add key_value provider

.puppet-lint.rc

@@ -1,3 +1,4 @@
 --fail-on-warnings
 --no-parameter_documentation-check
 --no-parameter_types-check
+--no-140chars-check

REFERENCE.md

@@ -18,6 +18,10 @@
 * `nomad::reload_service`: This class is meant to be called from certain configuration changes that support reload.
 * `nomad::run_service`: This class is meant to be called from nomad It ensure the service is running
 
+### Resource types
+
+* [`nomad_key_value`](#nomad_key_value): Manage Nomad key value objects.
+
 ## Classes
 
 ### <a name="nomad"></a>`nomad`
@@ -500,3 +504,147 @@ Nomad server RPC port
 
 Default value: `4647`
 
+## Resource types
+
+### <a name="nomad_key_value"></a>`nomad_key_value`
+
+Manage Nomad key value objects.
+
+#### Examples
+
+##### handling keys in the key value store
+
+```puppet
+nomad_key_value {
+  default:
+    ensure          => present,
+    address         => 'https://127.0.0.1:4646',
+    token           => $nomad_token.unwrap,
+    tls_server_name => 'nomad.example.org',
+    ca_cert         => '/etc/ssl/certs/COMODO_OV.crt',
+    require         => Class['nomad'];
+  'test/keys':
+    value  => {
+      'key1' => 'value1',
+      'key2' => 'value2',
+    };
+  'test_again/keys':
+    ensure => absent,
+    value  => {
+      'key1' => 'value13',
+      'key2' => 'value21',
+    };
+}
+```
+
+#### Properties
+
+The following properties are available in the `nomad_key_value` type.
+
+##### `ensure`
+
+Valid values: `present`, `absent`
+
+The basic property that the resource should be in.
+
+Default value: `present`
+
+##### `value`
+
+The key-value pairs to set
+
+#### Parameters
+
+The following parameters are available in the `nomad_key_value` type.
+
+* [`address`](#-nomad_key_value--address)
+* [`binary_path`](#-nomad_key_value--binary_path)
+* [`ca_cert`](#-nomad_key_value--ca_cert)
+* [`ca_path`](#-nomad_key_value--ca_path)
+* [`client_cert`](#-nomad_key_value--client_cert)
+* [`client_key`](#-nomad_key_value--client_key)
+* [`name`](#-nomad_key_value--name)
+* [`namespace`](#-nomad_key_value--namespace)
+* [`provider`](#-nomad_key_value--provider)
+* [`region`](#-nomad_key_value--region)
+* [`skip_verify`](#-nomad_key_value--skip_verify)
+* [`tls_server_name`](#-nomad_key_value--tls_server_name)
+* [`token`](#-nomad_key_value--token)
+
+##### <a name="-nomad_key_value--address"></a>`address`
+
+Nomad URL, with scheme and port number. It defaults to http://127.0.0.1:4646
+
+Default value: `http://127.0.0.1:4646`
+
+##### <a name="-nomad_key_value--binary_path"></a>`binary_path`
+
+Path to the nomad binary. Can be an absolute path or just "nomad" if it is in the PATH.
+
+##### <a name="-nomad_key_value--ca_cert"></a>`ca_cert`
+
+Path to a PEM-encoded CA certificate file to use to verify the Nomad server SSL certificate.
+
+Default value: `''`
+
+##### <a name="-nomad_key_value--ca_path"></a>`ca_path`
+
+Path to a directory of PEM-encoded CA certificate files to verify the Nomad server SSL certificate.
+
+Default value: `''`
+
+##### <a name="-nomad_key_value--client_cert"></a>`client_cert`
+
+Path to the client certificate file to use to authenticate to the Nomad server.
+
+Default value: `''`
+
+##### <a name="-nomad_key_value--client_key"></a>`client_key`
+
+Path to the client private key file to use to authenticate to the Nomad server.
+
+Default value: `''`
+
+##### <a name="-nomad_key_value--name"></a>`name`
+
+namevar
+
+Name of the path object containing the key/value pairs
+
+##### <a name="-nomad_key_value--namespace"></a>`namespace`
+
+The namespace to query. If unspecified, it will use the default namespace.
+
+Default value: `''`
+
+##### <a name="-nomad_key_value--provider"></a>`provider`
+
+The specific backend to use for this `nomad_key_value` resource. You will seldom need to specify this --- Puppet will
+usually discover the appropriate provider for your platform.
+
+##### <a name="-nomad_key_value--region"></a>`region`
+
+Name of the region. It defaults to global
+
+Default value: `global`
+
+##### <a name="-nomad_key_value--skip_verify"></a>`skip_verify`
+
+Valid values: `true`, `false`, `yes`, `no`
+
+Skip Nomad certificate verification. Defaults to false.
+
+Default value: `false`
+
+##### <a name="-nomad_key_value--tls_server_name"></a>`tls_server_name`
+
+The server name to use as the SNI host when connecting via TLS.
+
+Default value: `''`
+
+##### <a name="-nomad_key_value--token"></a>`token`
+
+Nomad token with read and write access to the variables
+
+Default value: `''`
+

