Implement Validation Mode Flag for Puppet Resources

[michaeltlombardi]

Use Case

In the course of early user feedback for the Puppetized DSC modules, we have discovered that numerous DSC Resources are not able to have their state properly validated using the default property insync logic in Puppet. The sorts of problems encountered are as complicated as the issues in ActiveDirectoryDsc and NetworkingDsc or as straightforward as a Resource not returning a key property in Get (see these two PRs: 1, 2).

When property-by-property state comparisons are not possible, one of several problems from this non-exhaustive list can show up:

1. Flapping resources, applying on every run
2. Resources applying state when they shouldn't
3. Resources not applying state when they should
4. Resources erroring on type mismatches of desired state and actual

Describe the Solution You Would Like

When puppetlabs/puppet-resource_api#285 is merged and available in Puppet 6&7 it will be possible to implement a custom insync? method on the DSC base provider. This would enable the use of DSC's own state comparison checking to be leveraged in place of Puppet's. However, it would do so at the cost of property-by-property reporting; DSC's Test method invocation returns only true or false and does not indicate which properties, if any, are out of desired state.

Enabling this override should be on a resource-by-resource case in the manifest, with the default behavior being the existing property-by-property reporting. If an override is specified to instead use the less granular test method for comparing desired state.

Additional Context

The following issues would all benefit from using a resource validation mode instead of property-by-property:

• Inconsistent data from DSC ruby-pwsh#116
• non-idempotent securitypolicydsc resources ruby-pwsh#112
• NetworkingDsc\NetAdapterBinding continually correcting when executed via Puppet ruby-pwsh#106
• dsc_securityoption not behaving idempotently ruby-pwsh#104
• dsc_securityoption not idempotent ruby-pwsh#82
• Settings of auditpolicydsc are overwritten by puppetized securitypolicydsc #131
• ActiveDirectoryDsc: dscADGroup option non-idempotent #112

Acceptance Criteria

• Builder
  • Add custom_insync feature to generated types
  • Add new validation_mode attribute to generated types which takes the enums property and resource, defaulting to property
  • Add documentation for validation_mode and especially guidance on when to use it
  • Add acceptance tests for a resource which fails with validation_mode set to property but succeeds with validation_mode set to resource
• Base Provider
  • Add a new class variable to cache the test results, similar to cached_query_results
  • Add a new invoke_test_method which passes a should hash to Invoke-DscResource and caches the result to cached_query_results
  • Add a new insync? method which takes context, name, attribute_name, is_hash, and should_hash parameters:
    • If validation_mode is set to resource:
      • call invoke_test_method unless the resource insync state is already cached in cached_test_results
      • Return true if in desired state and false if not
    • If validation_mode is set to property:
      • Do nothing, allow the default insync checks to occur
  • Unit tests for invoke_test_method
  • Unit tests for insync?

[michaeltlombardi]

Blocked on the next releases of Puppet (6.23.0 and 7.?.? and the PDK which incorporates them).