Puppet Guide
A guide to building your own Puppet module and importing it into Satellite 6
Edition 1
Abstract
Chapter 1. Overview
1.1. Defining the Puppet Workflow
- Collect facts about each system. These facts can include hardware, operating systems, package versions, and other information. The Puppet agent on each system collects this information and sends it to the Puppet master.
- The Puppet master generates a custom configuration for each system and sends it to the Puppet agent. This custom configuration is called a catalog.
- The Puppet agent applies the configuration to the system.
- The Puppet agent sends a report back to the Puppet master that indicates the changes applied and if any changes were unsuccessful.
- Third-party applications can collect these reports using Puppet's API.
1.2. Using Puppet on Satellite 6
- Satellite 6 imports Puppet modules used to define the system configuration. This includes control over module versions and their environments.
- Satellite 6 imports sets of parameters, also known as Puppet class parameters, from Puppet modules. Users can accept the default values from Puppet classes or provide their own at a global or system-specific level.
- Satellite 6 triggers the execution of Puppet between the master and the respective agents on each system. Puppet runs can occur either:
- Automatically, such as after the provisioning process completes or as a daemon that checks and manages the machine's configuration over its lifecycle.
- Manually, such as needing to trigger an immediate Puppet run.
- Satellite 6 collects reports from Puppet after the configuration workflow completes. This helps with auditing and archiving system configuration over long term periods.
Chapter 2. Building Puppet Modules from Scratch
2.1. Examining the Anatomy of a Puppet Module
- Manifests
- Manifests are files that contain code to define a set of resource and their attributes. A resource is any configurable part of a system. Examples of resources include packages, services, files, users and groups, SELinux configuration, SSH key authentication, cron jobs, and more. A manifest defines each required resource using a set of key-value pairs for their attributes. For example:
package { 'httpd': ensure => installed, }This declaration checks if thehttpdpackage is installed. If not, the manifest executesyumand installs it.Manifests are located in themanifestdirectory of a module.Puppet modules also use atestdirectory for test manifests. These manifests are used to test certain classes contained in your official manifests. - Static Files
- Modules can contain static files that Puppet can copy to certain locations on your system. These locations, and other attributes such as permissions, are defined through
fileresource declarations in manifests.Static files are located in thefilesdirectory of a module. - Templates
- Sometimes configuration files require custom content. In this situation, users would create a template instead of a static file. Like static files, templates are defined in manifests and copied to locations on a system. The difference is that templates allow Ruby expressions to define customized content and variable input. For example, if you wanted to configure httpd with a customizable port then the template for the configuration file would include:
Listen <%= @httpd_port %>
Thehttpd_portvariable in this case is defined in the manifest that references this template.Templates are located in thetemplatesdirectory of a module. - Plugins
- Plugins allow for aspects that extend beyond the core functionality of Puppet. For example, you can use plugins to define custom facts, custom resources, or new functions. For example, a database administrator might need a resource type for PostgreSQL databases. This could help the database administrator populate PostgreSQL with a set of new databases after installing PostgreSQL. As a result, the database administrator need only create a Puppet manifest that ensures PostgreSQL installs and the databases are created afterwards.Plugins are located in the
libdirectory of a module. This includes a set of subdirectories depending on the plugin type. For example:/lib/facter- Location for custom facts./lib/puppet/type- Location for custom resource type definitions, which outline the key-value pairs for attributes./lib/puppet/provider- Location for custom resource providers, which are used in conjunction with resource type definitions to control resources./lib/puppet/parser/functions- Location for custom functions.
2.2. Setting up a Puppet Development System
# subscription-manager repos --enable=rhel-7-server-satellite-tools-6.1-rpms
puppet package:
# yum install puppet
2.3. Generating a New Module Boilerplate
# cd /etc/puppet/modules # puppet module generate [module-name]
metadata.json file with metadata.
