Puppet, cfengine, bcfg2

Objectif principal – automatiser les mises à jour système:

• Debian/Ubuntu: apt-get update && apt-get upgrade
• RedHat: up2date
• Fedora: yum

Installation Puppet (Debian Etch)

# 1. Edit /etc/apt/preferences and add the following lines:
Package: *
Pin: release a=testing
Pin-Priority: 1

Package: puppet
Pin: release a=testing
Pin-Priority: 1001

Package: puppetmaster
Pin: release a=testing
Pin-Priority: 1001

# 2. Edit /etc/apt/sources.list and add the following lines (change the mirror to your own localized mirror): 
deb http://ftp.fr.debian.org/debian/ testing main

# 3. Edit /etc/apt/apt.conf.d/release and add: 
APT::Default-Release "stable";

# 4. Do a "apt-get update" and "apt-get install puppet puppetmaster"

Dépendances Puppet:

Configuration globale: /etc/puppet:

Pour le serveur maitre:

cp /etc/puppet/puppet.conf /etc/puppet.conf.orig

cat puppet.conf.orig 
[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
pluginsync=true

[puppetmasterd]
templatedir=/var/lib/puppet/templates

...
[puppetd]
#le nom machine
server = maitre.univ-metz.fr

Pour la machine client

~# cat /etc/puppet/puppet.conf 
[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
pluginsync=true
server=maitre.univ-metz.fr
report=true

Dans ma config. serveur, je rajoute:

• le stockage dans une base mysql nommé puppet (ça peut etre aussi postgres ou sqlite3)
• l'envoi de mail avec l'option tagmail
• pour mysql il installer libmysql-ruby

#cat puppet.conf
### Config. sur la machine maitre

[main]
### Config. commune pour puppetmaster et puppetd(daemon client)
### On peut installer et faire tourné un client (puppetd) sur la machine maitre, aussi 
logdir=/var/log/puppet
....

[puppetmasterd]
# config. specifique au daemon puppetmaster
templatedir=/etc/puppet/templates
....

# stockage database
# de http://reductivelabs.com/trac/puppet/wiki/UsingStoredConfiguration
storeconfigs=true
dbadapter = mysql
dbuser = puppet
dbpassword = puppet #le mot de passe de la base crée avec mysql
dbserver = localhost
dbsocket = /var/run/mysqld/mysqld.sock
# fin ajout stockage database


[puppetd]
### config. specifique au daemon client (puppetd)
server = maitre.univ-metz.fr
....

Fileserver

# This file consists of arbitrarily named sections/modules
# defining where files are served from and to whom

# Define a section 'files'
# Adapt the allow/deny settings to your needs. Order
# for allow/deny does not matter, allow always takes precedence
# over deny
[files]
  path /etc/puppet/files
#  allow 192.168.0.0/24
  allow *.interne.upvm
  allow 127.0.0.0/8
  allow arwen.univ-metz.fr

##[plugins]
#  allow *.example.com
#  deny *.evil.example.com
#  allow 192.168.0.0/24
##  allow 195.220.226.35/27

[modules]
  allow *.interne.univ-metz.fr
  allow 127.0.0.0/8
  allow maitre.univ-metz.fr

[common]
 path /var/lib/puppet/modules/common
 allow *.interne.univ-metz.fr
 allow 127.0.0.0/8
 allow maitre.univ-metz.fr

[apt]
 path /var/lib/puppet/modules/apt
 allow *.interne.univ-metz.fr
 allow 127.0.0.0/8
 allow maitre.univ-metz.fr

Common et Apt

# common prerequisite
$ git clone git://git.black.co.at/module-common /etc/puppet/modules/common
# module: apt-get update
$ git clone git://git.black.co.at/module-apt /etc/puppet/modules/apt

Ajouter apt-get dselect upgrade

#cat 
# apt.pp - common components and defaults for handling apt
# Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
# See LICENSE for the full license granted to you.
#
# With hints from
#  Micah Anderson <micah@riseup.net>
#  * backports key

class apt {
    
        schedule { maint:
        range => "17 - 20",
        period => daily,
        repeat => 1
        }

        # See README
        $real_apt_clean = $apt_clean ? {
                '' => 'auto',
                default => $apt_clean,
        }

        package {
                [apt, dselect, lsb-release]: ensure => installed,
        }

