Book Image

Puppet 3 Cookbook - Second Edition

By : John Arundel
Book Image

Puppet 3 Cookbook - Second Edition

By: John Arundel

Overview of this book

A revolution is happening in web operations. Configuration management tools can build servers in seconds, and automate your entire network. Tools like Puppet are essential to taking full advantage of the power of cloud computing, and building reliable, scalable, secure, high-performance systems. More and more systems administration and IT jobs require some knowledge of configuration management, and specifically Puppet."Puppet 3 Cookbook" takes you beyond the basics to explore the full power of Puppet, showing you in detail how to tackle a variety of real-world problems and applications. At every step it shows you exactly what commands you need to type, and includes full code samples for every recipe.The book takes the reader from a basic knowledge of Puppet to a complete and expert understanding of Puppet's latest and most advanced features, community best practices, writing great manifests, scaling and performance, and extending Puppet by adding your own providers and resources. It starts with guidance on how to set up and expand your Puppet infrastructure, then progresses through detailed information on the language and features, external tools, reporting, monitoring, and troubleshooting, and concludes with many specific recipes for managing popular applications.The book includes real examples from production systems and techniques that are in use in some of the world's largest Puppet installations, including a distributed Puppet architecture based on the Git version control system. You'll be introduced to powerful tools that work with Puppet such as Hiera. The book also explains managing Ruby applications and MySQL databases, building web servers, load balancers, high-availability systems with Heartbeat, and many other state-of-the-art techniques
Table of Contents (16 chapters)
Puppet 3 Cookbook
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Index

Running Puppet from cron


You can do a lot with the setup you already have: work on your Puppet manifests as a team, communicate changes via GitHub, and manually apply them on a machine using the papply script.

However, you still have to log into each machine to update the Git repo and re-run Puppet. It would be helpful to have each machine update itself and apply any changes automatically. Then all you need to do is to push a change to the repo, and it will go out to all your machines within a certain time.

The simplest way to do this is with a cron job that pulls updates from the repo at regular intervals and then runs Puppet if anything has changed.

Getting ready...

You'll need the Git repo we set up in Managing your manifests with Git and Creating a decentralized Puppet architecture, and the papply script from Writing a papply script.

You'll also need to create an SSH key that each machine can use to pull changes from the Git repo. To create this, follow these steps:

  1. Run the following command to generate the keyfile:

    ubuntu@cookbook:~/puppet$ ssh-keygen -f ubuntu
    Generating public/private rsa key pair.
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in ubuntu.
    Your public key has been saved in ubuntu.pub.
    The key fingerprint is:
    ae:80:48:1c:14:51:d6:b1:73:4f:60:e2:cf:3d:ce:f1 ubuntu@cookbook
    The key's randomart image is:
    +--[ RSA 2048]----+
    | ++o.o.o         |
    |      +          |
    |     +           |
    |      = +        |
    | o     oS=       |
    |        o +      |
    |         o E     |
    |                 |
    |                 |
    +-----------------+
    
  2. Print the contents of the ubuntu.pub file:

    ubuntu@cookbook:~/puppet$ cat ubuntu.pub
    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8EsdLAZHIg1nnMzJuIQ5jEcFL1WI5AVhml6Z3Gw4zc4xw6F1Citomc+3DexcaD+y3VrD3WEOGcXweCsxJF0EGyJoc4RbPAJaP3D4V/+9FQVZcH90GukasvtIrfJYy2KFfRBROKtrfckMbBlWF7U2U+FwaalMOtgLzZeECSDU4eYuheN3UVcyg9Zx87zrLYU5EK1JH2WVoZd3UmdH73/rwPJWtSEQ3xs9A2wMr0lJsCF4CcFCVwrAIoEf5WzIoHbhWyZaVyPR4gHUHd3wNIzC0rmoRiYwE5uYvVBObLN10uZhn7zGPWHEc5tYU7DMbz61iTe4NLtauwJkZxmXUiPJh ubuntu@cookbook
    

Copy this and add it to your GitHub repo as a deploy key (refer to the GitHub site for instructions on how to do this). This will authorize the key to clone the Puppet repo from GitHub.

How to do it...

