This is the start of a self service provisioning system.
It currently has these functions:
- Provide a REST-like API to manage Hiera YAML files with a certain structure
- Provides a graphical web interface to manage Hiera YAML files
- Provides a command line interface to manage (create, list) Hiera YAML files
- Provides a few Puppet functions to read these files and:
- populate glabal variables (like facts or an ENC)
- apply classes to a node
- Provides a pluggable backend for provisioning. Out of the box are:
- Null provisioner: does nothing when called
- Cloud Provisioner: calls out to Puppet's Cloud Provisioner to spin up, install, and classify new instances
This was originally designed to provide a REST API for provisioning nodes with Razor. With the design of Razor being such that the only bit of information that's known before & after is the MAC address, Arnold creates a Hiera datasource hierarchy allowing classification via either the certname or the MAC address. Because Hiera is so dependent on filesystem paths, this is accomplished by creating symlinks named by the certname and the MAC address. This architecture is slightly clumsy, so it may not last.
- Installing
- It's a Puppet module, yo! Install via
puppet module install binford2k-arnold
or copy thebinford2k-arnold
subdirectory to your modulepath and rename it toarnold
.
- It's a Puppet module, yo! Install via
- Setup the server
- Classify your server with
arnold::provisionator
and apply. - Configure by passing parameters to the
arnold::provisionator
class:reusecerts
- If this is true, Arnold will use the Puppet Master's certs, otherwise self signed certificates will be generated.
- Default value:
true
template
- Allows the caller to specify an alternate template file.
- Default value:
arnold/config.yaml.erb
hieradata
- Allows the caller to specify where Puppet's Hieradata is.
- Default value:
/etc/<puppetroot>/hieradata
user
- The administrative user for managing Arnold.
- Default value:
admin
password
- The password for the admin user.
- Default value:
admin
port
- The port Arnold should listen on.
- Default value:
9090
classes
- A hash of classes and descriptions that should be available for use. See the
tests/provisionator.pp
file for an example. - Default value:
{}
- A hash of classes and descriptions that should be available for use. See the
customconfig
- If this is true, then the module will not manage the config file.
- Default value:
false
- (Optional) manual configuration
- A sample configuration file is included as
doc/config.yaml
. - You will probably want to point the
datadir
to wherever you've configured Hiera to use asdatadir
. - If you choose to generate your own SSL certs, drop them in /etc/arnold/certs and they will not be overwritten.
openssl genrsa -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
- Classes described in
config.yaml
may be applied to nodes and will be listed in the GUI. See the sample.
- A sample configuration file is included as
- Point a web browser at the configured port
- Clicky clicky
- List nodes, create nodes, modify nodes, etc
- Enable arnold for clients:
- In
site.pp
on your master, outside of any node definitions, simply call thearnold()
function. - This will classify the node with any classes defined for that node and create global variables for each parameter listed.
- In
- Classify your server with
Currently only the CloudProvisioner provisioning backend exits. You can enable it by
adding a stanza like this to your config.yaml
backend: CloudProvisioner
keyfile: ~/.ssh/private_key.pem
enc_password: <password>
Provisioning backend will generally have their own configuration requirements. For example, the
Cloud Provisioner requires your ~/.fog
file to be configured for your provisioning provider
of choice.
If a backend is not configured, Arnold will not perform any provisioning actions. It is entirely useful like this, as it will instead only manage the Hiera datafiles.
Besides the web frontend, you can interact with Arnold via the command line and a REST-like API.
Send a JSON formatted payload to Arnold's endpoints that looks like:
{
'macaddr' => '00:0C:29:D1:03:A4',
'name' => 'this.is.another.brand.new.system',
'parameters' => {
'booga' => 'wooga',
'fiddle' => 'faddle',
},
'classes' => [ 'test', 'mysql', 'ntp' ],
}
The known endpoints are:
- Create a node:
/api/v1/create
- Retrieve a node's configuration:
/api/v1/:guid
- Delete a node:
/api/v1/remove/:guid
Sample code is included as doc/postjson.rb
.
Usage:
* arnold help
* arnold list
* arnold show <guid>
* arnold remove <guid>
* arnold new [name=<name>] [macaddr=<macaddr>] [template=<template>] [group=<group>] [classes=<class1,class2,...>] [param1=value1]...
- It does not currently manage parameterized classes.
- Author: Ben Ford
- Email: [email protected]
- Twitter: @binford2k
- IRC (Freenode): binford2k
The development of this code was sponsored by FBL Financial.
Copyright (c) 2013 Puppet Labs, [email protected]
Copyright (c) 2013 FBL Financial, [email protected]
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.