87 lines
3.2 KiB
Markdown
87 lines
3.2 KiB
Markdown
**Purpose**:
|
|
Puppet is another declarative configuration management tool that excels in system configuration and enforcement. Like Ansible, it's designed to maintain the desired state of a system's configuration but uses a client-server (master-agent) architecture by default.
|
|
|
|
!!! note "Assumptions"
|
|
This document assumes you are deploying Puppet server onto Rocky Linux 9.4. Any version of RHEL/CentOS/Alma/Rocky should behave similarily.
|
|
|
|
## Deployment Steps:
|
|
You will need to perform a few steps outlined in the [official Puppet documentation](https://www.puppet.com/docs/puppet/7/install_puppet.html) to get a Puppet server operational. A summarized workflow is seen below:
|
|
|
|
### Install Puppet Repository
|
|
**Installation Scope**: Puppet Server / Managed Devices
|
|
``` sh
|
|
# Add Puppet Repository / Enable Puppet on YUM
|
|
sudo rpm -Uvh https://yum.puppet.com/puppet7-release-el-9.noarch.rpm
|
|
```
|
|
|
|
### Install Puppet Server
|
|
**Installation Scope**: Puppet Server
|
|
``` sh
|
|
# Install the Puppet Server
|
|
yum install -y puppetserver
|
|
systemctl enable --now puppetserver
|
|
|
|
# Validate Successful Deployment
|
|
exec bash
|
|
puppetserver -v
|
|
|
|
# Open Necessary Firewall Port for Agent Communication
|
|
sudo firewall-cmd --add-port=8140/tcp --permanent
|
|
sudo firewall-cmd --reload
|
|
```
|
|
|
|
### Install Puppet Agent
|
|
**Installation Scope**: Puppet Server / Managed Devices
|
|
``` sh
|
|
# Install Puppet Agent
|
|
sudo yum install -y puppet-agent
|
|
|
|
# Enable the Puppet Agent
|
|
sudo /opt/puppetlabs/bin/puppet resource service puppet ensure=running enable=true
|
|
|
|
# Configure Puppet Server to Connect To
|
|
puppet config set server lab-puppet-01.bunny-lab.io --section main
|
|
|
|
# Establish Secure Connection to Puppet Server
|
|
puppet ssl bootstrap
|
|
|
|
# ((On the Puppet Server))
|
|
# You will see an error stating: "Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (fedora.bunny-lab.io)."
|
|
# Run the following command (as root) on the Puppet Server to generate a certificate
|
|
puppetserver ca sign --certname fedora.bunny-lab.io
|
|
```
|
|
|
|
#### Validate Agent Functionality
|
|
At this point, you want to ensure that the device being managed by the agent is able to pull down configurations from the Puppet Server. You will know if it worked by getting a message similar to `Notice: Applied catalog in X.XX seconds` after running the following command:
|
|
``` sh
|
|
puppet agent --test
|
|
```
|
|
|
|
### Install PuppetDB
|
|
At this point, we will install PuppetDB, which will add extra reporting and management functionality for Puppet to the Puppet server.
|
|
``` sh
|
|
# Install PuppetDB
|
|
yum install -y puppetdb
|
|
|
|
# Install PuppetDB Module
|
|
puppet module install puppetlabs-puppetdb
|
|
```
|
|
|
|
Now we need to configure a manifest file on the Puppet Server running PuppetDB, in this case, the same exact server that runs the Puppet Server itself. Create the following file if it does not already exist:
|
|
```json title="/etc/puppetlabs/code/environments/production/manifests/site.pp"
|
|
node 'lab-puppet-01.bunny-lab.io' {
|
|
# Include the puppetdb class with custom parameters
|
|
class { 'puppetdb':
|
|
listen_address => '0.0.0.0', # Allows access from all network interfaces
|
|
}
|
|
|
|
# Configure the Puppet Server to use PuppetDB
|
|
include puppetdb::master::config
|
|
}
|
|
```
|
|
|
|
Finally, we want to apply the configuration changes we made:
|
|
``` sh
|
|
sudo puppet agent -t
|
|
```
|