[chef] Re: Force recipe to run at the end

[Phil Dibowitz < >]

On 09/22/2012 02:16 PM, Julien Vehent wrote:
> Hi everyone,
> 
> Is there a way to force a recipe to run at the very end of the run list ?
> I have this firewall cookbook (AFW) that creates iptables rules into a
> template, but it runs in a base role and gets called before everything else.

Do the other cookbooks add stuff at runtime, or compile time?

I'm assuming it's at runtime, they just need to add the rules to the node
object, and then everything will work the way you want - the template is
processed at runtime, and the node object has all rules add by all other 
things.

If, on the other hand, you have, say, ruby_block's that are adding rules, then
you can do some manual mucking to make this work, but I question if you really
should be modifying your data at runtime, that's SUPER late in the game. But
if you absolutely must make a ruby_block which creates resources manually and
appends them to the resource_collection:

  t = Chef::Resource::Template.new('/etc/thissucks', run_context)
  t.cookbook "awf"
  t.source "suckage.erb"
  # Don't remember if this is exactly right:
  run_context.resource_collection << t

Now that template will be at the very end of the resource collection, so even
if you fuck with the rules in the node object at runtime, you'll be fine
(provided no one makes dynamic resources after this one).

But seriously... that's really the wrong approach unless you have a VERY good
reason. The better approach is that your recipes do stuff like:

  # Careful, when node attributes are array-like instead of hash-like
  # you need to initialize that somewhere.
  node.default['afw']['rules'] << 'iptables -A INPUT -m tcp -p 22 -j ACCEPT'

or whatever, and then your very very first template that runs can still have
access to all the stuff all your other cookbooks added:

> I have other cookbooks that create rules, but those rules won't appear until
> the next chef run when AFW runs again. I would like to converge in one run
> instead, by forcing AFW to run after everyone else.

This sounds like you're trying to pass in your rules using "variables" or
something...

> Is it doable ?

It's Chef, of course it's doable. :)

-- 
Phil Dibowitz                             

 
Open Source software and tech docs        Insanity Palace of Metallica
http://www.phildev.net/                   http://www.ipom.com/

"Be who you are and say what you feel, because those who mind don't matter
 and those who matter don't mind."
 - Dr. Seuss

Attachment: signature.asc
Description: OpenPGP digital signature