Puppet

1

# Running Puppet on Solaris

2

1

3

1

Solaris was an early development target for Puppet, hence Puppet's

4

1

support for the platform is mature and stable.

5

1

6

1

Note: Facter 1.5.2 and below use /etc/release to determine

7

1

operating system version. Solaris 5.11 (OpenSolaris) doesn't use

8

1

/etc/release any more. This has been fixed in the

9

1

[facter git repo](http://projects.reductivelabs.com/projects/facter/repository/revisions/e6d987d333d79e11dd8782fad1286d8348419842),

10

1

but as of this writing (6 Feb 09), has not been packaged. You will

11

1

need to manually patch Facter if you want to use it on OpenSolaris

12

1

13

1

# InstallationOpen Solaris?

14

1

15

1

Puppet and facter are available in pkg(5) format from Code Nursery,

16

1

so all you have to do is to add them as a package provider, and

17

1

then install the package.

18

1

19

1

    # pkg set-publisher -O http://pkg.codenursery.com/ codenursery.com

20

1

    # pkg install puppet

21

1

22

1

This installs two smf(5) services:

23

1

24

1

-   svc:/network/puppet/client:default

25

1

-   svc:/network/puppet/master:default

26

1

27

1

which both are disabled by default. They require

28

1

/etc/puppet/puppet.conf to be present, so before trying to enable

29

1

either of them you need to create that file.

30

1

31

1

# Installation (Blastwave Package)

32

1

33

1

Puppet has Facter and Ruby as prerequisites, neither of which will

34

1

be found on a stock, default Solaris installation.

35

1

36

1

By far the easiest way to install puppet and its dependencies is to

37

1

use the blastwave (Community Software) archive, aka CSW

38

1

[http://www.blastwave.org](http://www.blastwave.org). The first

39

1

step is to install pkgutil, which allows you to retreive software

40

1

from the blastwave repositories.

41

1

42

1

Please follow the instructions located on the blastwave site

43

1

[http://www.blastwave.org/howto.html](http://www.blastwave.org/howto.html)

44

1

for installing pkgutil, then return here to continue installing

45

1

Puppet.

46

1

47

1

Now that you have pkgutil installed, you can use pkgutil to install

48

1

puppet. Pkgutil will resolve all of the dependencies, and install

49

1

those packages as well.

50

1

51

1

    # /opt/csw/bin/pkgutil -U

52

1

    # /opt/csw/bin/pkgutil --install puppet

53

1

54

1

Note that this not only installs puppet, it also turns on the

55

1

daemon which starts looking for a local puppet master server. To

56

1

stop this, after installation:

57

1

58

1

    # svcadm disable puppetd

59

1

60

1

Note: At the moment blastwave is going through some internal

61

1

turmoil. This has caused Gary Law, the puppet solaris package

62

1

maintainer, to temporarily postpone updating the blastwave

63

1

repositories with the latest version of puppet. He has however

64

1

provided the packages from his personal website:

65

1

[http://garylaw.net/packages/](http://garylaw.net/packages/). For

66

1

more information check out Gary's post here:

67

1

[Gary's google groups post](http://groups.google.com/group/puppet-users/browse_thread/thread/4722c4119e4e9540/c064f4436c98e89d?lnk=gst&q=solaris#c064f4436c98e89d)

68

1

69

1

# Installation (Sunfreeware + )Ruby Gems?

70

1

71

1

This is an alternative method for installing Puppet on Solaris 10.

72

1

Rather than depending on Blastwave, which is an entire package

73

1

framework, I prefer the simplest installation with the least steps

74

1

and dependencies.

