Table of Contents ================= * [Before Starting](#before-starting) * [What You Get From This control\-repo](#what-you-get-from-this-control-repo) * [How To Set It All Up](#how-to-set-it-all-up) * [Setup a Trusted Fact On Your PE Master](#setup-a-trusted-fact-on-your-pe-master) * [If You Have Not Installed PE](#if-you-have-not-installed-pe) * [If You Have Already Installed PE](#if-you-have-already-installed-pe) * [Copy This Repo Into Your Own Git Server](#copy-this-repo-into-your-own-git-server) * [Gitlab](#gitlab) * [Stash](#stash) * [Github](#github) * [Configure PE to Use the Control\-Repo](#configure-pe-to-use-the-control-repo) * [Install PE](#install-pe) * [Get the Control\-Repo Deployed On Your Master](#get-the-control-repo-deployed-on-your-master) * [Test Code Manager](#test-code-manager) * [Updating From a Previous Version of PE](#updating-from-a-previous-version-of-pe) * [Upgrading to PE2015\.3\.z from PE 2015\.2\.z](#upgrading-to-pe20153z-from-pe-20152z) * [Appendix](#appendix) * [Test The Zack/r10k Webhook](#test-the-zackr10k-webhook) # Before Starting This control repo and the steps below are intended to be used during a new installation of PE. The instructions are geared towards a new installation of PE2015.3.z. However, the control-repo should work just fine on [PE2015.2.z](#upgrading-to-pe20153z-from-pe-20152z) If you intend to use this control-repo on an existing installation then be warned that if you've already written or downloaded modules when you start using r10k it will remove all of the existing modules and replace them with what you define in your Puppetfile. Please copy or move your existing modules to another directory to ensure you do not lose any work you've already started. # What You Get From This control-repo As a result of following the instructions below you will receive at least the beginning of a best-practices installation of PE including... - A git server - The ability to push code to your git server and have it automatically deployed to your PE Master - A config_version script to output the commit of code that your agent just applied - Optimal tuning of PE settings for this configuration - Working and example roles/profiles code # How To Set It All Up ## Setup a Trusted Fact On Your PE Master This control repository is setup to manage certain portions of your PE installation for you if you create a trusted fact called `pp_role`. In order to do so, lay down a file that looks exactly like the below in `/etc/puppetlabs/puppet/csr_attributes.yaml` ``` --- extension_requests: #pp_role 1.3.6.1.4.1.34380.1.1.13: 'all_in_one_pe' ``` ### If You Have Not Installed PE Good then you can proceed forward and the trusted fact will be used when you get to the install step. ### If You Have Already Installed PE Trusted facts are created at the time a CSR is generated. So, we need to regenerate the certificate on the master for the above trusted fact to be created. Follow this document to regenerate the certificate on your master. http://docs.puppetlabs.com/pe/latest/regenerate_certs_master.html ##Copy This Repo Into Your Own Git Server ###Gitlab 1. Install Gitlab - https://about.gitlab.com/downloads/ 2. After Gitlab is installed you may sign if with the `root` user and password `5iveL!fe` 3. Make a user for yourself 4. Make an ssh key to link with your user. You’ll want to do this on the machine you intend to edit code from ( most likely not your puppet master but your local workstation / laptop ) - http://doc.gitlab.com/ce/ssh/README.html - https://help.github.com/articles/generating-ssh-keys/ 5. Create a group called `puppet` ( this is case sensitive ) - http://doc.gitlab.com/ce/workflow/groups.html 6. Create a user called `r10k_api_user` and add them to the `puppet` group - From the landing page, select groups - Choose the puppet group - In the left hand pane, select memembers - Add the `r10k_api_user` with `master` permissions 7. Add your user to the `puppet` group as well 8. Create a project called `control-repo` and set the Namespace to be the `puppet` group 9. Logout of root and login as the `r10k_api_user` - Go to profile settings -> account ( https:///profile/account ) - Copy the api token 10. Clone this control repository to your laptop/workstation - `git clone ` - `cd control-repo` 11. `git mv hieradata/nodes/example-puppet-master.yaml hieradata/nodes/.yaml` - Open `hieradata/nodes/.yaml` - edit `gms_api_token` to be your api token - edit `git_management_system` to be 'gitlab' - edit the `gms_server_url` 12. `git add hieradata/nodes/.yaml` 13. `git commit -m "renaming example-puppet-master.yaml"` 14. Rename my repository as the upstream remote - `git remote rename origin upstream` 15. Add your internal repository as the origin remote - `git remote add origin ` 16. Push the production branch of the repository from your machine up to your git server - `git push origin production` 17. `git branch --set-upstream-to origin/production` ###Stash Coming soon! ###Github Coming soon! ##Configure PE to Use the Control-Repo ###Install PE 1. Download the latest version of the PE installer for your platform and copy it to your master - https://puppetlabs.com/download-puppet-enterprise 2. Expand the tarball and `cd` into the directory 3. Run `puppet-enterprise-installer` to install If you run into any issues or have more questions about the installer you can see our docs here: http://docs.puppetlabs.com/pe/latest/install_basic.html ###Get the Control-Repo Deployed On Your Master At this point you have our control-repo code deployed into your git server. However, we have one final challenge: getting that code onto your puppet master. In the end state the master will pull code from the git server via r10k, however, at this moment your puppet master doesn't have credentials to get code from the git server. So, we'll set up a deploy key in the git server that will allow a ssh-key we make to deploy the code and configure everything else. 1. On your puppet master, make an ssh key for r10k to connect to gitlab - `/usr/bin/ssh-keygen -t rsa -b 2048 -C 'code_manager' -f /etc/puppetlabs/puppetserver/code_manager.key -q -N ''` - http://doc.gitlab.com/ce/ssh/README.html - https://help.github.com/articles/generating-ssh-keys/ 2. Create a deploy key on the `control-repo` project in Gitlab - Paste in the public key from above - `cat /etc/puppetlabs/puppetserver/code_manager.key.pub` 3. Login to the PE console 7. Navigate to the Classification page - Click on the PE Master group - Click the Classes tab - Add the `puppet_enterprise::profile::master` - Set the `r10k_remote` to the ssh url from the front page of your gitlab repo - Set the `r10k_private_key` parameter to `/etc/puppetlabs/puppetserver/code_manager.key` - Commit your changes 8. Run `puppet agent -t` - Expect to see changes to `r10k.yaml` 9. Run `r10k deploy environment -pv` 10. Run `puppet agent -t` - Expect to see code manager enabled 10. `echo 'code_manager_mv_old_code=true' > /opt/puppetlabs/facter/facts.d/code_manager_mv_old_code.txt` 11. Run `puppet agent -t` - Now you should see many more changes - Your code has been deployed with code manager now ## Test Code Manager One of the components setup by this control-repo is that when you "push" code to your git server, the git server will inform the puppet master to deploy branch you just pushed. 1. In one terminal window, `tail -f /var/log/puppetlabs/puppetserver/puppetserver.log` 2. In a second terminal window - Add a new file, `touch test_file` - `git add test_file` - `git commit -m "adding a test_file"` - `git push origin production` 3. Allow the push to complete and then wait a few seconds for everything to sync over - `ls -l /etc/puppetlabs/code/environments/production` - Confirm test_file is present 4. In your first terminal window review the `puppetserver.log` to see the type of logging each sync will create ---- # Updating From a Previous Version of PE ## Upgrading to PE2015.3.z from PE 2015.2.z Remove `pe_r10k` from the PE master group in the console and instead add the following two parameters to the `puppet_enterprise::profile::master` class under the PE master group. - `r10k_remote` = the ssh url for your internal repo - `r10k_private_key` = `/etc/puppetlabs/puppetserver/code_manager.key` When upgrading the `puppet_enterprise::profile::master` class has the `file_sync_enabled` parameter set to `false`. This parameter should be removed so that code manager can configure file sync. Finally, you’ll need to `echo 'code_manager_mv_old_code=true' > /opt/puppetlabs/facter/facts.d/code_manager_mv_old_code.txt` so that my puppet code will redeploy all of your code with code manager. # Appendix ## Test The Zack/r10k Webhook If you are using PE2015.2.z or if you've forced the use of the zack/r10k webhook then you'll want to test that it works. One of the components setup by this control-repo is that when you "push" code to your git server, the git server will inform the puppet master to run `r10k deploy environment -p`. 