Add support for Puppet 8

Puppetfile

@@ -3,42 +3,41 @@
 forge "https://forgeapi.puppetlabs.com"
 
 mod 'cmdntrf-consul_template', '2.3.8'
-mod 'derdanne-nfs', '2.1.11'
-mod 'heini-wait_for', '2.2.0'
+mod 'heini-wait_for', '3.0.0'
 mod 'puppet-alternatives', '6.0.0'
-mod 'puppet-augeasproviders_core', '4.0.1'
+mod 'puppet-archive', '7.1.0'
+mod 'puppet-augeasproviders_core', '4.1.0'
 mod 'puppet-augeasproviders_pam', '4.0.0'
-mod 'puppet-augeasproviders_shellvar', '6.0.0'
-mod 'puppet-augeasproviders_ssh', '6.0.0'
-mod 'puppet-augeasproviders_sysctl', '3.1.0'
-mod 'puppet-archive', '4.6.0'
-mod 'puppet-consul', '7.3.1'
+mod 'puppet-augeasproviders_shellvar', '6.0.1'
+mod 'puppet-augeasproviders_ssh', '7.0.0'
+mod 'puppet-augeasproviders_sysctl', '3.2.0'
+mod 'puppet-consul', '9.0.0'
 mod 'puppet-epel', '5.0.0'
-mod 'puppet-extlib', '7.0.0'
-mod 'puppet-fail2ban', '4.2.0'
-mod 'puppet-healthcheck', '1.0.1'
-mod 'puppet-kmod', '4.0.0'
-mod 'puppet-logrotate', '5.0.0'
+mod 'puppet-extlib', '7.2.0'
+mod 'puppet-fail2ban', '5.0.2'
+mod 'puppet-healthcheck', '2.1.0'
+mod 'puppet-kmod', '4.0.1'
+mod 'puppet-logrotate', '7.1.0'
+mod 'puppet-nfs', '3.0.0'
+mod 'puppet-nftables', '4.0.0'
 mod 'puppet-postfix', '5.1.0'
-mod 'puppet-prometheus', '12.5.0'
+mod 'puppet-prometheus', '15.0.0'
 mod 'puppet-prometheus_reporter', '2.0.0'
 mod 'puppet-rsyslog', '7.1.0'
-mod 'puppet-selinux', '3.4.1'
-mod 'puppet-squid', '3.0.0'
+mod 'puppet-selinux', '5.0.0'
+mod 'puppet-squid', '5.1.0'
+mod 'puppet-systemd', '7.1.0'
 mod 'puppet-swap_file', '5.0.0'
-mod 'puppet-systemd', '3.10.0'
-mod 'puppetlabs-concat', '7.4.0'
-mod 'puppetlabs-firewall', '5.0.0'
-mod 'puppetlabs-inifile', '6.1.0'
-mod 'puppetlabs-lvm', '1.4.0'
+mod 'puppetlabs-concat', '9.0.2'
+mod 'puppetlabs-inifile', '6.1.1'
+mod 'puppetlabs-lvm', '2.3.0'
 mod 'puppetlabs-mailalias_core', '1.2.0'
 mod 'puppetlabs-motd', '7.1.0'
-mod 'puppetlabs-mount_core', '1.0.4'
-mod 'puppetlabs-mysql', '13.3.0'
-mod 'puppetlabs-stdlib', '5.2.0'
-mod 'puppetlabs-transition', '0.1.3'
-mod 'treydock-globus', '9.0.0'
-mod 'saz-limits', '3.0.4'
+mod 'puppetlabs-mount_core', '1.3.0'
+mod 'puppetlabs-mysql', '16.0.0'
+mod 'puppetlabs-stdlib', '9.6.0'
+mod 'puppetlabs-transition', '2.0.0'
+mod 'saz-limits', '5.0.0'
 
 mod 'computecanada-jupyterhub',
     :git => 'https://github.com/ComputeCanada/puppet-jupyterhub.git',
@@ -50,4 +49,4 @@ mod 'computecanada-metrix',
 
