passenger on Puppet PE and use foreman as an ENC and reporting engine¶
Overview¶
This how to describes the steps to install foreman's smart proxy on puppet enterprise 2.7.2 with the embedded puppet labs ruby version. It also walks you thru the steps of modifying the reporting engine to "foreman reports" and use "the foreman" as it's ENC.
Requirements¶
1. Internet access as you need to do some git pulls and install some rubygems
2. The puppet enterprise tar ball (puppet-enterprise-2.7.2-el-6-x86_64.tar.gz) which you can download from the puppet labs website.
3. A working foreman 1.1 or higher host
Install the needed dependencies to install the rubygems¶
Go to the troubleshooting section [[http://projects.theforeman.org/projects/foreman/wiki/Troubleshooting]] there is a paragraph "I use puppet enterprise, what now?" and install
"*pe-ruby-devel-1.8.7.370-1.pe.el6.x86_64.rpm*" from your unpacked puppet-enterprise tar ball. You can find the rpm in puppet-enterprise-2.7.2-el-6-x86_64/packages/el-6-x86_64/.
$ sudo yum localinstall pe-ruby-devel-1.8.7.370-1.pe.el6.x86_64.rpm
Pupppet pe 2.7.2 comes with mysql as a database back end. This means we need the mysql-devel to build the mysql rubygem package.
$ sudo yum install mysql-devel gcc make
Now follow the steps copied from the trouble shooting wiki page.
1. Update your path variable to use the ruby version PE ships with
# export PATH=/opt/puppet/bin:$PATH
2. Check to make sure your PATH was updated ("which gem" should return /opt/puppet/bin/gem)
# which gem /opt/puppet/bin/gem
3. Install rest-client and mysql
#gem install rest-client #gem install mysql
4. If everything went fine you should see the following output if you list the gem's
#gem list activerecord (2.3.17) activesupport (2.3.17) ar-extensions (0.9.5) builder (3.0.0) dalli (1.1.2) excon (0.14.1) fog (1.5.0) formatador (0.2.0) guid (0.1.1) hiera (0.3.0) hiera-puppet (0.3.0) json (1.7.7) mime-types (1.16) multi_json (1.0.3) mysql (2.9.1) net-scp (1.0.4) net-ssh (2.1.4) nokogiri (1.5.0) rack (1.1.6) rack_csrf (2.4.0) rake (0.8.7) rbvmomi (1.3.0) rest-client (1.6.7) ruby-hmac (0.4.0) sinatra (1.2.6) stomp (1.1.9) tilt (1.3.3) trollop (1.16.2)
Install the smart-proxy from git¶
As we need to modify some ruby files (for mcollective ) along the way, cloning the smart-proxy from git seemed to be the best way to go.
Cloning the repo¶
You can download the zip file or just clone the latest smart proxy with git.
# cd /usr/share/ # git clone git://github.com/theforeman/smart-proxy.git foreman-proxy
Create the foreman-proxy group / user¶
Add the foreman-proxy user and group to the system and make the foreman-proxy user part of the pe-puppet and pe-apache group.
# useradd -r foreman-proxy # usermod -G pe-puppet,pe-apache foreman-proxy
Add a log and ssl directory¶
Create those addtional directories:
# mkdir -p /var/log/foreman-proxy/ # mkdir -p /usr/share/foreman-proxy/ssl # mkdir -p /usr/share/foreman-proxy/ssl/certs # mkdir -p /usr/share/foreman-proxy/ssl/private_keys
After adding the user, log and ssl directory, cd into the foreman-proxy folder and change the following permissions for config.ru, logs and ssl.
# chown foreman-proxy:root config.ru # chown -R foreman-proxy:root ssl # chown -R foreman-proxy:foreman-proxy /var/log/foreman-proxy
The reason why we change the permission on config.ru is, because we want apache/passenger to spawn an new process as user foreman-proxy and NOT as root.
Configure the foreman-proxy settings.yml¶
Its recommended to have ssl enabled in prod envronments so we need to uncomment these 3 lines,
ssl_certificate: ssl/certs/fqdn.pem (created on foreman)
ssl_ca_file: ssl/certs/ca.pem (this is the foreman ca.pem)
ssl_private_key: ssl/private_keys/fqdn.key (created on foreman)
and generate a new certificate for the connection between the foreman-proxy and the foreman host. As we do not want to waste puppet enterprise licenses for the apache ssl connection we create the certificate on the foreman host which has puppet oss installed.
You can follow the foreman manual on section 4.3.6 SSL [[http://theforeman.org/manuals/1.1/index.html#4.3.6SSL]] to create the certificates on the foreman host
To generate a certificate for a proxy host that isn't managed by Puppet or is but you do not want to use the certs from it, do the following:
Generate a new certificate on your puppetmaster:
puppet cert --generate <proxy-FQDN> (which is your puppet-enterprise host)
Copy the certificates and key from the puppetmaster (foreman host) to the smart proxy (puppet enterprise) to /usr/share/foreman-proxy/ssl :
/usr/share/foreman-proxy/ssl/certs/ca.pem /usr/share/foreman-proxy/ssl/certs/proxy-FQDN.pem /usr/share/foreman-proxy/ssl/private_keys/proxy-FQDN.pem
Please pay attentions that these are NOT the same certs as you are createing on the puppet enterprise CA! these are created by the foreman open source puppetmaster!
You also have to enable the PuppetCA and Puppet management if your puppet master and ca is on the puppet enterprise host.
