Systems Automation
With Puppet
Ohad Levy
Senior Staff Engineer at
Infineon Technologies
Tel Aviv Linux Club
07/09/2008
Warning
Many of the slides are copied! :)
Typical System Life cycle
Installation
Typical System Life cycle
Initial
Configuration
Installation
Typical System Life cycle
Initial
Configuration
Installation
Fixes
Updates
Audits
The Challenges
Keep our systems "harmonized"
Know whats going on on each system
Replace a server if it dies or to be able to add another server
that is exactly like it
Similar Applications, different OS's
Push out changes to all the servers that need a particular
change
Stop duplicating effort
Go home early
How to solve the problem?
TheManualway
Loginanddoit
ThatsOKonlyforalimitedsetofmachines...
Installtimeautoconfigure
Kickstart,jumpstartetc,withapostinstallationscripts
Butthenwhat?
Howtopushachange?
NoHistoryofchanges,auditetc...
Or....
Puppet Life cycle
Puppet
Initial
Configuration
Installation
Fixes
Updates
Audits
What is Puppet?
AGPLOpenSourceProjectwritteninRuby
Adeclarativelanguageforexpressingsystem
configuration
AClientandserver
Alibrarytorealizetheconfiguration
Puppetistheabstractionlayerbetweenthesystem
administratorandthesystem
PuppetrequiresonlyRubyandFacter
Clientrunsevery30minutesbydefault
Puppet components
Puppet Types
ATypeisaparticularelementthatPuppetknowshow
toconfigure
Files(content,permissions,ownership)
Packages(ensureinstalledorabsent)
Services(enabled/disabled,running/stopped)
Exec(runcommands)
FullList:cron,exec,file,filebucket,group,host,
interface,k5login,mailalias,maillist,mount,
nagios*,package,service,sshkey,tidy,user,
yumrepo,zone
Example: Managing sudoers file
file{/etc/sudoers:
ensure=>file,
owner=>root,
group=>root,
mode=>600,
source=>puppet://server/files/sudoer
Dependencies
requireandbefore/aftersettingsensuresthattypesare
appliedinthecorrectorder
file { /etc/sudoers:
...
require => Package[sudo]
}
package { sudo:
ensure => present,
before => File[/etc/sudoers]
}
Dependencies - continued
notifyandsubscribesettingscantriggercascadedupdates
Particularlyusefulinservices,exec
file { /etc/ssh/sshd_conf:
...
notify => Service[sshd]
}
service { sshd:
subscribe => File[/etc/ssh/sshd_conf
}
What is Facter?
Factergathersinformationabouttheclient,whichcanbe
usedasvariableswithinpuppet.
Youcanaddcustomfactsasneeded.
package{"sshd":
ensure=>installed,
name=>$operatingsystem?{
solaris=>"IFKLssh",
default=>"opensshserver"
}
}
Example Facts
$sudofacter
architecture=>amd64
domain=>sin.infineon.com
facterversion=>1.3.8
lsbdistid => Ubuntu
lsbdistrelease => 8.04
macaddress => 00:1c:25:14:26:ab
fqdn=>sinn1636.sin.infineon.com
manufacturer => LENOVO
hardwaremodel=>x86_64
memorysize => 1.94 GB
hostname=>sinn1636
processorcount => 2
ipaddress=>172.20.88.132
kernel=>Linux
puppetversion => 0.24.4
kernelrelease=>2.6.2416generic
rubysitedir =>
/usr/local/lib/site_ruby/1.8
lsbdistcodename=>hardy
rubyversion => 1.8.6
lsbdistdescription=>Ubuntu8.04
What is a Class?
Anamedcollectionoftypeobjects
Canincludeorinheritfromotherclasses
class sudo_class {
include foo_class
file { /etc/sudoers:
...
}
package{ sudo:
...
}
}
Class inheritance
class afile {
file { /tmp/foo:
ensure => file
source => /src/versionA
}
}
class another_file inherits afile {
File[/tmp/foo] {
source => /src/versionB
}
}
What is a Node ?
Aconfigurationblockmatchingaclient
Cancontaintypes,classes
defaultnodematchesanyclientwithoutanode
block
node ohad.myself {
include sudo_class
include other_class
}
External Node
Nodedefinitionscanbedefinedoutsideofpuppet
LDAP,externalscript
Idealforsiteswithtoomanynodestobotherpre
creating
Classes and definitions
Classesaregroupsofresources.
