Merge pull request #962 from lsst-it/IT-4687/dep-update

(Puppetfile) bulk mod update; migrate to stdlib 9.x

Puppetfile

@@ -1,17 +1,18 @@
 forge 'https://forgeapi.puppetlabs.com'
 
-mod 'blockops/tailscale', git: 'https://github.com/lsst-it/puppet-tailscale', ref: '3b02597'  # https://gitlab.com/blockops/puppet-tailscale/-/merge_requests/6
+mod 'blockops/tailscale', git: 'https://github.com/lsst-it/puppet-tailscale', ref: '6334c25'  # https://gitlab.com/blockops/puppet-tailscale/-/merge_requests/6
+mod 'bodgit/scl', git: 'https://github.com/lsst-it/puppet-scl', ref: 'c367361'  # https://github.com/bodgit/puppet-scl/pull/2
 mod 'camptocamp/augeas', '1.9.0'
 mod 'ccin2p3/etc_services', git: 'https://github.com/lsst-it/puppet-etc_services', ref: 'ff17b73' # https://github.com/ccin2p3/puppet-etc_services/pull/11
 mod 'ccin2p3/mit_krb5', git: 'https://github.com/lsst-it/puppet-mit_krb5.git', ref: 'f8f0242'  # https://github.com/ccin2p3/puppet-mit_krb5/pull/29 https://github.com/ccin2p3/puppet-mit_krb5/pull/34 https://github.com/ccin2p3/puppet-mit_krb5/pull/35
-mod 'cirrax/libvirt', '5.0.2'
+mod 'cirrax/libvirt', '5.0.3'
 mod 'derdanne/nfs', git: 'https://github.com/lsst-it/puppet-nfs', ref: '6d51f51'  # https://github.com/derdanne/puppet-nfs/pull/170
 mod 'duritong/sysctl', git: 'https://github.com/duritong/puppet-sysctl', ref: '847ec1c'  # migrate to herculesteam/augeasproviders_sysctl; https://github.com/duritong/puppet-sysctl/pull/48
-mod 'example42/network', git: 'https://github.com/lsst-it/puppet-network', ref: 'd5ea77e'  # allow stdlib/concat 9.x
+mod 'example42/network', git: 'https://github.com/lsst-it/puppet-network', ref: 'c2b5c59'  # allow stdlib/concat 9.x
 mod 'fervid/snapd', '1.2.1' # 2021-05-31 hreinking: snapd for EAS Raspberry Pi
 mod 'jamtur01/httpauth', '0.0.6'
-mod 'jcpunk/irqbalance', '1.0.3'
-mod 'jhoblitt/ipmi', '5.0.0'
+mod 'jcpunk/irqbalance', '1.0.5'
+mod 'jhoblitt/ipmi', '5.2.0'
 mod 'lsst/ccs_daq', '1.1.0'
 mod 'lsst/ccs_database', '3.1.0'
 mod 'lsst/ccs_hcu', '3.1.0'
@@ -23,94 +24,94 @@ mod 'lsst/daq', '2.2.0'
 mod 'lsst/dellperc', '2.0.0'
 mod 'lsst/foreman_envsync', '2.1.0'
 mod 'lsst/helm_binary', '2.1.0'
+mod 'lsst/ipa', git: 'https://github.com/lsst-it/puppet-ipa', ref: '8ec66d1'
 mod 'lsst/java_artisanal', '3.3.0'
 mod 'lsst/kubectl', '1.1.0'
 mod 'lsst/maven', '3.1.0'
 mod 'lsst/nm', '0.2.0'
 mod 'lsst/rke', '2.1.0'
 mod 'lsst/smee', '2.2.0'
-mod 'puppet/alternatives', '4.1.0'
-mod 'puppet/archive', '6.0.2'
-mod 'puppet/augeasproviders_core', '3.2.0'
-mod 'puppet/augeasproviders_grub', '4.0.0'
