Ruby block executes on every run

[dblessing]

The run-iptables-resources-early ruby block in the default recipe runs on every single Chef run even if no rules are changed. Is there a way to avoid running this if there are no rules changing? It shows in the run as a changed resource.

[rtkrruvinskiy]

@dblessing Ideally, we would have been using default attributes for everything from the start and not setting persistent attributes attributes at all, as that is what's appropriate for our semantics of the simple_iptables_rule resources present in any one Chef run strictly determining the iptables rules present at the end of that run. In fact, we should still switch to use node.default in the resource provider over node.set. However, now that there are nodes out there with normal attributes set, we're kind of stuck, in that we must clear them at the beginning of the Chef run (regardless of whether we then proceed to use node.set or node.default in the provider). That is why that block was introduced.

I'll spend some time trying to think of a way to clean this up once and for all and get back to you. Suggestions are also welcome.

[rtkrruvinskiy]

I misspoke about the purpose, which is really to control when the resource actions are run. I'll play with it to see what can be done.

[dblessing]

Thanks @rtkrruvinskiy. I'm not totally sure I understand what you said so I probably won't have any suggestions. I appreciate you taking a look.