Puppeteers on Puppeteers Oy

Customer testimonials

Mon, 01 Jan 0001 00:00:00 +0000

What do customers say about Puppeteers?

Case: event-driven automation with Kafka and Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Case: event-driven automation with Kafka and Ansible

DevOps partner service

Mon, 01 Jan 0001 00:00:00 +0000

You can get an experienced DevOps team working for you, with you,e on call when you need us.

Samuli Seppänen

Mon, 01 Jan 0001 00:00:00 +0000

Samuli is our CEO and “puppet master”. Samuli has worked with computers since early 1980’s, moving from the Sinclair Spectrum to MSX to Amiga and from there to the PC. In 1998 he installed Linux to his PC. Samuli did an MA in archeology but decided to follow another passion of his, IT.

Freetime interests: Shooting, working and studying languages.

Fun fact: Rarely, when time permits, Samuli spends time recreating ancient weapons such as crossbows and cheiroballistas.

Case: SaaS Cloud backend automation

Mon, 01 Jan 0001 00:00:00 +0000

Case: SaaS Cloud backend automation

LibreNMS image

Mon, 01 Jan 0001 00:00:00 +0000

The fastest and easiest way to get going with LibreNMS

Petri Lammi

Mon, 01 Jan 0001 00:00:00 +0000

Petri’s first computer was an IBM AT which he took apart dozens of times in order to understand what makes it tick. During his studies in philosophy he transitioned from DOS/Windows to Linux and a world of new possibilities opened up to him. This made him get to his senses and acquire a “real” career in ICT.

Favourite thing about IT: Prototyping and learning new technologies.

Favourite food: Anything that doesn’t contain carbs.

Case: Ansible Automation Platform deployment

Mon, 01 Jan 0001 00:00:00 +0000

Case: Ansible Automation Platform deployment

Case: containerized Buildbot CI/CD system

Mon, 01 Jan 0001 00:00:00 +0000

Case: containerized Buildbot CI/CD system

Netbox image

Mon, 01 Jan 0001 00:00:00 +0000

The fastest and easiest way to get going with Netbox

Ricky Cousins

Mon, 01 Jan 0001 00:00:00 +0000

Ricky is an autodidact who loves problem-solving and learning new tools and techniques. He is originally from Tulsa, Oklahoma (US).

Ricky started his career in IT with taking apart his computer when he was a young kid. His curiosity led him to Linux which sparked a passion. In the process of learning more about computers, he found himself quite useful to his friends and neighbors. He enjoys automating and tinkering and often loses track of time doing so.

Case: Keycloak domain mode cluster

Mon, 01 Jan 0001 00:00:00 +0000

Case: Keycloak domain mode cluster

Case: Linux HPC cluster automation

Mon, 01 Jan 0001 00:00:00 +0000

Case: Linux HPC cluster automation

Case: Windows software robot automation project

Mon, 01 Jan 0001 00:00:00 +0000

Case: Windows software robot automation project

Case: Jenkins configuration automation

Mon, 01 Jan 0001 00:00:00 +0000

Case: Jenkins configuration automation

Getting latest Rocky Linux AMI ID

Mon, 02 Dec 2024 00:00:00 +0000

Introduction

Rocky Linux 9 is a bug-by-bug clone of Red Hat Enterprise Linux 9 (RHEL 9). We generally recommend using RHEL 9 for mission-critical workloads, but for less important services Rocky Linux 9 is a very good choice if you’re in the Red Hat land already. Official Rocky images are only available in AWS Marketplace, which complicates things when you need to programmatically determine the latest version. This is a common requirement when you do infrastructure as code, for example with Ansible, Terraform or Packer. Although we speak of latest Rocky Linux AMI here, everything in here is applicable for any other AWS Marketplace images, for example Alma Linux.

Fixing ansible-playbook hangs caused by SSH timeouts

Fri, 29 Nov 2024 00:00:00 +0000

Introduction

Ansible is an infrastructure as code tool that uses SSH as its transport mechanism. When the targeted nodes are close, latency-vise to the Ansible controller things usually work fine with the default settings. However, when the targets are far away or latency is big, you may notice that ansible-playbook hangs on some long-running task and never recovers. When you rerun the playbook it may proceed further and then hang at some other task. Or the same task. This is incredibly frustrating, but fortunately also fairly easy to fix.

Monitoring Azure with Prometheus

Thu, 31 Oct 2024 00:00:00 +0000

Introduction

Prometheus is a great tool for “cloud-native” metrics gathering and monitoring. It is particularly easy to manage with infrastructure as code methods. Prometheus can collect metrics from various sources, including Azure Monitor. You can use Azure Metrics Exporter to convert Azure Monitor metrics into Prometheus metrics, but doing so is definitely not trivial unless you’re pretty familiar with Prometheus, Azure Monitor and Microsoft Entra ID apps. This article tries to help you make monitoring Azure with Prometheus a breeze instead of a struggle. We won’t go into a lot of detail about Prometheus or Azure Monitor as there’s plenty of information available elsewhere about both of them. Also note that this article is about vanilla Prometheus, not Microsoft’s “Azure Monitor managed service for Prometheus”.

Avoid double taxation when selling to the U.S

Thu, 03 Oct 2024 00:00:00 +0000

Introduction

We sell digital products in AWS Marketplace, Azure Marketplace and Udemy - see our products page for detail. The end customers of our products are located around the world, including the Unites States of America. All the aforementioned platforms a located in the U.S. This means that they comply with the U.S. tax laws both on the state and federal level. Internal Revenue Service (IRS) is responsible for collecting the federal taxes, which are relevant for this article. Foreign (e.g. European) corporations that sell (digital) products or services to U.S. customers need to prove to IRS that it should not withhold federal taxes from the income coming from U.S. end customers. The goal of this article is to help European corporations (companies) avoid double taxation: first by the IRS and then by the tax office of its own home country. We have all the basic information that a typical European corporation (company) needs to do to avoid double taxation when selling services or digital products to U.S. end customers.

