Manage yumrepos via data

This commit adds parameters to manage Yumrepo resources via data.  The
primary parameter, `repos`, is simply a hash of Yumrepo resources for
digestion by an each loop similar to an old `create_resources()` call.
It does nothing on its own, acting only as a source of data.  The other
parameters control the behavior of the resource instantiation loop.

The parameters `managed_repos`, `os_default_repos`, and
`repo_exclusions` each take an array of key names from the `repos` hash.
They are then combined to select a set of repos from the `repos` hash
for instantiation.  The formula takes one of the following two forms:

    `managed_repos` - `repo_exclusions`

OR, if `manage_os_default_repos` is set to `true`

    `managed_repos` + `os_default_repos` - `repo_exclusions`

Data is included for most of the CentOS default repositories, with the
exception of the "archive" repos.

.sync.yml

@@ -11,3 +11,5 @@
     sudo: required
     bundler_args: --without development
   secure: "iItNJ/PlMvdSiYjtXWJkS69mF/4XUriTRC6axFoiTgX8BzGNWA1U/anENNyzmhRKcH/Nc0erVeau+RX8vyJ0HmIJOCvYfq5Q/SQWex1fDXLe/UYJkAEWwmeIOVSF2nTEUPDvDn/d6bNEdULw5yrNn1dT8eLqIIXl6/nThdpiS917BX6CeYdojr/mISrLsvihuB5DQRdVzH+hK1bXcECihnOfNH9lQ0lZ2v2ohJiLJL0DadDg0YMMeJMlP7CnBZzRs7fhTPdLMjzCvysef9nqBYRlGBRUn+CaQ4VoQZlWB1JchJup4qCGeU9ANkb8gdKYTy1kFkBrEDuqlUUuuTTMhDpQ+2fGF32zgnXCSnVY8AIriFfO9c1ljxL6k6vaHpfnsPcMrxuQXNeOPGYpVjNGi/Hz8OjuZ3IT07c8SmZgmGaNp+ZIKErJQV0eob0NeA/1P7HheRS5aPEiN8vj/ZGuIGa+BhbTp2riJ599urrSqGDcJ0YzNeW2BvBZQoXs953X4N4yROz4xKMNqPz/jhyGM9w5SBJ/uLiIvKTu+bSsJ2VNyrOOu25eYqzH1zKc71fKiWa1ZOTHKVM24chlmoq3tZTSpSn6OxpptKLxAYZG0IUdFSMy66m8nss1AxL2djScAptugsqpfLqziMArAoN9iWXCeGiWz1qLRl+5AlMrmMY="
+spec/spec_helper.rb:
+    hiera_config: "File.expand_path(File.join(__FILE__, '../fixtures/hiera.yaml'))"

data/common.yaml

@@ -2,3 +2,14 @@
 lookup_options:
     yum::config_options:
         merge: 'hash'
+    yum::repos:
+        merge:
+            strategy: 'deep'
+            knockout_prefix: '--'
+            merge_hash_arrays: true
+    yum::managed_repos:
+        merge: 'unique'
+    yum::os_default_repos:
+        merge: 'unique'
+    yum::repo_exclusions:
+        merge: 'unique'

data/os/RedHat/CentOS.yaml

@@ -1 +1,107 @@
 ---
+yum::os_default_repos:
+    - 'base'
+    - 'updates'
+    - 'extras'
+    - 'centosplus'
+    - 'base-source'
+    - 'updates-source'
+    - 'extras-source'
+    - 'base-debuginfo'
+    - 'centos-media'
+yum::repos:
+    base:
+        enabled: true
+        descr: 'CentOS-$releasever - Base'
+        mirrorlist: 'http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Base.repo'
+
+    updates:
+        enabled: true
+        descr: 'CentOS-$releasever - Updates'
+        mirrorlist: 'http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates&infra=$infra'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Base.repo'
+
+    extras:
+        enabled: false
+        descr: 'CentOS-$releasever - Extras'
+        mirrorlist: 'http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras&infra=$infra'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Base.repo'
+
+    centosplus:
+        enabled: false
+        descr: 'CentOS-$releasever - Plus'
+        mirrorlist: 'http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus&infra=$infra'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Base.repo'
+
+    contrib:
+        enabled: false
+        descr: 'CentOS-$releasever - Contrib'
+        mirrorlist: 'http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=contrib&infra=$infra'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Base.repo'
+
+    cr:
+        enabled: false
+        descr: 'CentOS-$releasever - cr'
+        baseurl: 'http://mirror.centos.org/centos/$releasever/cr/$basearch/'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-CR.repo'
+
+    fasttrack:
+        enabled: false
+        descr: 'CentOS-$releasever - fasttrack'
+        mirrorlist: 'http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=fasttrack&infra=$infra'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-fasttrack.repo'
+
+    base-source:
+        enabled: false
+        descr: 'CentOS-$releasever - Base Sources'
+        baseurl: 'http://vault.centos.org/centos/$releasever/os/Source/'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Sources.repo'
+
+    updates-source:
+        enabled: false
+        descr: 'CentOS-$releasever - Updates Sources'
+        baseurl: 'http://vault.centos.org/centos/$releasever/updates/Source/'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Sources.repo'
+
+    extras-source:
+        enabled: false
+        descr: 'CentOS-$releasever - Extras Sources'
+        baseurl: 'http://vault.centos.org/centos/$releasever/extras/Source/'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Sources.repo'
+
+    base-debuginfo:
+        enabled: false
+        descr: 'CentOS-$releasever - Debuginfo'
+        baseurl: 'http://debuginfo.centos.org/$releasever/$basearch/'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-Debug-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Debuginfo.repo'
+
+    centos-media:
+        enabled: false
+        descr: 'CentOS-$releasever - Media'
+        baseurl: 'file:///media/CentOS/ file:///media/cdrom/ file:///media/cdrecorder/'
+        gpgcheck: true
+        gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-%{facts.os.release.major}"
+        target: '/etc/yum.repos.d/CentOS-Media.repo'

data/os/RedHat/CentOS/6.yaml

@@ -0,0 +1,3 @@
+---
+yum::os_default_repos:
+    - 'contrib'

data/os/RedHat/CentOS/7.yaml

@@ -0,0 +1,3 @@
+---
+yum::os_default_repos:
+    - 'cr'

functions/bool2num_hash_recursive.pp

@@ -0,0 +1,13 @@
+function yum::bool2num_hash_recursive($arg) {
+  assert_type(Hash, $arg)
+  $arg.map |$key, $value| {
+    $return_value = $value ? {
+      Boolean => bool2num($value),
+      Hash    => yum::bool2num_hash_recursive($value),
+      default => $value,
+    }
+    Hash({ $key => $return_value })
+  }.reduce |$attrs_memo, $kv| {
+    merge($attrs_memo, $kv)
+  }
+}

hiera.yaml

@@ -2,13 +2,15 @@
 version: 4
 datadir: data
 hierarchy:
-    - name: 'Operating System'
+    - name: 'OS Data'
       backend: yaml
-      path: "os/%{facts.os.family}/%{facts.os}"
+      paths:
+        - "os/%{facts.os.family}/%{facts.os.name}/%{facts.os.release.full}"
+        - "os/%{facts.os.family}/%{facts.os.name}/%{facts.os.release.major}/%{facts.os.release.minor}"
+        - "os/%{facts.os.family}/%{facts.os.name}/%{facts.os.release.major}"
+        - "os/%{facts.os.family}/%{facts.os.name}"
+        - "os/%{facts.os.family}"
 
-    - name: 'OS family'
-      backend: yaml
-      path: "os/%{facts.os.family}"
-
-    - name: 'common'
+    - name: 'Common Data'
       backend: yaml
+      path: 'common'

manifests/init.pp

@@ -1,16 +1,108 @@
 # A class to install and manage Yum configuration.
 #
-# @param clean_old_kernels Whether or not to purge old kernel version beyond the `keeponly_limit`.
-# @param keep_kernel_devel Whether or not to keep kernel devel packages on old kernel purge.
-# @param config_options A Hash where keys are the names of `Yum::Config` resources and the values
+# @param clean_old_kernels [Boolean]
+#   Whether or not to purge old kernel version beyond the `keeponly_limit`.
+#
+# @param keep_kernel_devel [Boolean]
+#   Whether or not to keep kernel devel packages on old kernel purge.
+#
+# @param config_options [Hash]
+#   A Hash where keys are the names of `Yum::Config` resources and the values
 #   are either the direct `ensure` value, or a Hash of the resource's attributes.
-#   @note Boolean values will be converted to either a `1` or `0`; use a quoted string to get a
-#     literal `true` or `false`.
+#
+#   @note Boolean parameter values will be converted to either a `1` or `0`; use a quoted string to
+#     get a literal `true` or `false`.
+#
+# @param repos [Hash]
+#   A hash where keys are the names of `Yumrepo` resources and each value represents its respective
+#   Yumrepo's resource parameters.  This is used in conjunction with the `managed_repos` parameter
+#   to create `Yumrepo` resources en masse.  Some default data is provided for this using module
+#   data.  It is configured to deep merge with a `knockout_prefix` of `--` by default, so individual
+#   parameters may be overriden or removed via global or environment Hiera data.
+#
+#   @note Boolean parameter values will be converted to either a `1` or `0`; use a quoted string to
+#     get a literal `true` or `false`.
+#
+# @param managed_repos [Array]
+#   An array of first-level keys from the `repos` hash to include in the catalog.  The module uses
+#   this list to select `Yumrepo` resources from the `repos` hash for instantiation.  Defaults are
+#   set in the module's Hiera data.
+#
+#   @note This only indicates the *managed* state of the repos, the `ensure` state must be managed
+#     in the `repos` data.
+#
+# @param manage_os_default_repos [Boolean]
+#   Whether or not to add an operating system's default repos to the `managed_repos` array.
+#
+#   @note Currently only valid on CentOS.
+#
+# @param os_default_repos [Array]
+#   A list of default repos to add to `managed_repos` if `manage_os_default_repos` is enabled.
+#   Normally this should not be modified.
+#
+# @param repo_exclusions [Array]
+#   An array of first-level keys from the `repos` hash to exclude from management via this module.
+#   Values in this array will be subtracted from the `managed_repos` array as a last step before
+#   instantiation.
+#
+# @example Enable management of the default repos for a supported OS:
+#   ```yaml
+#   ---
+#   yum::manage_os_default_repos: true
+#   ```
+#
+# @example Add Hiera data to disable *management* of the CentOS Base repo:
+#   ```yaml
+#   ---
+#   yum::manage_os_default_repos: true
+#   yum::repo_exclusions:
+#       - 'base'
+#   ```
+#
+# @example Ensure the CentOS base repo is removed from the agent system(s):
+#   ```yaml
+#   ---
+#   yum::manage_os_default_repos: true
+#   yum::repos:
+#       base:
+#           ensure: 'absent'
+#   ```
+#
+# @example Add a custom repo:
+#   ```yaml
+#   ---
+#   yum::managed_repos:
+#       - 'example_repo'
+#   yum::repos:
+#       example_repo:
+#           ensure: 'present'
+#           enabled: true
+#           descr: 'Example Repo'
+#           baseurl: 'https://repos.example.com/example/'
+#           gpgcheck: true
+#           gpgkey: 'file:///etc/pki/gpm-gpg/RPM-GPG-KEY-Example'
+#           target: '/etc/yum.repos.d/example.repo'
+#   ```
+#
+# @example Use a custom `baseurl` for the CentOS Base repo:
+#   ```yaml
+#   ---
+#   yum::manage_os_default_repos: true
+#   yum::repos:
+#       base:
+#           baseurl: 'https://repos.example.com/CentOS/base/'
+#           mirrorlist: '--'
+#   ```
 #
 class yum (
   Boolean $clean_old_kernels = true,
   Boolean $keep_kernel_devel = false,
   Hash[String, Variant[String, Integer, Boolean, Hash[String, Variant[String, Integer, Boolean]]]] $config_options = { },
+  Optional[Hash[String, Optional[Hash[String, Variant[String, Integer, Boolean]]]]] $repos = {},
+  Array[String] $managed_repos = [],
+  Boolean $manage_os_default_repos = false,
+  Array[String] $os_default_repos = [],
+  Array[String] $repo_exclusions = [],
 ) {
 
