: statements and rvalues. Statements perform some action, for example the
fail
function, and rvalues return a value, for example if you pass in a value, the function will process it and return a value. The
split
function is an example of an rvalue function.

We're going to write a simple function and distribute it to our agents. Like plug-ins, we can use plug-in sync to distribute functions to agents; they are stored in:

The file containing the function must be named after the function it contains; for example, the
template
function should be contained in the
template.rb
file.

Let's take a look at a simple function in
Listing 10-12
.

Puppet contains an existing function called sha1 that generates a SHA1 hash value from a provided string. In
Listing 10-12
, we've updated that function to support SHA512 instead. Let's break that function down. To create the function we call the
Puppet::Parser::Functions::newfunction
method and pass it some values. First, we name the function, in our case
sha512
. We then specify the type of function it is, here rvalue, for a function that returns a value. If we don't specify the type at all then Puppet assumes the function is a statement. Lastly, we specify a
:doc
string to document the function.

The
newfunction
block takes the incoming argument and we process it, first adding in support for working with SHA hashes by requiring the
sha1
library, and then passing the argument to the
hexdigest
method. As this is an rvalue function, it will return the created hash as the result of the function.