puppet getting started - heinlein support ?· puppet getting started ... use puppets package...

Download Puppet getting started - Heinlein Support ?· Puppet getting started ... Use Puppets package resource…

Post on 17-Jul-2018

212 views

Category:

Documents

0 download

Embed Size (px)

TRANSCRIPT

  • Puppetgettingstarted

    BestpracticesonhowtoturnYourenvironment

    intoaPuppetmanagedenvironment

    SecureLinuxAdministrationConference2013Berlin20130606

    BerndStrenreuthermailto:slac@stroessenreuther.info

    mailto:slac@stroessenreuther.info

  • License

    Youmayuse,changeorredistributethisdocumentunderthecreativecommonslicensehttp://creativecommons.org/licenses/bysa/3.0/

    http://creativecommons.org/licenses/by-sa/3.0/

  • Agenda

    1. BestPracticesSomethingstoconsiderwhenintroducingpuppetinYourenvironment

    2. YourQuestions

  • Stopthinkingprocedural!

    Startthinkingdeclarativ!

    Avoidexecwhereeverpossible!!

  • ExampleManifest:SSH

    classssh{package{'opensshserver':ensure=>installed;}file{'/etc/ssh/sshd_config':owner=>'root',group=>'root',mode=>'0644',source=>'puppet:///ssh/sshd_config',require=>Package['opensshserver'],notify=>Service['ssh'];}service{'ssh':ensure=>running,enable=>true,require=>File['/etc/ssh/sshd_config'];}}

  • Moduleinheritance:site.pp

    nodedefault{fail"${fqdn}hasnopuppetmodulesassignedto,nonodedefinitionmatching"}

    nodebasenode{include'ssh'include'adminusers'}

    node/webserver[09].example.com/inheritsbasenode{include'httpd'}

    #includingdefinitionsfromfileanother_config.ppimport'another_config'

  • PuppetInfrastructure

    ImagesfromOpenClipart.org,releasedtothepublicdomain.Thankstothecontributors!

    PuppetMaster

    PuppetAgents

    pull

  • WhichversionofPuppettouse?

    Atleast2.7.x

    IfYourdistributionprovidesonlyelderversions,YoucanusethePuppetLabsReposathttp://apt.puppetlabs.com/orhttp://yum.puppetlabs.com/

    Useversionpinning,ifrequired,seehttp://docs.puppetlabs.com/guides/upgrading.html

    http://apt.puppetlabs.com/http://yum.puppetlabs.com/http://docs.puppetlabs.com/guides/upgrading.html

  • ConfigurationManagementSoftwareDistribution

    DonottransportsoftwareproductsoverPuppetmechanismsontotheagents

    Instead: Putsoftwareintorpmordebpackages Putpackagesintoarepository UsePuppetspackageresourcetoinstall IfYoudonotyethavealocalrepository,Youmightwantto

    havealookatmrepohttp://dag.wieers.com/homemade/mrepo/(supportsyumandapt)

    http://dag.wieers.com/home-made/mrepo/

  • HowtostartmyPuppetrollout?

    Withnothing!

    YoucanbringthePuppetAgentontoanode,connectittoPuppetMaster,haveitrunningandhaveitconfigurenothing.(Notevenasinglefileorservice!)

    Youcanputmoreandmoreresources(files,services,users,)undercontrolofPuppetafterwardsandstepbystep

  • WhichconfigurationfilesandservicesshouldIputundercontrolofPuppetfirst?

    Configureonenoncritcalserviceonviewmachinesfirst.

    Dothequickwinsnext

    EyecatchingheadersineveryPuppetmanagedconfigfilearehelpful

  • ShouldIuseaVersionControlSystem?

    IfYoualreadyhaveoneforYourconfigfiles,Youdonotwanttomiss!

    IfYoudonothaveone,introducingittogetherwithPuppetistheidealtime.