75

1

76

1

\1) Install Ruby from the

77

1

 [Solaris Companion DVD](http://www.sun.com/software/solaris/freeware/)

78

1

or

79

1

 [sunfreeware.com](ftp://ftp.sunfreeware.com/pub/freeware/sparc/10/ruby-1.8.7p72-sol10-sparc-local.gz):

80

1

81

1

      pkgadd -d /cdrom/Solaris_Software_Companion/Solaris_sparc/Packages/ SFWruby

82

1

83

1

\2) Download and install the latest

84

1

 [RubyGems](http://www.rubygems.org) (Like perl's CPAN module, but

85

1

 for Ruby):

86

1

87

1

      $ wget http://rubyforge.org/frs/download.php/45905/rubygems-1.3.1.tgz

88

1

      $ gzcat rubygems-1.3.1.tgz | tar -xf -

89

1

      $ cd rubygems-1.3.1

90

1

      $ /opt/sfw/bin/ruby setup.rb

91

1

92

1

\3) Install the latest Puppet and it's dependencies via Ruby

93

1

 Gems?:

94

1

95

1

      /opt/sfw/bin/gem update

96

1

      /opt/sfw/bin/gem install puppet

97

1

98

1

Ruby Gems? will automatically download and install all packages and

99

1

pre-requisites.

100

1

101

1

\4) You'll have to write your own /etc/init.d/puppetd and

102

1

 /etc/init.d/puppetmasterd scripts, or modify the Blastwave SMF

103

1

 manifests. Other than that, puppet is pretty much installed.

104

1

105

1

# Installation (Cool Stack)

106

1

107

1

"Optimized Open Source Software Stack (Cool Stack) for the Sun

108

1

Solaris Operating System(TM). Cool Stack is a collection of some of

109

1

the most commonly used open source applications optimized for the

110

1

Sun Solaris OS"

111

1

112

1

1)

113

1

[Download](https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_SMI-Site/en_US/-/USD/ViewProductDetail-Start?ProductRef=CoolStack-1.3.1Fin-G-F@CDS-CDS_SMI)

114

1

and install CSKruby package for your platform (Sparc or x86)

115

1

116

1

    pkgadd -d CSKruby_1.3.1_sparc.pkg

117

1

118

1

\2) CSKruby will be installed to /opt/coolstack, so add that to

119

1

 your default path.

120

1

121

1

    export PATH=$PATH:/opt/coolstack/bin

122

1

123

1

\3) Install facter + puppet from Ruby Gem? -or- tarball

124

1

125

1

    gem install facter

126

1

    gem install puppet

127

1

128

1

OR

129

1

 $ wget http://reductivelabs.com/downloads/facter/facter-latest.tgz

130

1

    $ tar xvzf facter-1.5.7.tar.gz

131

1

    $ cd facter-1.5.7

132

1

    $ ./install.rb

133

1

134

1

    $ wget http://reductivelabs.com/downloads/puppet/puppet-0.25.0.tar.gz

135

1

    $ tar xvzf puppet-0.25.0.tar.gz

136

1

    $ cd puppet-0.25.0

137

1

    $ ./install.rb

138

1

139

1

\4) TODO: Will add SRV4 packaging instructions here \*soon\*

140

1

141

1

# Integrating Puppet with Jumpstart

142

1

143

1

## Solaris 10

144

1

145

1

post-install script:

