From 497329e0935b32737f35a939ef3f5e4846c90877 Mon Sep 17 00:00:00 2001 From: Benedikt Trefzer Date: Mon, 12 Aug 2024 22:47:22 +0200 Subject: [PATCH] add support for journal upload to a remote server --- REFERENCE.md | 36 ++++++++++++++++++++++++ data/Debian-family.yaml | 1 + data/RedHat-family.yaml | 1 + manifests/init.pp | 12 ++++++++ manifests/journal_upload.pp | 38 ++++++++++++++++++++++++++ spec/classes/init_spec.rb | 50 ++++++++++++++++++++++++++++++++++ types/journaluploadsettings.pp | 12 ++++++++ 7 files changed, 150 insertions(+) create mode 100644 manifests/journal_upload.pp create mode 100644 types/journaluploadsettings.pp diff --git a/REFERENCE.md b/REFERENCE.md index 8f61754e..42742cfd 100644 --- a/REFERENCE.md +++ b/REFERENCE.md @@ -15,6 +15,7 @@ * `systemd::coredump`: This class manages the systemd-coredump configuration. * `systemd::install`: Install any systemd sub packages +* `systemd::journal_upload`: This class manages and configures journal-upload. * `systemd::journald`: This class manages and configures journald. * `systemd::logind`: This class manages systemd's login manager configuration. * `systemd::machine_info`: This class manages systemd's machine-info file (hostnamectl) @@ -56,6 +57,7 @@ * [`Systemd::CoredumpSettings`](#Systemd--CoredumpSettings): Configurations for coredump.conf * [`Systemd::Dropin`](#Systemd--Dropin): custom datatype that validates filenames/paths for valid systemd dropin files +* [`Systemd::JournalUploadSettings`](#Systemd--JournalUploadSettings): Matches Systemd journal upload config Struct * [`Systemd::JournaldSettings`](#Systemd--JournaldSettings): Matches Systemd journald config Struct * [`Systemd::JournaldSettings::Ensure`](#Systemd--JournaldSettings--Ensure): defines allowed ensure states for systemd-journald settings * [`Systemd::LogindSettings`](#Systemd--LogindSettings): Matches Systemd Login Manager Struct @@ -126,6 +128,8 @@ The following parameters are available in the `systemd` class: * [`set_local_rtc`](#-systemd--set_local_rtc) * [`manage_journald`](#-systemd--manage_journald) * [`journald_settings`](#-systemd--journald_settings) +* [`manage_journal_upload`](#-systemd--manage_journal_upload) +* [`journal_upload_settings`](#-systemd--journal_upload_settings) * [`manage_udevd`](#-systemd--manage_udevd) * [`udev_log`](#-systemd--udev_log) * [`udev_children_max`](#-systemd--udev_children_max) @@ -460,6 +464,22 @@ Config Hash that is used to configure settings in journald.conf Default value: `{}` +##### `manage_journal_upload` + +Data type: `Boolean` + +Manage the systemd journal upload to a remote server + +Default value: `false` + +##### `journal_upload_settings` + +Data type: `Systemd::JournalUploadSettings` + +Config Hash that is used to configure settings in journal-upload.conf + +Default value: `{}` + ##### `manage_udevd` Data type: `Boolean` @@ -2562,6 +2582,22 @@ custom datatype that validates filenames/paths for valid systemd dropin files Alias of `Pattern['^[^/]+\.conf$']` +### `Systemd::JournalUploadSettings` + +Matches Systemd journal upload config Struct + +Alias of + +```puppet +Struct[{ + Optional['URL'] => Variant[Stdlib::HTTPUrl,Systemd::JournaldSettings::Ensure], + Optional['ServerKeyFile'] => Variant[Stdlib::Unixpath,Systemd::JournaldSettings::Ensure], + Optional['ServerCertificateFile'] => Variant[Stdlib::Unixpath,Systemd::JournaldSettings::Ensure], + Optional['TrustedCertificateFile'] => Variant[Stdlib::Unixpath,Systemd::JournaldSettings::Ensure], + Optional['NetworkTimeoutSec'] => Variant[Systemd::Unit::Timespan,Systemd::JournaldSettings::Ensure], + }] +``` + ### `Systemd::JournaldSettings` Matches Systemd journald config Struct diff --git a/data/Debian-family.yaml b/data/Debian-family.yaml index 5c644fa2..b5c6093e 100644 --- a/data/Debian-family.yaml +++ b/data/Debian-family.yaml @@ -1,2 +1,3 @@ --- systemd::nspawn_package: 'systemd-container' +systemd::journal_upload::package_name: 'systemd-journal-remote' diff --git a/data/RedHat-family.yaml b/data/RedHat-family.yaml index 199df535..f16889bc 100644 --- a/data/RedHat-family.yaml +++ b/data/RedHat-family.yaml @@ -2,3 +2,4 @@ systemd::networkd_package: systemd-networkd systemd::nspawn_package: 'systemd-container' systemd::resolved_package: 'systemd-resolved' +systemd::journal_upload::package_name: 