    Keepsite.ppandallYourPuppetmodulesthere

    Usemeaningfulcommitmessages: UsenottoomanywordsonwhatYoudidchange TellwhyYoudidchangeit Onelineoftextisoftenenough

  • ConnectingtheVersionControlSystemtothePuppetMaster

    ChangesinversioncontrolsystemshouldbeautomaticallyavailableonthePuppetmaster

    Usehookscripts postcommithooke.g.inSubversion postupdatehooke.g.inGit

  • StagingofPuppetModules

    Onlytestedandapprovedversionsofmodulesshouldbeappliedtoproductivemachines

    Productiveversionanddevelopmentversionofonemoduleshouldliveintheversioncontrolsystem

    Distinguishbydifferentbranches(orbytags)

    Puppetprovidesenvironmentsfordifferenttypesofagents

    Hookscriptneedstocheckouttherightbranch(ortag)intotheaccordingPuppetenvironment

  • PuppetEnvironments:Configonthemaster

    extractof/etc/puppet/puppet.conf:[main]#....[test]manifest=/etc/puppet/test/manifests/site.ppmodulepath=/etc/puppet/test/modules[production]manifest=/etc/puppet/production/manifests/site.ppmodulepath=/etc/puppet/production/modules

  • PuppetEnvironments:Configontheagent

    extractof/etc/puppet/puppet.conf:[main]#....pluginsync=truereport=true[agent]environment=test

  • Exampleworkfowwithbranches(1/2)

    Youhave2longlivingbranches masterforYourtestmachines productionforYourproductivemachines

  • Exampleworkfowwithbranches(2/2)

    1. YouwanttochangeaPuppetmodule

    2. Createanewdevelopmentbranchfeature01basedonmaster

    3. DoYourchangesinfeature01,mergethembacktomaster

    4. RolloutbyPuppetontoYourtestmachines:ApproveYourchangesthere

    5. Ifenhancementsorbugfixesrequired:goto3.

    6. Ifok:mergebranchfeature01ontoproduction

    7. Puppetagenttestnoop

    8. RolloutbyPuppetontoYourproductivemachines

    9. Deletefeature01branch

  • precommitHook/prereceiveHook

    Dosyntaxchecksasearlyaspossible:Oncommitpuppetparservalidatepuppetlintcat|erbPxT|rubyc

    Savetime!

    Nevergetcheckedinfilesthatdonotevencompileorviolateagreedcodingstyle

    Samples:http://projects.puppetlabs.com/projects/1/wiki/Subversion_Commit_Hooks_Patterns

    https://puppetlabs.com/blog/usingpuppetlinttosaveyourselffromstylefauxpas/

    http://projects.puppetlabs.com/projects/1/wiki/Subversion_Commit_Hooks_Patternshttps://puppetlabs.com/blog/using-puppet-lint-to-save-yourself-from-style-faux-pas/

  • PuppetsModulePath

    BydefaulteachPuppetenvironmenthasexactlyonemodulepath

    Formostsetupstooflatandconfusing

    Useatleasttwo: Oneforthirdpartymodules(e.g.PuppetForge) OneforYourownmodules

  • MultipleModulePathEntries

    extractof/etc/puppet/puppet.confonPuppetmaster:[main]#....

    [test]manifest=/etc/puppet/test/manifests/site.ppmodulepath=/etc/puppet/test/modules/site:/etc/puppet/test/modules/thirdparty

    [production]manifest=/etc/puppet/production/manifests/site.ppmodulepath=/etc/puppet/production/modules/site:/etc/puppet/production/modules/thirdparty

  • WheretoassignPuppetmodulestonodes(1/3)

    Manuallyinsite.ppnodebasenode{include'ssh'include'adminusers'}

    nodewebserversinheritsbasenode{include'httpd'}

    node'webserver1.example.com'inheritswebservers{}node'webserver2.example.com'inheritswebservers{}

  • WheretoassignPuppetmodulestonodes(2/3)

    Byconvention Strictnamingconventionforhostnamesrequired Regularexpressionsareallowedinsite.pp

    nodebasenode{include'ssh'include'adminusers'}

    node/webserver[09].example.com/inheritsbasenode{include'httpd'}

  • WheretoassignPuppetmodulestonodes(3/3)

    InYourCMDBbyusingExternalNodeClassifiers(ENC)

    http://docs.puppetlabs.com/guides/external_nodes.html

    http://docs.puppetlabs.com/guides/external_nodes.html

  • PuppetAgentsintheDMZ(1/6)

    HowdoIgettheserversinmyDMZconnectedtoPuppetifthesecuritypolicyofmycompanydoesnotallowconnectionsfromoutside(DMZ)toinside(tomyPuppetmaster)?

