sensu / sensu-go-chef

Chef Library Cookbook for Sensu Go
https://sensu.io
MIT License
11 stars 22 forks source link

Add etcd_replicator resource #116

Closed webframp closed 3 years ago

webframp commented 3 years ago

Etcd replication is a newer commercial feature of sensu-go, this adds a custom resource to create the supported replicator resources.

There are some unique issues to handle with replication config that make this resource a little more complex than others. It is technically allowed to disable transport security by setting "insecure: true" on the object definition in Sensu.

When using an insecure transport, the ca_cert,cert and key values are not required in the spec.

There is no simple way to have Chef custom resource properties be conditionally required properties based on the values of other properties in the same resource. For this reason the check_resource_semantics! callback is used for this custom resource to validate the runtime usage of the transport security resource properties.

If a user attempts to use this resource with the default value of "insecure: false" (which will enable transport security for etcd replication) a runtime error will be raised if they do not also set the cert and key properties on the resource. The ca_cert property has reasonable platform defaults but can be overidden.

Key management of the actual pem and key files is left entirely to the user.

This error will look something like this:

[2020-10-19T01:03:17+00:00] FATAL: RuntimeError: sensu_etcd_replicator[cluster_role_binding_replicator] (sensu_test::default line 362) had an error: RuntimeError:

For the resource: cluster_role_binding_replicator the property 'insecure' is set to 'false'.
This is the default and enables transport security for replication.
Transport security requires both 'cert' and 'key' properties of this resource to be set to valid local paths. Please set these values.

Pull Request Checklist

Is this in reference to an existing issue?

Yes, #105

General

New Features

Purpose

Support management of etcd replication with chef resources

Known Compatibility Issues

None

webframp commented 3 years ago

For reference here's upstream chef discussion about check_resource_semantics!:

And sensu docs on etcd replication: