puppet-selective-enforcement.yaml

apiVersion: v1
summary: Selectively enforce Puppet run 
description: This workflow selectively enforces a Puppet run when changes are detected 
homepage: https://github.com/puppetlabs/relay-workflows/tree/master/puppet-selective-enforcement
tags:
  - auto remediation

parameters:
  host:
    description: "Hostname that submitted the report"
  noop:
    description: Whether this was a no-op run
    default: true
  resourceStatuses:
    description: The changed resources
triggers:
  - name: puppet-report
    source:
      type: push
    binding:
      parameters:
        host: !Data host
        noop: !Data noop
        resourceStatuses: !Data resource_statuses
steps:
  - name: view-puppet-resources
    image: relaysh/core
    spec:
      resourceStatuses: !Parameter resourceStatuses
    input:
      - ni get | jq .resourceStatuses
  - name: detect-corrective-changes
    image: relaysh/core
    dependsOn: view-puppet-resources
    spec:
      resourceStatuses: !Parameter resourceStatuses
    input:
    - DETECTED_CHANGES=$(ni get | jq -r '.resourceStatuses | to_entries[] | select(.value.corrective_change) | .key')
    - 'echo "Detected changes, if any: ${DETECTED_CHANGES}"'
    - 'if [ x = x${DETECTED_CHANGES} ] ; then ni output set -k detectedChanges -v none; else ni output set -k detectedChanges -v "${DETECTED_CHANGES}" ; fi'
  - name: approval
    description: Wait for approval to run Puppet for real
    type: approval
    dependsOn: detect-corrective-changes
    when:
    - !Parameter noop
    - !Fn.notEquals [ !Output { from: detect-corrective-changes, name: detectedChanges }, none ]  
  - name: start-puppet-run
    image: relaysh/puppet-step-run-start
    dependsOn: approval
    spec:
      connection: !Connection { type: puppet, name: my-puppet-connection}
      environment: production
      scope:
        nodes:
        - !Parameter host
  - name: wait-for-puppet-run
    image: relaysh/puppet-step-run-wait
    dependsOn: start-puppet-run
    spec:
      connection: !Connection { type: puppet, name: my-puppet-connection}
      id:
        !Output [ start-puppet-run, id ]