Refactor CloudWatch agent to shared base class with DRY configuration (development) #217
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Mark Phase 1 (logrotate ACL) and Phase 2 (btmp/wtmp removal) as DONE - Restructure phases 3-9 to implement in development environment first - Add gradual rollout: development -> sandbox -> production - Update file paths to target environments/development/modules/profile/ - Add explicit testing and promotion phases between environments
Create profile::cloudwatch_agent base class with: - Common logs: audit, auth, syslog, kern, dpkg, cloudwatch agent - Common metrics: CPU, memory, disk, swap, netstat, processes - Common procstat: auditd - Shared resources: package, user, service, ACL scripts, systemd drop-in Service classes now pass only their extras: - Jumphost: extra_logs=[fail2ban] - OpenVPN: extra_logs=[openvpn], extra_procstat=[openvpn] Additional changes: - Standardize dimensions to lowercase (host, environment) - Use Puppet built-in $environment instead of passing parameter - Remove DiskSpaceUsed from custom metrics (redundant with DISK_USED_PERCENT) - Add OpenVPN log ACL scripts and logrotate config - Add OpenVPN auditd profile - Move ACL script templates to shared cloudwatch_agent/ - Delete duplicate CloudWatch agent JSON templates This reduces ~400 lines of duplicated config to a single shared template.
infrahouse8
approved these changes
Dec 23, 2025
akuzminsky
added a commit
that referenced
this pull request
Jan 2, 2026
Move puppet-cloudwatch-agent-task.md to archive since it's been completed and superseded by the CloudWatch logging standardization effort (cloudwatch-logging-standardization.md). The original task (adding CloudWatch to OpenVPN) was completed as part of the larger refactoring work in PR #217 (development) and PR #223 (sandbox).
akuzminsky
added a commit
that referenced
this pull request
Jan 2, 2026
Move puppet-cloudwatch-agent-task.md to archive since it's been completed and superseded by the CloudWatch logging standardization effort (cloudwatch-logging-standardization.md). The original task (adding CloudWatch to OpenVPN) was completed as part of the larger refactoring work in PR #217 (development) and PR #223 (sandbox).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
profile::cloudwatch_agentwith common logs, metrics, and resourcesChanges
New shared base class (
profile::cloudwatch_agent)extra_logsandextra_procstatfor service-specific additionsService classes simplified
extra_logs=[fail2ban]extra_logs=[openvpn],extra_procstat=[openvpn]Metrics cleanup
host(built-in),environment(Puppet built-in)DiskSpaceUsedfrom custom metrics (covered byDISK_USED_PERCENT)OpenVPN improvements
copytruncate(OpenVPN doesn't reopen logs on SIGHUP)Test plan
host,environment)