Puppet environment setup

Here is the guidelines to get your Puppet environment properly set.

Puppet Master

Tested version: Puppet Master 2.8.1 Puppet 4.19.12 Ruby 2.3.7 GEM 2.7.7 cri 2.10.1

# Puppet labs repos
rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm

# Install Puppet Master
yum -y install puppetserver

# Check version (must be on 2.8.1)
puppetserver --version

# Check puppet version (must be on >4.10.12)
# If not, just run: yum --disablerepo=cern update puppet
puppet --version

# Start service
sudo systemctl start puppetserver

# Check for error messages. Use  "journalctl -xe" for a more complete output
systemctl status puppetserver.service

Edit puppet.conf and add puppet master configuration:

vim /etc/puppetlabs/puppet/puppet.conf

[main]
certname = puppet-server.cern.br
server = puppet
environment = production
runinterval = 1h
strict_variables = true

# Restart the service
sudo systemctl start puppetserver

# Check certificates (puppet-server must appear on the list)
puppet cert list --all

Development environment

Make sure that you have git installed

# Check ruby must be >2.3.7 and gem 2.7.7
ruby --version
gem --version

# If gem complains about the ruby version, you can get from:
wget https://github.com/feedforce/ruby-rpm/releases/download/2.3.7/ruby-2.3.7-1.el7.centos.x86_64.rpm
rpm -ivh ruby-2.3.7-1.el7.centos.x86_64.rpm

# Edit ˜/.bash_profile and change to:
PATH=/opt/puppetlabs/puppet/bin:$PATH:$HOME/bin

# Updating gems to the latest version
gem install rubygems-update
/opt/puppetlabs/puppet/bin/update_rubygems

# Install cri
gem install cri -v 2.10.1

# Now let install the r10k package.
# This will allow to map git branches to Puppet environments
gem install r10k
mkdir -p /etc/puppetlabs/r10k/
cd /etc/puppetlabs/r10k/

Create a r10k.yaml file with this content and DON'T FORGET TO CHANGE THE remote part:

---
:cachedir: '/var/cache/r10k'

:sources:
        :simple_grid_framework:
                remote: 'https://github.com/gitname/simple_grid_puppet_env'
                basedir: '/etc/puppetlabs/code/environments'
:postrun: ['git', '--git-dir=/etc/puppetlabs/code/environments/master/site/simple_grid/', 'pull', 'origin',  'master']

Now we are ready to deploy the r10k enviroment

r10k deploy environment -p

For the Puppet+R10k and "Role x profile" stuff check it out on https://puppet.com/docs/pe/2017.2/r_n_p_full_example.html

Puppet Client

Tested version: Puppet 4.19.12

---

# Puppet labs repos
rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm

# Install puppet client
yum -y install puppet-agent

# Check version (must be on 4.10.12)
puppet --version

# Add server info
sudo vim /etc/puppetlabs/puppet/puppet.conf

puppet.conf should have:

[main]
certname = puppetclient.cern.ch
server = puppet-master.cern.ch
environment = production
runinterval = 1h

# Restart puppet-agent service
sudo systemctl restart puppet

# Check if the server is set correctly
sudo puppet config print server puppet

# Check certificates (puppet-server must appear on the list)
sudo puppet cert list --all

On Puppet Master machine:

# Sign your client certificate
puppet cert sign puppetclient.cern.ch

Test the Client machine:

puppet agent -t

You should receive this output:

Info: Caching certificate for puppetclient.cern.ch
Info: Caching certificate_revocation_list for ca
Info: Caching certificate for puppetclient.cern.ch
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for puppetclient.cern.ch
Info: Applying configuration version '1537779510'

If you need to generate new certificates

1. On the master: puppet cert clean <agent_certname>
2. On the agent: mv /etc/puppetlabs/puppet/ssl/ /etc/puppetlabs/puppet/ssl_bak
3. Never do this if you are trying to regenerate the cert for the agent on the master. Instead you would need to delete specific certs
4. On the agent: puppet agent -t
5. On the master: puppet cert sign <agent_certname>