Puppet getting started - Heinlein Support ? Puppet getting started ... Use Puppets package resource

Download Puppet getting started - Heinlein Support ? Puppet getting started ... Use Puppets package resource

Post on 17-Jul-2018

212 views

Category:

Documents

0 download

TRANSCRIPT

  • Puppetgettingstarted

    BestpracticesonhowtoturnYourenvironment

    intoaPuppetmanagedenvironment

    SecureLinuxAdministrationConference2013Berlin20130606

    BerndStrenreuthermailto:slac@stroessenreuther.info

    mailto:slac@stroessenreuther.info

  • License

    Youmayuse,changeorredistributethisdocumentunderthecreativecommonslicensehttp://creativecommons.org/licenses/bysa/3.0/

    http://creativecommons.org/licenses/by-sa/3.0/

  • Agenda

    1. BestPracticesSomethingstoconsiderwhenintroducingpuppetinYourenvironment

    2. YourQuestions

  • Stopthinkingprocedural!

    Startthinkingdeclarativ!

    Avoidexecwhereeverpossible!!

  • ExampleManifest:SSH

    classssh{package{'opensshserver':ensure=>installed;}file{'/etc/ssh/sshd_config':owner=>'root',group=>'root',mode=>'0644',source=>'puppet:///ssh/sshd_config',require=>Package['opensshserver'],notify=>Service['ssh'];}service{'ssh':ensure=>running,enable=>true,require=>File['/etc/ssh/sshd_config'];}}

  • Moduleinheritance:site.pp

    nodedefault{fail"${fqdn}hasnopuppetmodulesassignedto,nonodedefinitionmatching"}

    nodebasenode{include'ssh'include'adminusers'}

    node/webserver[09].example.com/inheritsbasenode{include'httpd'}

    #includingdefinitionsfromfileanother_config.ppimport'another_config'

  • PuppetInfrastructure

    ImagesfromOpenClipart.org,releasedtothepublicdomain.Thankstothecontributors!

    PuppetMaster

    PuppetAgents

    pull

  • WhichversionofPuppettouse?

    Atleast2.7.x

    IfYourdistributionprovidesonlyelderversions,YoucanusethePuppetLabsReposathttp://apt.puppetlabs.com/orhttp://yum.puppetlabs.com/

    Useversionpinning,ifrequired,seehttp://docs.puppetlabs.com/guides/upgrading.html

    http://apt.puppetlabs.com/http://yum.puppetlabs.com/http://docs.puppetlabs.com/guides/upgrading.html

  • ConfigurationManagementSoftwareDistribution

    DonottransportsoftwareproductsoverPuppetmechanismsontotheagents

    Instead: Putsoftwareintorpmordebpackages Putpackagesintoarepository UsePuppetspackageresourcetoinstall IfYoudonotyethavealocalrepository,Youmightwantto

    havealookatmrepohttp://dag.wieers.com/homemade/mrepo/(supportsyumandapt)

    http://dag.wieers.com/home-made/mrepo/

  • HowtostartmyPuppetrollout?

    Withnothing!

    YoucanbringthePuppetAgentontoanode,connectittoPuppetMaster,haveitrunningandhaveitconfigurenothing.(Notevenasinglefileorservice!)

    Youcanputmoreandmoreresources(files,services,users,)undercontrolofPuppetafterwardsandstepbystep

  • WhichconfigurationfilesandservicesshouldIputundercontrolofPuppetfirst?

    Configureonenoncritcalserviceonviewmachinesfirst.

    Dothequickwinsnext

    EyecatchingheadersineveryPuppetmanagedconfigfilearehelpful

  • ShouldIuseaVersionControlSystem?

    IfYoualreadyhaveoneforYourconfigfiles,Youdonotwanttomiss!

    IfYoudonothaveone,introducingittogetherwithPuppetistheidealtime.

