Promote Google user-revocation sync to global (production)#286
Merged
Conversation
Final promotion of the OpenVPN certificate-revocation feature: development -> sandbox -> global, completing the development -> sandbox -> global path (cf. #284, #285). Copies the two files verbatim from environments/development into the top-level modules/ (which serves every environment, i.e. production) and adds the same fact-gated include to the global openvpn_server.pp. Inert until activated: the class is declared only where the openvpn.google_directory_revocation fact is true, which terraform-aws-openvpn (>= 7.0.0) sets only when enable_google_directory_revocation = true. On every existing node the fact is absent, so this installs no script and no cron and changes nothing until the feature is deliberately switched on per consumer. Validated on a live sandbox OpenVPN node running the promoted code: catalog compiled and no sync cron was installed while the fact was absent. Runtime dependencies Terraform cannot see (toolkit >= 2.61.0 for `ih-openvpn sync-google-users`, Google Workspace domain-wide delegation) are gated inside the wrapper. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
infrahouse8
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final promotion of the OpenVPN certificate-revocation feature: sandbox → global, completing the
development → sandbox → globalpath (cf. #284 dev, #285 sandbox, #278 → #279 → #281 precedent).What
Copies both feature files verbatim from
environments/developmentinto the top-levelmodules/— which serves every environment, i.e. production — and adds the same fact-gated include to the globalopenvpn_server.pp:modules/profile/manifests/openvpn_server/google_revocation_sync.ppmodules/profile/templates/openvpn_server/google-user-sync.sh.erbmodules/profile/manifests/openvpn_server.pp(gated include)The global
openvpn_server.ppdiffered from development's only by this block, so all three files are byte-identical to development.Safe to land — inert until activated
Declared only where the
openvpn.google_directory_revocationfact is true, whichterraform-aws-openvpn >= 7.0.0sets only whenenable_google_directory_revocation = true. On every existing node the fact is absent → the class isn't declared → no script, no cron, no behavior change. Activation stays a deliberate, per-consumer terraform switch.Validated on a live sandbox OpenVPN node running the promoted code (build316): the catalog compiled in the sandbox environment and no
openvpn_google_user_synccron was installed while the fact was absent — the dormant/gated path confirmed on real hardware.Runtime dependencies Terraform can't observe are gated inside the wrapper: toolkit
>= 2.61.0providingih-openvpn sync-google-users(released), and Google Workspace domain-wide delegation.Verified
puppet-lint --fail-on-warningsclean on all four module paths.Rollout note
Merging this makes the feature available everywhere but active nowhere. To turn it on for a given OpenVPN deployment: set
enable_google_directory_revocation = truein that consumer'sterraform-aws-openvpn(>= 7.0.0), which sets the fact, ships the WIF files, and activates the sync on the next puppet run — provided the instances run toolkit >= 2.61.0.🤖 Generated with Claude Code