This document provides an overview of Puppet, a system configuration management tool. Puppet uses a declarative language to define system resources and their desired state. It has a client-server architecture where the client collects facts, receives a configuration from the server, checks the current state, and runs required transactions to achieve the desired state. The Puppet server compiles configurations, acts as a file server and certificate authority, and handles reports. Puppet provides resource abstractions, templates, and modules to define reusable configurations. It aims to provide a more declarative, semantic, reproducible, and shareable approach to system administration compared to previous imperative methods.

1. Managing systems with
Puppet
NBLUG
Sept 9, 2008
Eric Eisenhart
http://eric.eisenhart.name/

2. System Administration

3. System Administration

4. System Administration
“We will encourage
you to develop the
three great virtues of a
programmer: laziness,
impatience, and hubris.”
--Larry Wall,
Programming Perl

5. One
Computer
Image From: http://ftp.arl.mil/ftp/historic-computers/

6. Two
Computers
Image From http://flickr.com/photos/arthur_pewty/2703897757/

7. Hand-
Crafted

8. Individually
Maintained

9. Many
Computers

10. Many
Computers

11. Many
Computers

12. Many
Computers

13. Many
Computers

14. Gold Master

15. Clone

16. Clone

17. Clone

18. Alter

19. Alter

20. Alter

21. Alter
? ?

22. Multiple
Masters?

23. Change by Hand?

24. What do you
do next time?

25. Reproducible Process

26. Same But Different

27. What is
Puppet?

28. Lazy Puppeteers
People are finally figuring out puppet and
how it gets you to the pub by 4pm. Note
that I've been at this pub since 2pm.
-- Jorge Castro

29. An Analogy

30. An Analogy

31. An Analogy
Programming SysAdmin
Low Level, commands and
Assembly
Non-Portable, files
Some Abstraction,
Portability Possible
C Cfengine
Abstract, Perl, Python,
Puppet
Portable Ruby

32. An Analogy
Programming SysAdmin
Low Level, commands and
Assembly
Non-Portable, files
Some Abstraction,
Portability Possible
C Cfengine
Abstract, Perl, Python,
Puppet
Portable Ruby

33. An Analogy
Programming SysAdmin
Low Level, commands and
Assembly
Non-Portable, files
Some Abstraction,
Portability Possible
C Cfengine
Abstract, Perl, Python,
Puppet
Portable Ruby

34. An Analogy
Programming SysAdmin
Low Level, commands and
Assembly
Non-Portable, files
Some Abstraction,
Portability Possible
C Cfengine
Abstract, Perl, Python,
Puppet
Portable Ruby

35. “the most damaging phrase in the language is:
`We've always done it this way.’”
-- Grace Hopper
(developer of the first compiler)

36. Puppet

37. Puppet
Language

38. Puppet
Language
Client & Server

39. Puppet
Language
Client & Server
Resource Abstraction

40. Puppet
Language
Client & Server
Resource Abstraction
New Way To Think

41. Puppet Language

42. Puppet Language
Declarative

43. Puppet Language
Declarative
Semantic

44. Puppet Language
Declarative
Semantic
Reproducible

45. Puppet Language
Declarative
Semantic
Reproducible
Shareable

46. Puppet Language
Declarative
Semantic
Reproducible
Shareable
Maintainable

47. Puppet Language
Declarative
Semantic
Reproducible
Shareable
Maintainable
Extensible

48. Old Way: Kickstart tricks
%post
if grep -q "release 5" /etc/redhat-release
then
INSTALL="yum -y install"
else
INSTALL="up2date-nox"
fi
$INSTALL exim
curl https://master/exim/exim.conf >
/etc/exim/exim.conf
chkconfig exim on

49. Old Way: Package tricks
Requires: exim
%post
curl https://master/exim/exim.conf >
/etc/exim/exim.conf
chkconfig exim on
service exim restart
%triggerin -- exim
curl https://master/exim/exim.conf >
/etc/exim/exim.conf
service exim restart

50. Old Way: ssh in a for loop
for h in eximbox1 eximbox2 eximbox3; do
ssh $h ‘
grep “release 4” /etc/redhat-release &&
up2date exim
grep “release 5” /etc/redhat-release &&
yum install exim’
scp exim/exim.conf $h:/etc/exim/exim.conf
ssh $h /etc/init.d/exim start
done

51. for h in eximbox1 eximbox2 eximbox3; do
ssh $h ‘
grep “release 4” /etc/redhat-release &&
up2date exim
grep “release 5” /etc/redhat-release &&
yum install exim’
scp exim/exim.conf $h:/etc/exim/exim.conf
ssh $h /etc/init.d/exim start
done
node eximbox1, eximbox2, eximbox3 {
package { exim:
ensure => installed
}
file { “/etc/exim/exim.conf”:
source => “puppet:///exim/exim.conf”
}
service { exim: ensure => running }
}