    Keepsite.ppandallYourPuppetmodulesthere

    Usemeaningfulcommitmessages: UsenottoomanywordsonwhatYoudidchange TellwhyYoudidchangeit Onelineoftextisoftenenough

  • ConnectingtheVersionControlSystemtothePuppetMaster

    ChangesinversioncontrolsystemshouldbeautomaticallyavailableonthePuppetmaster

    Usehookscripts postcommithooke.g.inSubversion postupdatehooke.g.inGit

  • StagingofPuppetModules

    Onlytestedandapprovedversionsofmodulesshouldbeappliedtoproductivemachines

    Productiveversionanddevelopmentversionofonemoduleshouldliveintheversioncontrolsystem

    Distinguishbydifferentbranches(orbytags)

    Puppetprovidesenvironmentsfordifferenttypesofagents

    Hookscriptneedstocheckouttherightbranch(ortag)intotheaccordingPuppetenvironment

  • PuppetEnvironments:Configonthemaster

    extractof/etc/puppet/puppet.conf:[main]#....[test]manifest=/etc/puppet/test/manifests/site.ppmodulepath=/etc/puppet/test/modules[production]manifest=/etc/puppet/production/manifests/site.ppmodulepath=/etc/puppet/production/modules

  • PuppetEnvironments:Configontheagent

    extractof/etc/puppet/puppet.conf:[main]#....pluginsync=truereport=true[agent]environment=test

  • Exampleworkfowwithbranches(1/2)

    Youhave2longlivingbranches masterforYourtestmachines productionforYourproductivemachines

  • Exampleworkfowwithbranches(2/2)

    1. YouwanttochangeaPuppetmodule

    2. Createanewdevelopmentbranchfeature01basedonmaster

    3. DoYourchangesinfeature01,mergethembacktomaster

    4. RolloutbyPuppetontoYourtestmachines:ApproveYourchangesthere

    5. Ifenhancementsorbugfixesrequired:goto3.

    6. Ifok:mergebranchfeature01ontoproduction

    7. Puppetagenttestnoop

    8. RolloutbyPuppetontoYourproductivemachines

    9. Deletefeature01branch

  • precommitHook/prereceiveHook

    Dosyntaxchecksasearlyaspossible:Oncommitpuppetparservalidatepuppetlintcat|erbPxT|rubyc

    Savetime!

    Nevergetcheckedinfilesthatdonotevencompileorviolateagreedcodingstyle

    Samples:http://projects.puppetlabs.com/projects/1/wiki/Subversion_Commit_Hooks_Patterns

    https://puppetlabs.com/blog/usingpuppetlinttosaveyourselffromstylefauxpas/

    http://projects.puppetlabs.com/projects/1/wiki/Subversion_Commit_Hooks_Patternshttps://puppetlabs.com/blog/using-puppet-lint-to-save-yourself-from-style-faux-pas/

  • PuppetsModulePath

    BydefaulteachPuppetenvironmenthasexactlyonemodulepath

    Formostsetupstooflatandconfusing

    Useatleasttwo: Oneforthirdpartymodules(e.g.PuppetForge) OneforYourownmodules

  • MultipleModulePathEntries

    extractof/etc/puppet/puppet.confonPuppetmaster:[main]#....

    [test]manifest=/etc/puppet/test/manifests/site.ppmodulepath=/etc/puppet/test/modules/site:/etc/puppet/test/modules/thirdparty

    [production]manifest=/etc/puppet/production/manifests/site.ppmodulepath=/etc/puppet/production/modules/site:/etc/puppet/production/modules/thirdparty

  • WheretoassignPuppetmodulestonodes(1/3)

    Manuallyinsite.ppnodebasenode{include'ssh'include'adminusers'}

    nodewebserversinheritsbasenode{include'httpd'}

    node'webserver1.example.com'inheritswebservers{}node'webserver2.example.com'inheritswebservers{}

  • WheretoassignPuppetmodulestonodes(2/3)

    Byconvention Strictnamingconventionforhostnamesrequired Regularexpressionsareallowedinsite.pp

    nodebasenode{include'ssh'include'adminusers'}

    node/webserver[09].example.com/inheritsbasenode{include'httpd'}

  • WheretoassignPuppetmodulestonodes(3/3)

    InYourCMDBbyusingExternalNodeClassifiers(ENC)

    http://docs.puppetlabs.com/guides/external_nodes.html

    http://docs.puppetlabs.com/guides/external_nodes.html

  • PuppetAgentsintheDMZ(1/6)

    HowdoIgettheserversinmyDMZconnectedtoPuppetifthesecuritypolicyofmycompanydoesnotallowconnectionsfromoutside(DMZ)toinside(tomyPuppetmaster)?