lib/puppet/provider/nomad_key_value/cli.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'tempfile'
+
+Puppet::Type.type(:nomad_key_value).provide(:cli) do
+  desc 'Provider to manage Nomad variables using `nomad var put`.'
+
+  def nomad_command
+    resource[:binary_path]
+  end
+
+  def build_command_args
+    raise Puppet::Error, "Nomad binary at #{resource[:binary_path]} is not executable or not found." unless File.executable?(resource[:binary_path])
+
+    args = []
+    args << "-token=#{resource[:token]}" unless resource[:token].to_s.empty?
+    args << "-address=#{resource[:address]}"
+    args << "-region=#{resource[:region]}"
+    args << "-namespace=#{resource[:namespace]}" unless resource[:namespace].to_s.empty?
+    args << "-tls-server-name=#{resource[:tls_server_name]}" unless resource[:tls_server_name].to_s.empty?
+    args << '-tls-skip-verify' if resource[:skip_verify] == true
+    args << "-client-key=#{resource[:client_key]}" unless resource[:client_key].to_s.empty?
+    args << "-client-cert=#{resource[:client_cert]}" unless resource[:client_cert].to_s.empty?
+    args << "-ca-cert=#{resource[:ca_cert]}" unless resource[:ca_cert].to_s.empty?
+    args << "-ca-path=#{resource[:ca_path]}" unless resource[:ca_path].to_s.empty?
+    args
+  end
+
+  def fetch_existing
+    command = [nomad_command, 'var', 'get', '-out', 'json'] + build_command_args + [resource[:name]]
+    output = execute(command, failonfail: false)
+    JSON.parse(output)
+  rescue JSON::ParserError, Puppet::ExecutionFailure
+    nil
+  end
+
+  def exists?
+    result = fetch_existing
+    return false if result.nil?
+
+    @modify_index = result['ModifyIndex']
+    @existing_items = result['Items']
+
+    @existing_items == resource[:value]
+  end
+
+  def create
+    json_value = { 'Items' => resource[:value] }.to_json
+    command = [nomad_command, 'var', 'put', '-in', 'json'] + build_command_args
+    command += ['-check-index', @modify_index.to_s] if @modify_index
+
+    Tempfile.open('nomad_var') do |tempfile|
+      tempfile.write(json_value)
+      tempfile.flush
+      execute(command + [resource[:name], '-'], stdinfile: tempfile.path)
+    end
+  end
+
+  def destroy
+    command = [nomad_command, 'var', 'purge'] + build_command_args + [resource[:name]]
+    execute(command)
+  end
+
+  def value
+    resource[:value]
+  end
+end

