Puppet/ko

Resources

Home

Wikipedia

Open Hub

Puppet은 루비^en로 작성한 설정 관리 시스템입니다. 머신 배포 자동화 용도로 활용할 수 있습니다

Installation

Puppet is provided by the app-admin/puppet package.

Currently, there is no distinction between server and client, so the basic installation procedure is the same for both.

Emerge

First, install Puppet via emerge:

root #emerge --ask app-admin/puppet

Configuration and setup

Puppet is mainly configured through /etc/puppet/puppet.conf in an INI-style format. Comments are marked with a hash sign (#).

The configuration file is separated into several sections, or blocks:

• [main] contains settings that act as a default for all parts of Puppet, unless overridden by settings in any of the following sections:
  • [master] is used for settings applying to the Puppetmaster (puppet master), or CA tool (puppet cert)
  • [agent] is used for settings applying to the Puppet agent (puppet agent)

그 밖의 블록과 마찬가지로 더 많은 설명을 찾으신다면 공식 Puppet 문서를 확인하십시오. 또한 모든 설정 목록 을 통해 서버 또는 클라이언트에 적용할 설정 방식을 알아볼 수 있습니다.

서버(Puppetmaster) 설정

이빌드가 puppet.conf에 넣은 기본 설정은 그대로 활용할 수 있습니다. Puppet 2.7.3에서는 다음과 같이 서버 관련 부분이 들어있습니다:

파일 /etc/puppet/puppet.conf서버 관련 기본 설정

[main]
    # The Puppet log directory.
    # The default value is '$vardir/log'.
    logdir = /var/log/puppet
  
    # Where Puppet PID files are kept.
    # The default value is '$vardir/run'.
    rundir = /var/run/puppet
  
    # Where SSL certificates are kept.
    # The default value is '$confdir/ssl'.
    ssldir = $vardir/ssl

Setting up the file server

To be able to send files to the clients, the file server has to be configured. This is done in /etc/puppet/fileserver.conf. By default, there are no files being served.

파일 /etc/puppet/fileserver.conffiles 공유 설정

[files]
    path /var/lib/puppet/files
    allow 192.168.0.0/24

The snippet above sets up a share called files (remember this identifier, as it will need to be referenced later), looking for files in /var/lib/puppet/files and only available for hosts with an IP from the 192.168.0.0/24 network. Any of the IP addresses, CIDR notation, and host names (including wildcards like *.domain.invalid) can be used here. The deny command can be used to explicitly deny access to certain hosts or IP ranges.

Starting the puppetmaster daemon

참고
It is recommended that the Puppetmaster is reachable from the clients using the host name puppet. However, the name can be overridden, which of course causes configuration effort.

중요
At this point, the host name as seen from the clients should be the same as the output of hostname -f. To achieve this, the /etc/hosts file might have to be adjusted, or a new certificate can be created manually as explained below.

With the basic configuration as well as an initial file server configuration, we can start the Puppetmaster daemon using its OpenRC init script:

root #/etc/init.d/puppetmaster start

During the first start, Puppet generates an SSL certificate for the Puppetmaster host and places it into the directory configured through the ssldir variable, as configured above.

It listens on Port 8140/TCP, make sure that there are no firewall rules obstructing access from the clients.

A simple manifest

Manifests, in Puppet's terminology, are the files in which the client configuration is specified. The documentation contains a comprehensive guide about the manifest markup language.

간단한 예제로 오늘의 메시지(MOTD)를 만들어보겠습니다. Puppetmaster에서 앞서 만든 files 공유 경로에 파일을 만드십시오:

파일 /var/lib/puppet/files/motd서버의 MOTD 파일

Welcome to this Puppet-managed machine!

Then, we have to create the main manifest file in the manifests directory. It is called site.pp:

파일 /etc/puppet/manifests/site.pp서버의 주 매니페스트 파일

node default {
  file { '/etc/motd':
    source => 'puppet:///puppet/files/motd'
  }
}

The default node (the name for a client) definition is used in case there is no specific node statement for the host. We use a file resource and want the /etc/motd file on our clients to contain the same thing as the motd file in the files share on the host puppet. If the puppetmaster is only reachable using another host name, adapt the source URI accordingly.