Important
puppet module generate command requires module-name take the format of [username]-[module] to comply with Puppet Forge specifications. However, to test our tutorial module and use it with Satellite 6 we need to rename the module directory without the [username]. For example, for dmacpher-mymodule you would run:
# puppet module generate dmacpher-mymodule # mv dmacpher-mymodule mymodule
manifests directory. This directory already contains a manifest file called init.pp, which is the module's main manifest file. View the file to see the empty class declaration for the module:
class mymodule {
}
tests directory containing a manifest also named init.pp. This test manifest contains a reference to the mymodule class within manifests/init.pp:
include mymodule
2.4. Installing a HTTP Server
httpd package.
manifests directory, create a new manifest file called httpd.pp:
# touch mymodule/manifests/httpd.pp
init.pp manifest.
httpd.pp manifest:
class mymodule::httpd {
package { 'httpd':
ensure => installed,
}
}
mymodule called httpd, then defines a package resource declaration for the httpd package. The ensure => installed attribute tells Puppet to check if the package is installed. If it is not installed, Puppet executes yum to install it.
init.pp manifest:
class mymodule {
include mymodule::httpd
}
# puppet apply mymodule/tests/init.pp --noop
puppet apply command applies the configuration in the manifest to your system. We use the test init.pp manifest, which refers to the main init.pp manifest. The --noop performs a dry-run of the configuration, which shows only the output but does not actually apply the configuration. The output should resemble the following:
Notice: Compiled catalog for puppet.example.com in environment production in 0.59 seconds
Notice: /Stage[main]/Mymodule::Httpd/Package[httpd]/ensure: current_value absent, should be present (noop)
Notice: Class[Mymodule::Httpd]: Would have triggered 'refresh' from 1 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Notice: Finished catalog run in 0.67 seconds
ensure => installed attribute. The current_value absent means that Puppet has detected the httpd package is not installed. Without the --noop option, Puppet would install the httpd package.
2.5. Running the HTTP Server
httpd package, we start the service using another resource declaration: service.
httpd.pp manifest and add the highlighted lines:
class mymodule::httpd {
package { 'httpd':
ensure => installed,
}
service { 'httpd':
ensure => running,
enable => true,
require => Package["httpd"],
}
}
- The
ensure => runningattribute checks if the service if running. If not, Puppet enables it. - The
enable => trueattribute sets the service to run when the system boots. - The
require => Package["httpd"]attribute defines an ordering relationship between one resource declaration and another. In this case, it ensures thehttpdservice starts after thehttpdpackage installs. This creates a dependency between the service and its respective package.
puppet apply command again to test the changes to our module:
# puppet apply mymodule/tests/init.pp --noop
Notice: Compiled catalog for puppet.example.com in environment production in 0.56 seconds
Notice: /Stage[main]/Mymodule::Httpd/Package[httpd]/ensure: current_value absent, should be present (noop)
Notice: /Stage[main]/Mymodule::Httpd/Service[httpd]/ensure: current_value stopped, should be running (noop)
Notice: Class[Mymodule::Httpd]: Would have triggered 'refresh' from 2 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Notice: Finished catalog run in 0.41 seconds
httpd service.
2.6. Configuring the HTTP Server
/etc/httpd/conf/httpd.conf, which provides a web host on port 80. We will add some additional configuration to provide an additional web host on a user-specified port.
templates and add a file called myserver.conf.erb in the new directory. Add the following contents to the file:
Listen <%= @httpd_port %>
NameVirtualHost *:<%= @httpd_port %>
<VirtualHost *:<%= @httpd_port %>>
DocumentRoot /var/www/myserver/
ServerName <%= @fqdn %>
<Directory "/var/www/myserver/">
Options All Indexes FollowSymLinks
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
httpd_port, which we use to specify the web server port.
fqdn, which is a variable that stores the fully qualified domain name of the system. This is known as a system fact. System facts are collected from each system prior to generating each respective system's Puppet catalog. Puppet uses the facter command to gather these system facts and you can also run facter to view a list of these facts.