    YoucanuseaRemoteSSHTunnelforthis

    CreateanuserforthistaskonYourPuppetmasterandallofYourDMZagents

    EnablekeyauthenticationforSSHfrommasterto

    [puppetuser@master~]$sshkeygen[puppetuser@master~]$sshcopyid

  • PuppetAgentsintheDMZ(2/6)

    ConfigurereverseSSHTunnelsforallconnectionstoDMZagents

    [puppetuser@master~]$cat~.ssh/configHost*RemoteForward8140127.0.0.1:8140StrictHostKeyCheckingnoBatchModeyes

    TellPuppetonDMZagentstousePuppetmasteratlocalhost

    [puppetuser@dmzagent~]$cat/etc/puppet/puppet.conf#...[agent]server=localhost#...

  • PuppetAgentsintheDMZ(3/6)

    AllowpuppetuseronDMZagentstorunPuppetasrootbysudo

    [puppetuser@master~]$cat/etc/sudoers#...Defaults:puppetuser!requirettypuppetuserALL=(root)NOPASSWD:/usr/bin/puppet

    AddaforcedcommandtotheSSHkeythatYoujustcreated(YoumayalsorestrictIPstoYourPuppetmasters)

    [puppetuser@dmzagent~]$cat~/.ssh/authorized_keysfrom="10.0.0.10,10.0.0.11",command="/usr/bin/sudoH/usr/bin/puppetagenttest",noX11forwarding,noagentforwardingsshrsaAAAAB3NzaC12[...]tooxPKT/BSGNw==puppetpushaccount

  • PuppetAgentsintheDMZ(4/6)

    UseavariablepuppetmasterinallYourfileresourcesfilledinsite.pp:

    nodebasenode{$puppetmaster=$network_zone_int_ext?{'ext'=>'localhost',default=>$servername}}

    UsedineveryfileresourceinallYourmodulesfile{'/etc/foo':source=>"puppet://$::puppetmaster/modules/mymod/foo",owner=>'root;}

  • PuppetAgentsintheDMZ(5/6)

    Wherenetwork_zone_int_extcanbeacustomfactdefinedinmymod/lib/facter/network_zone_int_ext.rb

    require'facterFacter.add("network_zone_int_ext")dosetcodedonetwork_zone_int_ext="int"ifFacter.value(:ipaddress).match(/^(10\.1\.|10\.2\.)/)network_zone_int_ext="ext"elsenetwork_zone_int_ext="int"endendend

  • PuppetAgentsintheDMZ(6/6)

    SetupacronjobforpuppetuseronPuppetmaster,thatregularlycallsasshtoeveryDMZagent

    ThelistofallDMZagentscanautomaticallybefilledbyaexportedresource

  • PuppetForge

    ApublicrepositoryforPuppetModules

    https://forge.puppetlabs.com/

    Qualityofmodulesdiffersverymuch

    https://forge.puppetlabs.com/

  • Anymorequestions?

    Nowisagoodtimetoask

    Grabmeontheconference

    Illbearoundheretodayandtomorrow

    HearMartinAlfke'stalkPuppetAdvancedtomorrow

  • Appendix

  • hiera

    Ahierachicalstoreforname=valuepairs

    ThehierachycanbeconfiguredaccordingtoYourneeds

    Themostspecificentryistaken

    Caneasilybequeriedbypuppet Putvariableshere

    IdealifYouhavemanycommonserversandviewexceptions

  • Facts

    Puppetqueriesmanydetailsofthesystemitconfigures,facterputstheseintosinglevariables

    Theycanbeusedintemplatesandmanifests[booboo@dunno~]$facterarchitecture=>i386domain=>example.comfqdn=>dunno.example.comhardwareisa=>i686hostname=>dunnointerfaces=>eth0,lo,peth0,sit0,veth1,vif0_0,vif0_1ipaddress=>10.0.0.182ipaddress_eth0=>10.0.0.182ipaddress_lo=>127.0.0.1is_virtual=>false...

