In this article, we show how to build a test environment to get started with using puppet for configuration management. We built several machines on virtual box running various Linux distributions. We use one of them as the puppet server (puppet master) and the rest as puppet client (puppet nodes/agent)
The environment
Below are the configuration of the machines used. The RHEL 6/7/8 were registered to RH for access to package repositories using Red Hat's Developer Subscription (free).
Server
Clients
mgmt8
OS : RHEL 8
RAM: 2GB
rhel6
OS : RHEL 6
RAM: 1GB
rhel7
OS : RHEL 7
RAM: 1GB
rhel8
OS : RHEL 8
RAM: 1GB
debian11
OS : Debian 11
RAM: 1GB
ubuntu20
OS : Ubuntu 20.04
RAM: 1GB
opensuse15
OS : OpenSUSE 15.3 (Leap)
RAM: 1GB
All the machines are on the same subnet and all have their /etc/hosts populated with all machine's IP address, e.g.
All the machines are using a non root user named admin (use whichever suites your environment) with sudo privilege. In our examle, we let it have NOPASSWD privilege for convenience.
To: JAVA_ARGS="-Xms512m -Xmx512m -Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger"
## The puppet binaries are in /opt/puppetlabs/bin
## To ensure this is present in the PATH environment when using sudo, we modify the secure_path parameter
## in /etc/sudoers
From Defaults secure_path = [current_secure_path]
To: Defaults secure_path = [current_secure_path]:/opt/puppetlabs/bin
## start, enable puppetserver service and add firewall rules
sudo rpm -Uvh http://yum.puppetlabs.com/puppet6-release-sles-15.noarch.rpm
sudo vi /etc/zypp/repos.d/puppet6.repo
## comment out line starting with gpgkey
## change from gpgcheck=1 to gpgcheck=0
## and save the updated puppet6.repo
sudo zypper install -y puppet-agent
## The puppet binaries are in /opt/puppetlabs/bin for all the above client machines
## To ensure this is present in the PATH environment when using sudo, we modify the secure_path parameter
## in /etc/sudoers
From Defaults secure_path = [current_secure_path]
To: Defaults secure_path = [current_secure_path]:/opt/puppetlabs/bin
## On the server machine and all client machines, test the puppet command
## Get puppet version
puppet agent --version
## To get help
puppet help
or
puppet help subcommand
e.g.
puppet help agent
## On all client machines, register with the puppet server
## For now ignore the warning "Certificate for XXXX has not been signed yet"
sudo puppet config set server mgmt8
sudo puppet resource service puppet ensure=running enable=true
sudo puppet agent -t
(sample command output) Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for rhel7
Info: Certificate Request fingerprint (SHA256): 3E:E2:AF:94:C9:1E:1F:85:97:1A:C4:0C:2A:85:63:DD:84:44:F3:01:68:8F:CC:03:5A:67:53:37:FF:7A:34:99
Info: Certificate for rhel7 has not been signed yet
Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (rhel7).
Exiting now because the waitforcert setting is set to 0
## On server mgmt8 machine
## By default the puppetserver command will connect to https://puppet:8140
e.g.
[admin@mgmt8 ~]$ sudo puppetserver ca list Fatal error when running action 'list'
Error: Failed connecting to https://puppet:8140/puppet-ca/v1/certificate_statuses/any_key?state=requested
Root cause: Failed to open TCP connection to puppet:8140 (getaddrinfo: Name or service not known)
## as a temporary workaround (until I figure a permanent fix), ## add to the end of the line that contains ip address for hostname mgmt8 in /etc/hosts the names puppetmaster and puppet
(command output) Successfully signed certificate request for opensuse15
Successfully signed certificate request for debian11
Successfully signed certificate request for rhel8
Successfully signed certificate request for rhel6
Successfully signed certificate request for ubuntu20
Successfully signed certificate request for rhel7
## Test again from the client machines
sudo puppet agent --test
(sample output) Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for rhel7
Info: Certificate Request fingerprint (SHA256): 3E:E2:AF:94:C9:1E:1F:85:97:1A:C4:0C:2A:85:63:DD:84:44:F3:01:68:8F:CC:03:5A:67:53:37:FF:7A:34:99
Info: Downloaded certificate for rhel7 from https://mgmt8:8140/puppet-ca/v1
Info: Using environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Retrieving locales
Info: Caching catalog for rhel7
Info: Applying configuration version '1635423879'
Notice: Applied catalog in 0.04 seconds
## On both server and client machines, you can view the current configuration paramters by
puppet config print
Using puppet for configuration management
The puppet server is where we create the configuration as code in files called manifests. These are then compiled into catalogs which are then pulled by the puppet agent in the client machines. The client and server trust each other via mutual TLS authentication.
