Puppet Open Source

CMP becomes the master’s external node classifier: the master asks CMP which classes belong to a node and forwards each agent’s run report to CMP, which then shows a server’s facts and its latest report. The Puppet Open Source tile appears in the Add dialog only where a Puppet Open Source configuration manager already exists, so this page covers deployments that already run Puppet.

What the integration does

• Installs and removes Puppet classes on servers as CMP applications.
• Signs the agent certificate and removes the node when a server is decommissioned.
• Imports classes, synchronizes servers, and records Puppet run reports.

CMP does not install the Puppet agent for open-source Puppet, so the agent must be in your images or installed by a remote script. With the 4.4+ version setting, node facts are not retrieved.

Prerequisites

• The master autosigns certificate signing requests, which is how CMP’s certificate gets signed.
• The master can use CMP as its external node classifier. Puppet supports only one external node classifier, so a master classified by CMP cannot also be classified by another tool, such as Foreman or the Puppet console.
• Agents run at least every 30 minutes, so that CMP sees current node data.
• The Puppet agent is installed and configured in the images your servers are built from.

Create the configuration manager in CMP

1. Go to Admin > Configuration Managers, then select Add.
2. Select the Puppet Open Source tile.
3. Complete the form:
   • Hostname: the Puppet master. CMP checks that it can reach it before saving.
   • Version: Before 4.4 or 4.4+. This selects the API paths CMP uses on the master.
   • Puppet environment: the environment CMP queries for classes, defaults to production.
4. Select Create. CMP submits a certificate signing request to the master. With autosigning enabled, it is signed straight away.
5. On the Overview tab, select Fetch signed certificate to complete the exchange.
6. On the Classes tab, select Import Classes to import Puppet classes and pair them with CMP applications. Until that is done, Puppet classes cannot be assigned to servers.

The configuration manager’s numeric ID appears in the URL of its detail page, as the 1 in /providers/1. You need it when configuring the master.

Configure the Puppet master

The master needs to be told to ask CMP which classes a node should have and to send run reports back.

Edit puppet.conf

Add or change these settings. The file is usually under /etc/puppet/ or /etc/puppetlabs/puppet/.

[master]
    autosign = true
    reports = http
    reporturl = http://{CLOUDBOLT-DOMAIN}/providers/puppet/{PUPPET_CONF_ID}/reports/
    node_terminus = exec
    external_nodes = /root/enc-script.sh

[agent]
    report = true

Replace {CLOUDBOLT-DOMAIN} with the domain your CMP web interface is served on, and {PUPPET_CONF_ID} with the configuration manager’s numeric ID.

The reports and reporturl settings are what make the master forward agent reports to CMP. To send them over HTTPS, install a CA on the master that validates CMP’s SSL certificate, then change the URL’s scheme. If the master already forwards reports to another service over HTTP, see Send reports to more than one destination.

The node_terminus and external_nodes settings are what make the master ask CMP for a node’s classes, which is what allows applications to be installed and removed from CMP.

Install the classifier script

external_nodes points at a script on the master that queries CMP. Create it with this content:

#!/bin/sh

SITE_URL="https://{your-CloudBolt-domain}/"
PUPPET_CONF_ID=1
NODE_NAME=$1

curl -fk ${SITE_URL}providers/puppet/${PUPPET_CONF_ID}/enc/${NODE_NAME}/

Set SITE_URL to the root URL of your CMP web interface, including the trailing slash, and PUPPET_CONF_ID to the configuration manager’s numeric ID. Then make the file executable:

chmod +x /root/enc-script.sh

The Puppet server process must be able to read and execute the script and access every directory above it.

Edit auth.conf

The master’s authorization rules must allow CMP through. First, find out whether your master uses HOCON authorization (which Puppet Server does) or the legacy format, and use the corresponding example below. Add the rules above any clause that denies everything. Ask your Puppet administrator if you are unsure.

HOCON

# Allow CloudBolt to manage certificates
{
    match-request: {
        path: "/puppet-ca/v1/certificate_status"
        type: path
    }
    allow: "/cloudbolt.*$/"
    sort-order: 100
    name: "cloudbolt cert status"
},
{
    match-request: {
        path: "/puppet-ca/v1/certificate_statuses/"
        type: path
        method: [get, post]
    }
    allow: "/cloudbolt.*$/"
    sort-order: 100
    name: "cloudbolt cert statuses"
},
# Allow CloudBolt to enumerate class names
{
    match-request: {
        path: "/puppet/v3/environment_classes"
        type: path
        method: get
    }
    allow: "/cloudbolt.*$/"
    sort-order: 100
    name: "cloudbolt classes"
},

Legacy

# let CloudBolt manage certificates
path /certificate_
auth any
method find, search, save, destroy
allow_ip {your-CloudBolt-IP-address}

# let CloudBolt discover node facts
path /facts
auth any
method find, search
allow_ip {your-CloudBolt-IP-address}

# let CloudBolt enumerate class names
path /resource_type
auth any
method find, search
allow_ip {your-CloudBolt-IP-address}

Puppet matches these rules from most to least specific, so when you add them to a customized auth.conf, interleave them with your existing rules.

Restart the master

Restart the Puppet server for the changes to take effect, with systemctl restart puppetserver or your platform’s equivalent.

Send reports to more than one destination

Puppet’s built-in http report processor supports a single destination, so pointing it at CMP means nothing else receives reports over HTTP. To keep another destination, use a third-party report processor that accepts several, such as the multi_http module on Puppet Forge.