Alldomains.hosting IPv6 support

Wed, 25 Sep 2024 00:00:00 +0000

We’ve recently started using alldomains.hosting for what we call “programmatic emails”. For that purpose alldomains.hosting is dirt cheap (~1€/year/email address), which makes one quite motivated to suffer through the confusing website to figure out how to buy stuff from them. Once you’ve managed to buy your domain and/or mail services they just “tend to work”. Alldomains.hosting IPv6 support, or lack of it, may be a problem for you, though.

For example, in AWS EC2 you nowadays really want to avoid assigning public IPv4 addresses to EC2 instances as they cost quite a lot. So, you set up an IPv6-only egress-only internet gateway in your VPC and, for the most part, everything “just works”. Then you try to add mail delivery via alldomains.hosting and IPv6 and “boom”, it does not work. According to their support (as of 25.9.2024) their mail servers lack IPv6 support.

Microsoft Entra ID multi-factor authentication in RDP

Fri, 28 Jun 2024 00:00:00 +0000

Introduction

Microsoft Entra ID, formerly known as Azure Activate Directory (AAD), is replacing classic on-premise Active Directory installations slowly but surely. It replaces “legacy” protocols such as LDAP and Kerberos with “modern” protocols such as SAML, OIDC and OAuth2. However, the client-side support in various operating systems such as Windows, Linux and MacOS is spotty, to say the least. You can make things work, but only if the stars (or rather, bits) are aligned just right. This article explains how multi-factor authentication in RDP works with Azure VMs when using Microsoft Entra ID. Note the emphasis on MFA: without MFA you can make logins with Entra ID work more easily by using the normal username + password authentication in RDP.

Installing OpenBSD 7.5 with virt-install on Linux

Wed, 12 Jun 2024 00:00:00 +0000

Introduction

OpenBSD 7.5 is a UNIX-like operating system. The project’s “efforts emphasize portability, standardization, correctness, proactive security and integrated cryptography”. Compared to modern Linux distributions OpenBSD is very compact, but comes with the usual packages and ports tree you would expect from any *BSD operating system. This article shows the process of installing OpenBSD 7.5 with virt-install, making it a virtualization guest on Linux.

Downloading the ISO installer

First you need to download the OpenBSD 7.5 ISO installer on your Linux system. On most systems the amd64 install75.iso is the correct choice. Check the OpenBSD download page for other architectures.

Using Hiera with Ansible

Fri, 07 Jun 2024 00:00:00 +0000

Introduction

Hiera is a very powerful “key-value configuration data lookup system” used mainly, but not exclusively, with the Puppet configuration management and orchestration system. In Hiera data is stored in in yaml files in, as the name implies, a hierarchy or set of prioritized levels. A typical Hiera lookup goes through the hierarchy starting from the highest-priority level and stops when it finds a match. That match could come from a node yaml file, a deployment (e.g. production or staging) yaml file or from site-wide yaml. What this essentially means is that you can define common, site-wide parameters at the lowest level of the hierarchy and override those when needed at higher levels. How does Hiera and Ansible work together, then? The short answer is “they don’t, really”, but the long answer is more complex than that.

RHEL on Upcloud

Mon, 27 May 2024 00:00:00 +0000

Introduction

Upcloud is a Finnish Cloud provider that focuses on high-quality services. There is no built-in support for installing RHEL on Upcloud, which is quite typical of “small Clouds”. Sometimes you don’t want to use clones (e.g. Rocky Linux) and need real RHEL instead. This is where this article comes handy, as the RHEL installation process in Upcloud is far from trivial. This article focuses on RHEL 9, but the process may work with older and newer versions as well. The process I describe here applies almost 1:1 to any Linux operating system Upcloud does not natively support.

Buildbot build order: how to run certain builds before others?

Tue, 06 Feb 2024 00:00:00 +0000

Introduction

The mechanisms for configuring Buildbot build order is documented fairly well. However, what that documentation lacks is a centralized place where ordering is explained. My personal goal was to run smoke tests first and if those don’t pass then cancel all other build requests. That seemed straightforward, but turned out not to be so. There were many, many ways that could in theory be achieved, but most of those did not work at all, or worked only partially. This article attempts to fill the “how do I order builds in Buildbot” gap, including what can and can’t be achieved with each strategy.

Red Hat subscriptions quick start

Mon, 15 Jan 2024 00:00:00 +0000

What follows is an minimalistic, bare-bones guide to get you started with Red Hat subscriptions quickly. No spoon-feeding, no introductions, just get your first RHEL* system into a blessed state quickly, while your attention can still keep up.

We assume you are starting from scratch and generally have no glue. We also assume that your boss has punished you with this task, not your mom, and therefore you represent a company, not a Sapiens specimen that looks like you. If this is not the case, then it isn’t.

Stop EC2 instances automatically with Terraform

Thu, 04 Jan 2024 00:00:00 +0000

Introduction

AWS EC2 is a very convenient place for experimenting with and testing things on virtual machines (or “EC2 instances”). However, it is also very easy to forget such EC2 instances running for no reason, which can become very costly very quickly. Fortunately In AWS computing (e.g. CPU, memory and I/O usage) and storage (disk) usage are billed separately. In other words: if your EC2 instance is stopped, you only pay for its storage. This cuts down the costs significantly, especially if your are using powerful EC2 instance types. So, you definitely should to stop EC2 instances automatically, say, every evening, if you don’t need them to be up. There is no built-in way in to do, though, so this article shows a couple ways it can be done.

Understanding Infrastructure as Code (IaC)

Tue, 02 Jan 2024 00:00:00 +0000

Learn what infrastructure as code is and how you can utilize it to your advantage

Options for building self-service infrastructure with Ansible and Terraform

Wed, 22 Nov 2023 00:00:00 +0000

Introduction

Being able to build IT infrastructure always having to involve an IT, operations or platform team seems be a big priority for many organizations. This is understandable because processes typically slow down to a crawl when they have to pass organizational boundaries. Also, teams responsible for infrastructure would not want to spend time on routine requests if possible. Provisioning infrastructure is no exception here. It is possible to create a custom solution to enable self-service infrastructure with Ansible and Terraform, but that takes a fair amount of effort. In this article we focus on open source and commercial open source offerings that make enabling self-service infrastructure provisioning easier.

