☰

为什么即使订阅触发器不匹配，我的 Puppet 类的 exec 调用也会触发？

tag-icon • tag-icon puppet
为什么即使订阅触发器不匹配，我的 Puppet 类的 exec 调用也会触发？

下面附上了我编写的一个 puppet 模块，它将 iptables 配置推送到我们的负载均衡器。它可以正常工作，只是 so-bans-apply 脚本会在每次 puppet 运行时运行，而不管服务本身是否真的有更新。我的问题是为什么 exec 会在每次运行时触发，我如何才能让它仅在订阅的服务刷新时运行？

我曾尝试删除 Exec 中的“onlyif”语句，认为 onlyif 也许会触发无条件执行，但即使没有“onlyif”，exec 仍然会触发每次 puppet 运行。

节点定义与此类似，没有指定任何参数：


node /or-rtlb\d{2}/ {
     include iptables
}

以下是该类本身的代码：



class iptables ($ApplyBans=true)
{
    if $hostname =~ /(?i:or-rtlb\d{2})/ {
        $ip6tables_file="or-rtlbs.ip6tables"
        $iptables_file="or-rtlbs.iptables"
    }
    if $hostname =~ /(?i:or-puptest)/ {
        $ip6tables_file="or-rtlbs.ip6tables"
        $iptables_file="or-rtlbs.iptables"
    }


    case $::osfamily {
        RedHat:
        {
            file { "/etc/sysconfig":
                ensure => directory,
                owner => root,
                group => root,
                mode  => 0755
            }

            file { "ip6tables-file":
                path    => "/etc/sysconfig/ip6tables",
                ensure  => present,
                owner   => root,
                group   => root,
                mode    => 0644,
                source  => "puppet:///modules/iptables/$ip6tables_file",
                require => [File["/etc/sysconfig"], Package["iptables"]],
                notify  => Service["ip6tables-service"]
            }
            file { "iptables-file":
                path    => "/etc/sysconfig/iptables",
                ensure  => present,
                owner   => root,
                group   => root,
                mode    => 0644,
                source  => "puppet:///modules/iptables/$iptables_file",
                require => [File["/etc/sysconfig"], Package["iptables"]],
                notify  => Service["iptables-service"]
            }
            package { "iptables":
                ensure => installed
            }
            package { "iptables-ipv6":
                ensure => installed
            }
            service { "iptables-service":
                name        => "iptables",
                ensure          => running,
                hasstatus       => true,
                hasrestart      => true,
                enable          => true,
            }
            service { "ip6tables-service":
                name        => "ip6tables",
                ensure          => running,
                hasstatus       => true,
                hasrestart      => true,
                enable          => true,
            }

            if ($ApplyBans)
            {
                exec { "so-bans-apply" :
                    command => "/root/bans/so-bans/force-ban-refresh",
                    onlyif => "/usr/bin/test -f /root/bans/so-bans/force-ban-refresh",
                    subscribe => [
                        Service["iptables-service"],
                        Service["ip6tables-service"],
                    ]                   
                }
            }
        }
    }
}

答案1

添加refreshonly => true到exec，它只会在notify或subscribe关系触发它时运行。

相关内容