Auteur Archief

Check usage of classes in your Puppet-infra

Written by Ger Apeldoorn. Posted in Manageable Puppet Infrastructure, Sysadmin

It’s always good to know what the impact is of your change. With these scripts, we can easily see which hosts use a specific class.

Example usage

$ module_usage.sh Random
=================================
DTA Server
Count Modulename
=================================
4 Profile::Random
4 Profile::Random::Accounts
4 Profile::Random::Filesystems
4 Profile::Random::Initd
4 Profile::Random::Ulimit
2 Role::Random

=================================
PRODUCTION Server
Count Modulename
=================================
7 Profile::Random
7 Profile::Random::Accounts
7 Profile::Random::Filesystems
7 Profile::Random::Initd
7 Profile::Random::Ulimit
3 Role::Random

Continue reading for info on how to set this up!

Emergency-stop

Written by Ger Apeldoorn. Posted in Sysadmin

When upgrading the Puppet master (or messing things up) it can be useful to have a quick script that enables the firewall and stops incoming connections.

This is a simple script that enables that. Note that it assumes that the normal situation does not have any firewall-rules running.

/usr/local/bin/puppetstop:

#!/bin/bash
# This script blocks all connections. Exceptions can be made in /etc/sysconfig/iptables-emergencystop
iptables-restore < /etc/sysconfig/iptables-emergencystop
mv /etc/sysconfig/iptables-emergencystop /etc/sysconfig/iptables

/etc/sysconfig/iptables-emergencystop:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [611449:52637218]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -s [puppetmaster-IP] -m tcp -j ACCEPT
-A INPUT -p tcp -s [testmachine-ip] -m tcp -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

/usr/local/bin/puppetstopundo:

#!/bin/bash
iptables -F
mv /etc/sysconfig/iptables /etc/sysconfig/iptables-emergencystop

/usr/local/bin/puppetenable

#!/bin/bash
if [ $# -eq 0 ]
  then
    echo "No arguments supplied"
fi
iptables -I INPUT -p tcp -s $1 -m tcp -j ACCEPT

New developer environment (script)

Written by Ger Apeldoorn. Posted in Geen categorie

If you want to add a new developer-environment, it can be quite a hassle.

Here is a script to help you set it up, make sure that the user is known in Gerrit and that the SSH key is set up. Also, the repos must be present of course!

Make sure you understand what this script does BEFORE you run it!

MPI – Managing multiple customers within a single environment

Written by Ger Apeldoorn. Posted in Manageable Puppet Infrastructure

Intro

This is set in the Manageable Puppet Infrastructure, but should be quite useable if you’re not using it.

You want to manage multiple clients within a single environment. (You probably don’t want to create seperate environments or puppetmasters, because that creates quite a bit of overhead in the long run).

But how do we keep things flexible? It’s quite simple, use Hiera and classes in a smart way and you’re there!

One note; this simple setup only works if you do not have any naming conflicts in the modules. e.g. customer1 needs puppetlabs/apache and another needs another module named apache. In that case, you do need seperate environments.

Get that $customer variable filled

You’ll need a way to let Puppet know what customer a node belongs to. There are several ways:

Facter variables can be overridden quite easily. Use the ENC or Hiera!

  • Getting the info from Hiera, see below.
  • Set it from the ENC.

Adding a global $customer variable

In my site.pp:

$customer = hiera('customer')

node default {
  hiera_include('roles')
}

Example: hieradata/hosts/myserver.customer.com.yaml

---
customer: mycustomer1

That’s an easy way to get the $customer (global) variable filled!

Putting it to use!

Roles

With the MPI, you’ve created a baserole that applies to all hosts.

We can still use that, just be aware that those resources/includes apply to ALL customers.

Also, we’d like a baseclass for each customer. Within the roles-module, that’s a piece of cake.

modules/role/
└── manifests
    ├── base.pp   # class role::base { (applies to all nodes)
    ├── mycustomer1
    │   ├── app.pp       # class role::mycustomer1::app {
    │   ├── base.pp      # class role::mycustomer1::base { (applies to all nodes of mycustomer1)
    │   ├── db.pp        # class role::mycustomer1::db {
    │   └── smarthost.pp # class role::mycustomer1::smarthost {
    └── mycustomer2
        ├── app.pp       # class role::mycustomer2::app {
        ├── base.pp      # class role::mycustomer2::base {
        ├── db.pp        # class role::mycustomer2::db {
        └── lamp.pp      # class role::mycustomer2::lamp {

Hiera

You can add a level for customer-specific settings.

:hierarchy:
  - "hosts/%{clientcert}"        # Host-specific settings
  - "customer/%{customer}"       # Customer specific settings
  - "osfamily/%{osfamily}"       # Settings based on OS
  - "environment/%{environment}" # Environment specific settings
  - common                       # Common settings for all nodes.

Now, we can add a yaml file for each customer and assign the role::customer::base there.

Example: hieradata/customer/mycustomer1.yaml

---
roles:
  - role::mycustomer1::base

Of course, you can add other customer-specific settings as well here!

Feedback is welcome, leave a message!

Upcoming: talk at PuppetCamp and FOSDEM

Written by Ger Apeldoorn. Posted in Nieuws

PuppetCamp last year

My talk @PuppetCamp last year

At January 28th, there will be a PuppetCamp in Amsterdam. Last year was a huge success with a lot of interesting talks and like-minded people.

I will be doing a talk about the Manageable Puppet Infrastructure setup that has evolved during my consultancy jobs. A technical breakout of this setup I can be found on this website.

A few days later, I will be doing a shortened version of this talk in the configuration management room at FOSDEM.

I am looking forward to these events and am very happy to participate!