Introduction to Configuration Management with Puppet

• master configuration file for agents and masters

• "node" is the Puppet term for an individual system managed by Puppet
• specifies configuration for nodes
• "node default" applies to any system that doesn't have its own node declaration
• custom configuration for specific individual nodes

node 10-0-20-254 {
	include module-name
	include another-module
}

• node names are the short hostnames of systems (shown by "hostname -s")
• each node declaration can contain individual Puppet resources and include modules

• modules are collections ("classes") of resources for specific services or configurations (such as how to configure a web server or install a sudoers file)
• node configurations in site.pp use "include" to bring in modules
• subdirectory structure for each module

  modulename

  top-level directory for each module

  modulename/manifests/init.pp

  Puppet resource class definition file "class modulename { … }", applied to a node with "include modulename" in the node configuration

  modulename/files

  subdirectory containing files needed by a module

• mapping source declarations to files:

• 'source => "puppet:///modules/example/software.conf"' therefore refers to "/etc/puppet/modules/example/files/software.conf".

The kinds of configuration resources whose state can be managed, with various resource-dependent parameters. An example declaration of a file resource:

file { "/etc/sudoers":
	ensure  => present,
	mode    => 400,
	owner   => root,
	group   => root,
	source  => "puppet:///modules/sudoers/sudoers",
	require => Package["sudo"],
}

The string in quotes between the opening brace and the colon "/etc/sudoers" is the resource title, usually also the same as the path to the file being managed (unless the "path =>" attribute says something different). A title must be unique (there cannot be another file with "/etc/sudoers" as its title) and is used to refer to the resource in other places with 'File["/etc/sudoers"]'.

Resources also have a number of paramters for attributes of the resource, many of which are resource-specific. This file resource specifies the mode (permissions), user and group owners, and where to obtain the file contents ("source =>"), as well as a relationship to another resource ('Package["sudo"]').

Below I discuss only some commonly-used resources and parameters.

file

a file on the system with specified contents

• ensure (present, absent, directory, link to other file)
• mode
• owner
• group
• source (where to get the master copy of this file)

user

a user account, primarily intended for system functions (not so useful for managing interactive user accounts)

• ensure (present, absent)
• uid
• gid
• home
• shell
• comment

group

a system group

• ensure (present, absent)
• gid
• members

package

a software package

• ensure (installed, latest, specific version, absent)
• source

service

a system service (typically a persistent running daemon program)

• enable (true, false; whether to enable this service at boot time)
• ensure (running, stopped)

cron

a cron job (scheduled execution of a task)

• user (which user to run as)
• command (command to run)
• minute
• hour
• monthday
• month
• weekday

exec

run a command (usually based on some trigger condition)

• command (what command to run)
• refreshonly (run command only if this exec is notified by another resource)

For more details on available resource types and how to declare them, see the "Resource Type Reference" at https://docs.puppet.com/puppet/5.4/type.html (for Puppet 5.4, your version may vary).

Attributes that can be applied to any resource

namevar

attribute that has the unique name identifying a resource of a given type (such as the path of a file, name of a user account, name of a package, etc.)

• usually given as a quoted string followed by a colon given before any other parameters, but sometimes can be specified as an explicit attribute

require

• specify another resource that must be present before this one is created or updated

before

• this resource must be present before the specified resource is created

subscribe

• like "require" but also refresh this resource if the dependent changes

notify

• refresh a specified resource if this one changes

For require/before/subscribe/notify, the parameter specifies the resource using the capitalized resource type and the resource name in brackets.

require => [ File["/etc/ldap.conf"],
             Package["openldap"],
             Service["slapd"].
source  => [ "puppet:///modules/ldap/$hostname/ldap.conf",
             "puppet:///modules/ldap/ldap.conf", ],

This example also shows how many resource parameters can be lists of values enclosed in brackets [] with elements separated by commas.

• "$var" is value of the variable named "var"
• $var = "value" assigns a value
• node facts are available in variables ($hostname == "ip-10-0-20-254")
• values can be tested in conditional expressions and interpolated into other Puppet expressions or even file contents
• variable scoping is kind of complicated, use carefully

• functions that can be evaluated when a manifest is compiled on the puppet master