 mod 'computecanada-uv',
     :git => 'https://github.com/ComputeCanada/puppet-uv.git',
-    :ref => 'v0.1.0'
+    :ref => 'v0.1.1'

data/site.yaml

@@ -11,6 +11,7 @@ magic_castle::site::all:
   - profile::freeipa
   - profile::base
   - profile::consul
+  - profile::firewall
   - profile::users::local
   - profile::sssd::client
   - profile::prometheus::node_exporter

site/profile/functions/getcidr.pp

@@ -1,4 +1,8 @@
 function profile::getcidr() >> String {
+  $terraform_cidr = lookup('terraform.network.cidr', String, 'first', '')
+  if $terraform_cidr != '' {
+    return $terraform_cidr
+  }
   $interface = profile::getlocalinterface()
   $masklen = extlib::netmask_to_cidr(profile::getnetmask())
   $ip = $networking['interfaces'][$interface]['ip']

site/profile/manifests/base.pp

@@ -58,41 +58,6 @@
     ensure => 'installed',
   }
 
-  package { 'firewalld':
-    ensure => 'absent',
-  }
-
-  class { 'firewall':
-    tag => 'mc_bootstrap',
-  }
-
-  # Sometimes systemd-tmpfiles-setup.service fails to create
-  # /run/lock/subsys folder which is required by iptables.
-  # This exec runs the command that should have created the folder
-  # if it is missing.
-  exec { 'systemd-tmpfiles --create --prefix=/run/lock/subsys':
-    unless => 'test -d /run/lock/subsys',
-    path   => ['/bin'],
-    notify => [Service['iptables'], Service['ip6tables']],
-  }
-
-  firewall { '001 accept all from local network':
-    chain  => 'INPUT',
-    proto  => 'all',
-    source => profile::getcidr(),
-    action => 'accept',
-    tag    => 'mc_bootstrap',
-  }
-
-  firewall { '001 drop access to metadata server':
-    chain       => 'OUTPUT',
-    proto       => 'tcp',
-    destination => '169.254.169.254',
-    action      => 'drop',
-    uid         => '! root',
-    tag         => 'mc_bootstrap',
-  }
-
   package { 'clustershell':
     ensure  => 'installed',
     require => Yumrepo['epel'],
@@ -113,7 +78,7 @@
     }
   }
 
-  ensure_packages($packages, { ensure => 'installed', require => Yumrepo['epel'] })
+  stdlib::ensure_packages($packages, { ensure => 'installed', require => Yumrepo['epel'] })
 
   if $::facts.dig('cloud', 'provider') == 'azure' {
     include profile::base::azure

site/profile/manifests/consul.pp

@@ -17,6 +17,13 @@
     $retry_join = $servers
   }
 
+  nftables::rule { 'default_in-consul_tcp':
+    content => 'tcp dport {8300,8301,8302,8500,8501,8502,8503,8600} accept comment "Accept consul"',
+  }
+  nftables::rule { 'default_in-consul_udp':
+    content => 'udp dport {8301,8302,8600} accept comment "Accept consul"',
+  }
+
   class { 'consul':
     config_mode   => '0640',
     acl_api_token => $acl_api_token,
@@ -69,7 +76,7 @@
   # consul config file like this:
   # jq -r .acl_agent_token /etc/consul/config.json
   include epel
-  ensure_packages(['jq'], { ensure => 'present', require => Yumrepo['epel'] })
+  stdlib::ensure_packages(['jq'], { ensure => 'present', require => Yumrepo['epel'] })
 
