Add p_role_tart_worker blueprint - #320
Merged
rcurranmoz merged 1 commit intoAug 19, 2026
Merged
Conversation
Tart VM hosts need /etc/puppet_role = tart_worker, and until now nothing delivered it. The
SimpleMDM Tart assignment group (2105807) carries only Sudoers and Command Line Tools -- no
role pkg, unlike the m4 bootstrap group's p_role_1500 -- so the role file was set by hand on
every one of the 16 pre-existing tart hosts, with no record of how.
That matters more than it looks: hiera keys per-role data on the puppet_role FACT
(roles/%{facts.puppet_role}.yaml), and run-puppet.sh derives that fact from /etc/puppet_role.
A host missing the file silently falls back to builder defaults -- a noop apply on
macmini-m4-245 planned LaunchAgents instead of LaunchDaemons, an image pull that
manage_image: false forbids, and omitted macos_step_cert entirely.
Byte-identical to p_role_gecko_t_osx_1500_m4 apart from the role name, including the payload's
lack of a trailing newline (11 bytes, matching that blueprint's 19).
Already signed and in production: uploaded as SimpleMDM app 690299
(com.github.munki.pkg.p_role_tart_worker), attached to group 2105807, and verified installed on
all 24 members -- the 8 new hosts plus the 16 existing ones, where it replaced the hand-set file
with a receipt-backed one. This commit lands the source for what is already deployed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a munki-pkg blueprint delivering
/etc/puppet_role = tart_worker, so tart VM hosts get their role from MDM instead of by hand.Why
The SimpleMDM Tart assignment group (2105807) carries only
Passwordless Sudo for AdminsandCommand Line Tools— no role pkg, unlike the m4 bootstrap group'sp_role_1500. So the role file was set by hand on all 16 pre-existing tart hosts, with no record of how, and it does not survive a wipe.That matters more than it first looks. hiera keys per-role data on the
puppet_rolefact (roles/%{facts.puppet_role}.yaml), andrun-puppet.sh:216derives that fact from/etc/puppet_role. A host without the file silently falls back to builder defaults — a noop apply onmacmini-m4-245planned:~/Library/LaunchAgentsinstead of/Library/LaunchDaemonsfor the worker jobsExec[pull_initial_image], whichmanage_image: falseexplicitly forbidsmacos_step_certat all, so no renewing client cert and no vault fetchWith the role file present, the catalog is correct. The failure is silent, and it would have produced eight subtly-wrong hosts.
Contents
Byte-identical to
p_role_gecko_t_osx_1500_m4apart from the role name:com.github.munki.pkg.p_role_tart_worker/etc/puppet_role→tart_workerThe absent newline is deliberate, matching the existing convention. This repo has no
end-of-file-fixerpre-commit hook so it survives commit — worth knowing before one gets added.Already in production
This lands the source for something already deployed: signed with
Developer ID Installer: Mozilla Corporation (43AQ936H96), uploaded as SimpleMDM app 690299, attached to group 2105807, and verified installed on all 24 members — the 8 newly-onboarded tart hosts plus the 16 existing ones, where it replaced the hand-set file with a receipt-backed one.Build and sign with the documented flow:
Note: this repo's blueprints are not the source of truth for what is deployed
The deployed m4 role pkg is SimpleMDM app
'Puppet Role 1500 Prod'/com.github.munki.pkg.p_role_1500, but this repo's blueprint isp_role_gecko_t_osx_1500_m4— a different identifier, so the deployed pkg was not built from here. The new blueprint follows the repo's own convention. Worth reconciling separately.🤖 Generated with Claude Code