   $module_metadata            = load_module_metadata($module_name)
@@ -23,8 +115,25 @@
     fail("${::os['name']} not supported")
   }
 
-  unless empty($config_options) {
+  $_managed_repos = $manage_os_default_repos ? {
+    true    => $managed_repos + $os_default_repos,
+    default => $managed_repos,
+  }
 
+  unless empty($_managed_repos) or empty($repos) {
+    $_managed_repos_minus_exclusions = $_managed_repos - $repo_exclusions
+    $normalized_repos = yum::bool2num_hash_recursive($repos)
+
+    $normalized_repos.each |$yumrepo, $attributes| {
+      if member($_managed_repos_minus_exclusions, $yumrepo) {
+        Resource['yumrepo'] {
+          $yumrepo: * => $attributes,
+        }
+      }
+    }
+  }
+
+  unless empty($config_options) {
     if has_key($config_options, 'installonly_limit') {
       assert_type(Variant[Integer, Hash[String, Integer]], $config_options['installonly_limit']) |$expected, $actual| {
         fail("The value or ensure for `\$yum::config_options[installonly_limit]` must be an Integer, but it is not.")

spec/classes/init_spec.rb

@@ -12,6 +12,12 @@
   end
 end
 
+shared_examples 'a catalog containing repos' do |repos|
+  repos.each do |repo|
+    it { is_expected.to contain_yumrepo(repo) }
+  end
+end
+
 describe 'yum' do
   on_supported_os.each do |os, facts|
     context "on #{os}" do
@@ -26,6 +32,58 @@
         let(:params) { {} }
 
         it_behaves_like 'a Yum class'
+        it { is_expected.to have_yumrepo_resource_count(0) }
+      end
+
+      context 'when `manage_os_default_repos` is enabled' do
+        let(:params) { { 'manage_os_default_repos' => true } }
+
+        case facts[:os]['name']
+        when 'CentOS'
+          it { is_expected.to have_yumrepo_resource_count(10) }
+          it_behaves_like 'a catalog containing repos', [
+            'base',
+            'updates',
+            'extras',
+            'base-source',
+            'updates-source',
+            'extras-source',
+            'base-debuginfo',
+            'centosplus',
+            'centos-media'
+          ]
+          case facts[:os]['release']['major']
+          when '7'
+            it { is_expected.to contain_yumrepo('cr') }
+            it { is_expected.not_to contain_yumrepo('contrib') }
+          when '6'
+            it { is_expected.to contain_yumrepo('contrib') }
+            it { is_expected.not_to contain_yumrepo('cr') }
+          end
+        else
+          it { is_expected.to have_yumrepo_resource_count(0) }
+        end
+
+        context 'and the CentOS base repo is negated' do
+          let(:facts) { facts.merge(hiera_fixture: 'repo_exclusions') }
+
+          case facts[:os]['name']
+          when 'CentOS'
+            it { is_expected.not_to contain_yumrepo('base') }
+            it_behaves_like 'a catalog containing repos', [
+              'updates',
+              'extras',
+              'base-source',
+              'updates-source',
+              'extras-source',
+              'base-debuginfo',
+              'centosplus',
+              'centos-media'
+            ]
+          else
+            it { is_expected.to have_yumrepo_resource_count(0) }
+          end
+        end
       end
 
       context 'when `config_options[installonly_limit]` is modified' do

spec/fixtures/data/default.yaml

@@ -0,0 +1 @@
+---

spec/fixtures/data/repo_exclusions.yaml

@@ -0,0 +1,3 @@
+---
+yum::repo_exclusions:
+    - 'base'