In this presentation we will see how to create a CI pipeline for Puppet code that automates testing and deployment of Puppet code using Puppet Enterprise and GitLab CI. We will cover, with theoretical and live demonstration: - How to automate configuration of Puppet Code Manager and GitLab for Puppet code deployments - How to design a CI pipeline which involves different steps that cover: -- Syntax checks on Puppet manifests, yaml files, templates, Puppetfile... -- Lint checks on Puppet code -- Rspec-puppet based unit tests on modules and the whole control repo -- Catalog diff checks relevant to the nodes affected by the change -- Integration tests based on Vagrant Vms -- Gradual Rollout of Puppet code from canary nodes to all the production

1. PUPPET CONTINUOUS INTEGRATION
WITH PE AND GITLAB
A L E S S A N D R O F R A N C E S C H I
P U P P E T C O N F 2 0 1 7

2. @ A LVA G A N T E
• CTO @ example42 GmbH
• Puppeteer since 2006
• More Ops than Dev

3. A G E N D A
• PE Code Manager Setup
• Puppet CI: What?
• GitLab CI: Where?
• Demo

4. C O D E M A N A G E R
P E

5. P E C O D E M A N A G E R S E T U P
• Create SSH keys to deploy
control-repo via r10k:
• stored on PE server
• added on GitLab (deploy keys)
• Generate token to deploy code:
• Create PE user with Code
Deployer role
• Request token as this user
• On Gitlab: copy token to
control-repo webhook
• Configure on Hiera or PE console
puppet_enterprise::profile::master
r10k_remote: <repo_url>
r10k_private_key: <private_key_path>
code_manager_auto_configure: true

6. W H AT ?
C I

7. P U P P E T C I : W H AT ?
• syntax checks
• lint checks
• commit check (danger.systems)
• site modules spec tests
• control-repo spec tests
• control-repo integration tests
• catalog diff
• verify code-deployment status
• run Puppet on canary nodes
• check canary nodes status
• trigger noop runs in production
• generate documentation
• manage code promotion

8. W H E R E
C I

9. G I T L A B C I : W H E R E ?
• On control-repo:
• .gitlab-ci.yml
• stages
• jobs
• scripts
• tags
• On gitlab-runners:
• ssh keys to fetch modules
• tokens or credentials to access
PuppetDB, Puppet Server,
GitLab...
• gems and packages used in
jobs

10. D E M O

11. T H A N K Y O U
G R A P H I C S B Y TAT L I N . N E T