-mod 'puppet/augeasproviders_shellvar', '5.0.0'
-mod 'puppet/chrony', '2.6.0'
-mod 'puppet/cron', '3.0.0'
+mod 'puppet/alternatives', '5.0.0'
+mod 'puppet/archive', '7.0.0'
+mod 'puppet/augeasproviders_core', '4.0.1'
+mod 'puppet/augeasproviders_grub', '5.0.1'
+mod 'puppet/augeasproviders_shellvar', '6.0.0'
+mod 'puppet/chrony', '3.0.0'
+mod 'puppet/cron', '4.1.0'
 mod 'puppet/epel', '4.1.0'
-mod 'puppet/extlib', '6.2.0'
-mod 'puppetfinland/easy_ipa', git: 'https://github.com/lsst-it/puppet-ipa', ref: 'e349cd3'  # https://github.com/Puppet-Finland/puppet-ipa/pull/32
-mod 'puppet/firewalld', '4.5.1'
-mod 'puppet/hosts', git: 'https://github.com/voxpupuli/puppet-hosts', ref: 'v0.1.0'
-mod 'puppet/ipset', '3.0.0'
-mod 'puppet/kmod', '3.2.0'
-mod 'puppetlabs/accounts', '7.1.1'
-mod 'puppetlabs/apache', '7.0.0'
-mod 'puppetlabs/apt', '8.3.0'
-mod 'puppetlabs/augeas_core', '1.2.0'
-mod 'puppetlabs/concat', '7.4.0'
-mod 'puppetlabs/cron_core', '1.1.0'
-mod 'puppetlabs/docker', '7.0.0'
+mod 'puppet/extlib', '7.0.0'
+mod 'puppet/firewalld', git: 'https://github.com/voxpupuli/puppet-firewalld', ref: '1eb95e1'  # stdlib 9.x
+mod 'puppet/hosts', '0.1.0'
+mod 'puppet/ipset', '4.0.0'
+mod 'puppet/kmod', '4.0.1'
+mod 'puppetlabs/accounts', '8.1.0'
+mod 'puppetlabs/apache', '10.1.1'
+mod 'puppetlabs/apt', '9.1.0'
+mod 'puppetlabs/augeas_core', '1.4.1'
+mod 'puppetlabs/concat', '9.0.0'
+mod 'puppetlabs/cron_core', '1.2.0'
+mod 'puppetlabs/docker', '9.1.0'
 mod 'puppetlabs/facts', '1.4.0'
-mod 'puppetlabs/firewall', '3.4.0'
-mod 'puppetlabs/host_core', '1.1.0'
-mod 'puppetlabs/inifile', '5.4.0'
-mod 'puppetlabs/java', '8.0.0'
+mod 'puppetlabs/firewall', '6.0.0'
+mod 'puppetlabs/host_core', '1.2.0'
+mod 'puppetlabs/inifile', '6.1.0'
+mod 'puppetlabs/java', '10.1.2'
 mod 'puppetlabs/k5login_core', '1.0.2'
 mod 'puppetlabs/mailalias_core', '1.1.0'
-mod 'puppetlabs/mount_core', '1.1.0'
+mod 'puppetlabs/mount_core', '1.2.0'
 mod 'puppetlabs/mount_providers', '2.0.1'
-mod 'puppetlabs/mysql', '12.0.2'
-mod 'puppetlabs/ntp', '9.1.0'
-mod 'puppetlabs/postgresql', '8.2.1'
-mod 'puppetlabs/puppet_agent', '4.12.1'
-mod 'puppetlabs/puppetdb', '7.12.0'
+mod 'puppetlabs/mysql', '15.0.0'
+mod 'puppetlabs/ntp', '10.1.0'
+mod 'puppetlabs/postgresql', '9.2.0'
+mod 'puppetlabs/puppet_agent', '4.15.0'
+mod 'puppetlabs/puppetdb', git: 'https://github.com/puppetlabs/puppetlabs-puppetdb', ref: '7.14.0'  # 7.14.0 was tagged but not released to forge
 mod 'puppetlabs/puppetserver_gem', '1.1.1'
-mod 'puppetlabs/reboot', '4.1.0'
-mod 'puppetlabs/selinux_core', '1.2.0'