httpd.pp manifest and add the highlighted lines:
class mymodule::httpd {
package { 'httpd':
ensure => installed,
}
service { 'httpd':
ensure => running,
enable => true,
require => Package["httpd"],
}
file {'/etc/httpd/conf.d/myserver.conf':
notify => Service["httpd"],
ensure => file,
require => Package["httpd"],
content => template("mymodule/myserver.conf.erb"),
}
file { "/var/www/myserver":
ensure => "directory",
}
}
- We add a file resource declaration for the server configuration file (
/etc/httpd/conf.d/myserver.conf). Thecontentfor this file is themyserver.conf.erbtemplate we created earlier. We also check thehttpdpackage is installed before adding this file. - We also add a second file resource declaration. This one creates a directory (
/var/www/myserverfor our web server. - We also add a relationship between the configuration file and the
httpdservice using thenotify => Service["httpd"]attribute. This checks our configuration file for any changes. If the file has changed, Puppet restarts the service.
httpd_port parameter in our main manifest file. Edit the init.pp manifest and add the following line:
class mymodule ( $http_port = 80 ) { include mymodule::httpd }
httpd_port parameter to a default value of 80. You can override this value with the Satellite Server.
puppet apply command again to test the changes to our module:
# puppet apply mymodule/tests/init.pp --noop Warning: Config file /etc/puppet/hiera.yaml not found, using Hiera defaults Notice: Compiled catalog for puppet.example.com in environment production in 0.84 seconds Notice: /Stage[main]/Mymodule::Httpd/File[/var/www/myserver]/ensure: current_value absent, should be directory (noop) Notice: /Stage[main]/Mymodule::Httpd/Package[httpd]/ensure: current_value absent, should be present (noop) Notice: /Stage[main]/Mymodule::Httpd/File[/etc/httpd/conf.d/myserver.conf]/ensure: current_value absent, should be file (noop) Notice: /Stage[main]/Mymodule::Httpd/Service[httpd]/ensure: current_value stopped, should be running (noop) Notice: Class[Mymodule::Httpd]: Would have triggered 'refresh' from 4 events Notice: Stage[main]: Would have triggered 'refresh' from 1 events Notice: Finished catalog run in 0.51 seconds
Note
hiera.yaml file is safe to ignore.
2.7. Configuring the Firewall
iptables. For Red Hat Enterprise Linux 7, we use firewalld.
mymodule::http class:
if $operatingsystemmajrelease <= 6 {
exec { 'iptables':
command => "iptables -I INPUT 1 -p tcp -m multiport --ports ${httpd_port} -m comment --comment 'Custom HTTP Web Host' -j ACCEPT && iptables-save > /etc/sysconfig/iptables",
path => "/sbin",
refreshonly => true,
subscribe => Package['httpd'],
}
service { 'iptables':
ensure => running,
enable => true,
hasrestart => true,
subscribe => Exec['iptables'],
}
}
elsif $operatingsystemmajrelease == 7 {
exec { 'firewall-cmd':
command => "firewall-cmd --zone=public --add-port=${httpd_port}/tcp --permanent",
path => "/usr/bin/",
refreshonly => true,
subscribe => Package['httpd'],
}
service { 'firewalld':
ensure => running,
enable => true,
hasrestart => true,
subscribe => Exec['firewall-cmd'],
}
}
- Use the
operatingsystemmajreleasefact to determine whether the operating system is Red Hat Enterprise Linux 6 or 7. - If using Red Hat Enterprise Linux 6, declare an executable (
exec) resource that runsiptablesandiptables-saveto add a permanent firewall rule. Thehttpd_portvariable is used in-line to define the port to open. After theexecresource completes, we trigger a refresh of theiptablesservice. To achieve this, we define a service resource that includes thesubscribeattribute. This attribute checks if any there are any changes to another resource and, if so, performs a refresh. In this case, it checks theiptablesexecutable resource. - If using Red Hat Enterprise Linux 7, declare a similar executable resource that runs
firewall-cmdto add a permanent firewall rule. Thehttpd_portvariable is also used in-line to define the port to open. After theexecresource completes, we trigger a refresh of thefirewalldservice but with asubscribeattribute pointing to thefirewall-cmdexecutable resource. - The code for both firewall executable resources contains
refreshonly => trueandsubscribe => Package['httpd']attributes. This ensures the firewall commands only run after thehttpdinstalls. Without these attributes, subsequent runs will add multiple instances of the same firewall rule.
