Etcd replication is a newer commercial feature of sensu-go, this adds a
custom resource to create the supported replicator resources.
There are some unique issues to handle with replication config that make
this resource a little more complex than others. It is technically
allowed to disable transport security by setting "insecure: true" on the
object definition in Sensu.
When using an insecure transport, the ca_cert,cert and key values
are not required in the spec.
There is no simple way to have Chef custom resource properties be
conditionally required properties based on the values of other
properties in the same resource. For this reason the
check_resource_semantics! callback is used for this custom resource to
validate the runtime usage of the transport security resource
properties.
If a user attempts to use this resource with the default value of
"insecure: false" (which will enable transport security for etcd
replication) a runtime error will be raised if they do not also set
the cert and key properties on the resource. The ca_cert property
has reasonable platform defaults but can be overidden.
Key management of the actual pem and key files is left entirely to the
user.
This error will look something like this:
[2020-10-19T01:03:17+00:00] FATAL: RuntimeError: sensu_etcd_replicator[cluster_role_binding_replicator] (sensu_test::default line 362) had an error: RuntimeError:
For the resource: cluster_role_binding_replicator the property 'insecure' is set to 'false'.
This is the default and enables transport security for replication.
Transport security requires both 'cert' and 'key' properties of this resource to be set to valid local paths. Please set these values.
Pull Request Checklist
Is this in reference to an existing issue?
Yes, #105
General
[X] Update Changelog following the conventions laid out here
[X] Update README with any necessary configuration snippets
[X] Cookstyle (rubocop) passes
[ ] Foodcritic passes
[X] Rspec (unit tests) passes
[X] Inspec (integration tests) passes
New Features
[X] Added a Testing Artifact as either an automated test or a manual artifact on the PR.
[X] Added documentation for it to the README.md
Purpose
Support management of etcd replication with chef resources
Etcd replication is a newer commercial feature of sensu-go, this adds a custom resource to create the supported replicator resources.
There are some unique issues to handle with replication config that make this resource a little more complex than others. It is technically allowed to disable transport security by setting "insecure: true" on the object definition in Sensu.
When using an insecure transport, the
ca_cert
,cert
andkey
values are not required in the spec.There is no simple way to have Chef custom resource properties be conditionally required properties based on the values of other properties in the same resource. For this reason the
check_resource_semantics!
callback is used for this custom resource to validate the runtime usage of the transport security resource properties.If a user attempts to use this resource with the default value of "insecure: false" (which will enable transport security for etcd replication) a runtime error will be raised if they do not also set the
cert
andkey
properties on the resource. Theca_cert
property has reasonable platform defaults but can be overidden.Key management of the actual pem and key files is left entirely to the user.
This error will look something like this:
Pull Request Checklist
Is this in reference to an existing issue?
Yes, #105
General
[X] Update Changelog following the conventions laid out here
[X] Update README with any necessary configuration snippets
[X] Cookstyle (rubocop) passes
[ ] Foodcritic passes
[X] Rspec (unit tests) passes
[X] Inspec (integration tests) passes
New Features
[X] Added a Testing Artifact as either an automated test or a manual artifact on the PR.
[X] Added documentation for it to the
README.md
Purpose
Support management of etcd replication with chef resources
Known Compatibility Issues
None