If sudo::sudoers is defined via Hiera only the configuration from one hierarchy will be preserved.
Given the following hiera hierachy:
:hierarchy:
- "%{::clientcert}"
- "defaults"
If you define sudo::sudoers both in e.g. bar.foo.org.yaml and in defaults.yaml with different rules, only the rules hash from defaults.yaml will be autowired to the param sudoers of the sudo class, losing the rules defined in bar.foo.org.yaml.
Other module like https://github.com/saz/puppet-sudo are using hiera_hash() to merge all hashes.
Perhaps you could add a parameter hiera_merge_sudoers like the one in the nrpe module by ghoneycutt (https://github.com/ghoneycutt/puppet-module-nrpe), defaulting to false, to read and merge the hashes from Hiera.
Example implementation
if $hiera_merge_sudoers {
$sudoers_real = hiera_hash(sudo::sudoers)
} else {
$sudoers_real = $sudoers
}
create_resources('sudo::sudoers', $sudoers_real)
I could provide a pull request if you like.
If
sudo::sudoersis defined via Hiera only the configuration from one hierarchy will be preserved.Given the following hiera hierachy:
If you define
sudo::sudoersboth in e.g.bar.foo.org.yamland indefaults.yamlwith different rules, only the rules hash fromdefaults.yamlwill be autowired to the paramsudoersof thesudoclass, losing the rules defined inbar.foo.org.yaml.Other module like https://github.com/saz/puppet-sudo are using
hiera_hash()to merge all hashes.Perhaps you could add a parameter
hiera_merge_sudoerslike the one in the nrpe module by ghoneycutt (https://github.com/ghoneycutt/puppet-module-nrpe), defaulting tofalse, to read and merge the hashes from Hiera.Example implementation
I could provide a pull request if you like.