Definitionsaresimilartoclasses,buttheycanbeinstantiatedmultipletimeswithdifferentargumentson
thesamenode.
class apache2 {
define simple-vhost ( $admin = "webmaster", $aliases, $docroot) {
file { "/etc/apache2/sites-available/$name":
mode
=> "644",
require => [ Package["apache2"], Service["apache2"] ],
content => template("apache/vhost.conf"),
} } }
node debiantest {
include apache2
apache2::simple-vhost { "debian.example.com":
"/var/www/debian"}
docroot =>
apache2::simple-vhost
{ "test.example.com":
docroot =>
"/var/www/test"}
vhost.conf template
PuppetusesRuby'sERBtemplatesystem:
<VirtualHost *>
ServerAdmin
<%= admin %>
DocumentRoot
<%= docroot %>
ServerName
<%= name %>
<% aliases.each do |al| -%>
ServerAlias
<%= al %>
<% end -%>
ErrorLog "|/usr/bin/cronolog /var/log/apache/<%=
name %>/%Y-%m/error-%d"
CustomLog "|/usr/bin/cronolog /var/log/apache/<%=
name %>/%Y-%m/access %d" sane
</VirtualHost>
Templates output
# more /etc/apache2/sites-available/debian.example.com
<VirtualHost *>
ServerAdmin
system@example.com
DocumentRoot
/var/www/debian
ServerName
debian.example.com
ServerAlias
debiantest.example.com
ServerAlias
debian
ErrorLog "|/usr/bin/cronolog
/var/log/apache/debian.example.com/%Y-%m/error-%d"
CustomLog "|/usr/bin/cronolog
/var/log/apache/debian.example.com/%Y-%m/access-%d" sane
</VirtualHost>
OS API - It also works the
other way around:
$ralshuserlevyo
user{'levyo':
password=>'absent',
shell=>'/bin/bash',
ensure=>'present',
uid=>'49960',
gid=>'49960',
home=>'/home/levyo',
comment=>'OhadLevy',
groups=>
['adm','dialout','fax','cdrom','floppy','tape','audio','dip','plugdev','scanner','fuse','lp
admin','admin']
Getting Started
Installpuppet(yum/aptgetinstallpuppet)orinstall
ruby,geminstallfacter/puppet.
Setupthepuppetserver(puppetmaster)use
versioncontrol!
Writeamanifestforyournode.
Startpuppetmasterontheserver
Runpuppetdontheclient
Next steps - modules
Modulesallowyoutogroupboththelogicandthefilesforanapplicationtogether.
Puppetautomaticallysearchesitsmodulepathtofindmodules.
Modulescancontainfourtypesoffiles,eachofwhichmustbestoredinaseparate
subdirectory:
Manifestsmustbestoredinmanifests/,andifyoucreatemanifests/init.ppthen
thatfilewillbeloadedifyouimportthemodulenamedirectly,e.g.import
"mymodule".
Templatesmustbestoredintemplates/,andthemodulenamemustbeaddedto
thetemplatename:template("mymodule/mytemplate.erb")
Filesstoredinfiles/,theseareavailablefromthefileserverunder
modules/<modulename>/files/<filename>.
Pluginsadditionaltypes,providersorfacts.
File server and File Bucket
Puppetalsoincludesafileserverwhichyoucanusefortransferringfilesfromthe
servertotheclient.
Ifyouconfigureit,puppetcanalsosaveabackupofeachfilethatischangedonthe
clienttotheserver.Thebackupsgoinafilebucketandcanberetrievedlater.
Some more info
PuppetusesSSLforallcommunications,thereforit
includesaCA,youcanautomaticallysignCSRor
usepuppetcatooltomangethem.
Storeconfig,optiontosavemachinestates(facts,
configurationruns)andspecialfacts(e.g.SSHkeys)
inadatabase.
Reporting,puppethasafewreportingoptions,most
commonareemailswithchanges,RRDfiles,yaml
filesandpuppetshowwebinterface.
PuppetHA,loadbalancingetc.
Conclusions
We'reallstuckonthehamsterwheel
Makeseasystuffeasy,hardstuffpossible
Similarprojects
cfengine
bcfg2
AdditionalResources
http://reductivelabs.com/trac/puppet
http://reductivelabs.com/trac/puppet/wiki/LanguageTutorial
http://reductivelabs.com/trac/puppet/wiki/CompleteConfiguration
#puppetonirc.freenode.org