puppet apply command again to test the changes to our module. The following example is a test of Red Hat Enterprise Linux 6:
# puppet apply mymodule/tests/init.pp --noop Warning: Config file /etc/puppet/hiera.yaml not found, using Hiera defaults Notice: Compiled catalog for puppet.example.com in environment production in 0.82 seconds Notice: /Stage[main]/Mymodule::Httpd/Exec[iptables]/returns: current_value notrun, should be 0 (noop) Notice: /Stage[main]/Mymodule::Httpd/Service[iptables]: Would have triggered 'refresh' from 1 events ...
subscribe attribute.
Important
2.8. Configuring SELinux
semanage command to manage port settings. This tool is a part of the policycoreutils-python package, which is not installed on Red Hat Enterprise Linux systems by default.
mymodule::http class:
exec { 'semanage-port':
command => "semanage port -a -t http_port_t -p tcp ${httpd_port}",
path => "/usr/sbin",
require => Package['policycoreutils-python'],
before => Service ['httpd'],
subscribe => Package['httpd'],
refreshonly => true,
}
package { 'policycoreutils-python':
ensure => installed,
}
- The
require => Package['policycoreutils-python']attribute makes sure thepolicycoreutils-pythonis installed prior to executing the command. - Puppet executes
semanageto open a port usinghttpd_portas a variable. - The
before => Service ['httpd']makes sure to execute this command before thehttpdservice starts. Ifhttpdstarts before the SELinux command, SELinux denies access to the port and the service fails to start. - The code for the SELinux executable resource contains
refreshonly => trueandsubscribe => Package['httpd']attributes. This ensures the SELinux commands only run after thehttpdinstalls. Without these attributes, subsequent runs result in failure. This is because SELinux detects the port is already enabled and reports an error.
puppet apply command again to test the changes to our module.
# puppet apply mymodule/tests/init.pp --noop ... Notice: /Stage[main]/Mymodule::Httpd/Package[policycoreutils-python]/ensure: current_value absent, should be present (noop) ... Notice: /Stage[main]/Mymodule::Httpd/Exec[semanage-port]/returns: current_value notrun, should be 0 (noop) ... Notice: /Stage[main]/Mymodule::Httpd/Service[httpd]/ensure: current_value stopped, should be running (noop) ...
policycoreutils-python first, then configures port access before starting the httpd service.
2.9. Copying a HTML file to the Web Host
index.html in the files directory. Add the following content to this file:
<html>
<head>
<title>Congratulations</title>
<head>
<body>
<h1>Congratulations</h1>
<p>Your puppet module has correctly applied your configuration.</p>
</body>
</html>
app.pp in the manifests directory. Add the following content to this file:
class mymodule::app {
file { "/var/www/myserver/index.html":
ensure => file,
mode => 755,
owner => root,
group => root,
source => "puppet:///modules/mymodule/index.html",
require => Class["mymodule::httpd"],
}
}
require attribute ensures the mymodule::http class completes configuration successfully before we apply mymodule::app.