1. Edit README.md - Just add something to it 2. `git add README.md` 3. `git commit -m "edit README"` 4. `git push origin production` 5. Allow the push to complete and then give it few seconds to complete - Open `/etc/puppetlabs/code/environments/production/README.md` and confirm your change is present { font-size:2.1337em; text-align: left; } .post h1+p { text-align: left; } ul.post-list { background: #f0f0f0; list-style: none; padding-inline-start: 0; padding: 0.8em; } ul.post-list li { padding:0.4em; } ul.post-list li:nth-child(2n-1) { background-color:#ffffff; } ul.post-list li span.post-meta { font-weight: bold;font-style: oblique;font-size:100%; } ul.post-list li span.post-meta:after { content: ':'; } ul.post-list li h3 { font-size: 100%;font-weight: normal; display: inline; margin-left: 1em; font-family: "Telex","Helvetica Neue",Helvetica,Arial,sans-serif; border-bottom: none; } ul.post-list li h3 a { text-decoration: none; } nav.blog-nav { background: transparent; position: static; border: none; } .blog-nav .nav-trigger { display:none; } .blog-nav .menu-icon { display:none; } .post-content table { margin-bottom: 30px; width: 100%; text-align: left; color: #3f3f3f; border-collapse: collapse; border: 1px solid #d0d0d0; } .post-content table tr:nth-child(odd) { background-color: #e0e0e0; } .post-content table tr:nth-child(even) { background-color: #f0f0f0; } .post-content table th, table td { padding: 10px 15px; } .post-content table th { background-color: #f0f0f0; border: 1px solid #dedede; border-bottom-color: #c9c9c9; } .post-content table td { border: 1px solid #e8e8e8; } .blog-nav a.page-link { text-decoration: none; font-size:110%; border-left: 1px solid; border-right: 1px solid; margin-left: 0.1em;margin-right:0.1em; padding-left:0.7331em;padding-right: 0.7331em; display: inline-block; } .blog-nav a.page-link:first-child { margin-left: 0; border-left: 0; } .blog-nav a.page-link:last-child { margin-right: 0; border-right: 0; } figure.highlight { margin: 0 auto; margin-left: 1em; padding: 0.666em; } figure.highlight pre { margin-top: 0; margin-bottom: 0; overflow-x: auto; overflow-y: hidden; } figure.highlight pre code, code.highlighter-rouge { font-size: 0.8em; } article.post div.post-content, #tocw { background: rgba(251,255,253,0.6); padding: 0.666em; } main.page-content a, footer.site-footer a { text-decoration: none; color: #169b62; font-weight: 550; } main.page-content a:hover, footer.site-footer a:hover, main.page-content a:active, footer.site-footer a:active { color: #ff883e; } .highlight { background: #e8fff0; } #tocw ol { list-style-type: decimal; counter-reset: item; padding-left: 10px; } #tocw ol li { display: block; } #tocw > ol > li { padding-left: 0.5em; } #tocw > ol > li > ol > li { padding-left: 0.666em; } #tocw > ol > li > ol > li > ol > li { padding-left: 1.337em; } #tocw ol li:before { content: counters(item, ".") ". "; counter-increment: item } /*main.page-content h2:before { content: counter(heading)". "; counter-increment: heading; } main.page-content h2 { counter-reset: subheading; } main.page-content h3:before { content: counter(heading)"." counter(subheading)". "; counter-increment: subheading; }*/ /** * Syntax highlighting styles */ .highlight { background: #fff; } .highlighter-rouge .highlight { background: #eef; } .highlight .c { color: #998; font-style: italic; } .highlight .err { color: #a61717; background-color: #e3d2d2; } .highlight .k { font-weight: bold; } .highlight .o { font-weight: bold; } .highlight .cm { color: #998; font-style: italic; } .highlight .cp { color: #999; font-weight: bold; } .highlight .c1 { color: #998; font-style: italic; } .highlight .cs { color: #999; font-weight: bold; font-style: italic; } .highlight .gd { color: #000; background-color: #fdd; } .highlight .gd .x { color: #000; background-color: #faa; } .highlight .ge { font-style: italic; } .highlight .gr { color: #a00; } .highlight .gh { color: #999; } .highlight .gi { color: #000; background-color: #dfd; } .highlight .gi .x { color: #000; background-color: #afa; } .highlight .go { color: #888; } .highlight .gp { color: #555; } .highlight .gs { font-weight: bold; } .highlight .gu { color: #aaa; } .highlight .gt { color: #a00; } .highlight .kc { font-weight: bold; } .highlight .kd { font-weight: bold; } .highlight .kp { font-weight: bold; } .highlight .kr { font-weight: bold; } .highlight .kt { color: #458; font-weight: bold; } .highlight .m { color: #099; } .highlight .s { color: #d14; } .highlight .na { color: #008080; } .highlight .nb { color: #0086B3; } .highlight .nc { color: #458; font-weight: bold; } .highlight .no { color: #008080; } .highlight .ni { color: #800080; } .highlight .ne { color: #900; font-weight: bold; } .highlight .nf { color: #900; font-weight: bold; } .highlight .nn { color: #555; } .highlight .nt { color: #000080; } .highlight .nv { color: #008080; } .highlight .ow { font-weight: bold; } .highlight .w { color: #bbb; } .highlight .mf { color: #099; } .highlight .mh { color: #099; } .highlight .mi { color: #099; } .highlight .mo { color: #099; } .highlight .sb { color: #d14; } .highlight .sc { color: #d14; } .highlight .sd { color: #d14; } .highlight .s2 { color: #d14; } .highlight .se { color: #d14; } .highlight .sh { color: #d14; } .highlight .si { color: #d14; } .highlight .sx { color: #d14; } .highlight .sr { color: #009926; } .highlight .s1 { color: #d14; } .highlight .ss { color: #990073; } .highlight .bp { color: #999; } .highlight .vc { color: #008080; } .highlight .vg { color: #008080; } .highlight .vi { color: #008080; } .highlight .il { color: #099; }

git.lirion.de

Of git, get, and gud

aboutsummaryrefslogtreecommitdiffstats
path: root/site
Commit message (Collapse)AuthorAgeFilesLines
* Allow code_manager profile to not error out on first runNick Walker 2015-12-092-4/+43
| | | | | | | | | | | | | | Prior to this commit, the code manger profile could not complete on the first run because the file function would error out I implemented a new version of the file function that returns nothing when the file does not exist instead of erroring out which allows me to gate creating the webhook on whether there is content in the file. As a result this means that it takes 2 runs to get everything setup but this is preferable over having to manually intervene in some other way if the token file doesn't exist.
* Refactor puppetmaster and zack_r10k_webhookNick Walker 2015-12-093-30/+12
| | | | | | | | | | Moved the webhook resource out of puppetmaster and into zack_r10k to support exchaning code_manager in place of zack_r10k As a result I cleaned up some unnecessary parameters. Installing both the r10k webhook and the code_manager at this time for testing
* Add support for code manager which will replace zack r10kNick Walker 2015-12-094-1/+86
| | | | | | | | | | | | | | | Add pltraing-rbac module Added a new profile for code_manager that: - creates a service users for code manager - creates a token for that service user - creates a hook on a git server using the token Turns out that the file function in puppet cannot read files in /root. The pe-puppet user needs read permissions on the file and traversal on the directory which giving to /root would probably be a bad idea. So, I just put the file containing the token in /etc/puppetlabs/puppetserver since I'm not sure where would be better.
* Add custom functions for determining some PE settingsNick Walker 2015-11-252-0/+17
| | | | | | Added a function to find the hostname and port of the classifier Added a fucntion to return all puppetdb hostnames
* Merge branch 'production' of https://github.com/npwalker/control-repo into ↵Nick Walker 2015-11-2410-0/+205
|\ | | | | | | merge_npwalker_control_repo
| * Change owner/group to pe-puppet for hiera moduleNick Walker 2015-11-171-2/+2
| | | | | | | | | | | | | | | | When the owner / group was root this meant that enabling hiera-eyaml wouldn't work properly as the keys couldn't be read by puppetserver. Changing to pe-puppet should resolve the issue.
| * fixing a bunch of puppet lint warningsNick Walker 2015-10-303-10/+10
| |
| * Refactor webhook profiles into one profile with a parameterNick Walker 2015-10-304-30/+24
| | | | | | | | | | | | | | | | Previously there was a mcollective and no_mcollective version of the webhook profile. They were almost identical so I merged them and manage the difference with a "use_mcollective" parameter. I renamed the webhook profile to zack_r10k_webhook.
