puppetlabs / puppetlabs-pecdm

Puppet Bolt driven fusion of puppetlabs/peadm and Terraform.
Apache License 2.0
14 stars 18 forks source link

Allow passing custom dns alt names #68

Closed ody closed 2 years ago

ody commented 2 years ago

Add parameter which provided interface for adding custom DNS Alternative Names to infrastructure certificates

ody commented 2 years ago

Came out of working with a customer deployment.

reidmv commented 2 years ago

I think for now we just merge this. 👍

But, it might be interesting to also state and ponder a possible bigger design question that might be relevant now or in the future...


I posit that there are two sets of parameters relevant to users of PECDM.

  1. Parameters pertinent to creating the PE cluster; things like provider, cloud_region, etc.
  2. Parameters pertinent to configuring the PE cluster; basically, everything that a user supplies PECDM, but which is effectively just a pass-through to PEAdm.

Right now, for pass-through parameters, we fully duplicate a set of PEAdm parameters in PECDM. However, we don't fully duplicate every possible PEAdm parameter. Rather, we've kind of hand-picked which ones seem most relevant, and for less common use cases provided the extra_peadm_params parameter hash, which a use can use to additionally supply any legal PEAdm parameter.

The one we're adding here is a bit different, in that we're combining automatically generated information with additional user-supplied information, and giving the combined data to PEAdm.

What is the rubric we use to decide which PEAdm parameters are "above the line", and get duplicated in PECDM, and which parameters are "below the line", and can only be passed through via extra_peadm_params? Is there a definable rubric? Might be useful to jot down, if anybody has such a thing in their head.

ody commented 2 years ago

@reidmv Excellent question. Now that I reflect, I'd probably set a more strict criteria. An individual should be able to launch a new PE cluster for demonstrations, testing, and development without knowing PEADM or Terraform so parameters should reflect that use case, one can get started by looking at the PECDM documentation alone. Once you're ready to go to production it should be an requirement to understand PEADM so anything beyond getting started would be a extra_peadm_params provided parameter.

This in mind, it would be more correct to implement a solution which extracts dns_alt_names from extra_peadm_params. I did have a second thought about dns_alt_names because it isn't required since we compute it but I decided to include it as a parameter because that is less cumbersome than extracting it from extra_peadm_params.

I want to get rid of the stack parameter, which has been around for a while and replace it by adding tag/label support to each Terraform module and passing the desired metadata in that way through extra_terraform_vars