init.pp manifest:
class mymodule (
$http_port = 80
) {
include mymodule::httpd
include mymodule::app
}
puppet apply command again to test the changes to our module. The output should resemble the following:
# puppet apply mymodule/tests/init.pp --noop
Warning: Config file /etc/puppet/hiera.yaml not found, using Hiera defaults
Notice: Compiled catalog for puppet.example.com in environment production in 0.66 seconds
Notice: /Stage[main]/Mymodule::Httpd/Exec[iptables]/returns: current_value notrun, should be 0 (noop)
Notice: /Stage[main]/Mymodule::Httpd/Package[policycoreutils-python]/ensure: current_value absent, should be present (noop)
Notice: /Stage[main]/Mymodule::Httpd/Service[iptables]: Would have triggered 'refresh' from 1 events
Notice: /Stage[main]/Mymodule::Httpd/File[/var/www/myserver]/ensure: current_value absent, should be directory (noop)
Notice: /Stage[main]/Mymodule::Httpd/Package[httpd]/ensure: current_value absent, should be present (noop)
Notice: /Stage[main]/Mymodule::Httpd/File[/etc/httpd/conf.d/myserver.conf]/ensure: current_value absent, should be file (noop)
Notice: /Stage[main]/Mymodule::Httpd/Exec[semanage-port]/returns: current_value notrun, should be 0 (noop)
Notice: /Stage[main]/Mymodule::Httpd/Service[httpd]/ensure: current_value stopped, should be running (noop)
Notice: Class[Mymodule::Httpd]: Would have triggered 'refresh' from 8 events
Notice: /Stage[main]/Mymodule::App/File[/var/www/myserver/index.html]/ensure: current_value absent, should be file (noop)
Notice: Class[Mymodule::App]: Would have triggered 'refresh' from 1 events
Notice: Stage[main]: Would have triggered 'refresh' from 2 events
Notice: Finished catalog run in 0.74 seconds
index.html file being copied to the webhost.
2.10. Finalizing the Module
# puppet module build mymodule
mymodule/pkg/mymodule-0.1.0.tar.gz, which contains the contents of our mymodule directory. We upload this module to our Red Hat Satellite 6 server to provision our own HTTP server.
Chapter 3. Adding Puppet Modules to Red Hat Satellite 6
3.1. Creating a Custom Product
Procedure 3.1. Creating a Custom Product
- Login to your Red Hat Satellite 6 server.
- Navigate to → .
- Click + New Product.
- Provide your custom product with a Name. In this example, use
MyProductas the name. - The Label field automatically populates with a label based on the Name.
- Provide a GPG Key, Sync Plan, and a Description if required. For our example, leave those fields blank.
- Click Save.
MyProduct.
3.2. Creating a Puppet Repository in a Custom Product
Procedure 3.2. Creating a Custom Puppet Repository
- On the Products page, click on the custom product created previously (
MyProduct). - Navigate to the Repositories subtab.
- Click Create Repository.
- Provide the repository with a Name. This example uses the name
MyRepo. - The Label field automatically populates with a label based on the Name.
- Select
puppetas the repository Type. - Leave the URL field blank. This field is used for remote repositories, but in our case Satellite 6 creates its own repository.
- Click Save.
3.3. Uploading a Puppet Module to a Repository
mymodule module to the newly created repository, which adds it to our custom product.
- Click the
Nameof the newly created repository. - In the Upload Puppet Module section, click Browse and select the
mymodulearchive. - Click Upload.
mymodule module.
3.4. Removing a Puppet Module from a Repository
- On the Products page, click on the custom product containing the module to remove.
- Click the
Nameof the repository containing the module to remove. - Click Manage Puppet Modules. The screen displays a list of Puppet modules contained within the repository.
- Select the modules to remove.
- Click Remove Puppet Modules.
3.5. Adding Puppet Modules from a Git Repository
pulp-puppet-module-builder. This tool checks out repositories containing a set of modules, builds the modules, and publishes them in a structure for Satellite 6 to synchronize. This provides an efficient way to manage module development in Git and include them in the Satellite 6 workflow.
Note
pulp-puppet-module-builder tool on other machines using the pulp-puppet-tools package.
Procedure 3.3. Publishing Git Repository to a Local Directory
- Create a directory on the Satellite server to synchronize the modules.
# mkdir /modules # chmod 755 /modules
- Run the
pulp-puppet-module-builderand checkout the Git repository.# pulp-puppet-module-builder --output-dir=/modules --url=git@mygitserver.com:mymodules.git --branch=develop
This checks out thedevelopbranch of the Git repository fromgit@mygitserver.com:mymodules.gitand publishes the modules to/modules.
