From Fedora Project Wiki
(Veja também)
(Arquivos Importantes / Localizações)
Line 10: Line 10:
Veja também o [[Infrastructure/SOP/Puppet|SOP]]
Veja também o [[Infrastructure/SOP/Puppet|SOP]]


== Important Files / Locations ==
== Arquivos Importantes / Localizações ==
Puppet Master (server):
Puppet Master (server):
* /etc/puppet - Basic puppet configuration information
* /etc/puppet - Informações básicas de configuração do Puppet
* /etc/puppet/manifests - node config mappings
* /etc/puppet/manifests - Mapeamento de configuração do node
* /etc/puppet/manifests/filetypes/* - Various filetype definitions
* /etc/puppet/manifests/filetypes/* - Várias definições de tipo de arquivo
* /etc/puppet/manifests/nodes/* - Server lists and what classes[1] they use
* /etc/puppet/manifests/nodes/* - Lista de servidores e quais classes[1] usam
* /etc/puppet/manifests/server-groups - Maps services with a server type
* /etc/puppet/manifests/server-groups - Serviços de mapas com um tipo de servidor
* /etc/puppet/manifests/service-types - Contains each service and whats required for that service
* /etc/puppet/manifests/service-types - Contém cada serviço e o que é necessário para esse serviço
* /etc/puppet/manifests/site.pp - Contains the 'root' config file which includes other config files
* /etc/puppet/manifests/site.pp - Contém o arquivo de configuração 'root' que inclui outros arquivos de configuração
* /var/lib/puppet/ - Puppet files
* /var/lib/puppet/ - Arquivos Puppet
* /var/lib/puppet/config - Config files for our actual nodes (eg httpd.conf)
* /var/lib/puppet/config - Arquivos de configuração para nodes atuais (eg httpd.conf)
* /etc/lib/puppet/bucket - Backup of overwritten config files
* /etc/lib/puppet/bucket - Backup de arquivos de configuração sobrepostos


Puppet client
Puppet client
* /etc/puppet - Basic configuration information
* /etc/puppet - Informações básicas de configuração
* /etc/sysconfig/puppet - Puppet startup definitions
* /etc/sysconfig/puppet - Definições de inicialização do Puppet


Puppet CVS
Puppet CVS

Revision as of 13:56, 4 March 2018

Puppet

NOTA: A curva aprendizado do Puppet é maior do que outras tecnologias com o mesmo potencial . Neste caso, a comunidade Fedora está migrando de Puppet para Ansible. Consulte a documentação migrated.

Introdução

Puppet é um sistema de gerenciamento de configurações atualmente avaliado pela Fedora para sua infraestrutura. Esta página descreve sua implementação e, embora seja específica para o Fedora, é uma configuração padrão e deve ser aplicável à maioria dos ambientes.

Veja também o SOP

Arquivos Importantes / Localizações

Puppet Master (server):

  • /etc/puppet - Informações básicas de configuração do Puppet
  • /etc/puppet/manifests - Mapeamento de configuração do node
  • /etc/puppet/manifests/filetypes/* - Várias definições de tipo de arquivo
  • /etc/puppet/manifests/nodes/* - Lista de servidores e quais classes[1] usam
  • /etc/puppet/manifests/server-groups - Serviços de mapas com um tipo de servidor
  • /etc/puppet/manifests/service-types - Contém cada serviço e o que é necessário para esse serviço
  • /etc/puppet/manifests/site.pp - Contém o arquivo de configuração 'root' que inclui outros arquivos de configuração
  • /var/lib/puppet/ - Arquivos Puppet
  • /var/lib/puppet/config - Arquivos de configuração para nodes atuais (eg httpd.conf)
  • /etc/lib/puppet/bucket - Backup de arquivos de configuração sobrepostos

Puppet client

  • /etc/puppet - Informações básicas de configuração
  • /etc/sysconfig/puppet - Definições de inicialização do Puppet

Puppet CVS

  • /cvs/puppet - puppet cvs
  • /cvs/private - Private information (keys, passwords, etc)

[1] In puppet classes are similar to templates. A class can contain another class. In our case, for example, we'll take the account system. On the proxy servers we require a config section to ProxyPass /accounts/ to the app servers. This account system is in a class which inherits properties from the http class. The http class requires that httpd be installed and the config file type we're using, apacheconfig, requires httpd to be restarted whenever a config file is deployed. This account system class is, in turn, placed in the proxy class. Then proxy1 and proxy2 use the "proxy" class, which contains the account class, which contains the httpd class. Take a look at the config files to see this in action.