146

1

147

1

    #!/bin/sh

148

1

149

1

    ### Setup

150

1

    mkdir /a/jumpstart

151

1

    mount jumpstartserver:/opt/solaris/jumpstart /a/jumpstart

152

1

153

1

    ### Blastwave support

154

1

    cd /a/jumpstart

155

1

    cp root.profile /a/.profile

156

1

    mkdir -p /a/usr/local/bin

157

1

    cp wget-`uname -p`.bin /a/usr/local/bin/wget

158

1

    chmod 755 /a/usr/local/bin/wget

159

1

    mkdir -p /a/opt/csw

160

1

    echo all | pkgadd -a admin.jumpstart -d pkg_get-3.8.1-all-CSW.pkg -R /a

161

1

    cp /a/jumpstart/pkg-get.conf /a/opt/csw/etc

162

1

    cp /a/var/pkg-get/admin-fullauto /a/var/pkg-get/admin

163

1

164

1

    ### Ruby from Blastwave

165

1

    cd /a/jumpstart

166

1

    mkdir -p /a/usr/local/sbin

167

1

    cp /a/jumpstart/ruby-install.sh /a/usr/local/sbin

168

1

    chmod 700 /a/usr/local/sbin/ruby-install.sh

169

1

    chroot /a /usr/local/sbin/ruby-install.sh

170

1

171

1

    ### Facter and Puppet from garylaw.net

172

1

    cp facter-1.3.8,REV=2007.09.23-SunOS5.8-all-CSW.pkg /a/tmp

173

1

    cp puppet-0.23.2,REV=2007.09.23-SunOS5.8-all-CSW.pkg /a/tmp

174

1

    cp admin.jumpstart /a/tmp

175

1

    cp /a/jumpstart/puppet-install.sh /a/usr/local/sbin

176

1

    chmod 700 /a/usr/local/sbin/puppet-install.sh

177

1

    chroot /a /usr/local/sbin/puppet-install.sh

178

1

179

1

    ## Puppet setup

180

1

    cp puppetd.conf /a/etc/puppet

181

1

    cd /a/var/svc/manifest/network

182

1

    ln -s ../../../../opt/csw/var/svc/manifest/puppetd.xml .

183

1

    cd /a/jumpstart

184

1

185

1

    ### Teardown

186

1

    cd /

187

1

    umount /a/jumpstart

188

1

    rmdir /a/jumpstart

189

1

190

1

root.profile

191

1

192

1

    umask 022

193

1

194

1

    PATH=/usr/bin:/usr/sbin:/usr/ccs/bin:/usr/dt/bin:/usr/openwin/bin:/bin:/usr/ucb:/opt/SUNWspro/bin:/usr/local/bin:/usr/local/sbin:/opt/csw/bin:/opt/csw/sbin

195

1

    export PATH

196

1

197

1

    MANPATH=/usr/man:/usr/dt/man:/usr/openwin/share/man:/usr/local/man:/opt/SUNWspro/man:/opt/csw/man

198

1

    export MANPATH

199

1

200

1

    PS1="`whoami`@`hostname`# "

201

1

    export PS1

202

1

203

1

admin.jumpstart

204

1

205

1

    mail=

206

1

    instance=unique

207

1

    partial=nocheck

208

1

    runlevel=nocheck

209

1

    idepend=nocheck

210

1

    rdepend=nocheck

211

1

    space=nocheck

212

1

    setuid=nocheck

213

1

    conflict=nocheck

214

1

    action=nocheck

215

1

    basedir=default

216

1

217

1

pkg-get.conf

218

1

219

1

    url=http://www.gtlib.gatech.edu/pub/blastwave/unstable

220

1

221

1

ruby-install.sh -- pkg-get running inside a chroot requires a

222

1

working mnttab, and openssl (one of the Ruby dependencies) requires

223

1

a working /dev/random and /dev/urandom. On my Solaris 10 Jumpstart

224

1

installs, /dev/random and /dev/urandom exist in the chroot, but are

225

1

symlinks to missing entries in /devices.

226

1

227

1

    #!/bin/sh

228

1

229

1

    /sbin/mount -F mntfs mnttab /etc/mnttab

230

1

    mknod /devices/pseudo/random@0:random c 190 0

231

1

    mknod /devices/pseudo/random@0:urandom c 190 1

232

1

233

1

    PATH=$PATH:/usr/local/bin:/usr/local/sbin:/opt/csw/bin:/opt/csw/sbin

234

1

    export PATH

235

1

    pkg-get install ruby

236

1

237

1

puppet-install.sh -- these installs might not require a chroot, and

238

1

may work fine if installed similar to the pkg-get installation

239

1

above.