52. Old Way: ssh in a for loop
Server
Client Client
Client Client Client Client

53. Old Way: ssh in a for loop
Client
Server
Client Client
Client Client Client

54. Old Way: ssh in a for loop
Client
Server
Client Client
Client Client

55. Client & Server
Server
Client

56. Client & Server
Code
Server
Client

57. Client & Server
Code
Server
Client

58. Client & Server
Code
Server
Facts
Client

59. Client & Server Code
Server
Compile
Facts
Client

60. Client & Server Code
Server
Compile
Config
Facts
Client

61. Client & Server Code
Server
Compile
Config
Facts
Run
Client

62. Client & Server Code
Server
Compile
Files
Config
Facts
Run
Client

63. Client & Server Code
Server
Compile
Files
Config
Report
Facts
Run
Client

64. Client & Server Code
Server
Compile
Files
Config
Report
Facts
Run Sleep
Client

65. Client & Server Code
Server
Compile
Files
Config
Report
Facts
Run Sleep
Client

66. Clients & Server
Code
Server
Client Client
Client Client Client Client

67. Expanded Old Way
for h in eximbox1 eximbox2 eximbox3; do
ssh $h ‘
grep “release 4” /etc/redhat-release &&
up2date exim
grep “release 5” /etc/redhat-release &&
yum install exim’
scp exim/exim.conf $h:/etc/exim/exim.conf
ssh $h /etc/init.d/exim start
done

68. for h in eximbox1 eximbox2 eximbox3; do
ssh $h ‘
grep “release 4” /etc/redhat-release &&
up2date exim
grep “release 5” /etc/redhat-release &&
yum install exim’
scp exim/exim.conf $h:/etc/exim/exim.conf
ssh $h /etc/init.d/exim start
done
node eximbox1, eximbox2, eximbox3 {
package { exim:
ensure => installed
}
file { “/etc/exim/exim.conf”:
source => “puppet:///exim/exim.conf”
}
service { exim: ensure => running }
}

69. for h in eximbox1 eximbox2 eximbox3; do
ssh root@$h chkconfig exim on
done
service { exim:
ensure => running,
enable => true
}

70. package { exim:
ensure => installed
}
file { “exim.conf”:
source => “puppet:///exim/exim.conf”,
name => “/etc/exim/exim.conf”,
require => Package[exim]
}
service { exim:
ensure => running,
enable => true,
subscribe => [
File[“exim.conf”], Package[exim]
]
}

71. class exim {
include spamassassin::client
package { exim: ... }
file { “exim.conf”: ... }
service { “exim”: ...}
}
class spamassassin {
class server { ... }
class client { ... }
}

72. node eximbox1, eximbox2 {
include exim
}
node eximbox3 {
include exim
include spamassassin::server
}
node spambox {
include spamassassin::server
}

73. Client

74. Client
• Collect Facts

75. Client
• Collect Facts
• Send Facts

76. Client
• Collect Facts
• Send Facts
• Receive Configuration

77. Client
• Collect Facts
• Send Facts
• Receive Configuration
• Sort Configuration

78. Client
• Collect Facts
• Send Facts
• Receive Configuration
• Sort Configuration
• For Each Resource:

79. Client
• Collect Facts
• Send Facts
• Receive Configuration
• Sort Configuration
• For Each Resource:
• Check Current State

80. Client
• Collect Facts
• Send Facts
• Receive Configuration
• Sort Configuration
• For Each Resource:
• Check Current State
• Run Required Transactions

81. Client
• Collect Facts
• Send Facts
• Receive Configuration
• Sort Configuration
• For Each Resource:
• Check Current State
• Run Required Transactions
• Send Report

82. Server

83. Server
• Compiler

84. Server
• Compiler
• Fileserver

85. Server
• Compiler
• Fileserver
• Certificate Authority

86. Server
• Compiler
• Fileserver
• Certificate Authority
• Report Handler

87. Library

88. Library
• Resource Types

89. Library
• Resource Types
• Providers

90. Library
• Resource Types
• Providers
• Resource Abstraction
Layer

91. Resource Abstraction Layer

92. Resource Abstraction Layer
Resource Types

93. Resource Abstraction Layer
Resource Types
Providers

94. Resource Abstraction Layer
Resource Types
Package
Providers

95. Resource Abstraction Layer
Resource Types
Package
Providers
dpkg rpm ports
apt yum sun

96. Resource Abstraction Layer
Resource Types
Package Service
Providers
dpkg rpm ports
apt yum sun

97. Resource Abstraction Layer
Resource Types
Package Service
Providers
dpkg rpm ports init SMF
apt yum sun redhat debian

