Puppet Class: compliance_markup

Defined in:
manifests/init.pp

Overview

The compliance markup helper class

This class should be included after all other classes in your site so that the mapper can properly analyze the standing catalog.

Parameters:

  • compliance_map (Hash)

    The compliance Hash to which to map

    • This defaults to Data In Modules

  • validate_profiles (Optional[Array[String[1]]]) (defaults to: undef)

    Compliance profiles that you wish to validate against

  • report_types (Array[ Enum[ 'full', 'non_compliant', 'compliant', 'unknown_resources', 'unknown_parameters', 'custom_entries' ] ]) (defaults to: ['non_compliant', 'unknown_parameters', 'custom_entries'])

    The types of entries that you want to report on

    • full => Include all report types*

    • non_compliant => Report on non-compliant parameters*

    • unknown_parameters => Report on parameters that are mapped but not included in the catalog*

    • custom_entries => Report custom calls to compliance_map() from the codebase

    • compliant => Report on compliant parameters

    • unknown_resources => Report on classes that are mapped but not included in the catalog

    • This is ignored if options is specified

  • report_format (Enum['json','yaml']) (defaults to: 'json')

    The output format for the report

  • report_on_client (Boolean) (defaults to: false)

    Save a copy of the report on the client as a File resource

    • This will make the report show up in PuppetDB but may also expose unwanted vulnerability information

  • report_on_server (Boolean) (defaults to: true)

    Save a copy of the report on the puppet server

  • server_report_dir (Optional[Stdlib::Absolutepath]) (defaults to: undef)

    The path where the server should store reports

    • If you change this, you must make sure that the puppet server can write to the location.

    • By default, this is written to Puppet[:vardir] as the Puppet server sees it: /opt/puppetlabs/server/data/puppetserver/simp/compliance_reports

  • custom_report_entries

    A hash that will be included in the compliance report under the heading site_data

    • This can be used for adding anything to the compliance report. The hash is simply processed with to_yaml

  • options (Optional[Hash]) (defaults to: undef)

    The options to pass directly to the compliance_map validation function

    • If specified, various other options may be ignored

  • custom_report_data (Optional[Hash]) (defaults to: undef)


58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# File 'manifests/init.pp', line 58

class compliance_markup (
  # $compliance_map is in module data
  Hash                           $compliance_map,
  Optional[Array[String[1]]]     $validate_profiles     = undef,
  Array[
    Enum[
      'full',
      'non_compliant',
      'compliant',
      'unknown_resources',
      'unknown_parameters',
      'custom_entries'
    ]
  ]                              $report_types       = ['non_compliant', 'unknown_parameters', 'custom_entries'],
  Enum['json','yaml']            $report_format      = 'json',
  Boolean                        $report_on_client   = false,
  Boolean                        $report_on_server   = true,
  Optional[Stdlib::Absolutepath] $server_report_dir  = undef,
  Optional[Hash]                 $custom_report_data = undef,
  Optional[Hash]                 $options            = undef
) {
  $available_profiles = delete($compliance_map.keys, 'version')

  if $options {
    if $compliance_map and !$options['default_map'] {
      $_full_options = $options + { 'default_map' => $compliance_map }
    }
    else {
      $_full_options = $options
    }

    $_options = $_full_options
  }
  else {
    $_options = {
      'report_types'      => $report_types,
      'format'            => $report_format,
      'client_report'     => $report_on_client,
      'server_report'     => $report_on_server,
      'server_report_dir' => $server_report_dir,
      'site_data'         => $custom_report_data
    }
  }

  compliance_markup::map { 'execute': options => $_options }
}