Node Setup

Node in this context refers to a server we wish to manage with puppet not the puppet master server. For the purposes of this example we'll use a new server "proxy3".

  1. Build proxy3
  2. Install ruby
  3. Install facter and puppet from EPEL
  4. Alter /etc/sysconfig/puppet: PUPPET_SERVER=puppet
  5. chkconfig puppet on
  6. /etc/init.d/puppet start

This will cause puppet to start up and contact puppet1 for a list of files. This will also send a certificate request to the server. At this point in time NO CONFIG FILES ARE CHANGED. This is because puppet1 has to give access to proxy 3.

To allow the server log in to puppet1 and run puppetca:

proxy3.fedora.phx.redhat.com
Signed: proxy3.fedora.phx.redhat.com

Next log in to puppet1 and add proxy3 to /etc/puppet/manifests/nodes/proxy3.fedora.phx.redhat.com.pp

Once this is done communcation between the node and the server should be ready.

Server Side

The server side of things is already configured. Please see the Important Files / Locations above for more details about where configuration files are. In our setup we have changed from a server centric management model to a service centric model. This was done for ease of management. For example, the Fedora Account System contains a few needs on multiple servers. It has proxy pass on the front servers, applications on the app server and a database to poll. In the previous configuration system this ment multiple files in multiple server groups and the relationship between them was unclear. In this new setup we have one file in the service-groups directory which contains the proxy configs, app configs and db configs.

Adding a file

There's a few steps to actually adding a file to puppet.

  1. Check out the current configuration
  2. Add configuation file
  3. Add the manifest config (tell puppet where your file should end up and what type of file it is)
  4. commit the files
  5. Run "make install" in the config directory and "make install" in the manifests directory.
  6. Verify new file on the client

Adding new files is easy, stick them in /var/lib/puppet/config/ somewhere that makes sense, for example all the web files are in ./web/ Once that is done you need to add your file to /etc/puppet/manifests/service-groups/. In this example we'll be discussing nagios (not yet implemented but will be soon).

class nagios {
package { nagios:
}

nagiosfile { '/etc/nagios/':
source => "nagios/",
ensure => directory,
recurse => true


service { nagios:
ensure => true,
subscribe => [ package["nagios"]   
}
}

class nagios-proxy inherits httpd {
apachefile { "/etc/httpd/conf.d/admin.fedoraproject.org/nagios.conf":
source => "web/nagios-proxy.conf"
}
}

There are 3 classes here. The first one defines a generic nagios class. It's used to make sure that anything that inherits it requires nagios to be installed and so it restarts nagios when a config file is changed. Next is the nagios-proxy file which inherits httpd (defined in a different config file). By inheriting httpd we're saying that wherever the nagios-proxy files get installed, that box will also need to have http. By specifying apachefile, we're telling puppet to restart httpd if the config has changed. We do the same thing with "nagiosfile" which is defined in /etc/puppet/manifests/filetypes. An example would be:

define nagiosfile(owner = root, group = nagios, mode = 664, source,
backup = main, recurse = false, ensure = file) {
file { $name:
mode => $mode,
owner => $owner,
group => $group,
backup => $backup,
recurse => $recurse,
notify => service[nagios] ,
ensure => $ensure,
source => "puppet://$server/config/$source"
}
}

The notify=>service[nagios] means that whenever a configfile of type "nagiosfile" is deployed, the service nagios is restarted.

From this point on you can specify which nodes include which classes. The proxy servers would include "nagios-proxy" where the actual nagios server would include "nagios".

To check if your changes are syntatically correct you can restart puppet master with:

service puppetmaster restart

The client checks in every half hour. If you want to immediately check your changes just run:

/etc/init.d/puppet restart; tail -f /var/log/messages