search

lacework / chef-lacework

Apache License 2.0
0 stars 3 forks source link

Cookbook not idempotent #21

Open asyd opened 2 years ago

asyd commented 2 years ago

This line

https://github.com/lacework/chef-lacework/blob/6e8616d94f70e9156dd4eaff60cfd24e7417d27c/recipes/_apt.rb#L17

make cookbook not idempotent

dmurray-lacework commented 2 years ago

Hi @asyd thanks for raising this issue. I want to help resolve this, could you give a little more detail on this please?

afiune commented 2 years ago

I'm going to try to guess here, I think what we want is for the execute resource to only trigger when the apt_repository resource runs, which means we should do something like:

  execute 'apt-update' do
    command "apt update --allow-releaseinfo-change"
    action :nothing
  end

  apt_repository 'packages-lacework-prod' do
    uri "https://packages.lacework.net/DEB/#{node['platform']}/#{node['platform_version'].to_i}"
    arch 'amd64'
    key ['18E76630']
    keyserver 'keyserver.ubuntu.com'
    components ['main']
    notifies 'execute[apt-update]', :run.    # <-- UPDATE
    action :add
  end

Would that help you @asyd ?

asyd commented 2 years ago

yeah indeed!