Hot answers tagged puppet
27
A domain-specific language makes a big difference in the amount of code you write. For example, you could argue that there's not much difference between:
chmod 640 /my/file
and
file { "/my/file":
mode => 640,
}
but there's a great deal of difference between these:
FILE=/my/file
chmod 640 $FILE
chown foo $FILE
chgrp bar $FILE
wget -O $FILE ...
14
You've answered your own question...
Automation is becoming more scalable and formalized. Puppet and Chef are considered standards these days (check the job ads).
Cobbled-together shell scripts have their place, but they're not scalable in the context of the DevOps movement. Readability is part of that.
7
Yes, this is certainly possible. Deciding if you should do so or not is up to you though.
Regarding your queries:
1) fair enough. The traffic is ssl based, so certificate management is important. Also don't trust any 'facts' which the client supplies relating to its identity, as these can be altered by the client. You want to rely on the client's ssl ...
6
This will be an unpopular opinion, but configuration management systems are not necessarily better. Sometimes simple really is best.
There is a definite learning curve and administrative overhead associated with the configuration system you choose. You are after all introducing a dependency. As with any automation you must also be careful that security ...
4
I would use a template. Set your file resource to use content instead of source:
content => template("mymodule/temp-conf-file.erb"),
Then have the template substitute the hostname. The template would be located in the templates subdirectory of your module:
# This file is managed by puppet
... random config stuff ...
hostname = <%= hostname %>
...
4
It probably fails because inheritance occurs before the $netgroup variable is evaluated, and therefore, catalog compilation fails. However, using this method to separate code from data has limitations and should be avoided.
I have refactored my puppet code to use hierarchical data for databindings and to achieve the same effect of grouping similar nodes. A ...
3
Is Puppet (or similar) a suitable technology for taking care of basic but critical mass changes?
Yes, it can be used this way. I use it this to support external clients systems.
I don't want any server to be able to see any config it shouldn't
If you are using puppet, you must not enable autosign then. Autosign permits hosts to automatically ...
3
Try Ansible (ansible.cc). May be it is for you. There is no agent running on your clients. It is growing very fast.
Another very good alternative is Salt Stack.
Ansible and Salt are easy to understand, you can use them as a command line tool if you want, like distributed shell.
3
You need to read that page you linked again :-)
Quoting:
You can also give default values for any parameter in the list:
class webserver( $vhost_dir = '/etc/httpd/conf.d', $packages = 'httpd' ) {
...
}
So, in your case:
class foo ($install_version = 'master') }
2
You can just use the function "generate" in your manifest to call some kind of random string generator (pwgen?) and assign this value to a variable:
http://docs.puppetlabs.com/references/latest/function.html#generate
2
Yes, the Shellvars_list lens should be able to parse your file as:
{ "SUPERACCESS"
{ "quote" = """ }
{ "value" = "127.0.0.1" }
{ "value" = "192.168.11.0/24" }
}
{ "SERVICES"
{ "quote" = """ }
{ "value" = "ping" }
{ "value" = "80/tcp" }
{ "value" = "443/tcp" }
{ "value" = "22/tcp" }
}
{ "FORWARDING"
{ "quote" = "" }
{ "value" = "1" }
}
...
2
If servers are disposable to you, or you have cause to stand up more than a couple at a time, a full-blown CM system will much better meet your needs than a series of shell scripts.
If your build needs are modest, (or like to artisanally hand-craft organic free-range fair-trade servers), then keep it simple.
Personally, having used Chef extensively at a ...
2
Arrays support negative indexing, with -1 being the final element of the array:
http://docs.puppetlabs.com/puppet/2.7/reference/lang_datatypes.html#indexing
so..
$foo = [ 'one', 'two', 'three', 'four', 'five' ]
notice( $foo[-1] )
# 'five'
2
You do need some form of configuration management. Puppet, Chef, CFengine, one of those. Basic setup of each is somewhat trivial, but they get complex very quickly. There are many different How-To's out there for each.
Do NOT go distro agnostic. It's nice to be able to use different distributions, but don't expect compatibility. Different distros have ...
2
Well, I think a good option for your usecase is to enable "storeconfigs" and then use "exported ressources".
Here you can finde some documentation about this topic including some examples: http://docs.puppetlabs.com/guides/exported_resources.html
http://www.masterzen.fr/2009/03/08/all-about-puppet-storeconfigs/
2
Is there any reason you can't have the definition of the main class in the init.pp file?
