Skip to content

Commit

Permalink
Fixes #35933 - Update for change from puppet master to server
Browse files Browse the repository at this point in the history
  • Loading branch information
jcpunk authored and ekohl committed May 15, 2023
1 parent 8a45aa7 commit 5050652
Show file tree
Hide file tree
Showing 20 changed files with 149 additions and 148 deletions.
26 changes: 13 additions & 13 deletions README.md
@@ -1,9 +1,9 @@
[![Puppet Forge](https://img.shields.io/puppetforge/v/theforeman/puppet.svg)](https://forge.puppetlabs.com/theforeman/puppet)
[![CI](https://github.com/theforeman/puppet-puppet/actions/workflows/ci.yml/badge.svg?event=schedule)](https://github.com/theforeman/puppet-puppet/actions/workflows/ci.yml)

# Puppet module for installing the Puppet agent and master
# Puppet module for installing the Puppet agent and server

Installs and configures the Puppet agent and optionally a Puppet master (when
Installs and configures the Puppet agent and optionally a Puppet server (when
`server` is true). Part of the [Foreman installer](https://github.com/theforeman/foreman-installer)
or to be used as a Puppet module.

Expand All @@ -13,7 +13,7 @@ If you know you'll be installing an earlier or specific version, you will
need to override `server_puppetserver_version`. More information in the Puppet
Server section below.

Many puppet.conf options for agents, masters and other are parameterized, with
Many puppet.conf options for agents, servers and other are parameterized, with
class documentation provided at the top of the manifests. In addition, there
are hash parameters for each configuration section that can be used to supply
any options that are not explicitly supported.
Expand All @@ -37,7 +37,7 @@ These are set up under /etc/puppetlabs/code/environments.

Environments can be backed by git by setting `server_git_repo` to true, which
sets up `/var/lib/puppet/puppet.git` where each branch maps to one environment.
Avoid using 'master' as this name isn't permitted. On each push to the repo, a
Avoid using 'server' as this name isn't permitted. On each push to the repo, a
hook updates `/etc/puppet/environments` with the contents of the branch.

Requires [theforeman/git](https://forge.puppetlabs.com/theforeman/git).
Expand All @@ -64,10 +64,10 @@ Then the `foreman_ssl_{ca,cert,key}` parameters are ignored and `certs::puppet`

## PuppetDB integration

The Puppet master can be configured to export catalogs and reports to a
The Puppet server can be configured to export catalogs and reports to a
PuppetDB instance, using the puppetlabs/puppetdb module. Use its
`puppetdb::server` class to install the PuppetDB server and this module to
configure the Puppet master to connect to PuppetDB.
configure the Puppet server to connect to PuppetDB.

Requires [puppetlabs/puppetdb](https://forge.puppetlabs.com/puppetlabs/puppetdb)

Expand Down Expand Up @@ -100,9 +100,9 @@ wrapper classes or even your ENC (if it supports param classes). For example:

```puppet
# Agent and cron (or daemon):
class { 'puppet': runmode => 'cron' }
class { 'puppet': runmode => 'cron', agent_server_hostname => 'hostname' }
# Agent and puppetmaster:
# Agent and puppetserver:
class { 'puppet': server => true }
# You want to use git?
Expand All @@ -121,7 +121,7 @@ class { 'puppet':
server_post_hook_content => 'puppetserver/post-hook.puppet',
}
# Configure master without Foreman integration
# Configure server without Foreman integration
class { 'puppet':
server => true,
server_foreman => false,
Expand Down Expand Up @@ -155,22 +155,22 @@ puppet apply install.pp --modulepath /path_to/extracted_tarball

# Advanced scenarios

An HTTP (non-SSL) puppetmaster instance can be set up (standalone or in addition to
An HTTP (non-SSL) puppetserver instance can be set up (standalone or in addition to
the SSL instance) by setting the `server_http` parameter to `true`. This is useful for
reverse proxy or load balancer scenarios where the proxy/load balancer takes care of SSL
termination. The HTTP puppetmaster instance expects the `X-Client-Verify`, `X-SSL-Client-DN`
termination. The HTTP puppetserver instance expects the `X-Client-Verify`, `X-SSL-Client-DN`
and `X-SSL-Subject` HTTP headers to have been set on the front end server.

The listening port can be configured by setting `server_http_port` (which defaults to 8139).

For puppetserver, this HTTP instance accepts **ALL** connections and no further restrictions can be configured.

**Note that running an HTTP puppetmaster is a huge security risk when improperly
**Note that running an HTTP puppetserver is a huge security risk when improperly
configured. Allowed hosts should be tightly controlled; anyone with access to an allowed
host can access all client catalogues and client certificates.**

