We made large use of autolookups in our early hiera days, and it's recognizedly a bad idea: it basically creates a huge category of globals implicitly applied everywhere a class is included.
We should stop doing that; I know it will take a long time before we reach that goal globally, but in the meantime I'll create an environment with data_binding_terminus=none and move progressively class of hosts to it.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T294906 Puppet Improvements | |||
| Resolved | jbond | T181967 Update puppet code to conform to puppet 4.x and later standards | |||
| Declined | None | T181971 Disable hiera autolookups | |||
| Open | None | T247956 Ensure hiera only has profile:: qualified or global hiera keys |
Change 395545 had a related patch set uploaded (by Giuseppe Lavagetto; owner: Giuseppe Lavagetto):
[operations/puppet@production] environments: add environment for removing hiera autolookups
Change 395546 had a related patch set uploaded (by Giuseppe Lavagetto; owner: Giuseppe Lavagetto):
[operations/puppet@production] standard: assume standard profile structure
Change 395545 abandoned by Giuseppe Lavagetto:
environments: add environment for removing hiera autolookups
Reason:
no one will work on this.
Change 395546 abandoned by Giuseppe Lavagetto:
standard: assume standard profile structure
data_binding_terminus is now deprecated.
data_binding_terminus
When automatic class parameter lookup was still young, we included the option to replace Hiera with an alternate data backend, using the data_binding_terminus setting.
But data binding termini were a really hairy extension point, and Hiera 5’s improved custom backend system makes them unnecessary. Setting data_binding_terminus to anything but hiera is now deprecated, and the setting will be removed in Puppet 6.
If you’re using a custom data_binding_terminus, rewrite it as a custom Hiera 5 backend. You’re already an advanced Puppet hacker if you managed to build one of these in the first place, so you can probably write an equivalent Hiera 5 backend in an afternoon or two. We hope you enjoy this improved interface! If you were disabling automatic class parameter lookup (data_binding_terminus = none), you can’t do that anymore. Module authors are relying on it for default data these days.
https://puppet.com/docs/puppet/4.10/deprecated_settings.html
As far as i can tell it still exists and possibly works in the master branch however i don't think we can rely on it.
I still hate automatic parameters lookups, but maybe we have to accept it's the way to go and adapt our guides accordingly?
In particular, I would be ok with using autolookup of parameters if we straight ban the definition of hiera variables for classes not in the profile module outside of the common range.
In particular, I would be ok with using autolookup of parameters if we straight ban the definition of hiera variables for classes not in the profile module outside of the common range.
I think that the coding style already states or at the very least suggests this. I have been meaning to right a check for CI to enforce that, ill work on that today as it shouldn't be that much effort
Change 939260 had a related patch set uploaded (by Jbond; author: jbond):
[operations/puppet@production] WIP: Add check to look for violating hiera keys