lib/puppet/type/nomad_key_value.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+require 'puppet/parameter/boolean'
+require 'facter'
+
+Puppet::Type.newtype(:nomad_key_value) do
+  desc <<-EOD
+  Manage Nomad key value objects.
+  @example handling keys in the key value store
+      nomad_key_value {
+        default:
+          ensure          => present,
+          address         => 'https://127.0.0.1:4646',
+          token           => $nomad_token.unwrap,
+          tls_server_name => 'nomad.example.org',
+          ca_cert         => '/etc/ssl/certs/COMODO_OV.crt',
+          require         => Class['nomad'];
+        'test/keys':
+          value  => {
+            'key1' => 'value1',
+            'key2' => 'value2',
+          };
+        'test_again/keys':
+          ensure => absent,
+          value  => {
+            'key1' => 'value13',
+            'key2' => 'value21',
+          };
+      }
+  EOD
+  ensurable
+
+  newparam(:name, namevar: true) do
+    desc 'Name of the path object containing the key/value pairs'
+    validate do |value|
+      raise ArgumentError, 'Path object name must be a string' unless value.is_a?(String)
+    end
+  end
+
+  newproperty(:value) do
+    desc 'The key-value pairs to set'
+    validate do |value|
+      raise ArgumentError, 'The key value must be a hash' unless value.is_a?(Hash)
+    end
+  end
+
+  newparam(:binary_path) do
+    desc 'Path to the nomad binary. Can be an absolute path or just "nomad" if it is in the PATH.'
+    validate do |value|
+      raise ArgumentError, "The binary '#{value}' could not be found." if Facter::Core::Execution.which(value).nil?
+    end
+    defaultto do
+      Facter::Core::Execution.which('nomad')
+    end
+  end
+
+  newparam(:address) do
+    desc 'Nomad URL, with scheme and port number. It defaults to http://127.0.0.1:4646'
+    validate do |value|
+      raise ArgumentError, 'The url must be a string' unless value.is_a?(String)
+    end
+    defaultto 'http://127.0.0.1:4646'
+  end
+
+  newparam(:token) do
+    desc 'Nomad token with read and write access to the variables'
+    validate do |value|
+      raise ArgumentError, 'Nomad token must be a string' unless value.is_a?(String)
+    end
+    defaultto ''
+  end
+
+  newparam(:region) do
+    desc 'Name of the region. It defaults to global'
+    validate do |value|
+      raise ArgumentError, 'The region must be an string' unless value.is_a?(String)
+    end
+    defaultto 'global'
+  end
+
+  newparam(:namespace) do
+    desc 'The namespace to query. If unspecified, it will use the default namespace.'
+    validate do |value|
+      raise ArgumentError, 'The namespace must be an string' unless value.is_a?(String)
+    end
+    defaultto ''
+  end
+
+  newparam(:tls_server_name) do
+    desc 'The server name to use as the SNI host when connecting via TLS.'
+    validate do |value|
+      raise ArgumentError, 'The server name must be a string' unless value.is_a?(String)
+    end
+    defaultto ''
+  end
+
+  newparam(:skip_verify, boolean: true, parent: Puppet::Parameter::Boolean) do
+    desc 'Skip Nomad certificate verification. Defaults to false.'
+    defaultto false
+  end
+
+  newparam(:client_key) do
+    desc 'Path to the client private key file to use to authenticate to the Nomad server.'
+    validate do |value|
+      raise ArgumentError, 'The client key must be a string' unless value.is_a?(String)
+    end
+    defaultto ''
+  end
+
+  newparam(:client_cert) do
+    desc 'Path to the client certificate file to use to authenticate to the Nomad server.'
+    validate do |value|
+      raise ArgumentError, 'The client certificate must be a string' unless value.is_a?(String)
+    end
+    defaultto ''
+  end
+
+  newparam(:ca_cert) do
+    desc 'Path to a PEM-encoded CA certificate file to use to verify the Nomad server SSL certificate.'
+    validate do |value|
+      raise ArgumentError, 'The CA certificate must be a string' unless value.is_a?(String)
+    end
+    defaultto ''
+  end
+
+  newparam(:ca_path) do
+    desc 'Path to a directory of PEM-encoded CA certificate files to verify the Nomad server SSL certificate.'
+    validate do |value|
+      raise ArgumentError, 'The CA path must be a string' unless value.is_a?(String)
+    end
+    defaultto ''
+  end
+
+  validate do
+    raise ArgumentError, "You cannot specify both 'ca_cert' and 'ca_path'. Please provide only one." if !self[:ca_cert].empty? && !self[:ca_path].empty?
+  end
+end

spec/acceptance/key_value.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require 'spec_helper_acceptance'