Index Creation is not Idempotent

[MattMencel]

I noticed that Index creation happens on every Chef run. Is there any way to make that idempotent so it only runs if it is new or is a modification?

Every time Chef runs the index creation provider runs and an indexing task is generated. That means an index operation is run on the LDAP server every time Chef runs. The cookbook shouldn't try to create an index task on every Chef run if the index itself hasn't changed or isn't new.

Not sure what direction to go to make this idempotent.

[williamsjj]

Was this ever corrected?

[awillis]

No, it wasn't. It's a pretty hairy thing to resolve because the directory server removes the entries after it creates the index, so a subsequent run would recreate the indices because the existence check would fail. It's mostly harmless though, as indices are generated quickly. You'd probably have to leave some additional entry that the directory server won't remove in order to detect that an index was already created.

I need some help maintaining this cookbook by the way, as it does not get much of my attention. Any takers?

[williamsjj]

@awillis I'd be somewhat interested. Our situation is we're sitting on an OpenDJ infrastructure that works quite well except their binary release policy stranded us on an old version with no way to upgrade. So it's either ApacheDS, OpenLDAP or 389 from my research, and your cookbook is the only one that handles replication set up sanely/maturely. So we're leaning 389 (even though we're an Ubuntu shop)....and that's a super long way of saying I'd be interested if we pull the trigger on 389. We were already maintaining our own OpenDJ cookbook.

[williamsjj]

@awillis BTW I'm in Santa Monica if you want to discuss over a beer or something.

[awillis]

@williamsjj Beer 👍

How does tomorrow at 5pm work?

[MattMencel]

Wish I was in Santa Monica, it's cold here. You can drink one for me if you want.

I don't know what all you need, but I can probably help too. We're running a very old Sun DS. We played with OpenDJ for a bit but the licensing model made it undoable....and then I found 389DS. So we're looking at a migration to 389 sometime in the near future.