Procedure 3.4. Publishing Git Repository to a Web Server
- Create a directory on the web server to synchronize the modules.
# mkdir /var/www/html/modules # chmod 755 /var/www/html/modules/
- Run the
pulp-puppet-module-builderand checkout the Git repository.# pulp-puppet-module-builder --output-dir=/var/www/html/modules/ --url=git@mygitserver.com:mymodules.git --branch=develop
This checks out thedevelopbranch of the Git repository fromgit@mygitserver.com:mymodules.gitand publishes the modules to/modules.
Procedure 3.5. Creating a Repository for Puppet Modules from Git
- On the Products page, click on the custom product created previously (
MyProduct). - Navigate to the Repositories subtab.
- Click Create Repository.
- Provide the repository with a Name. This example uses the name
MyGitRepo. - The Label field automatically populates with a label based on the Name.
- Select
puppetas the repository Type. - In the URL field, set the location you defined earlier. For example, local directories on the Satellite 6 server use the
file://protocol:file:///modules
A remote repository uses thehttp://protocol:http://webserver.example.com/modules/
- Click Save.
- Click Sync Now to synchronize the repository.
3.6. Publishing a Content View
Procedure 3.6. Publishing a Content View
- Navigate to → .
- Click + Create New View.
- Provide your view with a Name. In this example, we use
MyViewas the name. - The Label field automatically populates with a label based on the Name.
- Make sure Composite View is not selected.
- Click Save.
- Select the Name of your newly created view.
- Navigate to → .
- Add the required Red Hat Enterprise Linux repositories, including a base Red Hat Enterprise Linux Server RPM collection and a Red Hat Satellite Tools RPM collection for the same version. The Tools RPM collection contains the packages to set up our remote Puppet configuration on provisioned systems.
- Navigate to Puppet Modules.
- Click + Add New Module.
- Scroll to your module and click Select a Version.
- Scroll to the module version Use Latest and click Select Version.
- Our module is now a part of the content view. Navigate to Versions to publish and promote a new version of the content view.
- Click Publish New Version. On the Publish New Version page, click Save. This publishes the content view with our module.
- Scroll to the new version of our view and click Promote. Choose a lifecycle environment and click Promote Version. This makes the view a part of the chosen lifecycle environment.
3.7. Configuring Smart Variables from Puppet Classes
mymodule contains a parameter for the HTTP port of our web server. This parameter, httpd_port, is set to a default of 8120. However, a situation might occur where we need to use a different port for a provisioned system. Satellite 6 can convert the httpd_port parameter into a smart variable, override it, and send it back to the system during configuration. This provides an easy way to change the HTTP port on our webserver.
mymodule module uploaded to a product and added to a content view. This is because we need to edit the classes in the resulting Puppet environment.
- Navigate to → .
- A table appears listing all smart variables from the classes in your Puppet modules. Click on the
httpd_portvariable. - The options for the smart variable appears. To allow overriding this variable during provisioning, select the Override option.
