Slide 1
Slide 1 text
Puppet Modules
Apps for Ops!
!
Justin Bronn, Esq.
@jbronn
Slide 2
Slide 2 text
Slides / Notes
https://github.com/jbronn
Slide 3
Slide 3 text
Configuration
Management?
Slide 4
Slide 4 text
Complexity
Slide 5
Slide 5 text
!
![]()
/cgi-bin/perl.cgi
Slide 6
Slide 6 text
No content
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
mod_wsgi
Slide 9
Slide 9 text
Don’t Repeat Yourself
• Even a “simple” web application has a large
number of components
• You don’t want to configure them manually
Slide 10
Slide 10 text
Why Puppet?
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
crypt.py
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
Why Puppet?
• Mature (in Licensing & Security)
• “Explicit is better than Implicit”
• Wide OS support:
• Linux (of course), Windows, Mac
• OpenBSD, Solaris, AIX,HP-UX
Slide 15
Slide 15 text
Installing Puppet
Slide 16
Slide 16 text
Ubuntu 12.04
$ sudo gem install \!
--bindir /usr/local/bin!
puppet
$ sudo apt-get -y install \!
libruby libshadow-ruby1.8 rubygems
Packages also available:
apt.puppetlabs.com
Slide 17
Slide 17 text
OS X
$ sudo gem install \!
--bindir /usr/local/bin!
puppet
Package also available:
https://downloads.puppetlabs.com/mac/
Slide 18
Slide 18 text
Windows
C:\> msiexec /qn /i puppet-3.4.3.msi ^!
PUPPET_AGENT_STARTUP_MODE=Disabled!
MSI from:
https://downloads.puppetlabs.com/windows/
Slide 19
Slide 19 text
Puppet Language
Slide 20
Slide 20 text
Overview
• Puppet, the language, is a Ruby DSL
• Puppet code lives in files called “manifests”;
files end with “.pp” suffix
Slide 21
Slide 21 text
Overview
• Catalog: compiled Puppet code, describes
relationships between “resources”
• Catalog is a an directed acyclic graph
• Puppet applies catalog, bringing system into
state declared in manifests
Slide 22
Slide 22 text
Resources
Slide 23
Slide 23 text
package {'openssh-server':!
ensure => installed,!
}
Slide 24
Slide 24 text
package {'openssh-server':!
ensure => installed,!
}
Slide 25
Slide 25 text
package {'openssh-server':!
ensure => installed,!
}
Slide 26
Slide 26 text
package {'openssh-server':!
ensure => installed,!
}
Slide 27
Slide 27 text
package {'openssh-server':!
ensure => absent,!
}
Slide 28
Slide 28 text
package {'Django':!
ensure => '1.6.2',!
provider => 'pip',!
}
Slide 29
Slide 29 text
Basics
Slide 30
Slide 30 text
Declarative
Slide 31
Slide 31 text
$ssh_dir = '/etc/ssh'!
file { $ssh_dir:!
ensure => directory,!
owner => 'root',!
group => 'root',!
mode => '0755',!
}!
$ssh_dir = '/foo/ssh'!
Slide 32
Slide 32 text
$ssh_dir = '/etc/ssh'!
file { $ssh_dir:!
ensure => directory,!
owner => 'root',!
group => 'root',!
mode => '0644',!
}!
Slide 33
Slide 33 text
$array = ['foo', 'bar']!
!
$hash = {'key' => 'value'}!
$value = $hash['key']!
!
$py_versions = split('2.7,3.4', ',')!
Data Structures / Function Call
Slide 34
Slide 34 text
$noun = 'Lumberjack'!
$sentence = "I'm a ${noun}"!
String Interpolation
Slide 35
Slide 35 text
if $python_version == '3.4' {!
notice('You have asyncio!')!
} !
!
case $python_version {!
/^(2.6|2.7)$/: {!
}!
'3.4': {!
}!
default: {!
fail('Unsupported version!')!
}!
}!
Flow Control
Slide 36
Slide 36 text
Facts
Slide 37
Slide 37 text
$ facter | less!
!
$ facter fqdn ipaddress osfamily!
fqdn => puppet.local!
ipaddress => 10.0.2.15!
osfamily => Debian!
Slide 38
Slide 38 text
if $::osfamily == 'RedHat' {!
$py_dev_pkg = 'python-devel'!
} elsif $::osfamily == 'Debian'{!
$py_dev_pkg = 'python-dev'!
}!
!
!
$:: gives you facts in Puppet
Slide 39
Slide 39 text
if $::osfamily == 'RedHat' {!
$py_dev_pkg = 'python-devel'!
} elsif $::osfamily == 'Debian'{!
$py_dev_pkg = 'python-dev'!