COSS-webinaari: automaatio avoimen lähdekoodin välinein

Mon, 20 Nov 2023 00:00:00 +0000

Toimitusjohtajamme Samuli Seppänen on kutsuttu puhujaksi COSS ry:n webinaariin ma 4.12. 2023 klo 9. Webinaarin aiheena avoimen lähdekootin välinein toteutettava IT-automaatio.

“IT-automaatiolla nostetaan kierroksia samalla kun vähennetään kaasua. Avoimen lähdekoodin välinein tehdyllä IT-automaatiolla voidaan nopeuttaa ja tehostaa toimintaa sekä parantaa työn tuloksia mitattavasti. Yrityksille ja organisaatioille, joiden on pakko hakea yhä uusia keinoja kilpailukykynsä parantamiseen, IT-automaatio antaa syvällisesti toteutettuna mukavan lisäpotkun kilpailijoista erottautumiseen laadulla ja nopeudella. Strategisella automaatiolla voidaan lisäksi vähentää organisaation siiloutumista ja poistaa prosessien pullonkauloja. Mitä sitten avoimen lähdekoodin IT-automaatiosta tulisi tietää, jotta yritykset ja organisaatiot voivat valjastaa sen keskeiseksi osaksi tehokkuuden ja laadun maksimointia?”

Red Hat -automaatiolounas 1.11.2023

Tue, 24 Oct 2023 00:00:00 +0000

Järjestämme yhteisen lounastapahtuman Red Hatin ja 6G Nordic Oyn kanssa Turussa 1.11.2023. Tapahtuma kulkee nimellä automaatiolounas ja siellä kuullaan käytännön esimerkkejä ja ajatuksia IT-automaatiosta ja siitä, miten se kannattaa valjastaa koko yrityksen käyttöön strategiseksi voimavaraksi. Tilaisuus on tarkoitettu tekijöille, tiiminvetäjille ja managereille - kaikille, jotka näkevät, että automaatiotason nostosta olisi hyötyä.

Lämpimästä tervetuloa!

Lisätietoja ja ilmoittautumiset tästä.

Install RHEL 9 on Hetzner Cloud

Fri, 20 Oct 2023 00:00:00 +0000

Scaling a mountain is about as easy as to install RHEL 9 in Hetzner Cloud in scalable way. At minimum, you need this article and lots of endurance to pull it off. Photo credit.

Introduction

Hetzner Cloud is a really good “small” Cloud with particularly good value for money. While it does not have hundreds of services like AWS or Azure, but it has most of the basic stuff. Hetzner cloud has built-in support for Red Hat Enterprise Linux (RHEL) clones such as Rocky Linux 9. However, you cannot spin up real RHEL 9 instances without spending some time on it. This article will give you all the details you need to install RHEL 9 on Hetzner Cloud. We do that in a way that you can reuse your RHEL 9 installation to spin up multiple servers from one snapshot. This way you don’t have to run the RHEL installer for every RHEL server you want to spin up.

Puppeteers Joins Red Hat Solution Provider Program

Tue, 17 Oct 2023 00:00:00 +0000

Puppeteers has started a collaboration with Red Hat, the world’s leading provider of open source solutions. This collaboration marks Puppeteers as a member of the Red Hat partner ecosystem, where it brings its expertise in automation and open-source technologies to the forefront.

Today, organizations across various sectors are under immense pressure to deliver services quickly while upholding stringent security practices. Information technology is pivotal in meeting these demands, and automation offers a compelling solution to address challenges related to scalability, predictability, and efficiency. Red Hat, renowned for its automation solutions, is at the forefront of helping organizations navigate these challenges.

Blackbox Exporter ICMP module and selinux

Thu, 21 Sep 2023 00:00:00 +0000

Blackbox Exporter ICMP module and selinux do not like each other. Same goes for systemd units and ICMP Echo sockets. However, with persistence, skill and a bit of luck you can make it all work together. Photo credit.

Introduction

Blackbox Exporter is an exporter for the Prometheus monitoring system. It is able to probe a target, such as a host or an application from the outside. Blackbox Exporter does probing with modules such as http, tcp, dns, icmp and grpc (details here). The icmp module is special because it does privileged operations that require the CAP_NET_RAW capability and as well as custom selinux policies. This article aims to explain how you can make Blackbox Exporter ICMP module and selinux work together. NOTE: you do not need any of these tricks if you use non-icmp Blackbox exporter modules.

Excluding down targets in Prometheus

Fri, 11 Aug 2023 00:00:00 +0000

Excluding down targets in Prometheus is easy. It allow you to monitor volatile systems that start and shut down on demand.

Introduction

Prometheus is an open source metrics and alerting solution used to monitor a wide range of things. Unlike many classic network monitoring systems Prometheus is focused on colleting metrics. This makes it quite easy to do things that would be difficult in others systems. For example excluding down targets in Prometheus is quite trivial. This can be highly useful when you have volatile, static targets that come and go - for example Jenkins slaves (or build agents). Even on such targets you’d want to monitor things like systemd service status, memory usage and disk usage.

How to reduce RDS storage size in an automated way

Thu, 10 Aug 2023 00:00:00 +0000

Introduction

Amazon RDS is a relational database service available on Amazon Web Services. It is essentially a managed database server with a volume for the data. Both cost money. Having a large dataset is not the only reason have big volume: the volume size determines the number of I/O operations (IOPS) the volume can do. If you have high load on your RDS instance you may very well run out of IOPS which can result in a disaster. Scaling up the volume size is easy to avoid such disasters, but it is much more difficult to reduce RDS storage size. This is because downsizing RDS storage size is not officially supported by AWS. If the load on your RDS instance goes down (e.g. due to refactoring), you may end up having a database with an oversized volume that costs lots of money for no reason.

