Puppet

Puppet is a configuration management system written in Ruby. It can be used for automating machine deployments.

Installation
Puppet is provided by the Gentoo package. Currently, there is no distinction between server and client, so the basic installation procedure is the same for both.

First, install Puppet via emerge:

Configuration and Setup
Puppet is mainly configured through /etc/puppet/puppet.conf in an INI-style format. Comments are marked with a hash sign (#). The configuration file is separated into several sections, or blocks:


 * [main] contains settings that act as a default for all parts of Puppet, unless overridden by settings in any of the following sections:
 * [master] is used for settings applying to the Puppetmaster (puppet master), or CA tool (puppet cert)
 * [agent] is used for settings applying to the Puppet agent (puppet agent</tt>)

A more in-depth explanation, as well as a list of further blocks used is available in the official Puppet documentation. Also, there is a list of all configuration options, some of which of course make only sense when applied to either server or client.

Server (Puppetmaster) Setup
The default configuration put by the Ebuild into puppet.conf</tt> can be used as-is. For Puppet 2.7.3, the server-related parts look like this:

Setting up the file server
To be able to send files to the clients, the file server has to be configured. This is done in /etc/puppet/fileserver.conf</tt>. By default, there are no files being served.

The snippet above sets up a share called files</tt> (remember this identifier, as it will need to be referenced later), looking for files in /var/lib/puppet/files</tt> and only available for hosts with an IP from the 192.168.0.0/24 network. You can use IP addresses, CIDR notation, and host names (including wildcards like *.domain.invalid</tt>) here. The deny</tt> command can be used to explicitly deny access to certain hosts or IP ranges.

Starting the Puppetmaster daemon
With the basic configuration as well as an initial file server configuration, we can start the Puppetmaster daemon using its init script:

During the first start, puppet generates an SSL certificate for the Puppetmaster host and places it into the ssldir</tt>, as configured above.

It listens on Port 8140/TCP, make sure that there are no firewall rules obstructing access from the clients.

Manually generating certificates
To manually generate a certificate, you can use the puppet cert</tt> utility. It will place all generated certificates into the ssldir</tt> as set in the puppet configuration and will sign them with the key of your local Puppet Certificate Authority (CA).

An easy case is the generation of a certificate with only one Common Name:

If you need to have multiple host names the certificate is valid for, use the --certdnsnames</tt> parameter and separate the additional host names with a colon:

This example will generate a certificate valid for the three listed host names.