add support for automated splunk update when new version is available

[asifulhaque786]

… https://gitea.obmondo.com/EnableIT/abbnoa6nlk/issues/2554

[Aman1994]

P1 — this returns a value that violates the return_type declared on line 33, breaking every catalog on the second compile.

write_cache persists data.merge("fetched_at" => ...), and read_cache is a plain JSON.parse, so cached is {"version"=>..., "build"=>..., "fetched_at"=>...}. Puppet's Struct is strict — unlisted keys are rejected.

So: first compile fetches, returns a clean 2-key hash, passes. Every compile in the next 6h hits this line and dies with a return-type mismatch. cached || FALLBACK on line 48 has the same defect.

Stripping on read rather than on write keeps the timestamp available for stale?:

return cached.slice("version", "build") if cached && !stale?(cached)
...
rescue StandardError => e
  Puppet.warning(...)
  cached ? cached.slice("version", "build") : FALLBACK
end

[Aman1994]

These constants leak onto top-level Object.

Ruby resolves constant assignment lexically, and a block is not a constant scope — so inside create_function do ... end these define ::DOWNLOAD_PAGE, ::CACHE_PATH, ::CACHE_TTL_SECONDS and ::FALLBACK on Object in the puppetserver JRuby.

Two consequences: a collision with any other function that picks the same identifier, and warning: already initialized constant on every environment reload.

Private methods returning the literals (def cache_path = "/opt/..."), or nesting them under a real module, both avoid it.

[Aman1994]

Fixed temp filename races under concurrent compiles.

A puppetserver compiles many catalogs in parallel. When the TTL expires, every in-flight thread fetches and writes this same path, then renames it into place — so the cache can land truncated or spliced.

read_cache rescues the parse error and returns nil, so it degrades to "refetch on every compile" rather than a hard failure. But that's a live HTTP call to splunk.com per catalog, which is exactly what the cache exists to prevent.

tmp_path = "#{cache_path}.#{Process.pid}.#{Thread.current.object_id}.tmp"

plus an ensure block to unlink it on failure.

[Aman1994]

Dropping the 7.2.4 / 8a94541dcfac defaults is the highest-blast-radius part of this PR.

grep over data/ and hieradata/ finds no splunk version/build pin anywhere, so every node with manage => true is currently on 7.2.4 by way of these defaults. After this merge the same node resolves whatever splunk.com advertises (10.4.2 today) and package_ensure => 'latest' applies it on the next run — a 3-major-version jump on the agent that ships customer logs, unattended, keyed off a page scrape.

The machinery is right; it's the default I'd flip. Keeping the pin as the default and making tracking explicit (version => 'latest', or a track_latest boolean) gets the same capability without the fleet moving on its own.

[Aman1994]

/opt/obmondo/cache is referenced nowhere else in the repo — nothing creates or manages it.

FileUtils.mkdir_p runs as the puppetserver user, so if /opt/obmondo isn't writable by it, write_cache warns and every compile refetches. Same end state as the tmp-path race: a live HTTP call per catalog, with open_timeout: 5, read_timeout: 10 bounding one request but not the aggregate.

Puppet[:vardir] is writable by the compiling process by construction and would remove the failure mode. A short negative-result cache would also bound the worst case when Splunk's page is slow rather than down.