In the following example, we will create a manifest containing 2 modules. The first module (or class) we name it as packages and another we name it as machine_info. The first will make the client nodes install software packages if not found and the second will collect machine information from the nodes and store into a file.
## On puppet server mgmt8, for the packages class
## create the following file /etc/puppetlabs/code/environments/production/modules/packages/manifests/init.pp
## create the subdirectories as ncessary if they are not yet there
## The content should be as shown
## On puppet server mgmt8, for the machine_info class
## create the following file /etc/puppetlabs/code/environments/production/modules/machine_info/manifests/init.pp
## create the subdirectories as ncessary if they are not yet there
## The content should be as shown
## On puppet server mgmt8, for the machine_info template
## create the following file /etc/puppetlabs/code/environments/production/modules/machine_info/templates/info.erb
## create the subdirectories as ncessary if they are not yet there
## The content should be as shown
## On puppet server mgmt8, put them all together into the site manifest
## create the following file /etc/puppetlabs/code/environments/production/manifests/site.pp ## create the subdirectories as ncessary if they are not yet there ## The content should be as shown
node default {
class { 'packages': }
class { 'machine_info': }
}
## The puppet agents run as a service named puppet and the nodes pull the catalog at time intervals
## defined by the runinterval config parameter, the default is 1800 seconds
sudo puppet config print runinterval
(sample output) 1800
## To apply the catalogs on the client machines immediately
Info: Computing checksum on file /tmp/machine_info.txt
Info: /Stage[main]/Machine_info/File[machine_info]: Filebucketed /tmp/machine_info.txt to puppet with sum 254d236e091b9966b01831820b0c17c1
Notice: /Stage[main]/Machine_info/File[machine_info]/content: content changed '{md5}254d236e091b9966b01831820b0c17c1' to '{md5}1a741de47b86689c3e2e8c8fafa8bbf0'
Notice: Applied catalog in 0.29 seconds
Info: Computing checksum on file /tmp/machine_info.txt
Info: /Stage[main]/Machine_info/File[machine_info]: Filebucketed /tmp/machine_info.txt to puppet with sum c39d39c21d58eb1c0a6ad67172fe57a1
Notice: /Stage[main]/Machine_info/File[machine_info]/content: content changed '{md5}c39d39c21d58eb1c0a6ad67172fe57a1' to '{md5}9ceb2256c85423f41d4698ed4d041f0d'
Notice: Applied catalog in 0.24 seconds
Info: Computing checksum on file /tmp/machine_info.txt
Info: /Stage[main]/Machine_info/File[machine_info]: Filebucketed /tmp/machine_info.txt to puppet with sum 05830d007a029c30999fa312920b1823
Notice: /Stage[main]/Machine_info/File[machine_info]/content: content changed '{md5}05830d007a029c30999fa312920b1823' to '{md5}8f6ed6cab3189bb01af46559d8735bda'
Notice: Applied catalog in 0.47 seconds
Info: Computing checksum on file /tmp/machine_info.txt
Info: /Stage[main]/Machine_info/File[machine_info]: Filebucketed /tmp/machine_info.txt to puppet with sum 9a4a42c73a297f87a8001ab1a2f5869f
Notice: /Stage[main]/Machine_info/File[machine_info]/content: content changed '{md5}9a4a42c73a297f87a8001ab1a2f5869f' to '{md5}5f03ac65eb9eaf746d2d4276c0c45c7c'
Notice: Applied catalog in 0.21 seconds