Add validation on var.hieradata

[cmd-ntrf]

If the yaml input provided in var.hieradata is invalid, Puppet will be unable to execute properly. We can prevent injecting invalid yaml by trying to first decode it using yamldecode in the validation block of var.hieradata.

  validation {
    condition     = can(yamldecode(var.hieradata))
    error_message = "Hieradata needs to be valid YAML"
  }

[cmd-ntrf]

We can also validate the YAML content on the Puppet server before the user_data.yaml file is copied.
https://github.com/ComputeCanada/magic_castle/blob/main/common/provision/main.tf#L48

[etiennedub]

@cmd-ntrf I try your first suggestion but I'm not sure that it's enough. Almost everything can be convert to yaml with yamlencode (string, random text file, json object). However, it will catch resources pass to the variable and empty string.

For example, this is valid:

> yamlencode(file("bad.yaml"))
<<EOT
|
  this is not a yaml file
  a=>2
  $i : 42

EOT

Do you think we should get a better validation?

[etiennedub]

Forget my last comment, I realized that it was yamldecode instead of yamlencode. With yamldecode, it catches issues with invalid files. It's actually a good solution. I will send the PR.