Downsize AWS RDS Volume

Mon, 08 May 2023 00:00:00 +0000

It is trivial to downsize an AWS RDS instance. It is equally trivial to upsize AWS RDS volumes. However, to downsize AWS RDS volume you need to jump through lots of hoops.

So, why would you ever want to downsize an AWS RDS volume? One reason might be that you increased the volume size simply to get more burst credits for the volume. Then you did refactoring that reduced the need to have that many credits and want to save money. Or maybe you genuinely had a huge amount of data on your RDS instance volume, removed some of it but got stuck with a huge volume.

Linux Azure AD authentication options

Wed, 26 Apr 2023 00:00:00 +0000

There are a myriad of ways to login to Linux systems using Azure AD credentials. Photo credit.

Introduction

There are several ways to do Linux Azure AD authentication. Note that Azure AD was renamed “Microsoft Entra ID” recently, but in this article we’ll use its old name, at least for now. In other words you can log in to your Linux hosts Azure Active Directory (“Azure AD”) credentials in various ways. Azure, Microsoft’s public Cloud, builds on top of Azure AD. In fact, your Azure users, groups, roles and role assignments are stored in Azure AD.

Keycloak Javascript policy deployment

Wed, 19 Apr 2023 00:00:00 +0000

Introduction

This article tries to include everything you need to know about Keycloak Javascript policy deployment. By Javascript policies I mean authorization policies of Javascript type attached to Keycloak clients that have authorization enabled. If you don’t know what Keycloak authorization services are, you are probably in the wrong place.

While the process of creating and deploying the JAR files is pretty well documented, it is not altogether clear for the uninitiated how the policies are shown in Keycloak.

Openshift versions: all you hopefully need to know

Wed, 05 Apr 2023 00:00:00 +0000

Introduction

Red Hat Openshift is essentially an opinionated Kubernetes distribution that comes with a large number of features such as CI/CD and container registry built-in; for a full list of differences look at the Red Hat OpenShift vs. Kubernetes. Openshift comes in a number of versions, some commercial and some open source. The naming history of Openshift is particularly confusing. That’s why I wrote this blog post where I attempt to list most Openshift versions and variants and outline their main differences.

Keycloak authorization services REST API: paths and payloads

Fri, 24 Mar 2023 00:00:00 +0000

Introduction

The Keycloak Authorization Services allows you to offload your application’s authorization decisions to Keycloak instead of implementing them in your code. This way you can leverage Keycloak’s advanced features like 2FA without any additional development on your part. If you’re unfamiliar with the Authorization Services I suggest having a look at the Keycloak authorization services terminology first. You may also be interested in our sample code for managing Keycloak authorization services programmatically. To be perfectly honest, there is no separate Keycloak authorization services REST API. While the authorization services do support the UMA Protection API, that API is only needed if you want your resource servers (e.g. webapps) to be able manage their own authorization services configuration inside Keycloak. For example, you might want to provide your webapp users the capability to grant access (e.g. read, write) to their own resources to other users. In this article we will not cover the Protection API at all.

Debugging Keycloak OIDC token exchange

Wed, 22 Mar 2023 00:00:00 +0000

Introduction

There’s no substitute for understanding what you’re doing, and that in turn is difficult without seeing what is happening. Debugging Keycloak OIDC problems without understanding what is happening under the hood is no exception to this rule. The purpose of this article is twofold:

Help you learn how Keycloak OIDC token exchange work
Provide you with the tools to debug Keycloak OIDC token exchanges in production environments

For the purposes of this blog post I’ve been using the OpenID Connect Playground application from the book Keycloak - Identity and Access Management for Modern Applications from Packt Publishing. I can recommend that book for anyone who needs to understand Keycloak and in particular the protocols it supports (OAuth2, OIDC and SAML 2.0).

Keycloak authorization services: terminology

Fri, 17 Mar 2023 00:00:00 +0000

Introduction

Keycloak Authorization Services are built on top of well-known standards such as the OAuth2 and User-Managed Access specifications (UMA). You can manage Keycloak Authorization Services programmatically, if needed, as described in our other blog post.

OAuth2 clients (such as front end applications) can obtain access tokens from the server using the token endpoint and use these tokens to access resources protected by a resource server (such as back end services).

In the same way, Keycloak Authorization Services provide extensions to OAuth2 to allow access tokens to be issued based on the processing of all policies associated with the resource(s) or scope(s) being requested. This means that resource servers can enforce access to their protected resources based on the permissions granted by the server and held by an access token. In Keycloak Authorization Services the access token with permissions is called a Requesting Party Token or RPT for short.

Let's Encrypt on AWS: when, where and why

Wed, 15 Mar 2023 00:00:00 +0000

Let’s Encrypt on AWS can be a can of worms if you don’t know what you’re doing. Photo credit.

Introduction

Let’s Encrypt and the ACME protocol enable getting free (as in beer) TLS/SSL certificates. The main use for Let’s Encrypt is to enable HTTPS on web servers. Let’s Encrypt TLS certificates expire pretty quickly, in 3 months, but the idea is that renewal is automated so that you don’t ever really have to worry about expiration, unlike with commercial TLS certificates, which you typically need to manually renew every 12 months. Using Let’s Encrypt on AWS is in some cases a very viable option, but not so much in others. In many cases trying to use Let’s Encrypt certificates leads you down the path of Lovecraftian horrors and madness. Because “it all depends” I’ll try to explain when using Let’s Encrypt is viable in the AWS context and when you really should just give up an use certificates generated by the Amazon Certificate Manager (“ACM”) instead.

