1 reply
So, I've tried using jinja, but I don't understand something.
This is the template :
{#######TCP #}
{% for interface in vars.sys.interfaces %}
{% for port_tcp in vars.node.properties['ports_tcp'] %}
add rule ip filter INPUT tcp dport {{ port_tcp }} meta iifname {{interface}} accept # {{ port_tcp.key }} CUSTOM
{% endfor %}
{% endfor %}This is the "ports_tcp" property :
{
"http": 80,
"https": 443
}Why is it that "port_tcp", my iterator item, is a str (http) and not the value (80) ?
Am faced with this issue this morning.
in ldap.log - mdb_entry_decode: attribute index 909456690 not recognized
in webapp.log - Error is: Could not get node information from database; cause
Exception: Error during search cn=rudder-configuration SUB: internal error in mdb_id2edata; cause was: com.unboundid.ldap.sdk.LDAPSearchException: internal error in mdb_id2edata
-> com.normation.ldap.sdk.RoLDAPConnection.$anonfun$search$1(LDAPConnection.scala:321)
1 reply
1 reply
{% for port_name, port_tcp in vars.node.properties['ports_tcp'] %}items(). I will see how we can add it
Not really incorrect, but as you said, there is no mention of the .items().
I'd say that this section needs more examples, at least for me, its easier to understand with a given exemple than with a generic explanation.
I can provide the code I made for a dynamic firewall for NFtables based off a simple json entry in the node property if you feel it might be useful for future reference
Hey there i've got a little problem getting reports from my clients. As far as I see I get following errormassage on my server:
error: HailServer: ERROR, could not resolve '**'
error: Rudder agent was interrupted during execution by a fatal error Run with -i to see log messages.
I already tried:
checking firewall, running with -i ->nor results or errors
Have you got any suggestions?
resource to it.
- use the
package_check_installmethod in the technique editor, but I am pretty sure that it is based on our old package lib which is not super reliable and will soon be deprecated. - The other solution is to define a group based on the presence of the package on the nodes, and use a dedicated
ruleto apply the configuration to this group. The drawback is that the groups are based on the inventories which is only run one time per day. So this will induce a potential initial delay in your config deployment if you do not force an inventory after the installation of this pakcage.
I see. Is it possible to use a property from my node as a condition to deploy or not the file ? The idea is to configure all my snmpd's conf. So create a dédicated rule for each type of server seem pretty overkill and a pain to maintain.
So far the package_check_install works like a charm except the error if the package is not present. Note that it does what I want but the dashboard is not clean XD.
If you want to define conditions usable anywhere in a technique (and not just in a template), to prevent the execution of some methods in it for instance, you can try to use the
condition_from_variable_* methods. They are a bit tricky but they are well documented.Try to use those and a set of templates if the configuration is pretty complex. Let me know if you find a pretty way configure it.