add repo key using puppet under ubuntu

Question

I'll need to add a apt repository key to a bunch of ubuntu hosts using puppet.

Would a statement like this work for that?

 exec {"add apt key for elastic":
        command => "/usr/bin/curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | /usr/bin/apt-key add -",
     }

thanks

Answer 1

Yes, this should work but this will also apply the same configuration whenever you rerun Puppet.

From exec docs :

Any command in an exec resource must be able to run multiple times without causing harm — that is, it must be idempotent. There are three main ways for an exec to be idempotent:

• The command itself is already idempotent. (For example, apt-get update.)
• The exec has an onlyif, unless, or creates attribute, which prevents Puppet from running the command unless some condition is met.
• The exec has refreshonly => true, which only allows Puppet to run the command when some other resource is changed. (See the notes on refreshing below.)

Answer 2

I try and only use execs if I really have to. One of the reasons being that you have to code the exec so that it only runs when you want to. Instead, you can use the apt module. This will only place the key on the host if it does not already exist. The resource is under puppet control so will not be added on subsequent runs:

  include apt

  apt::key { 'elasticsearch':
    id      => '46095ACC8548582C1A2699A9D27D666CD88E42B4',
    options => 'https://packages.elasticsearch.org/GPG-KEY-elasticsearch',
  }