| * Change the zack/r10k webhook to utilize username and passwordNick Walker 2015-10-303-6/+24
| | | | | | | | | | | | | | To accomodate generating random usernames and passwords, I had to parameterize the profiles which I didn't feel great about but I also didn't want to have to put the username and pass in hiera.
| * enable SSL on the zack/r10k webhookNick Walker 2015-10-292-2/+2
| |
| * Add $::fqdn to post receive hook titleNick Walker 2015-10-281-3/+3
| | | | | | | | Also, change other references of $fqdn to $::fqdn
| * disable SSL on the zack/r10k webhookNick Walker 2015-10-282-2/+1
| | | | | | | | | | The abrader/gms provider for gitlab doesn't support disabling ssl verification but will soon.
| * enable ssl on the webhookNick Walker 2015-10-282-15/+17
| |
| * make environment timeout setting refresh the puppet master serviceNick Walker 2015-10-261-0/+1
| |
| * Fix the update-classes script and set appropriate perms on itNick Walker 2015-10-262-1/+2
| |
| * Fix some embarassing typosNick Walker 2015-10-261-1/+1
| |
| * Configure the MoM to update the classifier after deploying codeNick Walker 2015-10-262-0/+27
| | | | | | | | | | | | | | | | | | | | This entailed configring the classifier to never sync on a schedule. Changing environment_timeout to unlimited for all masters. Setting a postrun command for r10k that would update the class information in the classifier (the update-classes endpoint).
| * fix whitespaceNick Walker 2015-10-211-2/+2
| |
| * Change the zack/r10k webhook to not authenticateNick Walker 2015-10-201-0/+2
| |
| * Change to using the webhook without mcollectiveNick Walker 2015-10-164-13/+29
| | | | | | | | | | | | In order to complete the change I refactered the webhook into its own set of profiles, one with mcollective and the other without.
| * Add some notifies to pe services after making changesNick Walker 2015-10-151-0/+2
| |
| * Ensure /etc/gitlab/ssl exists before putting certs in itNick Walker 2015-09-241-0/+4
| |
| * add modules for stash and a profileNick Walker 2015-08-251-0/+28
| |
| * Update the repo name for deploy keys and webhook to match READMENick Walker 2015-08-181-2/+2
| |
| * Move some hieradata around for easier testing in vagrantNick Walker 2015-08-181-0/+1
| | | | | | | | | | | | | | | | I now have a virtual hierarchy level for setting up my lower memory settings when using vagrant/virtualbox. The gms settings are in an example-puppet-master.yaml file in the nodes directory which are needed for the instructions.
| * Copy agent certs into Gitlab directory for Gitlab SSLNick Walker 2015-08-181-0/+13
| |
| * Change default gitlab url to be https instead of httpNick Walker 2015-08-171-1/+1
| |
| * Add webhook config to git management systemNick Walker 2015-08-171-2/+11
| |
| * Add a gitlab roleNick Walker 2015-08-141-0/+5
| |
| * Add a gitlab profile / add ssh-keygen to puppetmaster profileNick Walker 2015-08-142-0/+45
| |
| * Remove extraneous slash from puppetmaster profileNick Walker 2015-08-141-1/+1
| |
| * Fix some incorrect quoting in the hiera classNick Walker 2015-08-131-3/+3
| | | | | | | | | | | | | | I thought I needed to double quote items that had interpolated variables but it turns out I don't need to which is good because I effectively can't due to .to_yaml not doing what I wanted it to do.
| * Fix some quoting issues and add role:: to the include in site.ppNick Walker 2015-08-131-3/+3
| |
| * Update the README, add an all_in_one_pe roleNick Walker 2015-08-131-0/+5
| | | | | | | | | | | | | | | | | | | | | | Updating README for instructions on how to use the control-repo by putting it in your own git server and then using the r10k answers during installation of PE. Removing the manifest for configuring r10k using zack/r10k. Added a role that can be used to bootstrap an all-in-one PE installation.
| * Remove hiera.yaml and instead manage it with puppet codeNick Walker 2015-08-031-0/+14
| | | | | | | | | | Added hunner/hiera to the Puppetfile and a manifest to use it instead of placing a hiera.yaml in the repo.
| * Add a site directory with example role and profile moduleNick Walker 2015-05-273-0/+19
|
* add example files to role and profile directoriesNick Walker 2015-08-252-0/+6
    © 2014-2019 lirion.de – served by cgit – All Rights Reverse Engineered