    YoucanuseaRemoteSSHTunnelforthis

    CreateanuserforthistaskonYourPuppetmasterandallofYourDMZagents

    EnablekeyauthenticationforSSHfrommasterto

    [puppetuser@master~]$sshkeygen[puppetuser@master~]$sshcopyid

  • PuppetAgentsintheDMZ(2/6)

    ConfigurereverseSSHTunnelsforallconnectionstoDMZagents

    [puppetuser@master~]$cat~.ssh/configHost*RemoteForward8140127.0.0.1:8140StrictHostKeyCheckingnoBatchModeyes

    TellPuppetonDMZagentstousePuppetmasteratlocalhost

    [puppetuser@dmzagent~]$cat/etc/puppet/puppet.conf#...[agent]server=localhost#...

  • PuppetAgentsintheDMZ(3/6)

    AllowpuppetuseronDMZagentstorunPuppetasrootbysudo

    [puppetuser@master~]$cat/etc/sudoers#...Defaults:puppetuser!requirettypuppetuserALL=(root)NOPASSWD:/usr/bin/puppet

    AddaforcedcommandtotheSSHkeythatYoujustcreated(YoumayalsorestrictIPstoYourPuppetmasters)

    [puppetuser@dmzagent~]$cat~/.ssh/authorized_keysfrom="10.0.0.10,10.0.0.11",command="/usr/bin/sudoH/usr/bin/puppetagenttest",noX11forwarding,noagentforwardingsshrsaAAAAB3NzaC12[...]tooxPKT/BSGNw==puppetpushaccount

  • PuppetAgentsintheDMZ(4/6)

    UseavariablepuppetmasterinallYourfileresourcesfilledinsite.pp:

    nodebasenode{$puppetmaster=$network_zone_int_ext?{'ext'=>'localhost',default=>$servername}}

    UsedineveryfileresourceinallYourmodulesfile{'/etc/foo':source=>"puppet://$::puppetmaster/modules/mymod/foo",owner=>'root;}

  • PuppetAgentsintheDMZ(5/6)

    Wherenetwork_zone_int_extcanbeacustomfactdefinedinmymod/lib/facter/network_zone_int_ext.rb

    require'facterFacter.add("network_zone_int_ext")dosetcodedonetwork_zone_int_ext="int"ifFacter.value(:ipaddress).match(/^(10\.1\.|10\.2\.)/)network_zone_int_ext="ext"elsenetwork_zone_int_ext="int"endendend

  • PuppetAgentsintheDMZ(6/6)

    SetupacronjobforpuppetuseronPuppetmaster,thatregularlycallsasshtoeveryDMZagent

    ThelistofallDMZagentscanautomaticallybefilledbyaexportedresource

  • PuppetForge

    ApublicrepositoryforPuppetModules

    https://forge.puppetlabs.com/

    Qualityofmodulesdiffersverymuch

    https://forge.puppetlabs.com/

  • Anymorequestions?

    Nowisagoodtimetoask

    Grabmeontheconference

    Illbearoundheretodayandtomorrow

    HearMartinAlfke'stalkPuppetAdvancedtomorrow

  • Appendix

  • hiera

    Ahierachicalstoreforname=valuepairs

    ThehierachycanbeconfiguredaccordingtoYourneeds

    Themostspecificentryistaken

    Caneasilybequeriedbypuppet Putvariableshere

    IdealifYouhavemanycommonserversandviewexceptions

  • Facts

    Puppetqueriesmanydetailsofthesystemitconfigures,facterputstheseintosinglevariables

    Theycanbeusedintemplatesandmanifests[booboo@dunno~]$facterarchitecture=>i386domain=>example.com