   # Ensure consul can read the state of agent_catalog_run.lock
   file { '/opt/puppetlabs/puppet/cache':

site/profile/manifests/fail2ban.pp

@@ -4,7 +4,9 @@
   include epel
 
   class { 'fail2ban' :
-    whitelist => ['127.0.0.1/8', profile::getcidr()] + $ignoreip,
+    banaction      => 'nftables-multiport',
+    iptables_chain => 'input',
+    whitelist      => ['127.0.0.1/8', profile::getcidr()] + $ignoreip,
   }
 
   file_line { 'fail2ban_sshd_recv_disconnect':

site/profile/manifests/firewall.pp

@@ -0,0 +1,14 @@
+class profile::firewall {
+  tag 'mc_bootstrap'
+  class { 'nftables':
+    out_all        => true,
+    noflush_tables => ['inet-f2b-table'],
+  }
+
+  # Do not let user get access to cloud-init metadata server as it could
+  # include sensitive information.
+  nftables::rule { 'default_out-drop_metadata':
+    content => 'ip daddr 169.254.169.254 skuid != 0 drop comment "Drop metadata server"',
+    order   => '89',
+  }
+}

site/profile/manifests/freeipa.pp

@@ -223,6 +223,28 @@
     mode   => '0755',
   }
 
+  include nftables::rules::dns
+  include nftables::rules::http
+  include nftables::rules::https
+  include nftables::rules::ldap
+  include nftables::rules::ssdp
+
+  nftables::rule { 'default_in-kerberos_tcp':
+    content => 'tcp dport 88 accept comment "Accept kerberos"',
+  }
+  nftables::rule { 'default_in-kerberos_udp':
+    content => 'udp dport 88 accept comment "Accept kerberos"',
+  }
+  nftables::rule { 'default_in-kpasswd_tcp':
+    content => 'tcp dport 464 accept comment "Accept kpasswd"',
+  }
+  nftables::rule { 'default_in-kpasswd_udp':
+    content => 'udp dport 464 accept comment "Accept kpasswd"',
+  }
+  nftables::rule { 'default_in-kadmind':
+    content => 'tcp dport 749 accept comment "Accept kadmind"',
+  }
+
   file { 'kinit_wrapper':
     path   => '/usr/bin/kinit_wrapper',
     source => 'puppet:///modules/profile/freeipa/kinit_wrapper',
@@ -246,7 +268,7 @@
     # https://pagure.io/freeipa/issue/9358
     # TODO: remove this patch once FreeIPA >= 4.10 is made available
     # in RHEL 8.
-    ensure_packages(['patch'], { ensure => 'present' })
+    stdlib::ensure_packages(['patch'], { ensure => 'present' })
     $python_version = lookup('os::redhat::python3::version')
     file { 'freeipa_27e9181bdc.patch':
       path   => "/usr/lib/python${python_version}/site-packages/freeipa_27e9181bdc.patch",
@@ -302,7 +324,11 @@
     require => [
       Package['ipa-server-dns'],
       File['/etc/hosts'],
-      File['/etc/ipa/dse-init.ldif']
+      File['/etc/ipa/dse-init.ldif'],
+      Class['nftables::rules::dns'],
+      Class['nftables::rules::https'],
+      Class['nftables::rules::ldap'],
+      Class['nftables::rules::ssdp'],
     ],
     notify  => [
       Service['systemd-logind'],
@@ -544,6 +570,10 @@
 ) {
   include mysql::server
 
+  nftables::rule { 'default_in-mokey_tcp':
+    content => 'tcp dport 12345 accept comment "Accept mokey"',
+  }
+
   yumrepo { 'mokey-copr-repo':
     enabled             => true,
     descr               => 'Copr repo for mokey owned by cmdntrf',
@@ -570,6 +600,8 @@
     password => $password,
     host     => 'localhost',
     grant    => ['ALL'],
+    charset  => 'utf8mb4',
+    collate  => 'utf8mb4_unicode_ci',
   }
 
   exec { 'mysql_mokey_schema':
@@ -657,8 +689,8 @@
         'password'             => $password,
         'dbname'               => 'mokey',
         'port'                 => $port,
-        'auth_key'             => seeded_rand_string(64, "${password}+auth_key", 'ABCDEF0123456789'),
-        'enc_key'              => seeded_rand_string(64, "${password}+enc_key", 'ABCEDF0123456789'),
+        'auth_key'             => stdlib::seeded_rand_string(64, "${password}+auth_key", 'ABCDEF0123456789'),
+        'enc_key'              => stdlib::seeded_rand_string(64, "${password}+enc_key", 'ABCEDF0123456789'),
         'enable_user_signup'   => $enable_user_signup,
         'require_verify_admin' => $require_verify_admin,
         'email_link_base'      => "https://mokey.${lookup('terraform.data.domain_name')}",

