Promote Google user-revocation sync to sandbox#285
Merged
Conversation
Promotes the OpenVPN certificate revocation feature from development to sandbox, following the usual development -> sandbox -> global path. Copies the two files verbatim from environments/development and adds the same fact-gated include to sandbox's openvpn_server.pp. Inert until activated: the class is only declared where the openvpn.google_directory_revocation fact is true, which Terraform (terraform-aws-openvpn >= 7.0.0) sets only when enable_google_directory_revocation = true. On every existing sandbox node the fact is absent, so this installs no script and no cron and changes nothing until the feature is deliberately switched on. The runtime dependencies Terraform cannot see -- toolkit >= 2.61.0 providing `ih-openvpn sync-google-users`, and Google Workspace domain-wide delegation -- are gated inside the wrapper. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
infrahouse8
approved these changes
Jul 21, 2026
akuzminsky
added a commit
that referenced
this pull request
Jul 21, 2026
Final promotion of the OpenVPN certificate-revocation feature: development -> sandbox -> global, completing the development -> sandbox -> global path (cf. #284, #285). Copies the two files verbatim from environments/development into the top-level modules/ (which serves every environment, i.e. production) and adds the same fact-gated include to the global openvpn_server.pp. Inert until activated: the class is declared only where the openvpn.google_directory_revocation fact is true, which terraform-aws-openvpn (>= 7.0.0) sets only when enable_google_directory_revocation = true. On every existing node the fact is absent, so this installs no script and no cron and changes nothing until the feature is deliberately switched on per consumer. Validated on a live sandbox OpenVPN node running the promoted code: catalog compiled and no sync cron was installed while the fact was absent. Runtime dependencies Terraform cannot see (toolkit >= 2.61.0 for `ih-openvpn sync-google-users`, Google Workspace domain-wide delegation) are gated inside the wrapper. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the OpenVPN certificate-revocation feature from development → sandbox, the next step on the usual
development → sandbox → globalpath (cf. #278 → #279 → #281). Follow-up to #284, which landed it in development only.What
environments/development:manifests/openvpn_server/google_revocation_sync.pptemplates/openvpn_server/google-user-sync.sh.erbopenvpn_server.pp.The sandbox
openvpn_server.ppdiffered from development's only by this include block, so the promotion is a mechanical copy — all three files are byte-identical to development.Safe to land — inert until activated
The class is declared only where the
openvpn.google_directory_revocationfact is true. That fact is set byterraform-aws-openvpn >= 7.0.0and only whenenable_google_directory_revocation = true. On every existing sandbox node the fact is absent →$facts.dig(...)isundef→ the class isn't declared → no script, no cron, no behavior change. This can land ahead of any activation with zero risk.The runtime dependencies Terraform can't observe are gated inside the wrapper: toolkit
>= 2.61.0providingih-openvpn sync-google-users(released), and Google Workspace domain-wide delegation.Verified
puppet-lint --fail-on-warningsclean on all four module paths (sandbox, development, global profile, role).🤖 Generated with Claude Code