Client configuration

중요
The client must have the same major and minor version as the Puppetmaster. Using a 2.7.1 Puppetmaster with 2.7.2 clients is fine, but using 2.6 for the server and 2.7 for clients can cause unexpected issues at any time.

참고
If the puppetmaster is not reachable via puppet, set server=<the hostname> to the actual host name in /etc/puppet/puppet.conf in the [main] section.

During the first execution of the Puppet agent, wait for the certificate to be signed by the puppetmaster. To request a certificate, and execute the first configuration run, execute:

root@client #puppet agent --test --waitforcert 60

info: Creating a new certificate request for client
info: Creating a new SSL key at /var/lib/puppet/ssl/private_keys/client.pem
notice: Did not receive certificate

Before the client can connect, authorize the certificate request on the server. The client should appear in the list of nodes requesting a certificate:

root@server #puppet cert --list

client

Now, we grant the request:

root@server #puppet cert --sign client

The client will check every 60 seconds whether its certificate has already been issued. After that, it continues with the first configuration run:

info: Caching catalog for client
info: Applying configuration version '1317317379'
notice: /Stage[main]//Node[default]/File[/etc/motd]/ensure: defined content as '{md5}30ed97991ad6f591b9995ad749b20b00'
notice: Finished catalog run in 0.05 seconds

When this message pops up, all went well. Now check the contents of the /etc/motd file on the client:

user@client $cat /etc/motd

Welcome to this Puppet-managed machine!

OpenRC

Start the puppet agent as a deamon and have it launch on boot:

root@client #/etc/init.d/puppet start

root@client #rc-update add puppet default

Systemd

Conversely, when running systemd:

root@client #systemctl start puppet

root@client #systemctl enable puppet

Other topics

Manually generating certificates

To manually generate a certificate, use the puppet cert utility. It will place all generated certificates into the ssldir defined directory as set in the puppet configuration and will sign them with the key of the local Puppet Certificate Authority (CA).

An easy case is the generation of a certificate with only one Common Name:

root #puppet cert --generate host1

If the certificate has to be valid for multiple host names, use the --certdnsnames parameter and separate the additional host names with a colon:

root #puppet cert --generate --certdnsnames puppet:puppet.domain.invalid host1.domain.invalid

이 예제에서는 3가지 호스트 이름을 유효하다고 판단하는 인증서를 만듭니다.

Refreshing agent certificates

This is the process used to manually refresh agent certificates.

1. (on master)
   root #puppet cert clean ${AGENT_HOSTNAME}
2. (on agent)
   root #rm /etc/puppet/ssl/{certs,certificate_requests}/${AGENT_HOSTNAME}.pem
   • This will cause the Puppet agent to regenerate the CSR with the existing SSL key.
   • The old certificate is no longer valid, as it was nuked on the master.
   • When one of the above steps is forgotten, an error will pop up about the certificate mis-matching between agent and master.
   • To replace the SSL keys (optional):
     root #rm /etc/puppet/ssl/{public,private}_keys/${AGENT_HOSTNAME}.pem
3. (on agent)
   root #puppet agent --onetime --no-daemonize --verbose --test --waitforcert 30
   • When using auto-signing, no further steps are needed.
4. (on master)
   root #puppet cert list ${AGENT_HOSTNAME}
5. Verify that the fingerprint listed in the previous two outputs matches
6. (on master)
   root #puppet cert sign ${AGENT_HOSTNAME}
7. (on agent)
   root #puppet agent --onetime --no-daemonize --verbose --test

Managing slots with puppet

While the default portage provider in puppet does support slots there are puppet modules available which also have this functionality.

For instance, with app-admin/puppet version 4.6.0 and higher, and/or app-admin/puppet-agent, the slot functionality is supported like to:

코드 Defining an absent slotted package

package { 'dev-lang/python:3.3': ensure => absent }

Additional modules are:

• puppet-portage
• PortageGT

See also

• Puppet module for Gentoo

External resources

• Upstream website
• Puppet Wiki