site/profile/manifests/gpu.pp

@@ -11,10 +11,10 @@
   Optional[String] $lib_symlink_path = undef
 ) {
   $restrict_profiling = lookup('profile::gpu::restrict_profiling')
-  ensure_resource('file', '/etc/nvidia', { 'ensure' => 'directory' })
-  ensure_packages(['kernel-devel'], { 'name' => "kernel-devel-${facts['kernelrelease']}" })
-  ensure_packages(['kernel-headers'], { 'name' => "kernel-headers-${facts['kernelrelease']}" })
-  ensure_packages(['dkms'], { 'require' => [Package['kernel-devel'], Yumrepo['epel']] })
+  stdlib::ensure_resource('file', '/etc/nvidia', { 'ensure' => 'directory' })
+  stdlib::ensure_packages(['kernel-devel'], { 'name' => "kernel-devel-${facts['kernelrelease']}" })
+  stdlib::ensure_packages(['kernel-headers'], { 'name' => "kernel-headers-${facts['kernelrelease']}" })
+  stdlib::ensure_packages(['dkms'], { 'require' => [Package['kernel-devel'], Yumrepo['epel']] })
   $nvidia_kmod = ['nvidia', 'nvidia_modeset', 'nvidia_drm', 'nvidia_uvm']
 
   selinux::module { 'nvidia-gpu':

site/profile/manifests/jupyterhub.pp

@@ -21,6 +21,10 @@
     tags => ['jupyterhub'],
   }
 
+  nftables::rule { 'default_in-jupyterhub_tcp':
+    content => 'tcp dport 8081 accept comment "Accept jupyterhub"',
+  }
+
   file { "${jupyterhub::prefix}/bin/ipa_create_user.py":
     source  => 'puppet:///modules/profile/users/ipa_create_user.py',
     mode    => '0755',
@@ -39,6 +43,9 @@
   if lookup('jupyterhub::kernel::install_method') == 'venv' and lookup('jupyterhub::kernel::venv::python') =~ /^\/cvmfs.*/ {
     Class['profile::software_stack'] -> Class['jupyterhub::kernel::venv']
   }
+  nftables::rule { 'default_in-jupyter_server':
+    content => 'tcp dport 32768-60999 accept comment "Accept jupyter_server"',
+  }
 }
 
 class profile::jupyterhub::hub::keytab {

site/profile/manifests/nfs.pp

@@ -69,6 +69,7 @@
   Optional[Array[String]] $export_paths = [],
 ) {
   include profile::volumes
+  include nftables::rules::nfs
 
   $nfs_domain = lookup('profile::nfs::domain')
   class { 'nfs':

site/profile/manifests/puppetserver.pp

@@ -48,4 +48,7 @@
     ensure => running,
     enable => true,
   }
+
+  include profile::firewall
+  include nftables::rules::puppet
 }

site/profile/manifests/reverse_proxy.pp

@@ -5,20 +5,17 @@
   String $main2sub_redir = 'jupyter',
   String $robots_txt = "User-agent: *\nDisallow: /",
 ) {
+  include profile::firewall
+
   selinux::boolean { 'httpd_can_network_connect': }
 
   selinux::module { 'caddy':
     ensure    => 'present',
     source_pp => 'puppet:///modules/profile/reverse_proxy/caddy.pp',
   }
 
-  firewall { '200 httpd public':
-    chain  => 'INPUT',
-    dport  => [80, 443],
-    proto  => 'tcp',
-    source => '0.0.0.0/0',
-    action => 'accept',
-  }
+  include nftables::rules::http
+  include nftables::rules::https
 
   yumrepo { 'caddy-copr-repo':
     enabled             => true,