Add puppetcore macos support #769

cthorn42 · 2025-04-01T21:30:53Z

This is a work in progress, currently based on Josh's WIP: #766

Now possible to run the install task specifying puppetcore collection: ``` /opt/puppetlabs/bolt/bin/bolt task run puppet_agent::install \ collection=puppetcore8 \ version=8.11.0 \ username=forge-key \ password=${PUPPET_FORGE_TOKEN} \ --targets 'winrm://HOST' \ --user Administrator \ --password ... ``` If the `windows_source` class parameter is explicitly given, then the task will use that. Also add additional logging as to where we are downloading the MSI from and the exception message if downloading fails.

When using the puppetcore collection on Windows, if we detect the installed version does not match, then upgrade the MSI. Due to a puppet bug, we cannot pass credentials in the `source` parameter. And `curl.exe` is not present in our puppet-agent packages. So use powershell to download. Co-authored-by: Kevin <[email protected]>

cthorn42 · 2025-04-01T21:34:11Z

manifests/osfamily/darwin.pp

@@ -20,12 +20,20 @@
    } else {
      $source = "puppet:///pe_packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"
    }
-  } else {
+  } elsif $puppet_agent::collection and $puppet_agent::collection =~ /core/ {
+    if $puppet_agent::prepare::package_version =~ /^\d+\.\d+\.\d+\.\d+\.g([a-f0-9]+)+$/ {


Is there a better way to determine if we need to set dev=true parameter?

cthorn42 · 2025-04-01T21:38:26Z

manifests/prepare/package.pp

+      onlyif  => "test -f '${response_file}'",
+      logoutput => true,
+      require => Exec['Download Puppet Agent for Darwin'],
+    }


This is what the output looks like for setting up the netrc file, reading the output file and then executing the install script:

Started on jovial-duck.delivery.puppetlabs.net... Finished on jovial-duck.delivery.puppetlabs.net: Notice: /Stage[main]/Puppet_agent::Prepare::Package/File[/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.netrc]/ensure: defined content as '{sha256}4f3d0ec5c7fa14041867e7009e7924c13c15c54cc2fbfc52362708a88964bf86' Notice: /Stage[main]/Puppet_agent::Prepare::Package/Exec[Remove .netrc file]/returns: executed successfully Notice: /Stage[main]/Puppet_agent::Prepare::Package/Exec[Read HTTP Response Code]/returns: 200 Notice: /Stage[main]/Puppet_agent::Prepare::Package/Exec[Read HTTP Response Code]/returns: executed successfully Notice: /Stage[main]/Puppet_agent::Install::Darwin/Exec[osx_install script]/returns: executed successfully changed: 4, failed: 0, unchanged: 26 skipped: 0, noop: 0 Finished: apply catalog with 0 failures in 15.54 sec

For now while working on this I'm mainly looking to get quick feedback on the curl HTTP response. But this is only a work in progress, and I do plan on spending time to improve this.

joshcooper · 2025-04-02T16:21:31Z

manifests/prepare/package.pp

+      mode    => '0600',
+    }
+
+    $curl_command = "curl -1 -sL --netrc-file '${netrc_file}' -w '%{http_code}' -o '${local_package_file_path}' '${source}' > '${response_file}'"


suggest adding --fail so it returns non-zero exit on HTTP error

joshcooper · 2025-04-02T16:22:22Z

manifests/prepare/package.pp

+      path    => ['/usr/bin', '/bin'],
+      onlyif  => "test -f '${netrc_file}'",
+      require => Exec['Download Puppet Agent for Darwin'],
+    }


may produce a "changed" event each time the agent runs?

Isn't that the kind of issue https://forge.puppet.com/modules/puppetlabs/transition/readme exists for?

manifests/prepare/package.pp

tasks/install_powershell.json

bastelfreak · 2025-04-02T16:42:15Z

manifests/prepare/package.pp

+    file { $netrc_file:
+      ensure  => file,
+      content => "machine artifacts-puppetcore.puppet.com\nlogin ${download_username}\npassword ${download_password}\n",
+      mode    => '0600',


please add show_diff => false,, to ensure password won't be leaked

👍 Good catch.

This updates the download of puppet-agent when puppetcore packages are used. The new 'puppetcore7' and 'puppetcore8' collections when used for MacOS will now download puppetcore packages. Due to a bug in Puppet for now we're going to depend on Curl to download the package.

joshcooper and others added 2 commits March 18, 2025 14:28

cthorn42 added the don't merge label Apr 1, 2025

cthorn42 requested review from bastelfreak and a team as code owners April 1, 2025 21:30

cthorn42 commented Apr 1, 2025

View reviewed changes

cthorn42 force-pushed the add_puppetcore_macos_support branch from 191a2cc to 4a3c3e5 Compare April 2, 2025 15:46

joshcooper reviewed Apr 2, 2025

View reviewed changes