        # a few templates need lsbdistcodename
        include assert_lsbdistcodename

        case $custom_sources_list {
                '': {
                        include default_sources_list
                }
                default: {
                        config_file { "/etc/apt/sources.list":
                                content => $custom_sources_list
                        }
                }
        }

	class default_sources_list {
		config_file {
			# include main, security and backports
			# additional sources could be included via an array
			"/etc/apt/sources.list":
				###content => template("apt/sources.list.erb"),
				content => template("apt/sources.list$lsbdistcodename.erb"),
				require => Exec[assert_lsbdistcodename];
		}
	}

	config_file {
		# this just pins unstable and testing to very low values
		"/etc/apt/preferences":
			content => template("apt/preferences$lsbdistcodename.erb"),
			# use File[apt_config] to reference a completed configuration
			# See "The Puppet Semaphor" 2007-06-25 on the puppet-users ML
			alias => apt_config,
			# only update together
			require => File["/etc/apt/sources.list"];
		# little default settings which keep the system sane
		"/etc/apt/apt.conf.d/from_puppet":
			content => "APT::Get::Show-Upgraded true;\nDSelect::Clean $real_apt_clean;\n",
			before => File[apt_config];
	}

	$apt_base_dir = "/etc/puppet/modules/apt"
	modules_dir { apt: }
	# watch apt.conf.d
	file { "/etc/apt/apt.conf.d": ensure => directory, checksum => mtime; }

	# suppress annoying help texts of dselect
	line { dselect_expert:
		file => "/etc/dpkg/dselect.cfg",
		line => "expert",
		ensure => present,
	}

	exec {
		# "&& sleep 1" is workaround for older(?) clients
		"/usr/bin/dselect update && sleep 1 #on refresh":
			refreshonly => true,
			subscribe => [ File["/etc/apt/sources.list"],
				File["/etc/apt/preferences"], File["/etc/apt/apt.conf.d"],
				File[apt_config] ];
		"/usr/bin/dselect update && /usr/bin/apt-get autoclean #hourly":
			require => [ File["/etc/apt/sources.list"],
				File["/etc/apt/preferences"], File[apt_config] ],
			# Another Semaphor for all packages to reference
			alias => apt_updated;
	}

	case $lsbdistcodename {
		etch: {
			## This package should really always be current
			package {
				[ "debian-archive-keyring", "debian-backports-keyring" ]:
					ensure => latest,
				}

			# This key was downloaded from
			# http://backports.org/debian/archive.key
			# and is needed to bootstrap the backports trustpath
			file { "${apt_base_dir}/backports.org.key":
				source => "puppet://$servername/apt/backports.org.key",
				mode => 0444, owner => root, group => root,
			}
			exec { "/usr/bin/apt-key add ${apt_base_dir}/backports.org.key && dselect update":
				alias => "backports_key",
				refreshonly => true,
				subscribe => File["${apt_base_dir}/backports.org.key"],
				before => [ File[apt_config], Package["debian-backports-keyring"] ]
			}
		}
		hardy: {
			## This package should really always be current
			## J'utilise aussi le depot medibuntu=> medibuntu-keyring
			package {
				###[ "ubuntu-keyring", "medibuntu-keyring" ]:
				[ "ubuntu-keyring" ]:
					ensure => latest,
				}
			## Si necessaire ajouter backport et la cle
		}
	}
	#Exec[apt_updated]: After this point, current packages can installed via apt,
        #	usually used like this:
        	###Package { require => Exec[apt_updated] }
		exec { "/usr/bin/apt-get -s  dselect-upgrade > /root/dselect-upgrade.simulate":
				require => Exec[apt_updated], 
				alias => apt_to_upgrade;
		}

		exec { "/usr/bin/apt-get dselect-upgrade":
				require => Exec[apt_to_upgrade], 
				alias => apt_upgraded,
		}

		exec { "/bin/date > /root/motd;
/bin/echo PUPPETD - ATTENTION INTERVENTION ROOT NECESSAIRE pour APT-GET UPGRADE >> /root/motd": 
			    tag => dselect_upgraded,
			    logoutput => true,
		            unless => "/usr/bin/test 'Exec[apt_upgraded]' != 'executed successfully'";
                }
        
        # Pour forcer la mise a jour, apres test,
faites d'abord un touch sur le serveur du fichier "really_upgrade"
        file {"${apt_base_dir}/really_upgrade":
            source => "puppet://$servername/apt/really_upgrade",
        }
        exec { "/usr/bin/apt-get -y dselect-upgrade":
            refreshonly => true,
            subscribe => File["${apt_base_dir}/really_upgrade"],
        }

}

Démarrage

client# puppetd --waitforcert 30 --server puppetserver.domain.net -v

serveur# puppetca --list

serveur# puppetca --sign client.univ-metz.fr

Démarrage en production

...A compléter ...