Follow these steps:

  1. Move the public key file into your puppet module:

    ubuntu@cookbook:~/puppet$ mv ubuntu.pub
      modules/puppet/files/ubuntu.pub
    
  2. Keep the private key file somewhere separate from your Puppet repo (you'll distribute this via some other channel to machines which need to check out the repo).

  3. Create the file modules/puppet/files/pull-updates.sh with the following contents:

    #!/bin/sh
    cd /home/ubuntu/puppet
    git pull && /usr/local/bin/papply
  4. Modify the file modules/puppet/manifests/init.pp to look like this:

    class puppet {  
      file { '/usr/local/bin/papply':
        source => 'puppet:///modules/puppet/papply.sh',
        mode   => '0755',
      }
    
      file { '/usr/local/bin/pull-updates':
        source => 'puppet:///modules/puppet/pull-updates.sh',
        mode   => '0755',
      }
      
      file { '/home/ubuntu/.ssh/id_rsa':
        source => 'puppet:///modules/puppet/ubuntu.priv',
        owner  => 'ubuntu',
        mode   => '0600',
      }
    
      cron { 'run-puppet':
        ensure  => 'present',
        user    => 'ubuntu',
        command => '/usr/local/bin/pull-updates',
        minute  => '*/10',
        hour    => '*',
      }
    }
  5. Run Puppet:

    ubuntu@cookbook:~/puppet$ papply
    Notice: /Stage[main]/Puppet/Cron[run-puppet]/ensure: created
    Notice: /Stage[main]/Puppet/File[/usr/local/bin/pull-
      updates]/ensure: defined content as 
        '{md5}20cfc6cf2a40155d4055d475a109137d'
    Notice:
      /Stage[main]/Puppet/File[/home/ubuntu/.ssh/id_rsa]/ensure:
        defined content as '{md5}db19f750104d3bf4e2603136553c6f3e'
    Notice: Finished catalog run in 0.27 seconds
    
  6. Test that the new SSH key is authorized to GitHub correctly:

    ubuntu@cookbook:~/puppet$ ssh [email protected]
    PTY allocation request failed on channel 0
    Hi bitfield/cookbook! You've successfully authenticated, but
      GitHub does not provide shell access.
    Connection to github.com closed.
    
  7. Check that the pull-updates script works properly:

    ubuntu@cookbook:~/puppet$ pull-updates
    Already up-to-date.
    Notice: Finished catalog run in 0.16 seconds
    

How it works...

Up to now, you've been using your own SSH credentials to access GitHub from the managed machine (using SSH agent forwarding), but that won't work if we want the machine to be able to pull updates unattended, while you're not logged in. So we've created a new SSH keypair and added the public part of it as a deploy key on GitHub, which gives repo access to anyone who has the private half of the key.

We've added this private key as the ubuntu user's default SSH key:

file { '/home/ubuntu/.ssh/id_rsa':
  source => 'puppet:///modules/puppet/ubuntu.priv',
  owner  => 'ubuntu',
  mode   => '0600',
}

This enables the ubuntu user to run git pull in the puppet directory. We've also added the pull-updates script, which does this and runs Puppet if any changes were pulled:

#!/bin/sh
cd /home/ubuntu/puppet
git pull && papply

We deploy this script to the box with Puppet:

file { '/usr/local/bin/pull-updates':
  source => 'puppet:///modules/puppet/pull-updates.sh',
  mode   => '0755',
}

Finally, we've created a cron job that runs pull-updates at regular intervals (every 10 minutes, but feel free to change this if you need to):

cron { 'run-puppet':
  ensure  => 'present',
  command => '/usr/local/bin/pull-updates',
  minute  => '*/10',
  hour    => '*',
}

There's more...

Congratulations, you now have a fully-automated Puppet infrastructure! Once you have checked out the repo on a new machine and applied the manifest, the machine will be set up to pull any new changes and apply them automatically.

So, for example, if you wanted to add a new user account to all your machines, all you have to do is add the account in your working copy of the manifest, and commit and push the changes to GitHub. Within 10 minutes it will automatically be applied to every machine that's running Puppet.

That's very handy, but sometimes we'd like to be able to apply the changes to a specific machine right away, without waiting for them to be picked up by the cron job. We can do this using the Rake tool, and we'll see how to do that in the next section.