Wrong Route53 domain contact details

Thu, 02 Mar 2023 00:00:00 +0000

The symptoms

I recently received and email from Amazon Route53 asking me to verify the contact details for one of our registered DNS domains (replaced here with example.org). And sure enough, I saw wrong Route53 domain contact details in the email:

Subject: Confirm that contact information for example.org is correct.
Message body:

Dear AWS customer,

This message is a reminder to help you keep the contact information for your domain registration up to date. WHOIS records include the following information:

  Domains:
  example.org

  Registrant:
  Name: On behalf of example.org owner
  Organization Name: Identity Protection Service
  Address: PO Box 786
  City: Hayes
  State/Province: Middlesex
  Country: GB
  Postal Code: UB3 9TR

  Administrative Contact:
  Name: On behalf of example.org owner
  Organization Name: Identity Protection Service
  Address: PO Box 786
  City: Hayes
  State/Province: Middlesex
  Country: GB
  Postal Code: UB3 9TR
  Phone: +44.1483307527
  Fax: +44.1483304031
  Email: e793d865-97ab-42ab-805c-50cc36fd9202@identity-protect.org

  Technical Contact:
  Name: On behalf of example.org owner
  Organization Name: Identity Protection Service
  Address: PO Box 786
  City: Hayes
  State/Province: Middlesex
  Country: GB
  Postal Code: UB3 9TR
  Phone: +44.1483307527
  Fax: +44.1483304031
  Email: e793d865-97ab-42ab-805c-50cc36fd9202@identity-protect.org

The contact information provided above is what is shown in the public WHOIS. If your domain is privacy protected, the information will be different than the contact data you have submitted. To verify your contact information, please open the Amazon Route 53 console to view your current contact information and make any necessary corrections:
https://console.aws.amazon.com/route53/home#DomainDetail:example.org

If your information is accurate, you do not need to take any action.

Important
Under the terms of your registration agreement, providing false contact data can be grounds for the cancellation of your domain name registration.

Regards,
Amazon Route 53

These wrong Route53 domain contact details originate from whois data for the registered domain. One might reasonably expect the whois data to match the contact details for AWS Route53 domain. However, in this case the Route 53 contact details were correct, but whois data seemed to be out of sync with those.

Keycloak realm SMTP settings with Ansible

Mon, 27 Feb 2023 00:00:00 +0000

Introduction

Ansible has reasonably good support for managing various aspects of Keycloak. You can use the community.general.keycloak_realm module to handle realm management, including Keycloak realm SMTP server settings. However, in the true Ansible fashion the documentation looks good, but does not help you much. In fact, documentation only mentions that the smtp_server parameter is a dictionary, but that’s it. To be honest, that’s about as helpful as the description of the RealmRepresentation for Keycloak. This article aims to fill this documentation void. I also want to share some general advise for similar cases that pop up when you manage Keycloak programmatically.

Integrating Twilio SMS and Prometheus Alertmanager

Thu, 16 Feb 2023 00:00:00 +0000

Introduction

Prometheus is a widely used, cloud-native open source monitoring solution. Its alerting component is called Alertmanager, which can send alerts to email, Slack and elsewhere. Both Prometheus and Alertmanager fit very well into the infrastructure as code model as well. Twilio SMS is a SMS sending service with consumption-based pricing model with an extensive API. With some effort you can integrate Twilio SMS and Prometheus together as described in this article.

Testing AlertManager webhooks with curl

Mon, 06 Feb 2023 00:00:00 +0000

Introduction

Prometheus is a Cloud-native metrics platforms that is very easy to manage with infrastructure as code tools. Prometheus is often couple with Alertmanager which handles alerting and alert routing. AlertManager has good support for various alert transport (e.g. email or slack) but its alerting capabilities can be extended with custom webhooks. When AlertManager is configured to use a webhook in an alert route, it forwards alerts to an HTTPS/HTTP endpoint instead of handling transporting of the alert itself. AlertManager’s official documentation gives a rough idea of what kind of payload to use and how to configure the webhook in alertmanager.yaml. What is not documented is how you can send test alerts to the webhook without having to trigger real (or fake) alerts in Prometheus. While using fake alerts does work, it is a slow, tedious and invasive process. This article shows one way for testing AlertManager webhooks with curl. In our case the target was to speed up testing of changes to promtotwilio.

Helpotusta työsuhde-etujen lataamiseen: Edenred-latausten automatisointi

Fri, 27 Jan 2023 00:00:00 +0000

Kyllästyimme Edenred-korttien latauksen kankeuteen ja automatisoimme latausprosessin. Tässä artikkelissa kerrotaan, miten automaatio toteutettiin CSV-tiedostoilla ja ohjelmistorobotilla. Lisäksi artikkelista löytyy linkit GitHub-sivustollemme, josta voit ladata koodit käyttöösi.

Edenred-korttien lataustapoja

Edenred on yksi suurimmista suomalaisista työsuhde-etujen tarjoajista. Edenred tarjoaa fyysisiä ja virtuaalisia kortteja, joihin voidaan ladata työntekijöiden lounas-, virike- ja työmatkaetuja. Edenred-korttien lataamiseen on lukuisia tapoja, mutta kaikki ne vaativat merkittävästi käsityötä työntekijän ja/tai työnantajan puolelta. Vaikka työntekijät voivatkin automatisoida omat saldolatauspyyntönsä, pitää työnantajan silti muistaa hyväksyä ne. Tässä artikkelissa esitellään tapa automatisoida Edenred lataus kokonaan CSV-tiedostolla ja Robot Frameworkia käyttävällä ohjelmistorobotilla. Ainoastaan Edenredin lähettämien saldotilauslaskujen maksu pitää tehdä käsin, joskin tämäkin olisi haluttaessa automatisoitavissa.

Adding new permission with Keycloak authorization services REST API

Sun, 15 Jan 2023 00:00:00 +0000

What does it do, this Keycloak thing?

Dear seasoned keycloaker, as you probably know, Keycloak is a stable, scalable, programmable and otherwise killer platform to centralize all your identity, authentication and authorization needs. Keycloak supports fine-grained authorization policies using Keycloak authorization services. We highly recommend reading our Keycloak authorization services terminology article before this article. if you don’t understand terms, you will have some hard times ahead. The purpose of this article is to give you an example of how to work with the Keycloak authorization services REST API.