- Selecting the Override option allows us to change the Parameter type and Default value. This is useful if we aim to globally change this value for all future configurations.The following parameter types are available:
- String
- The value is interpreted as a plain text string. For example, if your smart variable sets the hostname, the value is interpreted as a string:
myhost.example.com
- Boolean
- The value is interpreted and validated as a true or false value. Examples include:
True true 1
- Integer
- The value is interpreted and validated as an integer value. Examples include:
8120 -8120
- Real
- The value is interpreted and validated as a real number value. Examples include:
8120 -8120 8.12
- Array
- The value is interpreted and validated as a JSON or YAML array. For example:
["Monday","Tuesday","Wednesday","Thursday","Friday"]
- Hash
- The value is interpreted and validated as a JSON or YAML hash map. For example:
{"Weekdays": ["Monday","Tuesday","Wednesday","Thursday","Friday"], "Weekend": ["Saturday","Sunday"]} - YAML
- The value is interpreted and validated as a YAML file. For example:
email: delivery_method: smtp smtp_settings: address: smtp.example.com port: 25 domain: example.com authentication: none - JSON
- The value is interpreted and validated as a JSON file. For example:
{ "email":[ { "delivery_method": "smtp" "smtp_settings": [ { "address": "smtp.example.com", "port": 25, "domain": "example.com", "authentication": "none" } ] } ] }
For this example, leave the default as 8120. - Selecting the Override option also exposes Optional Input Validator, which provides validation for the overridden value. For example, we can include a regular expression to make sure
httpd_portis a numerical value. For our example, leave this section blank. - Selecting the Override option also exposes Override Value For Specific Hosts, which defines a hierarchical order of system facts and a set of matcher-value combinations. The matcher-value combinations determine the right parameter to use depending on an evaluation of the system facts. For our example, leave this section with the default settings.
- Click Submit.
httpd_port. We can set a value for this smart variable at either a Host Group level or at a Host level.
Chapter 4. Client and Server Settings for Configuration Management
4.1. Configuring Puppet on the Red Hat Satellite Server
/etc/puppet.conf configuration file contains the following [master] section:
[master]
autosign = $confdir/autosign.conf { mode = 664 }
reports = foreman
external_nodes = /etc/puppet/node.rb
node_terminus = exec
ca = true
ssldir = /var/lib/puppet/ssl
certname = sat6.example.com
strict_variables = false
manifest = /etc/puppet/environments/$environment/manifests/site.pp
modulepath = /etc/puppet/environments/$environment/modules
config_version =
$environment) that Satellite 6 uses to create configuration for different environments.
4.2. Configuring Puppet agent on Provisioned Systems
/etc/puppet/puppet.conf file that configures Puppet as an agent of the Puppet master on a chosen Capsule. This configuration file is stored as a provisioning template snippet in Satellite 6. Navigate to → and click the puppet.conf snippet to view it.
puppet.conf snippet contains the following agent configuration:
[agent] pluginsync = true report = true ignoreschedules = true daemon = false ca_server = <%= @host.puppet_ca_server %> certname = <%= @host.certname %> environment = <%= @host.environment %> server = <%= @host.puppetmaster %>
- @host.puppet_ca_server and @host.certname - The certificate and certificate authority for securing Puppet communication.
- @host.environment - The Puppet environment on the Satellite 6 server to use for configuration.
- @host.puppetmaster - The host containing the Puppet master. This is either the Satellite 6 server's internal Capsule or an external Satellite Capsule.
Chapter 5. Applying Configuration on Clients
mymodule module. We now aim to apply this module's configuration to a registered system.
5.1. Applying Configuration on Clients During Provisioning
mymodule as an example.
Procedure 5.1. Applying Configuration on Clients During Provisioning
- Navigate to → .
- Click the Host tab. Enter a Name for the host and choose the organization and location for the system. Choose the Lifecycle Environment and its promoted Content View. This defines the Puppet environment to use for the configuration. Also choose a Puppet CA and Puppet Master from the Capsule Settings. The chosen capsule acts as the server that controls the configuration and communicates with the agent on the new host.
- Click the Puppet Classes tab and from the Available Classes section choose the Puppet classes that contain the configuration to apply. In our example, choose:
mymodulemymodule:httpdmymodule:app
- Choose the necessary options from the Network and Operating System tabs. These options depend on your own Satellite 6 infrastructure. Make sure the Provisioning templates option includes the
Satellite Kickstart Defaultkickstart template. This template contains installation commands for the Puppet agent on the new host. - Click the Parameters tab and provide any custom overrides to our Puppet class parameters. For example, modify the
httpd_portfrom themymoduleto set your own custom port. - After completing all provisioning options, click Submit.
