name resolver

[Albert Shih]

Hi,

Is they are any way puppet can make some "name resolver" ?

The purpose is to make the firewall rule withouts putting the ip adresse
inside hiera.

For example I want add on all my host something like

firewal {'accept for puppetserver':
....
destination => 'puppetmaster.server'
}

instead

firewal {'accept for puppetserver':
....
destination => 'x.y.z.t/32',
}


regards.
--
Albert SHIH
DIO bātiment 15
Observatoire de Paris
5 Place Jules Janssen
92195 Meudon Cedex
France
xmpp: j...@obspm.fr
Heure local/Local time:
lun 14 nov 2016 22:38:39 CET

[Peter Faller]

Hi Albert

Here's a custom parser function that can resolve names:

require "resolv"

module Puppet::Parser::Functions

  newfunction(

  :name2ip,

  :type => :rvalue,

  :doc => "name2ip( hostname ) => ip_address"

  ) do |arguments|

    raise(Puppet::ParseError, "name2ip(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1

    name = arguments[0]

    begin

      return Resolv.getaddress(name)

    rescue

      begin

        return Resolv::Hosts.new.getaddress(name)

      rescue

        raise(Puppet::Error, "Can't resolve host name '#{name}' to an IP address")

      end

    end

  end

end

On Monday, 14 November 2016 23:41:29 UTC+2, Albert Shih wrote:

[R.I.Pienaar]

there are several on the forge too, but there's a good
reason your firewall doesnt allow you to enter names, its
not a safe thing to do.

> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email
> to puppet-users...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/ed9160af-82e5-4131-aae0-84dfaa8a507a%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Albert Shih]

Le 15/11/2016 à 08:33:12+0000, R.I.Pienaar a écrit

> there are several on the forge too, but there's a good
> reason your firewall doesnt allow you to enter names, its
> not a safe thing to do.

Yes I know that, but we got a very complexe and lot of changing
infrastructure. So managing the acl rules by hand is dangourous too ;-)

Regards.
--
Albert SHIH
DIO bâtiment 15

Observatoire de Paris
5 Place Jules Janssen
92195 Meudon Cedex
France
xmpp: j...@obspm.fr
Heure local/Local time:

mer 16 nov 2016 08:29:13 CET