Debugging Terraform AWS UnauthorizedOperation errors

Wed, 11 Jan 2023 00:00:00 +0000

Causes for the Terraform AWS UnauthorizedOperation errors

Terraform is an infrastructure as code tool you can use to configure Cloud resources in AWS. When using Terraform AWS provider you frequently run into various UnauthorizedOperation errors when creating, modifying or deleting resources. That happens unless you do what you should not do and let Terraform use an AWS API key tied to an IAM user with full admin privileges. In almost all cases Terraform UnauthorizedOperation errors are caused by missing IAM permissions. It can sometimes be a bit tedious to get to the root cause, because Terraform may not show it in its normal output.

How to disable S3 bucket ACLs

Tue, 10 Jan 2023 00:00:00 +0000

Introduction

AWS recommends that you disable S3 bucket ACLs for all new buckets. To understand why some background information is needed.

AWS S3 providers two ways to manage access to S3 buckets and objects:

Access policies: these are standard IAM policies that you attach to users (“user policies”) or resources (“resource-based policies”). IAM policies are the recommended method for managing access to Amazon S3 nowadays.
Access Control Lists (ACLs): ACLs are an older access control method for AWS S3. ACL map to IAM permissions. ACLs works on the bucket and object (file) file.

Microsoft Teams: a rant

Sun, 25 Dec 2022 00:00:00 +0000

It’s time for a brief rant about Microsoft Teams. Before we start I’ll state that Teams is probably an ok platform for collaboration when you work for just one organization. But when you need to work with multiple organizations, each with their own Teams, you immediately run into a world of hurt. There are two reasons:

There are no third-party clients or plugins for Teams
Official Teams web and desktop clients force you to actually switch workspaces (or organizations) if you want to participate in discussions

Convert a hash into JSON in Puppet

Thu, 22 Dec 2022 00:00:00 +0000

This article shows you how to convert a hash into JSON in Puppet using a simple ERB template that gets its data from Hiera.

Suppose you have this data in Hiera:

myhash:
  mykey:
    foo: one
    bar: two

Converting a hash into a JSON file on the target node is surprisingly easy. First look up the data:

$myhash = lookup('myhash', Hash)

Then create a simple ERB template (here: mymodule/templates/myhash.erb)

Terraform downloads the deprecated azure provider

Tue, 20 Dec 2022 00:00:00 +0000

You are 100% sure that all your Terraform resources are using terraform-provider-azurerm, yet Terraform attempts to download the deprecated “azure” provider:

$ terraform init
Initializing modules...

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/local versions matching "2.2.3"...
- Finding latest version of hashicorp/azure...
- Finding hashicorp/azurerm versions matching "3.17.0"...
- Installing hashicorp/local v2.2.3...
- Installed hashicorp/local v2.2.3 (signed by HashiCorp)
- Installing hashicorp/azurerm v3.17.0...
- Installed hashicorp/azurerm v3.17.0 (signed by HashiCorp)
╷
│ Error: Failed to query available provider packages
│ 
│ Could not retrieve the list of available versions for provider hashicorp/azure: provider registry registry.terraform.io does not have a provider named
│ registry.terraform.io/hashicorp/azure
│ 
│ Did you intend to use terraform-providers/azure? If so, you must specify that source address in each module which requires that provider. To see which
│ modules are currently depending on hashicorp/azure, run the following command:
│     terraform providers
╵

You grep the state file and find no references to the “azure” provider. You assume that the cause is some nested module that depends on it, but no, that’s not it. You run “terraform providers” and see that indeed, the “azure” provider is required:

Azure Private DNS and VPN Gateway

Tue, 13 Dec 2022 00:00:00 +0000

What is Azure Private DNS?

Azure Private DNS is a DNS service for Azure virtual networks. You can register a private DNS zone to Azure Private DNS and then link that zone with one or more virtual networks. If you enable DNS auto-registration for a virtual network, a new resource (e.g. virtual machines and VPN Gateways) will automatically add its IP address to Azure Private DNS. Resources in the linked virtual networks can use entries in Azure Private DNS to locate each other, instead of relying on IP addresses or the default Azure DNS domain. You can make Azure Private DNS and Azure VPN Gateway work together in several ways, some of which this article will describe.

Writing Ansible modules: when and why?

Wed, 23 Nov 2022 00:00:00 +0000

What are Ansible modules?

Ansible modules provide the infrastructure as code building blocks for your Ansible roles, plays and playbooks. Modules manage things such as packages, files and services. The scope of a module is typically quite narrow: it does one thing but attempts to do it well. Writing custom Ansible modules is not particularly difficult. The first step is to solve the problem with raw Python, then you can convert that Python code to an Ansible module

Software sovereignty: open source in the EU

Thu, 17 Nov 2022 00:00:00 +0000

What is software sovereignty

Software sovereignty is a subset of digital sovereignty. In essence, digital sovereignty means controlling your data, hardware and software. In Europe digital sovereignty has been driven by the EU. The reason is the reliance on services from big, global US-led vendors such as Amazon, Microsoft and Google. This poses a risk to the EU, just as does reliance on Chinese manufacturing is similarly a risk.

These worries are compounded by the threats to democracy posed by rise of authoritarianism (e.g Russia and China) and other threats to democracy, such as Trump’s rise to power and the MAGA movement in the US, and the rise of far-right nationalistic parties in various European countries. Without digital sovereignty in general, or software sovereignty in particular, somebody could “pull the plug” and you would loose access to your own data, hardware and software. Moreover, if you do not control your data, hardware and software, you’re capability to innovate is severely hindered.

Version locking Ansible Collections

Tue, 01 Nov 2022 00:00:00 +0000

What are Ansible Collections?

Ansible is an infrastructure as code tool used for configuration management, network device management, orchestration and other tasks. Ansible Collections are a way to distribute Ansible content such as roles, playbooks and modules. They can be downloaded from Ansible Galaxy, Git repositories or local directories. Basically collections are a more modern packaging format compared to standalone roles which they are in the process of replacing. Version-locking Ansible Collections allows you to run the exact same Ansible code every time.

