diff --git a/src/content/_index.html b/src/content/_index.html index 98fe0aa..2e62fb4 100644 --- a/src/content/_index.html +++ b/src/content/_index.html @@ -257,7 +257,7 @@ enroll diff \ --exit-code # Ignore a path and changes to package versions, and optionally -# enforce the old state locally (requires ansible-playbook) +# enforce the old state locally enroll diff --old /path/to/harvestA --new /path/to/harvestB \ --exclude-path /var/anacron \ --ignore-package-versions \ diff --git a/src/content/docs.html b/src/content/docs.html index 92f16ee..0c64ab0 100644 --- a/src/content/docs.html +++ b/src/content/docs.html @@ -323,7 +323,8 @@ target = ansible # is the default, otherwise salt, or puppet # ignore noisy drift exclude_path = /var/anacron ignore_package_versions = true -# enforce = true # requires ansible-playbook on PATH +# enforce = true +# target = ansible # to run ansible-playbook to enforce the old harvest, else puppet, salt
--target puppet renders Puppet module/control-repo style output., and in --fqdn mode, renders per-host Hiera data.--target salt renders Salt state trees and, in --fqdn mode, Salt pillar data.--target ansible too. As usual, in --fqdn mode, specific artifacts end up in host_vars inventory folders rather than polluting the 'golden' roles.--target ansible too.Section (or equivalent metadata), to reduce role/module/state sprawl and speed up execution.The harvest now detects the presence of container images, if the user has permission to call Docker or Podman. In particular, it detects the SHA256 of the image instead of relying on floating tags.
All three renderers (Ansible, Salt and Puppet) will attempt to enforce the presence of those Docker images per their precise SHA256 hash, if they were present in the harvest but not on the machine upon applying a manifest.
For Ansible, you may need the community.docker collection, but on Debian 13 I found that it was already present by default in the official ansible Debian packages.
For Ansible, if using Podman, you'll need 1.20.0 or later. Enroll creates a requirements.yml to make it easy for you: its README.md will guide you to run ansible-galaxy collection install -r requirements.yml before running the playbook.
For Ansible, if using Podman, you'll need 1.20.0 or later of the community.podman collection. Enroll creates a requirements.yml to make it easy for you: its README.md will guide you to run ansible-galaxy collection install -r requirements.yml before running the playbook.
$ ansible-playbook -i localhost, -c local playbook.yml --check --diff --tags role_container_images
@@ -122,7 +122,7 @@ PLAY RECAP *********************************************************************
localhost : ok=5 changed=0 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0
I did not use community extensions/modules for Docker in the Salt and Puppet renderers, because, well, they are god-awful (the Salt one simply doesn't work in 3008.1, and the Puppet one is non-idempotent and I would argue cruder in its approach to image management than a guarded Exec call can be (and is).
I'm off to try and write more tests - we're at about 85% coverage in pytest, and we also run a stack of 'noop' executions for Ansible, Puppet and Salt too now, in CI.
+I'm off to try and write more tests - we're at about 86% coverage in pytest, and run a big suite unit tests for Ansible, Puppet and Salt too now, in CI. I'm always trying to catch any regressions given there are so many variations on how you can use this tool.
Thanks to everyone who has reached out with suggestions, constructive criticism, and bug reports! You're helping make Enroll better for everyone.