Puppet 4 - Examples - Data Types

Puppet 4 has some new functionality. Within the next few blog posts I will give some examples on how to use the new functionality.
The first post covers the new Data Type system.

Puppet Enterprise 3.8 Installation - steps and fixes

The new Puppet Enterprise Version 3.8 is out since a couple of days.
It now supports Puppet 4 officially.
On mailinglist people were telling about installation issues.
This is a summary with fixes for SLES 11 and 12, CentOS 6 and 7, Ubuntu 12.04 and 14.10, Debian 6 and 7.
Seems as if Debian 8 is still to new for PE 3.8.

Puppet Enterprise on SLES

SLES and OpenSuSE are supported operatingsystems by Puppet.
But I always saw trouble when installing either the Puppet Master or the Agent on SLES.

One needs to take care on locales, paranoid umask, required packages.

News from PuppetConf - Puppet 4 server and agent

Puppet is working on new stuff for Puppet 4.x
During PuppetConf they provided information of upcoming changes:

Summary of Puppet 4 features and deprecations

PuppetLabs maintains a github repo where they manage documents regarding Puppet 4.x changes, deprecations and new features.
This article is a summary on planned and implemented changes.

OpenNebula Puppet types and providers

When setting up OpenNebula one has to configure many steps.
Since I do not like manual work and due to the reason that we already had the OpenNebula Puppet module available as OpenSource on GitHub, I started working on OpenNebula types and Providers.

You now can declare your OpenNebula infrastructure in Puppet DSL:

undefined method parent for nil:NilClass

Funny puppet errors:

err: Could not retrieve catalog from remote server: Error 400 on SERVER: Puppet::Parser::AST::Variable failed with error NoMethodError: undefined method `parent' for nil:NilClass at /etc/puppet/environments/foo/modules/util/manifests/init.pp:23 on node foo.bar.baz

warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run

And: it breaks always somewhere different.

Puppet rspec testing with automatic hiera lookups (implicit hiera lookup like puppet 3.x)

This article is an add-on to my other article regarding puppet & rspec.
This article only covers automatic hiera lookups used during rspec puppet runs.
Many thanks to Jan (janwaech<at>gmail<dot>com) who spend the time digging into rspec-puppet code finding this nice solution.

Puppet and Hiera Hashes

Hiera data is great for separating code and data.
Within hiera one can put different types of variables:
- text
- arrays
- hashes

Working with text and arrays is easy for most Puppet users.

Hashes still seem to have some kind of magic.
This post tries to show you an idea on how to work with hashes in hiera.

Puppet rspec testing and hiera

Rspec testing your puppet modules supports you in having stable and functional modules.
For a couple of weeks there is hiera integration in rspec-puppet.

OpenNebula Puppet Module

Within my actual project we implemented OpenNebula on CentOS.
The big picture is a self service where developers can startup virtual machines by themselves.

The team that worked on the OpenNebula implementation is heavily using automation for many tasks. Therefore we decided to also automate the OpenNebula installation and configuration using Puppet.

Restart puppet using puppet

If you want to ensure puppet upgrade via a puppet manifest you may run into trouble when it comes to puppet service restart.

When puppet stops the service it will kill the actual running puppet process.
Afterwards puppet does not do the start command.




You can solve this by using the following service resource:

service { 'puppet':
  enable   => true,
  ensure   => running,
  restart  => '/usr/bin/nohup /etc/init.d/puppet restart &',
}

This will fork a puppet restart command in background.

Puppet 2.7.x and Debian ruby 1.9.1

According to puppetlabs one should stay with ruby 1.8.7 when running puppet - Puppet FAQ and supported Ruby versions.

Most things work, but the CA and SSL has an issue when running ruby 1.9.x - Mixing and matching ruby versions for puppetmasterd and puppetd causes a "certificate verify failed" error.

The solution is to create a symlink in the ssl certs directory as described here.

Puppetlabs removes dynamic variable scoping

When you run puppet 2.7.12 or higher you will see a warning message, telling you that dynamic variable scope look-up will be removed in puppet 2.8.x.

What to do if you have variables defined in a node definition?

1. switch to hiera
2. write a mockup

A mockup can be build in the following way:

1. write a new module with a define
2. use the define and add the proper parameter

Why do you have to do it that ugly way? Is there no way to give the scope of a node definition?

No. Nodes do not have any scope. Scope is limited to modules and classes.

class base_variable ( stage = first, dummyvariable ) {
  case $dummyvariable {
     'live': { $truevariable = 'live' }
     'testing': { $truevariable = 'testing' }
     'testing2': { $truevariable = 'testing2' }
  }
}

In node definition you can now use the define:

node 'default.server.domain.tld' {
        include stages
        class { base_variable:
                dummyvariable => 'testing2',
        }
        include base::dev
        ....
}

example for munin-nagios integration

Let's assume that you have an USB temperature sensor connected to a machine in your server room.
Active checks would make no sense here, since most of the time the temperature should be OK.
But you want to get notified in case of cooling problems and over heating.




First you need a plugin for munin:
serverroom



Verifiy that this plugin is working prior doing anything else!
Also adopt the warn and crit values to your needs.

Now you need nsca installed on your munin master node.

Next
step is a proper munin master configuration for your system that has
the USB thermometer connected. We assume that the system has the name
intranet and that you have configured munin to make use of some
domains. intranet is located in domain intern.

contact.nagios.command /usr/sbin/send_nsca -H <nagios server IP> -c /etc/send_nsca.cfg
[intranet.intern]
        notify_alias intranet
        address <your systems IP>
        use_node_name yes

If you omit the "notify_alias" part all alarms will be sent from the given system name  plus domain appended (intranet.intern).
With the notify alias you can make sure that nagios receives the alarm for the proper system.

Now the nagios system needs to get configured.
Make sure you have nsca installed and running.
Now enable passive chacks in nagios.conf and create a service for the temperature alarm:

define service{
        use                             passive-service
        hostgroup_name                  temperature-servers
        service_description             Serverroom
                check_command                   return-ok
        }

combining nagios and munin

munin offers a nice way to collect and show system information. So munin can be easily used as a monitoring system. Munin uses simple plugins (either shell- or perl code) to gather data from systems.
nagios is well-known as an alarming system.

munin offers the possibility to name warn and critical values. In single use munin will show items that are beyond their warn and critical values by link highliting.

Additionally munin offers the possibility to make use of nagios passive checks via nsca.

nsca is a part of nagios.

first one needs to configure the munin-master to make use of the send_nsca command.
second one has to configure the nagios master to also run the nsca daemon (either via inetd or as standalone daemon)

Since nsca documentation is very simple the guys from munin made a documentation on how to combine munin and nagios.

The advantage of this is that you get information upon changes immediately.

puppet and key management

In case that you need to set up a system that has already benn managed by puppet one does need to run some additional steps.
First you need to remove the key from puppetmaster:

puppetca --clean <hostname>

Then you may set up the old system from scratch,.

After puppet startup use the puppetca command on puppet master to look and sign the new key


In case that puppetca --list will not show the new host key you need to run the following steps:

1. remove ssl-keys from puppet client
2. start puppet on client
3. run puppetca --list on puppetmaster.

puppet automated system configuration

We use puppet for automated system configuration for some time.
The developers are naming puppet the successor of cfengine.
Puppet is written in ruby and supports the following platforms:
- Linux
- OS X
- BSD
- Solaris

I will add some notes of puppet - especially about items that took us some time to find out - in the near future.