为什么即使订阅触发器不匹配，我的 Puppet 类的 exec 调用也会触发？

Question

下面附上一个我写的 puppet 模块，它将 iptables 配置推送到我们的负载均衡器。它可以工作，除了 so-bans-apply 脚本在每次木偶运行时运行，而不管服务本身是否真的有更新。我的问题是为什么每次运行都会触发 exec，我怎样才能让它在订阅的服务刷新时运行？

我曾尝试删除 Exec 中的“onlyif”语句，认为可能 onlyif 会触发无条件执行，但即使没有“onlyif”，exec 仍会触发每次运行木偶。

节点定义的指定与此类似，但未指定任何参数：

node /or-rtlb\d{2}/ {
     include iptables
}

这是类本身的代码：

class iptables ($ApplyBans=true)
{
    if $hostname =~ /(?i:or-rtlb\d{2})/ {
        $ip6tables_file="or-rtlbs.ip6tables"
        $iptables_file="or-rtlbs.iptables"
    }
    if $hostname =~ /(?i:or-puptest)/ {
        $ip6tables_file="or-rtlbs.ip6tables"
        $iptables_file="or-rtlbs.iptables"
    }


    case $::osfamily {
        RedHat:
        {
            file { "/etc/sysconfig":
                ensure => directory,
                owner => root,
                group => root,
                mode  => 0755
            }

            file { "ip6tables-file":
                path    => "/etc/sysconfig/ip6tables",
                ensure  => present,
                owner   => root,
                group   => root,
                mode    => 0644,
                source  => "puppet:///modules/iptables/$ip6tables_file",
                require => [File["/etc/sysconfig"], Package["iptables"]],
                notify  => Service["ip6tables-service"]
            }
            file { "iptables-file":
                path    => "/etc/sysconfig/iptables",
                ensure  => present,
                owner   => root,
                group   => root,
                mode    => 0644,
                source  => "puppet:///modules/iptables/$iptables_file",
                require => [File["/etc/sysconfig"], Package["iptables"]],
                notify  => Service["iptables-service"]
            }
            package { "iptables":
                ensure => installed
            }
            package { "iptables-ipv6":
                ensure => installed
            }
            service { "iptables-service":
                name        => "iptables",
                ensure          => running,
                hasstatus       => true,
                hasrestart      => true,
                enable          => true,
            }
            service { "ip6tables-service":
                name        => "ip6tables",
                ensure          => running,
                hasstatus       => true,
                hasrestart      => true,
                enable          => true,
            }

            if ($ApplyBans)
            {
                exec { "so-bans-apply" :
                    command => "/root/bans/so-bans/force-ban-refresh",
                    onlyif => "/usr/bin/test -f /root/bans/so-bans/force-ban-refresh",
                    subscribe => [
                        Service["iptables-service"],
                        Service["ip6tables-service"],
                    ]                   
                }
            }
        }
    }
}

Answer 1

添加refreshonly => true到exec，它只会在一个notifyorsubscribe关系触发它时运行。