# enable PuppetCA management :puppetca: true :ssldir: /etc/puppetlabs/puppet/ssl :puppetdir: /etc/puppetlabs/puppet # enable Puppet management :puppet: true :puppet_conf: /etc/puppetlabs/puppet/puppet.conf
Allow the foreman-proxy to make puppetca requests¶
Add the following content to /etc/sudoers.d/foreman-proxy
foreman-proxy ALL = NOPASSWD : /opt/puppet/sbin/puppetca * Defaults:foreman-proxy !requiretty
Adding the smart-proxy configuration to the puppet httpd directory¶
You can find the pe-apache folder in /etc/puppetlabs/httpd/conf.d/
Create the follwing file 12-pe-httpd-foreman-proxy.conf
Listen 8443 <VirtualHost YOURIP:8443> ServerName puppet-enterprise-fqdn SetEnv HOME /usr/share/foreman-proxy RailsAutoDetect On RailsEnv production DocumentRoot /usr/share/foreman-proxy/public PassengerAppRoot /usr/share/foreman-proxy AddDefaultCharset UTF-8 SSLEngine On SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP SSLProtocol ALL -SSLv2 SSLCertificateFile /usr/share/foreman-proxy/ssl/certs/puppet-enterprise-fqdn.pem SSLCertificateKeyFile /usr/share/foreman-proxy/ssl/private_keys/puppet-enterprise-fqdn.pem SSLCertificateChainFile /usr/share/foreman-proxy/ssl/certs/ca.pem SSLCACertificateFile /usr/share/foreman-proxy/ssl/certs/ca.pem SSLVerifyClient optional SSLOptions +StdEnvVars SSLVerifyDepth 3 Loglevel Debug CustomLog /usr/share/foreman-proxy/logs/access.log combined ErrorLog /usr/share/foreman-proxy/logs/error.log </VirtualHost>
Now that we have setup the foreman-proxy we need to add the node.rb file to the /etc/puppetlabs/puppet/ directory so that puppet foreman as it's ENC. Make sure if you run pe and oss that the node.rb is the same.¶
You can get the node.rb file from here:
https://raw.github.com/theforeman/puppet-foreman/master/templates/external_node.rb.erb
# cd /etc/puppetlabs/puppet/ # wget https://raw.github.com/theforeman/puppet-foreman/master/templates/external_node.rb.erb -O node.rb # chmod 550 node.rb # chown pe-puppet:pe-puppet node.rb
Edit node.rb and add the correct url and certificates¶
That the foreman host and the foreman-proxy host can toak to each other in a secure way, edit the node.rb file and add your certs.
SETTINGS = { :url => "https://foreman.youdomain", # e.g. https://foreman.example.com :puppetdir => "/var/opt/lib/pe-puppet", # This is the puppet enterprise dir :facts => true, # true/false to upload facts :storeconfigs => true, # true/false if sharing ActiveRecord-storeconfigs :timeout => 10, # if CA is specified, remote Foreman host will be verified :ssl_ca => "/usr/share/foreman-proxy/ssl/certs/ca.pem", # This is the ca.pem form you puppet opensource foreman host # ssl_cert and key are required if require_ssl_puppetmasters is enabled in Foreman :ssl_cert => "/usr/share/foreman-proxy/ssl/certs/puppet-enterprise-fqdn.pem", # This is the fqdn.pem form you puppet opensource foreman host :ssl_key => "/usr/share/foreman-proxy/ssl/private_keys/puppet-enterprise-fqdn.pem" # This is the fqdn.pem form you puppet opensource foreman host
Add the foreman.rb report to the puppetlabs ruby report dir¶
# cd /opt/puppet/lib/ruby/site_ruby/1.8/puppet/reports/ # wget https://raw.github.com/theforeman/puppet-foreman/master/templates/foreman-report.rb.erb -O foreman.rb # chmod +x foreman.rb
Now also add the your certs in foreman.rb
# URL of your Foreman installation $foreman_url='https://foreman.yourdomain # if CA is specified, remote Foreman host will be verified $foreman_ssl_ca = "/usr/share/foreman-proxy/ssl/certs/ca.pem" # ssl_cert and key are required if require_ssl_puppetmasters is enabled in Foreman $foreman_ssl_cert = "/usr/share/foreman-proxy/ssl/certs/puppet-enterprise-fqdn.pem" $foreman_ssl_key = "/usr/share/foreman-proxy/ssl/private_keys/puppet-enterprise-fqdn.pem"
After adding all these files we need to modify the master section in the puppet.conf file.¶
[master] reports = foreman node_terminus = exec external_nodes = /etc/puppetlabs/puppet/node.rb ### foreman settings privatekeydir = $ssldir/private_keys { group = service } hostprivkey = $privatekeydir/$certname.pem { mode = 640 } #### for passenger ssl_client_header = SSL_CLIENT_S_DN ssl_client_verify_header = SSL_CLIENT_VERIFY
Restart pe-httpd¶
Restart the puppetlabs httpd server
/etc/init.d/pe-httpd
Add the smart-proxy to the Foreman's Smart Proxy page¶
Go to [FOREMAN_URL]/smart_proxies and klick New Proxy
Then you type in the Name for your Proxy and the URL of your Proxy, with the Port you use.
For example:
Name: Puppet-Proxy
URL: http://puppetpe.your-domain.com:8443
Updated by Laurent Domb over 11 years ago ยท 16 revisions