}!
!
!
$:: gives you facts in Puppet
Slide 40
Slide 40 text
Resource Ordering
Slide 41
Slide 41 text
Resource References
Package['openssh-server']
Resource type is capitalized
Resource name is in brackets
Slide 42
Slide 42 text
$sshd_config = "${ssh_dir}/sshd_config"!
!
file {$sshd_config:!
ensure => file,!
owner => 'root',!
group => 'root',!
mode => '0644',!
content => template('sshd_config.erb'),!
require => Package['openssh-server'],!
}
Require Metaparameter
Slide 43
Slide 43 text
$sshd_config = "${ssh_dir}/sshd_config"!
!
file {$sshd_config:!
ensure => file,!
owner => 'root',!
group => 'root',!
mode => '0644',!
content => template('sshd_config.erb'),!
require => Package['openssh-server'],!
}
Require Metaparameter
Slide 44
Slide 44 text
Package[openssh-server]
File[/etc/ssh/sshd_config]
Slide 45
Slide 45 text
service {'ssh':!
ensure => running,!
enable => true,!
subscribe => File[$sshd_config],!
}
Subscribe Metaparameter
Slide 46
Slide 46 text
service {'ssh':!
ensure => running,!
enable => true,!
subscribe => File[$sshd_config],!
}
Subscribe Metaparameter
Slide 47
Slide 47 text
file { $sshd_config:!
...!
notify => Service['ssh'],!
...!
}
service {'ssh':!
ensure => running,!
enable => true,!
}
Notify Metaparameter
Slide 48
Slide 48 text
file { $sshd_config:!
...!
notify => Service['ssh'],!
...!
}
service {'ssh':!
ensure => running,!
enable => true,!
}
Notify Metaparameter
Slide 49
Slide 49 text
Package['openssh-server'] ->!
File[$sshd_config] ~>!
Service['ssh']
Chaining Arrows
Slide 50
Slide 50 text
Package['openssh-server'] ->!
File[$sshd_config] ~>!
Service['ssh']
Chaining Arrows
Slide 51
Slide 51 text
Package['openssh-server'] ->!
File[$sshd_config] ~>!
Service['ssh']
Chaining Arrows
Slide 52
Slide 52 text
Puppet Modules
Slide 53
Slide 53 text
Modules
• Containers for Puppet code
• Analogous to Python Packages
• May be installed from a Puppet “Forge”
Slide 54
Slide 54 text
Installing Modules
Slide 55
Slide 55 text
puppet module install -
Slide 56
Slide 56 text
$ puppet module install counsyl-python
Notice: Preparing to install into /Users/justin/.puppet/modules ...!
Notice: Downloading from https://forge.puppetlabs.com ...!
Notice: Installing -- do not interrupt ...!
/Users/justin/.puppet/modules!
!"# counsyl-python (v0.9.3)!
!"# counsyl-sys (v0.9.13)!
!"" puppetlabs-stdlib (v4.1.0)!
!
Slide 57
Slide 57 text
https://forge.puppetlabs.com
https://github.com/jbronn/django-forge
Slide 58
Slide 58 text
Module Structure
Slide 59
Slide 59 text
counsyl-pyapp/
Modulefile
manifests/init.pp
templates/
files/
lib/
$ puppet module generate \!
counsyl-pyapp
Slide 60
Slide 60 text
counsyl-pyapp/
Modulefile
manifests/init.pp
templates/
files/
lib/
Slide 61
Slide 61 text
counsyl-pyapp/
Modulefile
manifests/init.pp
templates/
files/
lib/
Slide 62
Slide 62 text
manifests/init.pp
class pyapp {!
...!
}
“class” name must match name of module
Slide 63
Slide 63 text
manifests/install.pp
class pyapp::install {!
...!
}
Can have other namespaces, but file name
must match name of file.
Slide 64
Slide 64 text
counsyl-pyapp/
Modulefile
manifests/init.pp
templates/
files/
lib/
Slide 65
Slide 65 text
file { ‘/path/to/settings.py':!
ensure => file,!
owner => 'root',!
group => 'root',!
mode => '0644',!
content => template('pyapp/settings.py.erb'),!
}
Puppet Templates
Slide 66
Slide 66 text
file { ‘/path/to/settings.py':!
ensure => file,!
owner => 'root',!
group => 'root',!
mode => '0644',!
content => template('pyapp/settings.py.erb'),!
}
Puppet Templates
pyapp/templates/settings.py.erb
Slide 67
Slide 67 text
counsyl-pyapp/
Modulefile
manifests/init.pp
templates/
files/
lib/
Slide 68
Slide 68 text
file { '/path/to/foo.js':!
ensure => file,!
owner => 'root',!
group => 'root',!
mode => '0644',!
source => 'puppet:///modules/pyapp/foo.js'!
