Puppet 6 and module puppetlabs/accounts does not create user account in Hiera YAML format

问题

When I run puppet agent --test I have no errors output but the user did not create.

My puppet hira.yaml configuration is:

---
version: 5
  datadir: "/etc/puppetlabs/code/environments"
  data_hash: yaml_data
hierarchy:
  - name: "Per-node data (yaml version)"
    path: "%{::environment}/nodes/%{::trusted.certname}.yaml"
  - name: "Common YAML hierarchy levels"
    paths:
      - "defaults/common.yaml"
      - "defaults/users.yaml"

users.yaml is:

accounts::user:
  joed:
    locked: false
    comment: System Operator
    uid: '1700'
    gid: '1700'
    groups:
    - admin
    - sudonopw
    sshkeys:
    - ssh-rsa ...Hw== sysop+moduledevkey@puppetlabs.com

I use this module

回答1:

Nothing in Hiera data itself causes anything to be applied to target nodes. Some kind of declaration is required in a manifest somewhere or in the output of an external node classifier script. Moreover, the puppetlabs/accounts module provides only defined types, not classes. You can store defined-type data in Hiera and read it back, but automated parameter binding via Hiera applies only to classes, not defined types.

In short, then, no user is created (and no error is reported) because no relevant resources are declared into the target node's catalog. You haven't given Puppet anything to do.

If you want to apply the stored user data presented to your nodes, you would want something along these lines:

$user_data = lookup('accounts::user', Hash[String,Hash], 'hash', {})

$user_data.each |$user,$props| {
  accounts::user { $user: * => $props }
}

That would go into the node block matched to your target node, or, better, into a class that is declared by that node block or an equivalent. It's fairly complicated for so few lines, but in brief:

• the lookup function looks up key 'accounts::user' in your Hiera data

  • performing a hash merge of results appearing at different levels of the hierarchy
  • expecting the result to be a hash with string keys and hash values
  • and defaulting to an empty hash if no results are found;

• the mappings in the result hash are iterated, and for each one, an instance of the accounts::user defined type is declared

  • using the (outer) hash key as the user name,
  • and the value associated with that key as a mapping from parameter names to parameter values.

回答2:

There are a few problems here.

You are missing a line in your hiera.yaml namely the defaults key. It should be:

---
version: 5
defaults:  ## add this line
  datadir: "/etc/puppetlabs/code/environments"
  data_hash: yaml_data
hierarchy:
  - name: "Per-node data (yaml version)"
    path: "%{::environment}/nodes/%{::trusted.certname}.yaml"
  - name: "Common YAML hierarchy levels"
    paths:
      - "defaults/common.yaml"
      - "defaults/users.yaml"

I detected that using the puppet-syntax gem (included if you use PDK, which is recommended):

▶ bundle exec rake validate            
Syntax OK
---> syntax:manifests
---> syntax:templates
---> syntax:hiera:yaml
ERROR: Failed to parse hiera.yaml: (hiera.yaml): mapping values are not allowed in this context at line 3 column 10

Also, in addition to what John mentioned, the simplest class to read in your data would be this:

class test (Hash[String,Hash] $users) {
  create_resources(accounts::user, $users)
}

Or if you want to avoid using create_resources*:

class test (Hash[String,Hash] $users) {
  $users.each |$user,$props| {
    accounts::user { $user: * => $props }
  }
}

Note that I have relied on the Automatic Parameter Lookup feature for that. See the link below.

Then, in your Hiera data, you would have a key named test::users to correspond (class name "test", key name "users"):

---
test::users:  ## Note that this line changed.
  joed:
    locked: false
    comment: System Operator
    uid: '1700'
    gid: '1700'
    groups:
    - admin
    - sudonopw
    sshkeys:
    - ssh-rsa ...Hw== sysop+moduledevkey@puppetlabs.com

Use of automatic parameter lookup is generally the more idiomatic way of writing Puppet code compared to calling the lookup function explicitly.

For more info:

• PDK
• Automatic Parameter Lookup
• create_resources

(*Note that create_resources is "controversial". Many in the Puppet community prefer not to use it.)

来源：https://stackoverflow.com/questions/54871219/puppet-6-and-module-puppetlabs-accounts-does-not-create-user-account-in-hiera-ya