  • Facterexample

    Yourhostshaveaproductivenetworkinterfaceandoneformanagement

    YouwantYourapachetolistenonlyontheproductiveinterface

    Unabletouse:

    Listen80

    Useinstead:

    Listen:80

  • CustomFacts

    E.g.stageordatacenter

    Writealittlebitofrubycode

    Putitinto/lib/facter/.rb

    Setin/etc/puppet/puppet.confattheagent:[main]#....pluginsync=true

  • ExportedResources

    WheneverYouaddanewhostundercontrolofPuppetYoumightwanttoaddbasicmonitorings(diskspace,CPUusage,)toYourmonitoringsystem(runningonanothernode)

    WheneverYouaddYourPuppetmoduleapachetoahostYouneedtoconfigurearegularcheckofHTTPonthishostinYourmonitoringsystem

    LetPuppetdothisforYouautomatically!

    Soundsuseful?UseExportetResourcestoconfigurethis.

  • ExportedResourcesExample(monitoredmachine)

    classapache{service{'httpd':ensure=>running,enable=>true,hasstatus=>true;}@@nagios_service{check_http_${hostname}:check_command=>'check_http_port_path!80!/',use=>'genericservice',host_name=>$hostname,notification_period=>'24x7',service_description=>'HTTPGET/',target=>'/etc/icinga/objects.puppet.autogen/services.http.cfg;}}

  • ExportedResourcesExample(monitoringmachine)

    classicingaserver{file{'/etc/icinga/objects.puppet.autogen/services.http.cfg':owner=>'root',group=>'root',mode=>'0644';}

    #collectresources#andpopulate#/etc/icinga/objects.puppet.autogen/*.cfgNagios_service}

  • ExportedResourcesExample:Result

    [booboo@icingaserver~]$catservices.http.cfg#HEADER:Thisfilewasautogeneratedat#HEADER:FriDec1413:53:26+01002012#HEADER:bypuppet.Whileitcanstillbemanaged#HEADER:manually,itisdefinitelynotrecommended.

    defineservice{##PUPPET_NAME(called'_naginator_name'in##themanifest)check_http_dunno1usegenericserviceservice_descriptionHTTPGET/check_commandcheck_http_port_path!80!/host_namedunno1notification_period24x7}

  • VersionControl:Exampleworkfowwithtags(1/2)

    OftenusedwithSubversion

    Basicsetup: MostofthetimeYouhavenobranchbesidetrunk SetupanownprojectforeachPuppetmodule

    plusoneformainmanifests(plusoneforhieradata) Writeapostcommithookscriptthatchecksouttrunkinto

    Puppetsenvironmenttestandthelatesttagofeachprojectintoproductionenvironment

    UsedefinednamesforYourtags,e.g.YYYYMMDD_hhmm

  • VersionControl:Exampleworkfowwithtags(2/2)

    1. YouwanttochangeaPuppetmodule

    2. CommitYourchanges(intotrunk)

    3. RolloutbyPuppetontoYourtestmachines:ApproveYourchangesthere

    4. Ifenhancementsorbugfixesrequired:goto2.

    5. Ifok:checkforotherchangesonthismodulenotyettagged(svndiff)

    6. taglastversionofthechangedPuppetmodule(Subversionproject)

    7. puppetdtestnoop

    8. RolloutbyPuppetontoYourproductivemachines

    Folie 1Folie 2Folie 3Folie 4Folie 5Folie 6Folie 7Folie 8Folie 9Folie 10Folie 11Folie 12Folie 13Folie 14Folie 15Folie 16Folie 17Folie 18Folie 19Folie 20Folie 21Folie 22Folie 23Folie 24Folie 25Folie 26Folie 27Folie 28Folie 29Folie 30Folie 31Folie 32Folie 33Folie 34Folie 35Folie 36Folie 37Folie 38Folie 39Folie 40Folie 41Folie 42Folie 43