}
Puppet Files
Slide 69
Slide 69 text
file { '/path/to/foo.js':!
ensure => file,!
owner => 'root',!
group => 'root',!
mode => '0644',!
source => 'puppet:///modules/pyapp/foo.js'!
}
Puppet Files
pyapp/files/foo.js
Slide 70
Slide 70 text
counsyl-pyapp/
Modulefile
manifests/init.pp
templates/
files/
lib/
Slide 71
Slide 71 text
Writing Modules
for Python
Slide 72
Slide 72 text
Roadmap
• “Simple” Django application
• Needs Celery (and Redis)
• Nginx reverse-proxy to Gunicorn
Slide 73
Slide 73 text
class pyapp {!
include python!
}
Python / Pip
Slide 74
Slide 74 text
class pyapp {!
include python!
include python::virtualenv!
}
Virtualenv
counsyl-python
Slide 75
Slide 75 text
class pyapp {!
include python!
include python::virtualenv!
include redis!
}
Redis
counsyl-redis
Slide 76
Slide 76 text
class pyapp {!
include python!
include python::virtualenv!
include redis!
include nginx!
}
Nginx
counsyl-nginx
Slide 77
Slide 77 text
Mix & Match
Slide 78
Slide 78 text
Python Types
Slide 79
Slide 79 text
package {'pyapp':!
ensure => '0.1.0',!
source => 'git+https://github.com …’,
provider => 'pip',!
}
pip provider
Slide 80
Slide 80 text
package {'pyapp':!
ensure => '0.1.0',!
source => 'git+https://github.com …’,
provider => 'pip',!
}
pip provider
Slide 81
Slide 81 text
package {'Django':!
ensure => '1.6.2',!
provider => 'pipx',!
install_options => [!
{'--index-url' => !
'https://pypi.mycorp.com'}!
]!
}
pipx provider
Slide 82
Slide 82 text
package {'Django':!
ensure => '1.6.2',!
provider => 'pipx',!
install_options => [!
{'--index-url' => !
'https://pypi.mycorp.com'}!
]!
}
pipx provider
Slide 83
Slide 83 text
package {'Django':!
ensure => '1.6.2',!
provider => 'pipx',!
install_options => [!
{'--index-url' => !
'https://pypi.mycorp.com'}!
]!
}
pipx provider
Slide 84
Slide 84 text
venv {'/srv/pyapp': } !
!
!
!
venv type
Slide 85
Slide 85 text
venv {'/srv/pyapp': !
owner => $user,!
group => $group,!
system_site_packages => true,!
}!
venv type
Slide 86
Slide 86 text
venv_package {'celery@/srv/pyapp': !
ensure => installed,!
}!
venv_package type
Slide 87
Slide 87 text
$venv = '/srv/pyapp'!
venv_package {"celery@${venv}": !
ensure => installed,!
}!
venv_package type
Slide 88
Slide 88 text
$venv = '/srv/pyapp'!
venv_package {"redis@${venv}": !
ensure => '2.9.1',!
require => Class['redis'],!
}!
venv_package type
Slide 89
Slide 89 text
Class Parameters
Slide 90
Slide 90 text
class pyapp(!
$venv = '/srv/pyapp',!
$package = 'pyapp',!
$source = 'git+https://...',!
$version = '0.1.0',!
){!
...!
venv { $venv: }!
venv_package { "${package}@${venv}":!
ensure => $version,!
source => $source,!
}!
...!
}
Slide 91
Slide 91 text
class pyapp(!
$venv = '/srv/pyapp'!
$package = 'pyapp',!
$source = 'git+https://...' !
$version = '0.1.0',!
){!
...!
venv { $venv: }!
venv_package { "${package}@${venv}":!
ensure => $version,!
source => $source,!
}!
...!
}
Slide 92
Slide 92 text
class {'pyapp':!
version => '0.8',!
}
Using Class Parameters
Slide 93
Slide 93 text
class {'pyapp':!
version => '0.8',!
}
Using Class Parameters
Slide 94
Slide 94 text
class {'pyapp':!
version => '0.8',!
}
Using Class Parameters
Slide 95
Slide 95 text
ERB
Slide 96
Slide 96 text
ERB: Ruby Templates
• This time, it’s Ruby
• Great for when you need dynamic content
in a configuration file (e.g., ServerName)
Slide 97
Slide 97 text
DATABASES = {!
'NAME': '<%= @db %>',!
}!
!
NGINX_CONFIG = '<%= scope['nginx::config_file'] %>'!
SERVER_NAME = '<%= scope['::fqdn'] %>'!