-mod 'puppetlabs/sshkeys_core', '2.3.0'
-mod 'puppetlabs/stdlib', '8.6.0'
-mod 'puppetlabs/tomcat', '6.2.0'
-mod 'puppetlabs/vcsrepo', '5.3.0'
-mod 'puppetlabs/xinetd', '3.3.0'
-mod 'puppetlabs/yumrepo_core', '1.1.0'
-mod 'puppet/letsencrypt', '8.0.2'
-mod 'puppet/lldpd', '5.1.0'
-mod 'puppet/mosquitto', '1.2.0'
-mod 'puppet/nginx', '3.3.0'
-mod 'puppet/openldap', '5.0.1'
-mod 'puppet/postfix',  '3.0.0'
-mod 'puppet/python', '6.3.0'
-mod 'puppet/r10k', '10.3.0'
-mod 'puppet/redis', '8.8.0'
-mod 'puppet/rsyslog', '6.0.0'
-mod 'puppet/scl', git: 'https://github.com/lsst-it/puppet-scl', ref: 'production'  # https://github.com/bodgit/puppet-scl/pull/2
-mod 'puppet/selinux', '3.4.1'
-mod 'puppet/ssh_keygen', '5.0.2'
+mod 'puppetlabs/reboot', '5.0.0'
+mod 'puppetlabs/selinux_core', '1.3.0'
+mod 'puppetlabs/sshkeys_core', '2.4.0'
+mod 'puppetlabs/stdlib', '9.4.0'
+mod 'puppetlabs/tomcat', git: 'https://github.com/puppetlabs/puppetlabs-tomcat', ref: 'ad28630'  # archive 7.x
+mod 'puppetlabs/transition', '2.0.0'
+mod 'puppetlabs/vcsrepo', '6.1.0'
+mod 'puppetlabs/xinetd', '3.4.1'
+mod 'puppetlabs/yumrepo_core', '2.0.0'
+mod 'puppet/letsencrypt', '10.1.0'
+mod 'puppet/lldpd', '6.0.0'
+mod 'puppet/mosquitto', '2.0.0'
+mod 'puppet/nginx', '5.0.0'
+mod 'puppet/openldap', '7.0.0'
+mod 'puppet/postfix',  '4.3.0'
+mod 'puppet/python', '7.0.0'
+mod 'puppet/r10k', '12.2.0'
+mod 'puppet/redis', '9.1.0'
+mod 'puppet/rsyslog', '7.1.0'
+mod 'puppet/selinux', '4.0.0'
+mod 'puppet/ssh_keygen', '6.0.0'
 mod 'puppet/sssd', '1.0.0'
-mod 'puppet/systemd', '3.10.0'
-mod 'puppet/telegraf', '4.3.1'  # requires toml-rb installed on master
+mod 'puppet/systemd', '5.2.0'
+mod 'puppet/telegraf', '5.2.0'
 mod 'puppet/tuned', '1.0.0'
-mod 'puppet/yum', '6.1.0'
-mod 'qtechnologies/sysstat', '1.2.4'
+mod 'puppet/yum', '7.1.0'
+mod 'qtechnologies/sysstat', '1.2.7'
 mod 'richardc/datacat', '0.6.2'
-mod 'saz/resolv_conf', git: 'https://github.com/saz/puppet-resolv_conf', ref: 'c22ad80'  # https://github.com/saz/puppet-resolv_conf/issues/71
-mod 'saz/ssh', git: 'https://github.com/lsst-it/saz-puppet-ssh', ref: '6fad31a'  # https://github.com/saz/puppet-ssh/pull/344
-mod 'saz/sudo', '7.0.2'
-mod 'saz/timezone', '6.2.0'
-mod 'simp/auditd', git: 'https://github.com/lsst-it/pupmod-simp-auditd', ref: '2b3f311'  # https://github.com/simp/pupmod-simp-auditd/pull/160 https://github.com/simp/pupmod-simp-auditd/pull/161 https://github.com/simp/pupmod-simp-auditd/pull/164 https://github.com/simp/pupmod-simp-auditd/pull/189
