Skip to content

Commit e2b0bdd

Browse files
txajtxaj
txaj
authored and
txaj
committed
Create the pg_ident_rule defined type
This allows us to declare user map as easilly as pg_hba entries.
1 parent 3ed4370 commit e2b0bdd

File tree

8 files changed

+141
-0
lines changed

8 files changed

+141
-0
lines changed

‎README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,7 @@ Resources:
240240
* [postgresql::server::database](#resource-postgresqlserverdatabase)
241241
* [postgresql::server::database_grant](#resource-postgresqlserverdatabasegrant)
242242
* [postgresql::server::pg_hba_rule](#resource-postgresqlserverpghbarule)
243+
* [postgresql::server::pg_ident_rule](#resource-postgresqlserverpgidentrule)
243244
* [postgresql::server::role](#resource-postgresqlserverrole)
244245
* [postgresql::server::table_grant](#resource-postgresqlservertablegrant)
245246
* [postgresql::server::tablespace](#resource-postgresqlservertablespace)
@@ -326,6 +327,9 @@ Path to the `psql` command.
326327
####`pg_hba_conf_path`
327328
Path to your `pg\_hba.conf` file.
328329

330+
####`pg_ident_conf_path`
331+
Path to your `pg\_ident.conf` file.
332+
329333
####`postgresql_conf_path`
330334
Path to your `postgresql.conf` file.
331335

@@ -434,6 +438,9 @@ Path to the `psql` command.
434438
####`pg_hba_conf_path`
435439
Path to your `pg\_hba.conf` file.
436440

441+
####`pg_ident_conf_path`
442+
Path to your `pg\_ident.conf` file.
443+
437444
####`postgresql_conf_path`
438445
Path to your `postgresql.conf` file.
439446

@@ -468,6 +475,8 @@ This value defaults to `false`. Many distros ship with a fairly restrictive fire
468475
####`manage_pg_hba_conf`
469476
This value defaults to `true`. Whether or not manage the pg_hba.conf. If set to `true`, puppet will overwrite this file. If set to `false`, puppet will not modify the file.
470477

478+
####`manage_pg_ident_conf`
479+
This value defaults to `true`. Whether or not manage the pg_ident.conf. If set to `true`, puppet will overwrite this file. If set to `false`, puppet will not modify the file.
471480

472481
###Class: postgresql::client
473482

@@ -667,6 +676,24 @@ This would create a ruleset in `pg_hba.conf` similar to:
667676
# Order: 150
668677
host app app 200.1.2.0/24 md5
669678

679+
###Resource: postgresql::server::pg\_ident\_rule
680+
This defined type allows you to create user name maps for `pg_ident.conf`. For more details see the [PostgreSQL documentation](http://www.postgresql.org/docs/9.4/static/auth-username-maps.html).
681+
682+
For example:
683+
684+
postgresql::server::pg_ident_rule{ 'Map the SSL certificate of the backup server as a replication user':
685+
map_name => 'sslrepli',
686+
system_username => 'repli1.example.com',
687+
database_username => 'replication',
688+
}
689+
690+
This would create a user name map in `pg_ident.conf` similar to:
691+
692+
# Rule Name: Map the SSL certificate of the backup server as a replication user
693+
# Description: none
694+
# Order: 150
695+
sslrepli repli1.example.com replication
696+
670697
####`namevar`
671698
A unique identifier or short description for this rule. The namevar doesn't provide any functional usage, but it is stored in the comments of the produced `pg_hba.conf` so the originating resource can be identified.
672699

‎manifests/globals.pp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
$createdb_path = undef,
2121
$psql_path = undef,
2222
$pg_hba_conf_path = undef,
23+
$pg_ident_conf_path = undef,
2324
$postgresql_conf_path = undef,
2425

2526
$pg_hba_conf_defaults = undef,
@@ -42,6 +43,7 @@
4243

4344
$manage_firewall = undef,
4445
$manage_pg_hba_conf = undef,
46+
$manage_pg_ident_conf = undef,
4547
$firewall_supported = undef,
4648

4749
$manage_package_repo = undef

‎manifests/params.pp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
$service_provider = $service_provider
1616
$manage_firewall = $manage_firewall
1717
$manage_pg_hba_conf = pick($manage_pg_hba_conf, true)
18+
$manage_pg_ident_conf = pick($manage_pg_ident_conf, true)
1819
$package_ensure = 'present'
1920

2021
# Amazon Linux's OS Family is 'Linux', operating system 'Amazon'.
@@ -198,6 +199,7 @@
198199
$createdb_path = pick($createdb_path, "${bindir}/createdb")
199200
$pg_hba_conf_path = pick($pg_hba_conf_path, "${confdir}/pg_hba.conf")
200201
$pg_hba_conf_defaults = pick($pg_hba_conf_defaults, true)
202+
$pg_ident_conf_path = pick($pg_ident_conf_path, "${confdir}/pg_ident.conf")
201203
$postgresql_conf_path = pick($postgresql_conf_path, "${confdir}/postgresql.conf")
202204
$default_database = pick($default_database, 'postgres')
203205
}

