|
47 | 47 | exit 1 |
48 | 48 | fi |
49 | 49 |
|
50 | | -gem install --no-document hiera-eyaml:${RUBYGEM_HIERA_EYAML} |
| 50 | +# Install gems into the system CRuby gem path. These back the tools that run |
| 51 | +# under the distro Ruby inside the container: the `puppet`/`facter` CLIs (used |
| 52 | +# by the entrypoint, e.g. `puppet config print`), the `puppetserver ca` CLI |
| 53 | +# (its cli/apps/ca app runs under the distro Ruby via /opt/puppetlabs/puppet/bin/ruby |
| 54 | +# and needs openvoxserver-ca plus its hocon dependency), and the `r10k` |
| 55 | +# convenience symlink created below. racc and syslog are stdlib gems dropped |
| 56 | +# from default Ruby 3.4+, installed here for the distro Ruby. rugged is a native |
| 57 | +# extension that cannot load on JRuby. |
| 58 | +# |
| 59 | +# NOTE: this path is NOT on puppetserver's JRuby gem-path. hiera-eyaml is needed |
| 60 | +# only by the server JVM (for eyaml Hiera lookups), so it is installed solely |
| 61 | +# into the JRuby gem-home further down, along with openvox. See #148. |
51 | 62 | gem install --no-document hocon:1.4.0 |
52 | 63 | gem install --no-document openvox:${RUBYGEM_OPENVOX} |
53 | 64 | gem install --no-document openvoxserver-ca:${RUBYGEM_OPENVOXSERVER_CA} |
@@ -97,13 +108,44 @@ chmod 0770 /opt/puppetlabs/server/data/puppetserver |
97 | 108 | find /etc/puppetlabs/puppet/ssl -type d -exec chmod 0770 {} \; |
98 | 109 |
|
99 | 110 | mkdir -p /opt/puppetlabs/puppet/bin |
100 | | -for executable in puppet facter ruby gem irb erb r10k eyaml |
| 111 | +for executable in puppet facter ruby gem irb erb r10k |
101 | 112 | do |
102 | 113 | ln -s "$(command -v "$executable")" "/opt/puppetlabs/puppet/bin/$executable" |
103 | 114 | done |
104 | 115 |
|
105 | | -# install puppet gem as library into jruby loadpath |
| 116 | +# Install the gems the puppetserver JVM loads at runtime into the JRuby |
| 117 | +# gem-home. The `gem install` calls above only populate the distro CRuby gem |
| 118 | +# path (e.g. /var/lib/gems/3.x), which is NOT on puppetserver's JRuby gem-path, |
| 119 | +# so any gem the server loads is invisible there. openvox provides puppet as a |
| 120 | +# server library, and hiera-eyaml is required for eyaml-encrypted Hiera lookups |
| 121 | +# during catalog compilation. The other gems above are CLI tools that run under |
| 122 | +# the distro Ruby (not the JVM), so they are not needed here. See #148. |
106 | 123 | puppetserver gem install --no-document openvox:${RUBYGEM_OPENVOX} |
| 124 | +puppetserver gem install --no-document hiera-eyaml:${RUBYGEM_HIERA_EYAML} |
| 125 | + |
| 126 | +# Colocate the puppetdb termini with the openvox gem lib so the puppetdb_query |
| 127 | +# function resolves during compilation. The termini in vendor_ruby (on |
| 128 | +# ruby-load-path) cover the require-loaded terminus and report processor, but |
| 129 | +# Puppet 4 functions load via the Pops system loader, rooted at puppet's own lib |
| 130 | +# rather than ruby-load-path. Since #141 gem-installs openvox instead of using |
| 131 | +# the OS packages (whose openvoxdb-termini colocated everything in vendor_ruby), |
| 132 | +# that root is the gem lib, so puppetdb_query would otherwise be unknown. |
| 133 | +cp -r /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet \ |
| 134 | + "/opt/puppetlabs/server/data/puppetserver/jruby-gems/gems/openvox-${RUBYGEM_OPENVOX}/lib/" |
| 135 | + |
| 136 | +# Expose the `eyaml` CLI. hiera-eyaml lives only in the JRuby gem-home, and its |
| 137 | +# binstub there resolves the gem against the default (distro) gem-path, where it |
| 138 | +# is no longer installed, so it can't simply be symlinked. Wrap it to run under |
| 139 | +# the distro Ruby with GEM_PATH pointed at the JRuby gem-home; hiera-eyaml is a |
| 140 | +# pure-Ruby gem, so it loads fine there and we avoid JVM start-up. The CLI is |
| 141 | +# essentially never used inside the container, it is provided only for the |
| 142 | +# occasional manual eyaml encrypt/decrypt. |
| 143 | +cat > /opt/puppetlabs/puppet/bin/eyaml <<'SCRIPT' |
| 144 | +#!/bin/bash |
| 145 | +export GEM_PATH="/opt/puppetlabs/server/data/puppetserver/jruby-gems${GEM_PATH:+:$GEM_PATH}" |
| 146 | +exec ruby /opt/puppetlabs/server/data/puppetserver/jruby-gems/bin/eyaml "$@" |
| 147 | +SCRIPT |
| 148 | +chmod 0755 /opt/puppetlabs/puppet/bin/eyaml |
107 | 149 |
|
108 | 150 | # use system/root paths instead of non-root paths to make permission management |
109 | 151 | # and volume mounting simpler. for this we link the appropiate paths and explicitly |
|
0 commit comments