```puppet
# Configure an HTTP puppetmaster vhost in addition to the standard SSL vhost
# Configure an HTTP puppetserver vhost in addition to the standard SSL vhost
class { '::puppet':
server => true,
server_http => true,
Expand Down
2 changes: 1 addition & 1 deletion manifests/agent/config.pp
Expand Up @@ -6,7 +6,7 @@
'localconfig': value => $puppet::localconfig;
'default_schedules': value => $puppet::agent_default_schedules;
'report': value => $puppet::report;
'masterport': value => $puppet::port;
'masterport': value => $puppet::agent_server_port;
'environment': value => $puppet::environment;
'splay': value => $puppet::splay;
'splaylimit': value => $puppet::splaylimit;
Expand Down
34 changes: 17 additions & 17 deletions manifests/config.pp
Expand Up @@ -2,22 +2,22 @@
# @api private
class puppet::config (
# lint:ignore:parameter_types
$allow_any_crl_auth = $puppet::allow_any_crl_auth,
$auth_allowed = $puppet::auth_allowed,
$auth_template = $puppet::auth_template,
$ca_server = $puppet::ca_server,
$ca_port = $puppet::ca_port,
$dns_alt_names = $puppet::dns_alt_names,
$module_repository = $puppet::module_repository,
$pluginsource = $puppet::pluginsource,
$pluginfactsource = $puppet::pluginfactsource,
$puppet_dir = $puppet::dir,
$puppetmaster = $puppet::puppetmaster,
$syslogfacility = $puppet::syslogfacility,
$srv_domain = $puppet::srv_domain,
$use_srv_records = $puppet::use_srv_records,
$additional_settings = $puppet::additional_settings,
$client_certname = $puppet::client_certname,
$allow_any_crl_auth = $puppet::allow_any_crl_auth,
$auth_allowed = $puppet::auth_allowed,
$auth_template = $puppet::auth_template,
$ca_server = $puppet::ca_server,
$ca_port = $puppet::ca_port,
$dns_alt_names = $puppet::dns_alt_names,
$module_repository = $puppet::module_repository,
$pluginsource = $puppet::pluginsource,
$pluginfactsource = $puppet::pluginfactsource,
$puppet_dir = $puppet::dir,
$agent_server_hostname = $puppet::agent_server_hostname,
$syslogfacility = $puppet::syslogfacility,
$srv_domain = $puppet::srv_domain,
$use_srv_records = $puppet::use_srv_records,
$additional_settings = $puppet::additional_settings,
$client_certname = $puppet::client_certname,
# lint:endignore
) {
puppet::config::main {
Expand Down Expand Up @@ -53,7 +53,7 @@
}
} else {
puppet::config::main {
'server': value => pick($puppetmaster, $facts['networking']['fqdn']);
'server': value => pick($agent_server_hostname, $facts['networking']['fqdn']);
}
}
if $pluginsource {
Expand Down
8 changes: 4 additions & 4 deletions manifests/config/master.pp → manifests/config/server.pp
@@ -1,21 +1,21 @@
# Set a config entry in the [master] section
# Set a config entry in the [server] section
#
# @param value
# The value for the config entry
# @param key
# The key of the config entry
# @param joiner
# How to join an array value into a string
define puppet::config::master (
define puppet::config::server (
Variant[Array[String], Boolean, String, Integer] $value,
String $key = $name,
String $joiner = ','
) {
puppet::config::entry { "master_${name}":
puppet::config::entry { "server_${name}":
key => $key,
value => $value,
joiner => $joiner,
section => 'master',
section => 'server',
sectionorder => 3,
}
}
40 changes: 20 additions & 20 deletions manifests/init.pp
Expand Up @@ -24,7 +24,7 @@
# Can also install only server packages with value
# of 'server' or only agent packages with 'agent'.
#
# $port:: Override the port of the master we connect to.
# $agent_server_port:: Override the port of the server we connect to.
#
# $splay:: Switch to enable a random amount of time
# to sleep before each run.
Expand Down Expand Up @@ -99,7 +99,7 @@
# $syslogfacility:: Facility name to use when logging to syslog
#
# $use_srv_records:: Whether DNS SRV records will be used to resolve
# the Puppet master
# the Puppet server
#
# $srv_domain:: Search domain for SRV records
#
Expand Down Expand Up @@ -171,7 +171,7 @@
#
# $agent_noop:: Run the agent in noop mode.
#
# $puppetmaster:: Hostname of your puppetmaster (server
# $agent_server_hostname:: Hostname of your puppetserver (server
# directive in puppet.conf)
#
# $prerun_command:: A command which gets excuted before each Puppet run
Expand Down Expand Up @@ -209,22 +209,22 @@
#
# == puppet::server parameters
#
# $server:: Should a puppet master be installed as well as the client
# $server:: Should a puppet server be installed as well as the client
#
# $server_ip:: Bind ip address of the puppetmaster
# $server_ip:: Bind ip address of the puppetserver
#
# $server_port:: Puppet master port
# $server_port:: Puppet server port
#
# $server_ca:: Provide puppet CA
#
# $server_ca_crl_sync:: Sync puppet CA crl file to compile masters, Puppet CA Must be the Puppetserver
# for the compile masters. Defaults to false.
# $server_ca_crl_sync:: Sync puppet CA crl file to compilers, Puppet CA Must be the Puppetserver
# for the compilers. Defaults to false.
#
# $server_crl_enable:: Turn on crl checking. Defaults to true when server_ca is true. Otherwise
# Defaults to false. Note unless you are using an external CA. It is recommended
# to set this to true. See $server_ca_crl_sync to enable syncing from CA Puppet Master
#
# $server_reports:: List of report types to include on the puppetmaster
# $server_reports:: List of report types to include on the puppetserver
#
# $server_external_nodes:: External nodes classifier executable
#
Expand Down Expand Up @@ -267,16 +267,16 @@
