Pretty much all of us engineers want to manage Puppet code in a source control for traceability and manageability. I’m going to write a step-by-step documentation on how to just do it based on this document, this documentation and some other documentation I found by Googling. I had a hard time finding a single document that takes me to where Puppet works out of Git source control, so here it is.
Create a Control Repo from the Puppet template
We will create a Git repo based on a template that Puppet offers on GitHub. Here is the picture of how it work.
Getting Puppet Master Ready to Sync
Using ssh-keygen, create public/private key pair.
First of all, ssh into the Puppet master you installed as root and generate an SSH private/public key pair.
# ssh-keygen -t rsa -b 2048 -C 'code_manager' -f /etc/puppetlabs/puppetserver/ssh/id-control_repo.rsa -q -N ''
It generates 2 files id-control_repo.rsa and id-control_repo.rsa.pub under /etc/puppetlabs/puppetserver/ssh. id-control_repo.rsa is the private key and id-control_repo.rsa.pub is the public key. Let’s print the content of the public key to get the text.
# cat /etc/puppetlabs/puppetserver/ssh/id-control_repo.rsa.pub
Next make sure that the user pe-puppet created by the puppet installation has the ownership on the directory /etc/puppetlabs/puppetserver/ssh Execute the following command.
# chown -R pe-puppet:pe-puppet /etc/puppetlabs/puppetserver/ssh
Next make sure that the pe-puppet account has rwx permissions for the files in SSH key directory.
# chmod 755 /etc/puppetlabs/puppetserver/ssh/
Getting a Git repo Ready
Puppet master (optionally) needs a Git repo to pull code from. In this example, I will use GitLab as my source. This process does not need to be performed on Puppet master. Please skip this section if you already have access to GitLab (or other Git) repository.
SSH Key to GitLab
- Open your terminal or console.
- Generate a SSH key.
$ ssh-keygen -t ed25519
- Print the public key on your console.
$ cat ~/.ssh/id_ed25519.pub
- Navigate to gitlab.com on your browser.
- Click on the icon at the upper right corner of the screen and select Settings.
- Click SSH Keys from the menu on the left.
- On the terminal, copy the printed public key in the previous section and paste it to the Key textarea and click Add key button.
- Now you are ready to access GitLab.
Create a New Repo on GitLab
In this section, we will create a repo on GitLab where Puppet master pull code from. The source control does not have to be GitLab. Any Git server will do as long as your Puppet master can reach it.
- Navigate to gitlab.com on your browser and login.
- Click New Project button.
- Enter control-repo in Project name (or whatever you like). Keep the project private if you don’t want to expose the code but I am making this one a public because this is just an example and I would like to share the code to public later on. Click Create project button.
Cloning control-repo from GitHub to GitLab
Puppet provides us with a template source in GitHub, so we will copy the repo to my own repo on GitLab. The following process can be done from your desktop. As long as you create a copied repo on GitLab, our mission is accomplished in this section.Puppet provides us with a template source in GitHub, so we will copy the repo to my own repo on GitLab. The following process can be done from your desktop. As long as you create a copied repo on GitLab, our mission is accomplished in this section.
- Open your terminal and navigate to the directory where you want to store the code to. (e.g. C:\Windows\Users\[myaccount]\Dev)
- Clone the source repo from GitHub.
$ git clone email@example.com:puppetlabs/control-repo.git
- We don’t want to push any change to GitHub, so we will remove the origin.
$ git remote remove origin
- Add the URL to the GitLab repo we created in the previous section. Please change the URL accordingly.
$ git remote add origin firstname.lastname@example.org:hiriumi/control-repo.git
- Push the code to the GitLab repo.
$ git push --set-upstream origin production
- Alternatively, you can check the URL of the remote by executing the following command.
$ git remote get-url origin
- When you open the GitLab UI, you can see production branch was created automatically because the original repo has production branch. All code must be pushed to the production branch for it to take effect.
Configure Puppet Master
Now we need to tell Puppet master where to pull the source code from. We will do this from the UI.
- Login to https://puppet (or wherever your Puppet is installed).
- Click Classification on the menu.
- Expand PE Infrastructure and click PE Master.
- Click Configuration tab.
- Navigate to Class:puppet_enterprise::profile::master and select r10k_remote from the dropdown list. Paste the SSH URL for the GitLab repo configured in the previous section. Click Add parameter.
- From the same dropdown list under Class:puppet_enterprise::profile::master, select r10k_private_key and enter /etc/puppetlabs/puppetserver/ssh/id-control_repo.rsa.
- From the same dropdown list, select code_manager_auto_configure and set the value to true. Click Commit 3 change button at the lower right corner of the screen.
- Let’s test the configuration by executing the following command.
# puppet agent -t
- You will see an output like the following.
- Login to get a token to execute
# puppet-access login --lifetime 2h
This means the token to execute puppet-code will last for 2 hours.
- Next deploy the environment with puppet-code.
# puppet-code deploy production
- The command above should show an output like this.
puppet agent -tagain.
- All the code pulled from the source control can be located at /etc/puppetlabs/code/environments.
This document explained how to copy the existing template repo and apply it to your own environment. Puppet now can talk to the Git server. However, we need to understand how we can create groups and different environments for testing. I will talk more about it in my blog later.