{"id":834,"date":"2017-08-02T12:11:16","date_gmt":"2017-08-02T00:11:16","guid":{"rendered":"http:\/\/mdickinson.dyndns.org\/php\/wordpress\/?p=834"},"modified":"2017-08-02T12:11:16","modified_gmt":"2017-08-02T00:11:16","slug":"the-puppet-downloadable-vm-tutorial","status":"publish","type":"post","link":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/?p=834","title":{"rendered":"The puppet downloadable VM tutorial"},"content":{"rendered":"<p>The puppet VM tutorial environment is available from <a href=\"https:\/\/puppet.com\/download-learning-vm\">https:\/\/puppet.com\/download-learning-vm<\/a> as an OVA file for VMWare or VirtualBox.<br \/>\n<em>The good news<\/em>, once the disk image is extracted from the .ova file and converted from vmdk to qcow2 using qemu-img the resulting qcow2 disk can be run under kvm simply by launching it from virt-manager using that existing disk, with one proviso, give it a minimum of 4Gb of memory, trying to run it in a VM with 3Gb of memory will eventually just lock it up.<\/p>\n<p>A good intro, but with a few minor. Not all the &#8220;lab&#8221; examples in later sections work, they say 100% success in applying the manifests\/classes\/profiles\/roles according to the outputs, but none of the services actually get started no matter how many time I restarted the affected quests, so all the &#8220;curl&#8221; test commands in later sections fail with nothing listening on port 80 on any of the test instances (it is possible to ssh into the instances to confirm that). <b>But as a introduction to puppet it is very useful<\/b>.<\/p>\n<p>Either Puppet-Enterprise doesn&#8217;t offer much extra in the way of functionality or the training VM concentrated mainly on puppet-core. What it covers that is missing from puppet-core is the &#8220;puppet job&#8221; command to initiate jobs for nodes\/applications from the puppetserver machine. Oh and the web interface, it covers setting up a new user on the web interface (do that step, having that is usefull to look at the reports from job runs to see what the errors are), but I didn&#8217;t really play with the web interface other than looking at the &#8216;job run&#8217; error reports and the tutorial coverage on it is pretty much just setting up that new user.<\/p>\n<p><em>One of the key things learnt<\/em> is that the &#8220;puppet parser validate <em>&#8230;\/class\/manifests\/xxx.pp<\/em>&#8221; command is of limited function, it syntax checks but does not check dependencies. In using the puppet learning VM I mistyped a &#8216;class xxx::submodule&#8217; name, although the pp filename was correct. The parser validate command had no errors in that or the init.pp that refered to the class file&#8230; so I guess it just checks the include file refered to in the init.pp file exists (if that, it may just syntax check). The &#8211;noop test on the agent flagged the error when the manifest was used.<\/p>\n<p>The &#8220;puppet job&#8221; command used in the PE tutorial seems reasonably useful, but as it is not available in the free puppet core package I have skipped over that, other than noting I will probably have difficulty testing application deployments (although as puppet core does support the &#8220;puppet parser validate &#8211;app_management&#8221; command I suppose applications may be supported ???, without the &#8220;job run &#8211;application&#8221; command available I&#8217;m not sure how the agents would sort the dependenicies out). Anyway, I don&#8217;t really have a need for orchestrating an application across multiple servers at home so that is not an issue for me.<\/p>\n<p>The &#8220;defined resource type&#8221; section I am still having trouble with in that nobody would ever use the example in the real world and I am having trouble thinking of where it could be used. The example adds (ensures they exist) users&#8230; err\/hmm\/what?, auditor field day !. A poor security admin could try deleting users off a server but puppet would put them back again. But I understand why it was used as an example as quite honestly I cannot thing of any other use for a &#8220;defined resource&#8221; either; which is why I think I will have trouble remembering the concept. But the example works and shows how it functions anyway. I cannot think of anything I can use that functionality for at the moment anyway.<\/p>\n<p>The application orchestrator section examples define an application with hard coded ip-addresses, I will have to spend some time looking at that to see if it can be changed to use ip-addresses provided by facter; I&#8217;m sure it can or the ability to orchestrate applications onto new VMs would be pointless. But as noted above with puppet core not providing the &#8220;job run&#8221; function to deploy applications I&#8217;m not sure that will be useful to me anyway&#8230; especially as for me I cannot see the point in creating an application stack with empty databases.<\/p>\n<p>Anyway, after running through the tutorial VM I have managed to<\/p>\n<ul>\n<li>split my working &#8216;live&#8217; nrpe manifest file into multiple &#8216;functional&#8217; pp files under the manifest<\/li>\n<li>managed to use a template to recreate my existing bacula-fd configurations on all the servers, so can use puppet to install bacula-fd on new servers now<\/li>\n<li>used the example motd configuration to have a consistent (if unused) motd file on all my servers<\/li>\n<li>have used puppet to push out a &#8220;standard&#8221; configuration file and standard prelogin banner for sshd, <em>however a &#8220;notify => Service[&#8216;sshd&#8217;]&#8221; throws up an error that service sshd is undefined<\/em>, so on each server you have to &#8220;systemctl restart sshd&#8221; or &#8220;service sshd restart&#8221; manually so it cannot really protect against unauthorised changes for that subsystem, which is weird as it is on all *nix servers<\/li>\n<li>created a &#8220;allservers&#8221; role and used the role to deploy the four manifests instead of four include statements for the node(s)<\/li>\n<li>I am still using only the &#8220;default&#8221; node entry, with a named node entry only when I want to test a new module; as currently the only real use I have for puppet is keeping configuration files in sync, although it is nice to know by using the &#8220;default&#8221; node any new VM I spin up will have nrpe and bacula-fd available for my backup and nagios servers to use<\/li>\n<\/ul>\n<p>In the &#8220;Afterword&#8221; section of the tutorial is a link where Puppet-Enterprise can be downloaded for free use on up to ten nodes; as I expect my VM farm to exceed that at some point I will not bother with that.<\/p>\n<p>The tutorial VM covers puppet in enough detail to make it fairly easy to use, so if you are looking at puppet you should download it and give it a try, which you can do as it can be run under KVM.<\/p>\n<p>It has given me enough insight to convince me I should continue using the free puppetserver from puppetlabs, but mainly to ensure all KVM machines have a common set of scripts and basic system utilities configured. As I do not build that many new KVM machines I won&#8217;t have a need for using it for installing\/deploying onto new KVM machines. And of course where I do throw-up\/tear-down test machines at a frequent rate in my little openstack lab I use heat patterns to build the short lived application stacks needed for multi-server deployments for whatever I am breaking, er I mean testing :-).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The puppet VM tutorial environment is available from https:\/\/puppet.com\/download-learning-vm as an OVA file for VMWare or VirtualBox. The good news, once the disk image is extracted from the .ova file and converted from vmdk to qcow2 using qemu-img the resulting &hellip; <a href=\"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/?p=834\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,5],"tags":[],"class_list":["post-834","post","type-post","status-publish","format-standard","hentry","category-automation","category-my-nux-thoughts-and-notes"],"_links":{"self":[{"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/834","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=834"}],"version-history":[{"count":2,"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/834\/revisions"}],"predecessor-version":[{"id":836,"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/834\/revisions\/836"}],"wp:attachment":[{"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=834"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=834"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mdickinson.dyndns.org\/php\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=834"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}