Puppet Enterprise

CMP installs the Puppet agent on each new server, has its certificate signed, and adds the server to the node groups it was ordered with. The Puppet Enterprise tile appears in the Add dialog only where a Puppet Enterprise configuration manager already exists, so this page covers deployments that already run Puppet Enterprise.

What the integration does

• Installs the Puppet agent on a new server and signs its certificate.
• Sets the server’s node groups during provisioning.
• Imports node groups from Puppet Enterprise so they can be offered as applications.
• Synchronizes servers and retrieves node facts.
• Removes a node from Puppet Enterprise and cleans its certificate when a server is decommissioned.

The Version setting in the configuration manager determines which built-in actions CMP uses and also changes what the manager offers. With 3.X, CMP shows the certificate name, adds a Reports tab, and allows applications to be installed and uninstalled on servers through Puppet Enterprise. With 2015+, none of those are offered, and you configure the API and SSH endpoints described below.

Anything not built in can be added as an action. See Customize the built-in actions.

Prerequisites

• Puppet agents run at least every 30 minutes, so that CMP sees current node data.
• Your templates and images do not carry the Puppet agent. CMP installs it on the provisioned servers.
• CMP can reach the master on port 8140, plus the API ports when using the 2015+ version: 4433 for the master and console APIs, and 8081 for PuppetDB.
• A Puppet Enterprise user for CMP to authenticate as, rather than the console admin account.

Create a user for CMP in the Puppet Enterprise console

1. Go to Access Control > Users and add a local user for CMP.
2. Go to Access Control > User Roles and add a role.
3. Open the new role, select the Member Users tab, and add the created user.
4. Select the Permissions tab and grant the role what CMP needs: view and edit node groups, sign and revoke certificates, and read node data. Puppet’s own documentation covers what each permission type allows.

Create the configuration manager in CMP

1. Go to Admin > Configuration Managers, then select Add.
2. Select the Puppet Enterprise tile.
3. Complete the form:
   • Hostname: the Puppet Enterprise master. CMP checks that it can reach it before saving.
   • Version: 3.X or 2015+, as described above.
   • Environment: the Puppet environment for created nodes, defaults to production.
4. Select Create. CMP submits a certificate signing request to the master.
5. On the master, sign the request on the Certificate requests page.
6. Back on the configuration manager’s Overview tab, select Fetch signed certificate.

CMP’s certificate is appended to the client_whitelist of three classification groups, which is what grants it access to Puppet’s APIs: PE Certificate Authority, PE Console, and PE PuppetDB.

Endpoints, for the 2015+ version

A 2015+ configuration manager lists its connection endpoints on the Overview tab, each with a pencil icon to edit it. Both the PE Master SSH Connection and the PE Master API Connection are required, and the manager will not work until they are configured.

PE Console API Connection and PE DB API Connection are only needed for a split installation, where the console or database runs on a different host from the master. Left empty, each falls back to the master API connection.

Import node groups

On the Groups tab, select Import Groups to bring in node groups from Puppet Enterprise and pair them with CMP applications. Until that is done, Puppet groups cannot be assigned to servers. The Nodes tab lists what CMP knows about each node and includes a Sync servers button that refreshes Puppet information for the servers in this manager’s environments.

Customize the built-in actions

Most of what this configuration manager does is handled by actions you can read and modify, enabling you to add custom behavior. Each action is named puppet_ent_<version>_<feature>, so the agent bootstrap action for version 3.X is puppet_ent_3.X_auto_install_agent. The name uses the stored version value rather than the label, so the 2015+ actions are named puppet_ent_2015.3_ and then the feature. CMP picks the action whose version matches the one set on the configuration manager for the following features:

• auto_install_agent: installs the agent during provisioning.
• discover_groups: lists the node groups available to import.
• get_node_facts: reads a server’s facts during synchronization.
• delete_server_from_connector: removes the node at decommission time.
• clean_cert: removes the node’s certificate from the master.

To support another Puppet Enterprise version, copy the actions from the closest version, rename them for the new version, and add that version to the choices in the configuration manager. A feature with no matching action for the selected version fails when CMP tries to use it.