‎manifests/server.pp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
$createdb_path = $postgresql::params::createdb_path,
2727
$psql_path = $postgresql::params::psql_path,
2828
$pg_hba_conf_path = $postgresql::params::pg_hba_conf_path,
29+
$pg_ident_conf_path = $postgresql::params::pg_ident_conf_path,
2930
$postgresql_conf_path = $postgresql::params::postgresql_conf_path,
3031

3132
$datadir = $postgresql::params::datadir,
@@ -43,6 +44,7 @@
4344

4445
$manage_firewall = $postgresql::params::manage_firewall,
4546
$manage_pg_hba_conf = $postgresql::params::manage_pg_hba_conf,
47+
$manage_pg_ident_conf = $postgresql::params::manage_pg_ident_conf,
4648
$firewall_supported = $postgresql::params::firewall_supported,
4749

4850
#Deprecated

‎manifests/server/config.pp‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77
$ipv4acls = $postgresql::server::ipv4acls
88
$ipv6acls = $postgresql::server::ipv6acls
99
$pg_hba_conf_path = $postgresql::server::pg_hba_conf_path
10+
$pg_ident_conf_path = $postgresql::server::pg_ident_conf_path
1011
$postgresql_conf_path = $postgresql::server::postgresql_conf_path
1112
$pg_hba_conf_defaults = $postgresql::server::pg_hba_conf_defaults
1213
$user = $postgresql::server::user
1314
$group = $postgresql::server::group
1415
$version = $postgresql::server::version
1516
$manage_pg_hba_conf = $postgresql::server::manage_pg_hba_conf
17+
$manage_pg_ident_conf = $postgresql::server::manage_pg_hba_conf
1618

1719
if ($manage_pg_hba_conf == true) {
1820
# Prepare the main pg_hba file
@@ -107,4 +109,15 @@
107109
replace => false,
108110
}
109111
}
112+
113+
if ($manage_pg_ident_conf == true) {
114+
concat { $pg_ident_conf_path:
115+
owner => $user,
116+
group => $group,
117+
force => true, # do not crash if there is no pg_ident_rules
118+
mode => '0640',
119+
warn => true,
120+
notify => Class['postgresql::server::reload'],
121+
}
122+
}
110123
}

‎manifests/server/pg_ident_rule.pp‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# This resource manages an individual rule that applies to the file defined in
2+
# $target. See README.md for more details.
3+
define postgresql::server::pg_ident_rule(
4+
$map_name,
5+
$system_username,
6+
$database_username,
7+
$description = 'none',
8+
$order = '150',
9+
10+
# Needed for testing primarily, support for multiple files is not really
11+
# working.
12+
$target = $postgresql::server::pg_ident_conf_path
13+
) {
14+
15+
if $postgresql::server::manage_pg_ident_conf == false {
16+
fail('postgresql::server::manage_pg_ident_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests')
17+
} else {
18+
19+
# Create a rule fragment
20+
$fragname = "pg_ident_rule_${name}"
21+
concat::fragment { $fragname:
22+
target => $target,
23+
content => template('postgresql/pg_ident_rule.conf'),
24+
order => $order,
25+
}
26+
}
27+
}

‎spec/unit/defines/server/pg_ident_rule_spec.rb‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
require 'spec_helper'
2+
3+
describe 'postgresql::server::pg_ident_rule', :type => :define do
4+
let :facts do
5+
{
6+
:osfamily => 'Debian',
7+
:operatingsystem => 'Debian',
8+
:operatingsystemrelease => '6.0',
9+
:kernel => 'Linux',
10+
:concat_basedir => tmpfilename('pg_ident'),
11+
:id => 'root',
12+
:path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
13+
}
14+
end
15+
let :title do
16+
'test'
17+
end
18+
let :target do
19+
tmpfilename('pg_ident_rule')
20+
end
21+
22+
context 'test template 1' do
23+
let :pre_condition do
24+
<<-EOS
25+
class { 'postgresql::server': }
26+
EOS
27+
end
28+
29+
let :params do
30+
{
31+
:map_name => 'thatsmymap',
32+
:system_username => 'systemuser',
33+
:database_username => 'dbuser',
34+
}
35+
end
36+
it do
37+
is_expected.to contain_concat__fragment('pg_ident_rule_test').with({
38+
:content => /thatsmymap\s+systemuser\s+dbuser/
39+
})
40+
end
41+
end
42+
context 'not managing pg_ident' do
43+
let :pre_condition do
44+
<<-EOS
45+
class { 'postgresql::globals':
46+
manage_pg_ident_conf => false,
47+
}
48+
class { 'postgresql::server': }
49+
EOS
50+
end
51+
let :params do
52+
{
53+
:map_name => 'thatsmymap',
54+
:system_username => 'systemuser',
55+
:database_username => 'dbuser',
56+
}
57+
end
58+
it 'should fail because $manage_pg_ident_conf is false' do
59+
expect {subject}.to raise_error(Puppet::Error,
60+
/postgresql::server::manage_pg_ident_conf has been disabled/)
61+
end
62+
end
63+
end

‎templates/pg_ident_rule.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
2+
# Rule Name: <%=@name%>
3+
# Description: <%=@description%>
4+
# Order: <%=@order%>
5+
<%=@map_name%> <%=@system_username%> <%=@database_username%>

0 commit comments

Comments
 (0)