-mod 'simp/dconf', git: 'https://github.com/lsst-it/pupmod-simp-dconf', ref: 'c196d2c'  # https://github.com/simp/pupmod-simp-dconf/pull/45
-mod 'simp/mate', git: 'https://github.com/lsst-it/pupmod-simp-mate', ref: 'f692a64'  # https://github.com/simp/pupmod-simp-mate/pull/40
-mod 'simp/polkit', git: 'https://github.com/lsst-it/pupmod-simp-polkit', ref: '4f769e6'  # https://github.com/simp/pupmod-simp-polkit/pull/62
-mod 'simp/simpkv', git: 'https://github.com/lsst-it/pupmod-simp-simpkv', ref: '71ae5b7'  # https://github.com/simp/pupmod-simp-simpkv/pull/72
-mod 'simp/simplib', git: 'https://github.com/lsst-it/pupmod-simp-simplib', ref: 'de5ec9f'  # https://github.com/simp/pupmod-simp-simplib/pull/284
-mod 'stm/debconf', '4.1.0'
+mod 'saz/resolv_conf', git: 'https://github.com/lsst-it/puppet-resolv_conf', ref: '5c00538'  # https://github.com/saz/puppet-resolv_conf/pull/72
+mod 'saz/ssh', '11.1.0'
+mod 'saz/sudo', '8.0.0'
+mod 'saz/timezone', '6.3.0'
+mod 'simp/auditd', '8.13.0'
+mod 'simp/dconf', '0.4.0'
+mod 'simp/mate', '1.6.0'
+mod 'simp/polkit', '6.7.0'
+mod 'simp/simpkv', '0.12.0'
+mod 'simp/simplib', '4.12.1'
+mod 'stm/debconf', '5.0.0'
 mod 'syseleven/restic', '2.6.1'
-mod 'theforeman/dhcp', '8.2.0'
-mod 'theforeman/dns', '9.2.0'
-mod 'theforeman/foreman', git: 'https://github.com/lsst-it/puppet-foreman', ref: '306b18e'  # 20.2.0 + dep updates
-mod 'theforeman/foreman_proxy', git: 'https://github.com/lsst-it/puppet-foreman_proxy', ref: 'f641120'  # https://github.com/theforeman/puppet-foreman_proxy/pull/772
-mod 'theforeman/puppet', '16.3.0'
-mod 'theforeman/puppetserver_foreman', '2.1.0'
-mod 'theforeman/tftp', '7.1.0'
-mod 'treydock/clustershell', '2.0.0'
-mod 'treydock/perfsonar', '2.0.0'
+mod 'theforeman/dhcp', git: 'https://github.com/lsst-it/puppet-dhcp', ref: '4d48173'  # https://github.com/theforeman/puppet-dhcp/pull/226
+mod 'theforeman/dns', '10.1.0'
+mod 'theforeman/foreman', git: 'https://github.com/lsst-it/puppet-foreman', ref: '70b70bc'  # 20.2.0 + dep updates
+mod 'theforeman/foreman_proxy', git: 'https://github.com/lsst-it/puppet-foreman_proxy', ref: '39ef803'  # https://github.com/theforeman/puppet-foreman_proxy/pull/772 https://github.com/theforeman/puppet-foreman_proxy/pull/816
+mod 'theforeman/puppet', git: 'https://github.com/lsst-it/puppet-puppet', ref: '8ef01c3'  # https://github.com/theforeman/puppet-puppet/pull/891
+mod 'theforeman/puppetserver_foreman', '2.4.0'
+mod 'theforeman/tftp', git: 'https://github.com/theforeman/puppet-tftp', ref: '6e49a28'  # stdlib 9.x
+mod 'treydock/clustershell', '3.0.0'
+mod 'treydock/perfsonar', '3.1.0'

