puppet-sysctl

Overview

Manage sysctl variable values. All changes are immediately applied, as well as configured to become persistent. Tested on Red Hat Enterprise Linux 6 and 7.

• sysctl : Definition to manage sysctl variables by setting a value.
• sysctl::base: Base class (included from the definition).

For persistence to work, your Operating System needs to support looking for sysctl configuration inside /etc/sysctl.d/.

You may optionally enable purging of the /etc/sysctl.d/ directory, so that all files which are not (or no longer) managed by this module will be removed.

Beware that for the purge to work, you need to either have at least one sysctl definition call left for the node, or include sysctl::base manually.

You may also force a value to ensure => absent, which will always work.

For the few original settings in the main /etc/sysctl.conf file, the value is also replaced so that running sysctl -p doesn't revert any change made by puppet.

Examples

Enable IP forwarding globally :

sysctl { 'net.ipv4.ip_forward': value => '1' }

Set a value for maximum number of connections per UNIX socket :

sysctl { 'net.core.somaxconn': value => '65536' }

Make sure we don't have any explicit value set for swappiness, typically because it was set at some point but no longer needs to be. The original value for existing nodes won't be reset until the next reboot :

sysctl { 'vm.swappiness': ensure => absent }

If the order in which the files get applied is important, you can set it by using a file name prefix, which could also be set globally from site.pp :

Sysctl { prefix => '60' }

To enable purging of settings, you can use hiera to set the sysctl::base $purge parameter :

---
# sysctl
sysctl::base::purge: true

Hiera

It is also possible to manage all sysctl keys using hiera, through the $values parameter of the sysctl::base class. If sysctl values are spread across different hiera locations, it's also possible to merge all of them instead of having only the last one applied, by setting the $hiera_merge_values parameter to true.

sysctl::base::values:
  net.ipv4.ip_forward:
    value: '1'
  net.core.somaxconn:
    value: '65536'
  vm.swappiness:
    ensure: absent

Original /etc/sysctl.d entries

When purging, puppet might want to remove files from /etc/sysctl.d/ which have not been created by puppet, but need to be present. It's possible to set the same values for the same keys using puppet, but if the file comes from an OS package which gets updated, it might re-appear when the package gets updated. To work around this issue, it's possible to simply manage an identical file with this module. Example :

package { 'libvirt': ensure => installed } ->
sysctl { 'libvirtd':
  suffix => '',
  source => "puppet:///modules/${module_name}/libvirtd.sysctl",
}

2021-06-30 - 1.0.7

• Add missing owner/group to 99-sysctl.conf that could get inherited.
• Fix 99-sysctl.conf being removed on RHEL8+.

2016-02-05 - 1.0.6

• Revert previous incorrect change, more work is needed to cover all cases.

2016-02-05 - 1.0.5

• Fix enforcing for values with spaces (#37, @mattpascoe).

2016-02-02 - 1.0.4

• Convert numerical value to string to work around shellquote() failure (#35).

2016-02-02 - 1.0.3

• Update project_page and source in metadata.json file (#25).
• Add default value to hiera_hash call (#30, @tedivm).
• Prevent spaces in file names (#31, @jokajak).
• Add support for Debian 8 (same symlink99 as RedHat 7).
• Enforce values on each run by default (#23, @jjneely).
• Remove incorrectly advertised FreeBSD support (#27, @b4ldr).

2014-12-22 - 1.0.2

• Fix metadata.json file (#18).

2014-12-16 - 1.0.1

• Replace Modulefile with metadata.json.

2014-09-05 - 1.0.0

• Keep the 99-sysctl.conf symlink on RHEL7.
• Add support for hiera defined sysctl values (#14, @emahags).
• Add support for source, content and configurable file suffix.
• Allow comment to be any of string (even multi-line) or array (#12).
• Start adding support for setting sysctl_dir to false.

2014-07-19 - 0.3.2

• Use a different separator for sed to allow values with '/' (#11, @rubenk).

2014-03-17 - 0.3.1

• Fix ensure => 'absent' (#9).

2014-01-20 - 0.3.0

• Add optional comment inside the sysctl.d file.
• Use sysctl -p with the created/modified file instead of sysctl -w (#3).
• Fix purge and set its default to false (#7, tehmaspc).

2013-10-02 - 0.2.0

• Add optional prefix to the sysctl.d file name, to force ordering.

2013-06-25 - 0.1.1

• Make purge optional, still enabled by default.
• Add rspec tests (Justin Lambert).
• Minor fix for values with spaces (needs more changes to be robust).

2013-03-06 - 0.1.0

• Update README to markdown.
• Change to recommended 2 space indent.

2012-12-18 - 0.0.3

• Add feature to update existing values in /etc/sysctl.conf.
• Apply setting on each run if needed (hakamadare).
• Make sure $ensure => absent still works with the above change.

2012-09-19 - 0.0.2

• Fix deprecation warnings.
• Fix README markup.

2012-07-19 - 0.0.1

• Initial module release.