'systemd-journal-remote' diff --git a/manifests/init.pp b/manifests/init.pp index 56575d24..7382876e 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -132,6 +132,12 @@ # @param journald_settings # Config Hash that is used to configure settings in journald.conf # +# @param manage_journal_upload +# Manage the systemd journal upload to a remote server +# +# @param journal_upload_settings +# Config Hash that is used to configure settings in journal-upload.conf +# # @param manage_udevd # Manage the systemd udev daemon # @@ -253,6 +259,8 @@ Boolean $purge_dropin_dirs = true, Boolean $manage_journald = true, Systemd::JournaldSettings $journald_settings = {}, + Boolean $manage_journal_upload = false, + Systemd::JournalUploadSettings $journal_upload_settings = {}, Systemd::MachineInfoSettings $machine_info_settings = {}, Boolean $manage_udevd = false, Optional[Variant[Integer,String]] $udev_log = undef, @@ -355,6 +363,10 @@ contain systemd::journald } + if $manage_journal_upload { + contain systemd::journal_upload + } + if $manage_logind { contain systemd::logind } diff --git a/manifests/journal_upload.pp b/manifests/journal_upload.pp new file mode 100644 index 00000000..a035373e --- /dev/null +++ b/manifests/journal_upload.pp @@ -0,0 +1,38 @@ +# @api private +# @summary This class manages and configures journal-upload. +# @see https://www.freedesktop.org/software/systemd/man/journald.conf.html +# +# @param package_name +# name of the package to install for the functionality +# +class systemd::journal_upload ( + Optional[String[1]] $package_name = undef, +) { + assert_private() + + if $package_name { + stdlib::ensure_packages($package_name) + } + + service { 'systemd-journal-upload': + ensure => running, + } + $systemd::journal_upload_settings.each |$option, $value| { + ini_setting { + $option: + path => '/etc/systemd/journal-upload.conf', + section => 'Upload', + setting => $option, + notify => Service['systemd-journal-upload'], + } + if $value =~ Hash { + Ini_setting[$option] { + * => $value, + } + } else { + Ini_setting[$option] { + value => $value, + } + } + } +} diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index 1be26d8a..4ba2ae14 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -587,6 +587,56 @@ it { is_expected.not_to contain_service('systemd-journald') } end + context 'when journal-upload is enabled' do + let(:params) do + { + manage_journal_upload: true, + journal_upload_settings: { + 'URL' => 'https://central.server:19532', + 'ServerKeyFile' => '/tmp/key.pem', + 'ServerCertificateFile' => '/tmp/cert.pem', + 'TrustedCertificateFile' => { + 'ensure' => 'absent', + }, + }, + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_service('systemd-journal-upload') } + + it { is_expected.to have_ini_setting_resource_count(4) } + + it { + expect(subject).to contain_ini_setting('URL').with( + path: '/etc/systemd/journal-upload.conf', + section: 'Upload', + notify: 'Service[systemd-journal-upload]', + value: 'https://central.server:19532' + ) + } + + it { + expect(subject).to contain_ini_setting('TrustedCertificateFile').with( + path: '/etc/systemd/journal-upload.conf', + section: 'Upload', + notify: 'Service[systemd-journal-upload]', + ensure: 'absent' + ) + } + end + + context 'when journal-upload is not enabled' do + let(:params) do + { + manage_journal_upload: false, + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.not_to contain_service('systemd-journal-upload') } + end + context 'when disabling udevd management' do let(:params) do { diff --git a/types/journaluploadsettings.pp b/types/journaluploadsettings.pp new file mode 100644 index 00000000..66ef297c --- /dev/null +++ b/types/journaluploadsettings.pp @@ -0,0 +1,12 @@ +# Matches Systemd journal upload config Struct +type Systemd::JournalUploadSettings = Struct[ + # lint:ignore:140chars + { + Optional['URL'] => Variant[Stdlib::HTTPUrl,Systemd::JournaldSettings::Ensure], + Optional['ServerKeyFile'] => Variant[Stdlib::Unixpath,Systemd::JournaldSettings::Ensure], + Optional['ServerCertificateFile'] => Variant[Stdlib::Unixpath,Systemd::JournaldSettings::Ensure], + Optional['TrustedCertificateFile'] => Variant[Stdlib::Unixpath,Systemd::JournaldSettings::Ensure], + Optional['NetworkTimeoutSec'] => Variant[Systemd::Unit::Timespan,Systemd::JournaldSettings::Ensure], + } + # lint:endignore +]