hieradata/common.yaml

@@ -142,22 +142,16 @@ ssh::server::match_block:
     <<: *authorized_keys
   csilva_b:
     <<: *authorized_keys
-# easy_ipa server options
+# ipa server options
 # defines the uid/gid of the admin user
 # needs to be coordinated between master + replicas
-easy_ipa::idstart: 70000
-easy_ipa::idmax: 79999
-easy_ipa::domain: "lsst.cloud"
-easy_ipa::ipa_master_fqdn: "ipa1.cp.lsst.org"
-# easy_ipa client options
-easy_ipa::ipa_role: "client"
-easy_ipa::configure_ntp: false
-easy_ipa::configure_sshd: false
-easy_ipa::install_autofs: false
-easy_ipa::install_epel: false
-easy_ipa::install_kstart: false
-easy_ipa::install_sssd: false
-easy_ipa::install_sssdtools: false
+ipa::idstart: 70000
+ipa::idmax: 79999
+ipa::domain: "lsst.cloud"
+ipa::ipa_master_fqdn: "ipa1.cp.lsst.org"
+# ipa client options
+ipa::ipa_role: "client"
+ipa::configure_ntp: false
 epel::epel_managed: true
 epel::epel_source_managed: false
 epel::epel_debuginfo_managed: true
@@ -347,10 +341,10 @@ sssd::main_config:
       - "sudo"
   nss:
     homedir_substring: "/home"
-  "domain/%{lookup('easy_ipa::domain')}":
+  "domain/%{lookup('ipa::domain')}":
     cache_credentials: true
     krb5_store_password_if_offline: true
-    ipa_domain: "%{lookup('easy_ipa::domain')}"
+    ipa_domain: "%{lookup('ipa::domain')}"
     id_provider: "ipa"
     auth_provider: "ipa"
     access_provider: "ipa"
@@ -359,8 +353,8 @@ sssd::main_config:
     chpass_provider: "ipa"
     ipa_server:
       - "_srv_"
-      - "%{lookup('easy_ipa::ipa_master_fqdn')}"
-    dns_discovery_domain: "%{::site}._locations.%{lookup('easy_ipa::domain')}"
+      - "%{lookup('ipa::ipa_master_fqdn')}"
+    dns_discovery_domain: "%{::site}._locations.%{lookup('ipa::domain')}"
 sssd::package_name:
   - "sssd"
   - "sssd-tools"  # not installed by default
@@ -385,25 +379,25 @@ mit_krb5::ticket_lifetime: "24h"
 mit_krb5::udp_preference_limit: "0"
 mit_krb5::realms:
   "%{lookup('mit_krb5::default_realm')}":
-    kdc: "%{lookup('easy_ipa::ipa_master_fqdn')}:88"
-    master_kdc: "%{lookup('easy_ipa::ipa_master_fqdn')}:88"
-    admin_server: "%{lookup('easy_ipa::ipa_master_fqdn')}:749"
-    kpasswd_server: "%{lookup('easy_ipa::ipa_master_fqdn')}:464"
-    default_domain: "%{lookup('easy_ipa::domain')}"
+    kdc: "%{lookup('ipa::ipa_master_fqdn')}:88"
+    master_kdc: "%{lookup('ipa::ipa_master_fqdn')}:88"
+    admin_server: "%{lookup('ipa::ipa_master_fqdn')}:749"
+    kpasswd_server: "%{lookup('ipa::ipa_master_fqdn')}:464"
+    default_domain: "%{lookup('ipa::domain')}"
     pkinit_anchors: "FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem"
     pkinit_pool: "FILE:/var/lib/ipa-client/pki/ca-bundle.pem"
 mit_krb5::domain_realms:
   "%{lookup('mit_krb5::default_realm')}":
     domains:
-      - ".%{lookup('easy_ipa::domain')}"
-      - "%{lookup('easy_ipa::domain')}"
+      - ".%{lookup('ipa::domain')}"
+      - "%{lookup('ipa::domain')}"
       - "%{facts.fqdn}"
       - ".%{facts.domain}"
       - "%{facts.domain}"
 
 openldap::client::tls_cacertdir: "/etc/openldap/certs"
 openldap::client::sasl_nocanon: true
-openldap::client::uri: "ldaps://%{lookup('easy_ipa::ipa_master_fqdn')}"
+openldap::client::uri: "ldaps://%{lookup('ipa::ipa_master_fqdn')}"
 openldap::client::base: "dc=lsst,dc=cloud"
 openldap::client::tls_cacert: "/etc/ipa/ca.crt"
 openldap::client::sasl_mech: "GSSAPI"
@@ -412,10 +406,10 @@ profile::core::ipa::default:
   global:
     basedn: "%{lookup('openldap::client::base')}"
     realm: "%{lookup('mit_krb5::default_realm')}"
-    domain: "%{lookup('easy_ipa::domain')}"
-    server: "%{lookup('easy_ipa::ipa_master_fqdn')}"
+    domain: "%{lookup('ipa::domain')}"
+    server: "%{lookup('ipa::ipa_master_fqdn')}"
     host: "%{facts.fqdn}"
-    xmlrpc_uri: "https://%{lookup('easy_ipa::ipa_master_fqdn')}/ipa/xml"
+    xmlrpc_uri: "https://%{lookup('ipa::ipa_master_fqdn')}/ipa/xml"
     enable_ra: "True"
 