Satellite Kickstart Default provisioning template. This provisioning template contains the following:
<% if puppet_enabled %>
# and add the puppet package
yum -t -y -e 0 install puppet
echo "Configuring puppet"
cat > /etc/puppet/puppet.conf << EOF
<%= snippet 'puppet.conf' %>
EOF
# Setup puppet to run on system reboot
/sbin/chkconfig --level 345 puppet on
/usr/bin/puppet agent --config /etc/puppet/puppet.conf -o --tags no_such_tag <%= @host.puppetmaster.blank? ? '' : "--server #{@host.puppetmaster}" %> --no-daemonize
<% end -%>
- Installs the
puppetpackage from the Red Hat Satellite 6 Tools RPMs repository. - Installs the Puppet configuration snippet to the system at
/etc/puppet/puppet.conf. - Enables the Puppet service to run on the system.
- Run Puppet for the first time and apply the system configuration.
http://newhost.example.com:8120/ and the following message appears in your browser:
Congratulations
Your puppet module has correctly applied your configuration.
5.2. Applying Configuration to Existing Clients
Important
Procedure 5.2. To Install and Enable the Puppet Agent:
- Open a terminal console and log in as root.
- Install the Puppet agent:
# yum install puppet
- Configure the puppet agent to start at boot:
- On Red Hat Enterprise Linux 6:
# chkconfig puppet on
- On Red Hat Enterprise Linux 7:
# systemctl enable puppet
Procedure 5.3. Configuring the Puppet Agent
- Configure the Puppet agent by changing the
/etc/puppet/puppet.conffile:# vi /etc/puppet/puppet.conf
[main] # The Puppet log directory. # The default value is '$vardir/log'. logdir = /var/log/puppet # Where Puppet PID files are kept. # The default value is '$vardir/run'. rundir = /var/run/puppet # Where SSL certificates are kept. # The default value is '$confdir/ssl'. ssldir = $vardir/ssl [agent] # The file in which puppetd stores a list of the classes # associated with the retrieved configuratiion. Can be loaded in # the separate ``puppet`` executable using the ``--loadclasses`` # option. # The default value is '$confdir/classes.txt'. classfile = $vardir/classes.txt pluginsync = true report = true ignoreschedules = true daemon = false ca_server = satellite.example.com server = satellite.example.com environment = KT_Example_Org_Library_RHEL6Server_3 # Where puppetd caches the local configuration. An # extension indicating the cache format is added automatically. # The default value is '$confdir/localconfig'. localconfig = $vardir/localconfigImportant
Set theenvironmentparameter to the host's Puppet environment from the Satellite server. The Puppet environment label contains the organization label, lifecycle environment, content view name, and the content view ID. To see a list of Puppet environments in the Satellite 6 web UI, navigate to → . - Run the Puppet agent on the host:
# puppet agent -t --server satellite.example.com
- Sign the SSL certificate for the puppet client through the Satellite Server web interface:
- Log in to the Satellite Server through the web interface.
- Select → .
- Click to the right of the required host.
- Click .
- Rerun the
puppet agentcommand:# puppet agent -t --server satellite.example.com
Note
Chapter 6. Reviewing Puppet Reports in Red Hat Satellite 6
Procedure 6.1. Reviewing Puppet Reports in Red Hat Satellite 6
- Navigate to → .
- Click the Name of your desired host.
- Click the Reports button.
- Select a report to view.
Appendix A. Revision History
| Revision History | ||||
|---|---|---|---|---|
| Revision 1.3-3 | Tue Sep 6 2016 | |||
| ||||
| Revision 1.3-2 | Wed May 11 2016 | |||
| ||||
| Revision 1.3-1 | Mon Oct 12 2015 | |||
| ||||
| Revision 1.1-1 | Wed Aug 26 2015 | |||
| ||||
| Revision 1.0-2 | Tue Jul 14 2015 | |||
| ||||
| Revision 1.0-1 | Sun Jun 14 2015 | |||
| ||||
| Revision 1.0-0 | Fri Jun 12 2015 | |||
| ||||