Automation use-cases in the Cloud: Red Hat Open Tour 2022 Tallinn

Fri, 14 Oct 2022 00:00:00 +0000

Automation use-cases in the Cloud

Johan Wennerberg, a Solution Architect for Red Hat Nordics in Stockholm gave presentation in Red Hat Open Tour 2022 Tallinn. In his presentation titled “Gain robust repeatability as selfservice, by automating your automation” he listed several automation use-cases in the Cloud. Each of these automation use-cases is made possible by automation stacks. The automation stacks are technology stacks that produce business value through automation. In practice you need to build your automation stacks on top of infrastructure as code.

Ansible variable validation with ansible.utils.assert

Thu, 06 Oct 2022 00:00:00 +0000

Overview of Ansible quality assurance

Ansible is an IT automation engine which you can use for configuration management, orchestration and device management, among other things. While you can get started fast with Ansible, ensuring high-quality, bug-free code can be challenging. Moreover, there’s not that much official, high-quality or coherent documentation available on Ansible quality assurance best practices. While low hanging fruit like Ansible variable validation are available, they are not emphasized in official documentation.

Cloud automation and infrastructure standardization at Red Hat Open Tour 2022

Sat, 01 Oct 2022 00:00:00 +0000

We participated in Red Hat Open Tour 2022 Tallinn a while back. Johan Wennerberg, who is a Solution Architect for Red Hat Nordics in Stockholm, gave a presentation titled “Gain robust repeatability as self.service, by automating your automation”. Among other things he discussed the importance and use-cases of Cloud infrastructure standardization and automation. Here I willsummarize his views on standardization and automation and explain how they tie in with our focus on quality in the Cloud infrastructure and elsewhere.

Importing DNS records from Cloudflare to Terraform

Fri, 30 Sep 2022 00:00:00 +0000

Computers were supposed to relieve us humans from boring and repetitive jobs. Here we turn this upside down and do the boring and repetitive job of a computer by importing Cloudflare DNS records to Terraform ourselves. Not fun, but someone’s gotta do it sometimes. If you’re reading this, that someone is probably you. Condolences. My hope is that someone lazy enough gets bored enough to write a program to do this. I didn’t. Yet.

Azure function monitoring with Azure Monitor and Application Insights

Mon, 26 Sep 2022 00:00:00 +0000

Microsoft Azure provides a metrics and monitoring framework called Azure Monitor. With it you can monitor your Cloud infrastructure and services running there. You can view graphs of the metrics, alert on threshold and all that usual stuff, just like in AWS Cloudwatch.

Some Cloud resources like Azure Functions expose “a limited number of useful metrics” in Azure Monitor. This is a polite way of saying that the metrics are “completely useless” for most intents and purposes. For example, an Azure Function that gets triggered a few times a week on an irregular schedule by real people you don’t really have any useful metrics in Azure Monitor which you could alert on if something is off.

Red Hat Open Tour 2022: Ansible automation project at Elering

Sat, 17 Sep 2022 00:00:00 +0000

We participated in Red Hat Open Tour 2022 Tallinn a few weeks ago. Jaan Tanel Veikesaar from Elering, a gas/energy company in Estonia, gave a really nice presentation about their Ansible automation project. Ansible is a very common infrastructure as code and automation tool. Below I’ll go over Jaan’s presentation, adding some comments and key takeaways.

The starting point for the Ansible automation project

The starting point at Elering was fairly typical: to create a new VM, one had to go to VSphere, launch a VM and continue from there manually. In other words, automation did not really exist. This started to change when business started to demand more from the IT without adding any more human resources. This essentially made automation a necessity instead of being a luxury. So, they did some research and testing, after which Elering ended up with Ansible. They made this choice in part because whenever an Ansible problem was encountered, they could find an answer easily from the Internet.

Terraform, AWS Cloudfront and CNAMEAlreadyExists error

Sat, 17 Sep 2022 00:00:00 +0000

When you create a distribution, AWS creates several DNS A records with the same name (e.g. d25gma2ea3ckma.cloudfront.net) which point to IPs the distribution is using. Then, typically, you would define CNAME(s) pointing to that cloudfront.net address in your own DNS. Each Cloudfront distribution has a list of aliases, similar to Subject Alternative Names (“SAN”) in SSL certificates. The aliases should match the CNAME(s) you’ve set in DNS.

Now, this is all good until you need to migrate those Cloudfront distributions to, say, a new AWS account. If you attempt to create a new distribution (here with Terraform) with the same alias you will get this error:

Enabling Azure Backup on Linux VMs with Terraform

Mon, 05 Sep 2022 00:00:00 +0000

This article shows you how to enable Azure Backup on Linux VMs. It is recommended to read the Understanding Azure Backup for Linux VMs article first before trying to enable backups with Terraform. Terraform AzureRM provider has three relevant resources:

azurerm_linux_virtual_machine: parameters provision_vm_agent and allow_extension_operations should be true or enabling backups will fail (with or without Terraform)
azurerm_virtual_machine_extension: this can be used to run/enable a VM extension on a VM
azurerm_backup_protected_vm: this resource enables backups on a VM
azurerm_recovery_services_vault: the recovery services vault where backups will be stored
azurerm_backup_policy_vm: backup schedule and retainment rules

I’ll go through the basic process first, which may work for some people. I’ll then take a deep dive into the timeout issues you may or may not encounter in your environment.

Understanding Azure Backup for Linux VMs

Mon, 29 Aug 2022 00:00:00 +0000

Azure Backup is an Azure service that allows, among other things, backing up Windows and Linux VMs in Azure. The backups are essentially virtual machine snapshots, but backing up and/or restoring individual files is also possible. This article tries to explain how Azure Backup and Linux VMs interact and what is required for them to work. If you’re interested in using Terraform to configure Azure Backup, please have a look at the Enabling Azure Backup on Linux VMs with Terraform article.

