DevOps / Sys Admin Q & A #5 : Configuration Management

We can create AWS instances using Python boto module (AWS : Creating an EC2 instance and attaching Amazon EBS volume to the instance using Python boto module with User data)

Here are the host names of puppet on EC2:

1. puppet
2. puppetagent1

We have a file for ssh login, ~/.ssh/config:

Host master
  Hostname      54.183.114.28
  User          ubuntu
  IdentityFile  ~/.ssh/bogo.pem
Host agent1
  Hostname      54.153.51.67
  User          ubuntu
  IdentityFile  ~/.ssh/bogo.pem

We can install puppet master and agent from our remote desktop. We'll use the following scripts (myscp.sh/myscp-agent.sh to remote copy setup scripts (setup-puppet.sh/setup-puppet-agent.sh), and run them remotely using ssh -t.

For puppet master - myscp.sh:

#!/bin/bash
#
# 1. deploy local setup-puppet.sh to EC2 instance
# 2. run the setup-puppet.sh with alias and EC2_hostname (the alias is defined in .ssh/config)
# (ex) ./myscp.sh simple srv_01_0001_simple_testing
target_server=$1
host_name=$2
scp setup-puppet.sh $1:/home/ubuntu
ssh -t $target_server "
sudo chmod u+x setup-puppet.sh;
sudo ./setup-puppet.sh $2;

For puppet agent - myscp-agent.sh:

#!/bin/bash
#
# 1. deploy local setup-puppet-agent.sh to EC2 instance
# 2. run the setup-puppet-agent.sh with alias and EC2_hostname (the alias is defined in .ssh/config)
# (ex) ./myscp.sh simple srv_01_0001_simple_testing
target_server=$1
host_name=$2
scp setup-puppet-agent.sh $1:/home/ubuntu
ssh -t $target_server "
sudo chmod u+x setup-puppet-agent.sh;
sudo ./setup-puppet-agent.sh $2;

The two scripts will put setup-puppet.sh/ setup-puppet-agent.sh scripts on aws instances, master and agent nodes, respectively. Then, run them using ssh -t.

We can run the scripts like this on our remote desktop:

For master:

$ ./myscp.sh master puppet  

At this point, puppetmaster is installed. We may want to configure /etc/puppet/puppet.conf, and add the following two lines to the [main] section:

certname = puppet
dns_alt_names = puppet, puppet.localdomain

Then, we run the following script for angent:

$ ./myscp-agent.sh agent1 puppetagent1  

The arguments to myscp.sh are:

1. master/agent : local aliases to aws instances
2. puppet/puppetagent1 : hostnames of aws instances

The files uploaded to aws instances from our local desktop in previous sections are like this.

For master - setup-puppet.sh:

if [ $# -eq 0 ]
  then
    echo "No hostname supplied"
    exit
fi
env=$1
echo $env
hostname=`hostname`
apt-get update -y
apt-get upgrade -y
wget http://apt.puppetlabs.com/puppetlabs-release-precise.deb
dpkg -i puppetlabs-release-precise.deb
apt-get update -y
apt-get -y install puppetmaster
sed -i "s/$hostname/$env/g" /etc/hostname
sed -i "s/no/yes/g"  /etc/default/puppet
echo "172.31.4.137  puppet.example.net    puppet" >>  /etc/hosts
echo "172.31.4.137  puppet" >>  /etc/hosts
puppet agent --waitforcert 60
reboot

For agent - setup-puppet-agent.sh:

if [ $# -eq 0 ]
  then
    echo "No hostname supplied"
    exit
fi
env=$1
echo $env
hostname=`hostname`
apt-get update -y
apt-get upgrade -y
wget http://apt.puppetlabs.com/puppetlabs-release-precise.deb
dpkg -i puppetlabs-release-precise.deb
apt-get update -y
apt-get -y install puppet
sed -i "s/$hostname/$env/g" /etc/hostname
sed -i "s/no/yes/g"  /etc/default/puppet
echo "172.31.12.19  puppet" >>  /etc/hosts
puppet agent --waitforcert 60
reboot

On master, we need to sign on the certify request from our agent node, puppetagent1:

ubuntu@puppet:/etc/puppet$ sudo puppet cert list
  "puppetagent1.us-west-1.compute.internal" (SHA256) BE:07:3F:4F:E5:DE:B1:CF:08:85:8D:5F:CF:81:D7:CF:BD:76:58:E9:F2:15:74:47:47:9D:D9:3E:29:46:E5:72

ubuntu@puppet:/etc/puppet$ sudo puppet cert sign puppetagent1.us-west-1.compute.internal
Notice: Signed certificate request for puppetagent1.us-west-1.compute.internal
Notice: Removing file Puppet::SSL::CertificateRequest puppetagent1.us-west-1.compute.internal at '/var/lib/puppet/ssl/ca/requests/puppetagent1.us-west-1.compute.internal.pem'

After this, our puppet agent will pull any catalog from the master.

Now, we want to create a new user with username k on our agent node by setting it up on master.

/etc/puppet/manifests/site.pp:

node 'puppetagent1' {
   include user
}

Then, in modules directory, we need to have a file, /etc/puppet/modules/user/manifests/init.pp:

class user {
   user { 'k':
      ensure => present,
      comment => 'bogo user',
      home => '/home/k',
      managehome => true
   }
}

Then, on agent node:

ubuntu@puppetagent1:/home$ sudo puppet agent -t
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for puppetagent1.us-west-1.compute.internal
Info: Applying configuration version '1445207540'
Notice: /Stage[main]/User/User[k]/ensure: created
Notice: Finished catalog run in 0.17 seconds

We can check if the newuser has been created:

ubuntu@puppetagent1:/home$ ls -la
...
drwxr-xr-x  2 k      k      4096 Oct 18 22:32 k
drwxr-xr-x  4 ubuntu ubuntu 4096 Oct 18 20:48 ubuntu

We did it!

We can add SSH login to the agent:

class user {
   user { 'k':
      ensure => present,
      comment => 'bogo user',
      home => '/home/k',
      managehome => true
   }
   ssh_authorized_key { 'k_ssh':
   user => 'k',
   type => 'rsa',
   key => 'AAAAB...jjQfJ7',
  }
}

Then, on agent node:

ubuntu@puppetagent1:/home$ sudo puppet agent -t
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for puppetagent1.us-west-1.compute.internal
Info: Applying configuration version '1445212835'
Notice: Finished catalog run in 0.02 seconds

Login to aws agent node from our desktop:

k@laptop:~$ ssh k@54.153.51.67
Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.13.0-48-generic x86_64)
...

$ pwd
/home/k

DevOps

DevOps / Sys Admin Q & A