240

1

241

1

    #!/bin/sh

242

1

    /sbin/mount -F mntfs mnttab /etc/mnttab

243

1

    cd /tmp

244

1

    mkdir /etc/puppet

245

1

    echo all | pkgadd -a admin.jumpstart -d \

246

1

            facter-1.3.8,REV=2007.09.23-SunOS5.8-all-CSW.pkg

247

1

    echo all | pkgadd -a admin.jumpstart -d \

248

1

            puppet-0.23.2,REV=2007.09.23-SunOS5.8-all-CSW.pkg

249

1

250

1

puppet.conf

251

1

252

1

    [puppetd]

253

1

    # Make sure all log messages are sent to the right directory

254

1

    # This directory must be writable by the puppet user

255

1

    logdir=/opt/csw/var/puppet/log

256

1

    vardir=/opt/csw/var/puppet

257

1

    rundir=/opt/csw/var/puppet/run

258

1

    server=puppetserver.domain

259

1

    factsync=true

260

1

261

1

# Simple Puppetmaster install and configuration

262

1

263

1

To do

264

1

265

1

# Puppet on older versions of Solaris

266

1

267

1

Of course, blastwave will only work on Solaris 8+. However, Puppet

268

1

does work well with the Ruby from sunfreeware for at least Solaris

269

1

2.6 and 7, and people have even had success compiling pkg-get for

270

1

use with those platforms by pointing it to the sunfreeware

271

1

repository - however, your mileage may vary with that (not tested

272

1

by the person writing this paragraph). Certainly, using sunfreeware

273

1

packages and native sun packages on their own works quite well.

274

1

275

1

# Minimal Solaris Puppet Client Installation Instructions

276

1

277

1

This assumes Solaris 10 or later, you are **root**, with **bash**

278

1

and **wget** installed and in your PATH:-

279

1

280

1

## Step 1, install pkgutil

281

1

282

1

    exec bash

283

1

    wget -q -O - \

284

1

    http://ftp.math.purdue.edu/mirrors/opencsw.org/unstable/$(uname -p)/$(uname -r)/pkgutil-1.4,REV=2009.01.19-SunOS5.8-$(uname -p)-CSW.pkg.gz \

285

1

    | gunzip --stdout - > /tmp/pkgutil.pkg

286

1

    yes | pkgadd -d /tmp/pkgutil.pkg all

287

1

    /opt/csw/bin/pkgutil -U

288

1

289

1

## Step 2, install puppet

290

1

291

1

    yes | /opt/csw/bin/pkgutil -i CSWpuppet

292

1

293

1

This will install common, ruby, facter and any other required

294

1

dependencies, then puppet, and then start up puppetd with a blank

295

1

config (defaults to looking for a puppet server at

296

1

puppet.YOURDOMAIN)

297

1

298

1

## More Detailed Solaris Puppet Client Installation Instructions

299

1

300

1

Installation of the Puppet infrastructure onto a client machine

301

1

requires a number of prerequisites to be met first. This procedure

302

1

outlines the installation process for these prerequisites and

303

1

ultimately Puppet itself on the Solaris 10 platform. Note: This

304

1

guide assumes that LDAPNodes is being used for node storage. If

305

1

not, omit any steps that relate to LDAP and do whatever is needed

306

1

for your node storage mechanism of choice.

307

1

308

1

All Blastwave packages are installed under: /opt/csw

309

1

310

1

### Procedure

311

1

312

1

\1) Install Blastwave Support

313

1

314

1

    # pkgadd -d http://www.blastwave.org/pkg_get.pkg

315

1

316

1

\2) Verify that the pkg-get configuration file is configured for

317

1

 your region

318

1

319

1

\3) Install the complete wget package

320

1

321

1

    # /opt/csw/bin/pkg-get -i wget

322

1

323

1

\4) Configure pkg-get to support automation.

324

1

325

1

    # cp -p /var/pkg-get/admin-fullauto /var/pkg-get/admin

326

1

327

1

\5) Now we are going to install gnupg and an md5 utility so that we

328

1

 can do some security validation of Blastwave packages.