98. service { iptables:
ensure => running,
hasstatus => true,
}

99. host { example:
ip => “192.168.7.4”,
alias => [“monkey”, “tamarin”]
}

100. file {
“/nfs”:
ensure => directory;
“/nfs/example”:
ensure => directory;
“/nfs/example/foo”:
ensure => directory;
}

101. file {
“/nfs”:
ensure => directory;
“/nfs/example”:
ensure => directory;
“/nfs/example/foo”:
ensure => directory;
}
file {
[ “/nfs”,
“/nfs/example”,
“/nfs/example/foo” ]:
ensure => directory;
}

102. $nfsopts = “vers=3,tcp,intr,hard”
mount { "/nfs/example/foo":
atboot => true,
device => "example:/foo",
ensure => "mounted",
fstype => "nfs",
options => $nfsopts,
dump => "0",
pass => "0",
require => [
Host[example],
File["/nfs/example/foo"]
]
}

103. group { monkeys: ensure => present }
group { eric: ensure => present }
user { eric:
ensure => present,
comment => “Eric Eisenhart”,
managehome => true,
groups => [monkeys, admin],
before => Group[eric],
require => Group[monkeys]
}

104. mailalias { root:
recipient => “eric@nblug.org”,
}

105. cron { logrotate:
command => “/usr/sbin/logrotate”,
user => root,
hour => 2,
minute => 0,
}

106. exec { “make stuff”:
cwd => “/nfs/example/foo”,
creates => “/nfs/example/foo/stuff”,
require => Mount[“/nfs/example/foo”]
}

107. Conditionals
case $operatingsystem {
sunos: { include solaris }
redhat: { include redhat }
}

108. Conditionals
case $operatingsystem {
sunos: { include solaris }
redhat: { include redhat }
}
file { “/example”:
owner => $operatingsystem ? {
sunos => “adm”,
redhat => “bin”,
}, mode => 0755, owner => root
}

109. Conditionals
include yoursite::${operatingsystem}
case $operatingsystem {
sunos: { include solaris }
redhat: { include redhat }
}
file { “/example”:
owner => $operatingsystem ? {
sunos => “adm”,
redhat => “bin”,
}, mode => 0755, owner => root
}

110. Mutually Assured Resurrection
$cron = $operatingsystem ? {
redhat => “crond”,
debian => “cron”
}
service { cron:
name => $cron,
ensure => running,
}
cron { “restart-puppet”:
command => “pgrep puppetd ||
service puppetd restart”,
minute => 0,
}

111. Scary
package { “kernel”:
ensure => latest,
notify => Exec[reboot]
}
exec { “reboot”:
refreshonly => true,
}
Think carefully before using this example

112. Virtual Resources

113. Virtual Resources
class users {
@user { eric: ... }
}
class sysadmins {
include users
realize( User[eric] )
}
class workstation {
include users
realize( User[eric] )
}

114. Exported Resources

115. Exported Resources
class ssh::knownhosts {
@@sshkey { $hostname:
type => rsa,
key => $sshrsakey
}
Sshkey <<| name != $hostname |>>
}

116. define virtualhost (
$ensure = present,
$aliases = [],
$path = “/var/www/html/hosts/$hostname”
) {
file { “/etc/httpd/conf.d/vh-$name.conf”:
content => template(“vhost.erb”),
notify => Service[“httpd”],
ensure => $ensure
}
file { $path: ensure => directory }
}
virtualhost { “nblug.org”:
aliases => [“www.nblug.org”]
}

117. Templates
<VirtualHost>
ServerName <%= hostname %>
<% aliases.each do |name| -%>
ServerAlias <%= name %>
<% end -%>
DocumentRoot <%= path %>
CustomLog /var/log/httpd/<%= name %>.log
ErrorLog /var/log/httpd/<%= name %>.err
</VirtualHost>

118. Modules
# cd /etc/puppet/modules/bind/
# find . | grep -v CVS
./README
./manifests
./manifests/init.pp
./manifests/special.pp
./templates
./templates/named.conf.erb
./files
./files/named.root
./files/named.local

119. ¿ Live Demo ?

120. Future
• More native types and providers
• Puppet Common Modules
• augeas integration:
augeas { "grub timeout":
context => "/files/etc/grub.conf",
changes => "set timeout 30"
}
• Test Frameworks?

121. Questions

122. End
• Puppet: http://puppet.reductivelabs.com/
• More: http://delicious.com/freiheit/puppet
• Pulling Strings With Puppet: http://xrl.us/oqpb4 (amazon)
• Alternatives:
• cfengine (automating the old ways)
• Bcfg2 (XML)
• LCFG (less OS support)
• $$$$
• Me: http://eric.eisenhart.name/
• slide:ology: http://slideology.com/