#
# $server_manage_user:: Whether to manage the server user resource
#
# $server_user:: Name of the puppetmaster user.
# $server_user:: Username used for the puppetserver process
#
# $server_group:: Name of the puppetmaster group.
# $server_group:: Group used for the puppetserver process
#
# $server_dir:: Puppet configuration directory
#
# $server_http:: Should the puppet master listen on HTTP as well as HTTPS.
# $server_http:: Should the puppet server listen on HTTP as well as HTTPS.
# Useful for load balancer or reverse proxy scenarios.
#
# $server_http_port:: Puppet master HTTP port; defaults to 8139.
# $server_http_port:: Puppet server HTTP port; defaults to 8139.
#
# $server_foreman_facts:: Should foreman receive facts from puppet
#
Expand Down Expand Up @@ -347,13 +347,13 @@
# $server_default_manifest_content:: A string to set the content of the default_manifest
# If set to '' it will not manage the file
#
# $server_package:: Custom package name for puppet master
# $server_package:: Custom package name for puppet server
#
# $server_version:: Custom package version for puppet master
# $server_version:: Custom package version for puppet server
#
# $server_ssl_dir:: SSL directory
#
# $server_ssl_dir_manage:: Toggle if ssl_dir should be added to the [master]
# $server_ssl_dir_manage:: Toggle if ssl_dir should be added to the [server]
# configuration section. This is necessary to
# disable in case CA is delegated to a separate instance
#
Expand Down Expand Up @@ -561,7 +561,7 @@
#
# include puppet
#
# * Installing a puppetmaster
# * Installing a puppetserver
#
# class {'puppet':
# server => true,
Expand Down Expand Up @@ -591,7 +591,7 @@
Optional[String] $package_provider = $puppet::params::package_provider,
Optional[Variant[String,Hash,Array]] $package_install_options = $puppet::params::package_install_options,
Optional[Variant[Stdlib::Absolutepath, Stdlib::HTTPUrl]] $package_source = $puppet::params::package_source,
Stdlib::Port $port = $puppet::params::port,
Stdlib::Port $agent_server_port = $puppet::params::agent_server_port,
Boolean $splay = $puppet::params::splay,
Variant[Integer[0],Pattern[/^\d+[smhdy]?$/]] $splaylimit = $puppet::params::splaylimit,
Variant[Boolean, Stdlib::Absolutepath] $autosign = $puppet::params::autosign,
Expand Down Expand Up @@ -637,7 +637,7 @@
Boolean $agent = $puppet::params::agent,
Boolean $report = $puppet::params::report,
Variant[String, Boolean] $client_certname = $puppet::params::client_certname,
Optional[String] $puppetmaster = $puppet::params::puppetmaster,
Optional[String] $agent_server_hostname = $puppet::params::agent_server_hostname,
String $systemd_unit_name = $puppet::params::systemd_unit_name,
String $service_name = $puppet::params::service_name,
Optional[String] $syslogfacility = $puppet::params::syslogfacility,
Expand All @@ -649,7 +649,7 @@
String $server_group = $puppet::params::group,
String $server_dir = $puppet::params::dir,
String $server_ip = $puppet::params::ip,
Stdlib::Port $server_port = $puppet::params::port,
Stdlib::Port $server_port = $puppet::params::agent_server_port,
Boolean $server_ca = $puppet::params::server_ca,
Boolean $server_ca_crl_sync = $puppet::params::server_ca_crl_sync,
Optional[Boolean] $server_crl_enable = $puppet::params::server_crl_enable,
Expand Down
8 changes: 4 additions & 4 deletions manifests/params.pp
Expand Up @@ -7,7 +7,7 @@
$user = 'puppet'
$group = 'puppet'
$ip = '0.0.0.0'
$port = 8140
$agent_server_port = 8140
$splay = false
$splaylimit = 1800
$runinterval = 1800
Expand Down Expand Up @@ -203,14 +203,14 @@
$client_certname = $trusted['certname']

# Set by the Foreman ENC
$puppetmaster = getvar('puppetmaster')
$agent_server_hostname = getvar('puppetmaster')

# Hashes containing additional settings
$additional_settings = {}
$agent_additional_settings = {}
$server_additional_settings = {}

# Will this host be a puppetmaster?
# Will this host be a puppetserver?
$server = false
$server_ca = true
$server_ca_crl_sync = false
Expand All @@ -223,7 +223,7 @@
$server_http = false
$server_http_port = 8139

# Need a new master template for the server?
# Need a new server template for the server?
$server_template = 'puppet/server/puppet.conf.erb'
# Template for server settings in [main]
$server_main_template = 'puppet/server/puppet.conf.main.erb'
Expand Down

0 comments on commit 5050652

Please sign in to comment.