329

1

330

1

    # /opt/csw/bin/pkg-get -i gnupg textutils

331

1

332

1

\6) Next we will copy the Blastwave PGP public key to the local

333

1

 host.

334

1

335

1

    # /opt/csw/bin/wget --output-document=pgp.key http://www.blastwave.org/mirrors.html

336

1

337

1

Which should result in output like this:

338

1

339

1

    --10:39:55--  http://www.blastwave.org/mirrors.html

340

1

               => `pgp.key'

341

1

    Resolving www.blastwave.org... 131.188.30.245

342

1

    Connecting to www.blastwave.org[131.188.30.245]:80... connected.

343

1

    HTTP request sent, awaiting response... 200 OK

344

1

    Length: 16,060 [text/html]

345

1

346

1

    100%[====================================>] 16,060        52.41K/s

347

1

348

1

    10:39:56 (52.33 KB/s) - `pgp.key' saved [16060/16060]

349

1

350

1

\7) Next we will import the PGP key that we just copied.

351

1

352

1

    # gpg --import pgp.key

353

1

354

1

\8) Verify that the following two lines in

355

1

 /opt/csw/etc/pkg-get.conf are COMMENTED OUT.

356

1

357

1

    #use_gpg=false

358

1

    #use_md5=false

359

1

360

1

\9) Install the Ruby software (CSWruby) from Blastwave.

361

1

362

1

    # /opt/csw/bin/pkg-get -i ruby

363

1

364

1

Note: This will also install any Ruby prerequisites.

365

1

366

1

\10) Install the Ruby Gems? software (CSWrubygems) from Blastwave.

367

1

368

1

    # /opt/csw/bin/pkg-get -i rubygems

369

1

370

1

\11) Add /opt/csw/bin and /opt/csw/sbin to the root user's PATH.

371

1

372

1

\12) Install Reductive Labs facter gem package using the Ruby Gem?

373

1

 installation tool.

374

1

375

1

    # gem install facter

376

1

377

1

\13) Install Reductive Labs Puppet gem package using the Ruby Gem?

378

1

 installation tool. The current STABLE version is: 0.23.2.

379

1

380

1

    # gem install puppet --version '0.23.2'

381

1

382

1

\14) Create the puppet user and group:

383

1

384

1

Info for /etc/passwd:

385

1

386

1

    puppet:x:35001:35001:puppet user:/home/puppet:/bin/sh

387

1

388

1

Info for /etc/shadow:

389

1

390

1

    puppet:*LK*:::::::

391

1

392

1

Info for /etc/group:

393

1

394

1

    puppet::35001:

395

1

396

1

\15) Create the following core directories and set the

397

1

 permissions:

398

1

399

1

    # mkdir -p /sysprov/dist/apps /sysprov/runtime/puppet/prod/puppet/master

400

1

    # chown -R puppet:puppet /sysprov/dist /sysprov/runtime

401

1

402

1

\16) Grab this sample puppet.conf file and modify the attributes

403

1

 listed below. Copy the modified file to the

404

1

 /sysprov/runtime/puppet/prod/puppet/master directory on your host.

405

1

406

1

\17) Create a file containing the new LDAP entry information for

407

1

 your host. In this file you specify the Puppet class membership

408

1

 which is what Puppet uses to determine which configuration(s) to

409

1

 use on your host. In the example below, the device is a member of

410

1

 the sudo and syslog-ng classes. This means that whenever the

411

1

 puppetd process is running on your host, it will periodically check

412

1

 with the puppetmaster to see whether its configuration is out of

413

1

 date and apply the configuration for a machine in the sudo and

414

1

 syslog-ng puppet classes. Likewise, if you later modify the LDAP

415

1

 entry to include another puppetclass entry or remove an existing

416

1

 entry, the puppetmaster will apply that configuration instead.

417

1

418

1

Note: You should specify the fully qualified domain name. Puppet

419

1

will compare this value to the SSL certificate to ensure a match.

420

1

If you use a non-FQDN, you are going to run into issues.

421

1

422

1

    # puppettest

423

1

    dn: cn=puppettest.domain.edu,ou=Hosts,dc=puppet

424

1

    objectClass: device

425

1

    objectClass: ipHost

426

1

    objectClass: puppetClient

427

1

    objectClass: top

428

1

    cn: puppettest.domain.edu

429

1

    ipHostNumber: W.X.Y.Z

430

1

    description: Test puppet client

431

1

    l: statcomp

432

1

    puppetclass: sudo

433

1

    puppetclass: syslog-ng

434

1

435

1

\18) Add an LDAP entry for your host. YOUR-LDAP-ENTRY-FILENAME is

436

1

 the file created in the previous step.

437

1

438

1

    $ ldapadd -h ld.domain.edu -x -D uid=12345, ou=humans, dc=domain, dc=edu -W -f YOUR-LDAP-ENTRY-FILENAME -v

439

1

440

1

If you are modifying an existing entry use this instead:

441

1

442

1

    $ ldapmodify -h ld.domain.edu -x -D uid=12345, ou=humans, dc=domain, dc=edu -W -f YOUR-LDAP-ENTRY-FILENAME -v

443

1

444

1

\19) Verify that your LDAP entry exists.

445

1

446

1

    $ ldapsearch -h ld.domain.edu -x -b'dc=puppet'

447

1

448

1

\20) From the Puppet client machine, request SSL Client Certificate

449

1

 from the puppetmaster.

450

1

451

1

    # puppetd --server puppetmaster.domain.edu --waitforcert 60 --test --config=/sysprov/runtime/puppet/prod/puppet/master/puppet.conf

452

1

453

1

\21) Login to the puppetmaster and sign the certificates

454

1

455

1

    # sudo puppetca --list --config=/sysprov/runtime/puppet/prod/puppet/master/puppet.conf

456

1

457

1

Which should show:

458

1

459

1

    YOURHOSTNAME.domain.edu

460

1

461

1

    # sudo puppetca --sign YOURHOSTNAME.domain.edu --config=/sysprov/runtime/puppet/prod/puppet/master/puppet.conf

462

1

463

1

\22) On the Puppet client machine you can then start the puppetd

464

1

 process. If you pass in the -v and/or -d parameters (verbose and

465

1

 debug), then the process does not run in the background. Omit these

466

1

 parameters to daemonize the process.

467

1

468

1

    # puppetd --server puppetmaster.domain.edu --config=/sysprov/runtime/puppet/prod/puppet/master/puppet.conf

469

1

470

1

Example Using Verbose and Debug Mode:

471

1

472

1

    # puppetd -v -d --server puppetmaster.domain.edu --config=/sysprov/runtime/puppet/prod/puppet/master/puppet.conf

473

1

474

1

\23) That is it. You should be able to check the system log to see

475

1

 whether your client is receiving updates from the puppetmaster.

476

1

477

1

    # tail -f /var/adm/messages

478

1

    Dec 17 09:06:39 cheshire puppetd[23486]: [ID 702911 daemon.notice] Starting configuration run

479

1

    Dec 17 09:07:00 cheshire puppetd[23486]: [ID 702911 daemon.notice] (//sudo/File[/sysprov/dist/apps/sudo]/ensure) created

480

1

    Dec 17 09:07:24 cheshire puppetd[23486]: [ID 702911 daemon.notice] (//sudo/File[/sysprov/dist/apps/sudo/UCRsudo]/ensure) created

481

1

    Dec 17 09:07:33 cheshire puppetd[23486]: [ID 702911 daemon.notice] (//sudo/Package[UCRsudo]/ensure) created

482

1

    Dec 17 09:07:33 cheshire puppetd[23486]: [ID 702911 daemon.notice] Finished configuration run in 54.72 seconds

Puppet Solaris