 profile::core::monitoring::database: "telegraf"

hieradata/node/ipa1.dev.lsst.org.yaml

@@ -1,3 +1,3 @@
 ---
 # need to use an off site ipa replica to bootstrap the first local ipa instance
-easy_ipa::ipa_master_fqdn: "ipa2.ls.lsst.org"
+ipa::ipa_master_fqdn: "ipa2.ls.lsst.org"

hieradata/node/ipa1.ls.lsst.org.yaml

@@ -1,3 +1,3 @@
 ---
 # need to use an off site ipa replica to bootstrap the first local ipa instance
-easy_ipa::ipa_master_fqdn: "ipa1.tu.lsst.org"
+ipa::ipa_master_fqdn: "ipa1.tu.lsst.org"

hieradata/node/ipa1.tu.lsst.org.yaml

@@ -1,6 +1,6 @@
 ---
 # need to use an off site ipa replica to bootstrap the first local ipa instance
-easy_ipa::ipa_master_fqdn: "ipa1.cp.lsst.org"
+ipa::ipa_master_fqdn: "ipa1.cp.lsst.org"
 network::interfaces_hash:
   eth0:  # fqdn
     ipaddress: "140.252.146.74"

hieradata/role/cmms.yaml

@@ -1,12 +1,10 @@
 ---
 classes:
   - "accounts"
-  - "easy_ipa"
+  - "ipa"
   - "network"
   - "profile::core::cmms"
   - "puppet_agent"
   - "resolv_conf"
   - "ssh"
   - "sudo"
-
-easy_ipa::install_sssd: true

hieradata/role/ipareplica.yaml

@@ -1,30 +1,21 @@
 ---
 classes:
   - "clustershell"
-  - "easy_ipa"
+  - "ipa"
   - "profile::core::common"
   - "profile::core::ipa_pwd_reset"
   - "tailscale"
 
 profile::core::common::disable_ipv6: true
-profile::core::common::manage_ipa: false
 profile::core::common::manage_krb5: false
 profile::core::common::manage_sssd: false
 profile::core::sysctl::disable_ipv6::disable: false  # ipa-server-install wants ipv6
-easy_ipa::ipa_role: "replica"
-easy_ipa::configure_replica_ca: true
-easy_ipa::install_ipa_server: true
-easy_ipa::enable_ip_address: true
-easy_ipa::webui_disable_kerberos: true
-easy_ipa::webui_enable_proxy: true
-easy_ipa::webui_force_https: true
-easy_ipa::configure_dns_server: false
-easy_ipa::ipa_server_fqdn: "%{facts.fqdn}"
-easy_ipa::ip_address: "%{facts.networking.ip}"
-
-# enable easy_ipa management of sssd packages on servers
-easy_ipa::install_sssd: true
-easy_ipa::install_sssdtools: true
+ipa::ipa_role: "replica"
+ipa::configure_replica_ca: true
+ipa::enable_ip_address: true
+ipa::configure_dns_server: false
+ipa::ipa_server_fqdn: "%{facts.fqdn}"
+ipa::ip_address: "%{facts.networking.ip}"
 
 clustershell::groupmembers:
   ipa:

hieradata/role/ubuntu.yaml

@@ -1,9 +1,7 @@
 ---
 classes:
   - "accounts"
-  - "easy_ipa"
+  - "ipa"
   - "puppet_agent"
   - "ssh"
   - "sudo"
-
-easy_ipa::install_sssd: true

hieradata/site/cp.yaml

@@ -1,7 +1,7 @@
 ---
 docker::log_driver: ~
 docker::log_opt: ~
-easy_ipa::ipa_master_fqdn: "ipa1.cp.lsst.org"
+ipa::ipa_master_fqdn: "ipa1.cp.lsst.org"
 rsyslog::config::actions:
 # Send copy to logs to GKE Graylog instance
   graylogCloud:

hieradata/site/dev.yaml

@@ -1,5 +1,5 @@
 ---
-easy_ipa::ipa_master_fqdn: "ipa1.ls.lsst.org"
+ipa::ipa_master_fqdn: "ipa1.ls.lsst.org"
 rsyslog::config::actions:
 # Send copy to logs to Ruka Cluster
   graylogCloud: