Open jkasarherou opened 3 years ago
Do you mind sharing what you added to the validate.sh file?
The validate.sh file is dependent on the package I install (falcon-sensor):
#!/bin/bash
get_output () {
echo $(/opt/CrowdStrike/falconctl -g --${1})
}
validate_param () {
local param_name=$1
local value=$2
if [[ $(get_output ${param_name}) =~ =${value}\. ]]; then
return 0
fi
echo "$param_name mismatch"
return 1
}
validate_param tags ${SSM_tag}
@jkasarherou Did you ever figure this out by chance? We are trying to use distributor and AWS-ConfigureAWSPackage to install multiple packages. However, how can we get it to check that the service is in fact running before checking the installation state file local on the instances? When we see "is already installed", that could be a false positive if the package was uninstalled outside of SSM.
@connor-tyndall I would suggest you try adding a validate.sh script in your package. This let you run custom steps to verify the actual state on the system, so in your case verify that the service is running/installed.
@jkasarherou I'm curious how you came across this find of using a validate.sh script since this is basically undocumented?
@connor-tyndall I was looking into the source code and stumble across this https://github.com/aws/amazon-ssm-agent/blob/dfafad1eba3ab41eb0de566fba4810d422af5001/agent/plugins/configurepackage/ssminstaller/ssminstaller.go#L93
then I tried crafting a package with a validate.sh
Hello, I am using Distributor and aws:configurePackage and I want to update my association
additionalArguments
. The problem is that if the association only changes theadditionalArguments
the installation will be skipped with a message like:First I was forcing the package to
Uninstall
thenInstall
to apply the changes, but it is a bit cumbersome to do from my Terraform code. I figured out that you can use the undocumentedvalidate
step, so I added a customvalidate.sh
to the package zip file to check if arguments have drifted. This approach worked because the installationCheck will fail and force a reinstall but this feels hacky. Am I missing something? It would be nice to have a way to handle this case properly.