My understanding of the class discovery is rudimentary, but the file modules/mod1/mod1.pp would be automatically checked for the mod1::mod1 class, not the mod1 class.
As far as I'm aware, the mod1 class should always be defined in init.pp, but that doesn't mean your ...
2
My problem is that this feels like mixing code and data (since all of the host keys live inside a module directory) and I have to make another commit to the Puppet VCS every time I add a new set of hosts. Is there a better way to manage these things?
You can adjust your fileserver.conf and basically share out another directory you use just for ssh ...
2
Based on the doc
Manage groups. On most platforms this can only create groups. Group
membership must be managed on individual users.
On some platforms such as OS X, group membership is managed as an
attribute of the group, not the user record. Providers must have the
feature ‘manages_members’ to manage the ‘members’ property of a group
...
2
As posted in my comment, the package name was wrong.
Here is how I fixed it to install on Ubuntu and CentOS.
package {"openjdk-6-jdk":
ensure => installed,
name => $operatingsystem ? {
Ubuntu => "openjdk-6-jdk",
CentOS => "java-1.6.0-openjdk",
}
}
1
Looking at the information reported by the one of the packages, it depends of any of libaugeas-ruby1.{8,9}
# dpkg --info puppet-common_3.1.1-1puppetlabs1_all.deb
Package: puppet-common
Source: puppet
Version: 3.1.1-1puppetlabs1
Architecture: all
Maintainer: Puppet Labs
Installed-Size: 3592
Depends: ruby | ruby-interpreter, libxmlrpc-ruby, ...
1
Very strange that it just worked.. I don't see anything in your Apache config that would cause a 400 response when running under passenger when it's not happening under webrick, but you never know.
Is the puppet master under passenger working ok otherwise?
The next step in figuring out what's wrong would be to enable the --debug line in your config.ru, if ...
1
I don't want Puppet to make any changes which it shouldn't, or revert
any manual changes done on the server.
For config files that are created using Puppets File type this can be achieved by setting:
replace => false,
I use that to generate some config files the first time that an application is deployed to a server, but then any edits to that ...
1
So you want certain hosts to get information from another host's facts, but which host the facts come from will vary depending on the configuration of the specific host. Is that correct?
If so, I would also recommend using exported resources and using tags to specify the particular resource to use. The reason for this is that there are basically two ways ...
1
Chef makes it a lot easier to manage and version the setup of a complex infrastructure, especially in any type of cloud environment vs. having to manually ftp or scp a bunch of shell scripts organized in a unstandardized fashion. Depending on how many dependencies you need to manage, the size of this win can vary greatly, making the decision to move to a CM ...
1
Modern configuration management tools such as Puppet and Chef allow you to define the state of a system instead of worrying about activities necessary to achieve a configured server.
For example, your chmod command assumes that the file exists, the user owning the file exists, that the directories have been created, and so on. Your script therefore must ...
1
The fix was the modify fileserver.conf, and set:
allow *
instead of
allow fqdn
allow_ip ip
Like this:
[files]
path /srv/puppet
allow *
# allow *.botnet.corp.yeri.be
# allow_ip 172.27.0.0/18
[plugins]
allow *
# allow *.botnet.corp.yeri.be
# allow_ip 172.27.0.0/18
1
You still have to download that module from the forge first:
puppet module install puppetlabs/git
It will put it in the default modulepath, but you can override that with the --modulepath switch.
You can see the mentioned command at the URL that you mentioned... ;)
You then 'use' that module like this:
include git
1
Yes, you can install specific versions of packages you want installed. The package resource has a special version attribute. You can read more about the package resource here: http://docs.opscode.com/resource_package.html
The code will look something like this:
package "httpd" do
version "2.2.22"
end
1
There are several ways my favourites are the following three:
For our migration from apache1 to apache2 we created completely separate modules. You'd think this caused a lot of duplication, but we redid our config at the same time.
For simple upgrades of single packages, we do things like
package{"foo":
ensure => $wants_foo_upgrade ? {
true ...
1
I would recommend doing this by having a single module that takes a version number as a parameter, something like this:
class our_software ($version) {
...
}
What you do within that class depends on how much the two versions of your software have in common. You might be able to have all of the config files included directly in the class with templates ...
Only top voted, non community-wiki answers of a minimum length are eligible