!
<% !
db_folder = File.dirname(@db_name)!
-%>!
DB_FOLDER = '<%= db_folder %>'!
ERB
Slide 98
Slide 98 text
DATABASES = {!
'NAME': '<%= @db %>',!
}!
!
NGINX_CONFIG = '<%= scope['nginx::config_file'] %>'!
SERVER_NAME = '<%= scope['::fqdn'] %>'!
!
<% !
db_folder = File.dirname(@db_name)!
-%>!
DB_FOLDER = '<%= db_folder %>'!
ERB
Slide 99
Slide 99 text
DATABASES = {!
'NAME': '<%= @db %>',!
}!
!
NGINX_CONFIG = '<%= scope['nginx::config_file'] %>'!
SERVER_NAME = '<%= scope['::fqdn'] %>'!
!
<% !
db_folder = File.dirname(@db_name)!
-%>!
DB_FOLDER = '<%= db_folder %>'!
ERB
Slide 100
Slide 100 text
DATABASES = {!
'NAME': '<%= @db %>',!
}!
!
NGINX_CONFIG = '<%= scope['nginx::config_file'] %>'!
SERVER_NAME = '<%= scope['::fqdn'] %>'!
!
<% !
db_folder = File.dirname(@db_name)!
-%>!
DB_FOLDER = '<%= db_folder %>'!
ERB
Slide 101
Slide 101 text
Running Puppet
Slide 102
Slide 102 text
Stand-Alone
Slide 103
Slide 103 text
puppet apply manifest.pp
Slide 104
Slide 104 text
puppet apply site.pp \!
--modulepath /modules
Customize Module Path
Slide 105
Slide 105 text
puppet apply -e \!
"include pyapp"
“Evaluate”
Slide 106
Slide 106 text
puppet agent
Slide 107
Slide 107 text
The Puppetmaster
• Centralized server for housing modules
and configurations for nodes (servers)
• Secured with HTTPS Client Certificates
• Nodes must have certificate signed to
receive configuration
Slide 108
Slide 108 text
Node Master
Slide 109
Slide 109 text
Node Master
node$ sudo puppet agent —test!
Info: Creating a new SSL key for node.local!
Exiting; no certificate found
Slide 110
Slide 110 text
Node Master
master$ sudo puppet cert sign node.local!
Info: Signed certificate request for node.local
Slide 111
Slide 111 text
Node Master
node$ sudo puppet agent —test!
info: Caching certificate for node.local!
info: Retrieving plugin!
info: Caching catalog for node.local!
info: Applying configuration version '1326210629'!
notice: Finished catalog run in 0.11 seconds
/etc/puppet/modules
/etc/puppet/manifests
Slide 112
Slide 112 text
No content
Slide 113
Slide 113 text
Module Development
Slide 114
Slide 114 text
Use Vagrant!
Slide 115
Slide 115 text
Vagrant
• A must-have for DevOps development in
general, not just Puppet
• Also supports Ansible, Salt, Chef
• You may think you can do better…
Slide 116
Slide 116 text
Vagrantfile
• Tells Vagrant what to do
• An API for provisioning a VM (actually Ruby
+ magic)
• Forward ports, change memory, multiple
provisioners, multiple VMs, multiple NICs…
Slide 117
Slide 117 text
Vagrantfile
Vagrant.configure('2') do |config|!
config.vm.box = "precise64"!
config.vm.box_url = "http://..."!
...!
end
Slide 118
Slide 118 text
Puppet Provisioner
Vagrant.configure('2') do |config|!
...!
config.vm.provision "puppet" do |puppet|!
puppet.facter = { "vagrant" => "1" }!
puppet.module_path = "modules"!
end!
...!
end
Slide 119
Slide 119 text
Puppet Provisioner
Vagrant.configure('2') do |config|!
...!
config.vm.provision "puppet" do |puppet|!
puppet.facter = { "vagrant" => "1" }!
puppet.module_path = "modules"!
end!
...!
end
Looks for manifests/default.pp
Slide 120
Slide 120 text
Another Ruby DSL?
• Yeah…
• Tremendous workflow benefits
• Much easier to share your snowflake
environments
Slide 121
Slide 121 text
vagrant up
• All end user has to do is type this
command
• No waiting for a server/sysadmin
• Can get to work
Slide 122
Slide 122 text
Base Boxes?
Slide 123
Slide 123 text
Use Packer!
Slide 124
Slide 124 text
Packer
• Virtual Machine image creation tool
• Written in Go, uses JSON templates
• See my sample for creating a base box:
• https://github.com/jbronn/packer-vagrant
Slide 125
Slide 125 text
No content
Slide 126
Slide 126 text
Questions?