Terraform: converting an aws_instance network interface into an explicitly managed interface

Tue, 23 Aug 2022 00:00:00 +0000

The aws_instance resource in Terraform can automatically create the default network interface for you. There are cases, however, when you notice that the default network interface is not enough anymore, and modifying it via the limited aws_instance parameters is not sufficient. In these cases you can convert the interface into an aws_network_interface resource, but the process is far from straightforward.

The first step is to create a Terraform resource for the network interface:

Terraform, Azure and MissingSubscriptionRegistration

Sat, 20 Aug 2022 00:00:00 +0000

When deploying with Terraform to Azure you may sometimes encounter errors such as this:

╷                                                                                                                                                             
│ Error: creating Automation Account (Subscription: "83fa140a-2bea-175a-395c-914cae2902ce"                                                                    
│ Resource Group Name: "production"                                             
│ Automation Account Name: "backup-automation"): automationaccount.AutomationAccountClient#CreateOrUpdate: Failure responding to request: StatusCode=409 -- Or
iginal Error: autorest/azure: Service returned an error. Status=409 Code="MissingSubscriptionRegistration" Message="The subscription is not registered to use 
namespace 'Microsoft.Automation'. See https://aka.ms/rps-not-found for how to register subscriptions." Details=[{"code":"MissingSubscriptionRegistration","mes
sage":"The subscription is not registered to use namespace 'Microsoft.Automation'. See https://aka.ms/rps-not-found for how to register subscriptions.","targe
t":"Microsoft.Automation"}]

The problem is that in Azure you may need to register the provider for the service you intend to manage with Terraform. If you add resources from Azure Portal this registration part is handled automation. In the above case the Azure Automation provider was missing.

Finding which MySQL/MariaDB tables are modified by a GUI

Fri, 19 Aug 2022 00:00:00 +0000

I was working with Keycloak realm private/public key automation and it was not immediately obvious where Keycloak stores the keys. Figuring it out was actually easy, and this method applies to any web application that uses MySQL/MariaDB, not just Keycloak.

Anyhow, on Ubuntu, you’d navigate to /var/lib/mysql/name-of-database. For example:

cd /var/lib/mysql/keycloak

Make sure that no changes have been made recently (within one minute):

$ find -mmin -1

Then go to the web application and change whatever you’re trying to locate from the database. Here I changed the Keycloak RSA key priority. Then run the find command again:

Managing custom realm keys in Keycloak programmatically

Fri, 19 Aug 2022 00:00:00 +0000

What are Keycloak realm keys?

Keycloak’s authentication protocols make use of private and public keys for signing and encrypting, as described in the official documentation. These keys are realm-specific, and by default managed internally in Keycloak. So, when you create a realm using the Keycloak Admin API, kcadm.sh or manually using the Web UI, new keypair(s) get generated automatically. These are called “Managed keys”. However, you can also use custom realm keys in Keycloak, which is what this article is about. Using custom realm keys allow you, for example, to use a single keypair in multiple realms. When you import a custom private key, Keycloak uses it to automatically create a certificate. If you want, you can pass both a private key and a certificate signed with that private key instead. That way you can bypass Keycloak’s automatic certificate generation, should you need to.

AWS: creating AMIs from EBS snapshots shared with you

Mon, 15 Aug 2022 00:00:00 +0000

In AWS EBS (“Elastic Block Storage”) is the underlying technology that (virtual) hard disks of your instances (virtual machines) use. You can take snapshots of those virtual hard disks and use those snapshots to, for example:

Debugging issues with unbootable virtual machines: attach and then mount the snapshot on another virtual machine and investigate what is wrong.
Creating AMI images from which you can launch new instances
Sharing EBS volumes (between regions and AWS accounts), e.g. for purposes of migrating VMs

Here we’ll focus on the last use-case: being able to create copies of virtual machines on another AWS account. The reason why I even bothered writing this blog post is that most of the articles on the Internet do not cover this use-case: they assume you’re working within one AWS account and/or one region. The use-case covered here requires a few extra steps:

Modern cronjob part 1: Azure Automation with Terraform

Thu, 11 Aug 2022 00:00:00 +0000

Microsoft Azure has a nice service for scheduling tasks called Azure Automation. While Azure Automation is able to other things as well, such as being able to act as a Powershell DSC pull server, we’ll focus on the runbooks and scheduling. Runbooks are scripts that do things, e.g. run maintenance and reporting tasks. Runbooks often, but not necessarily manipulate objects in Azure. Runbooks are serverless like Azure Functions and the pricing is therefore similar - you pay for the amount of computing resources you use and don’t have to pay for a server that’s mostly idle.

Joining nodes to FreeIPA using a non-admin user

Tue, 09 Aug 2022 00:00:00 +0000

Typically Linux nodes are joined to FreeIPA using admin credentials. While this works, it exposes fully privileged credentials unnecessarily, for example when used within a configuration management system (see for example puppet-ipa).

Fortunately joining nodes to FreeIPA is possible with more limited privileges. The first step is to create a new FreeIPA role, e.g. “Enrollment administrator” with three privileges:

DNS Administrators
Host Administrators
Host Enrollment

Then you create a new user, e.g. “enrollment”, and join it to the “Enrollment administrator” role. After that you should be able to join nodes using that “enrollment” user.

Using .sync.yml in Puppet Development Kit (PDK)

Tue, 09 Aug 2022 00:00:00 +0000

Puppet Development Kit is probably the best thing since sliced bread if you work a lot with Puppet. It makes adding basic validation and unit tests trivial with help from rspec-puppet. It also makes it very easy to build module packages for the Puppet Forge.

That said, there is a minor annoyance with it: whenever you run “pdk update” to update PDK to the latest version, all your local changes to files such as .gitignore get destroyed, because PDK creates those files from PDK templates and any local changes are mercilessly wiped. Fortunately there is a way to sync your local changes to the files generated from the templates with .sync.yml. While .sync.yml is is pretty well documented, documentation is lots and lots of words with very few examples. So, here’s a fairly trivial .sync.yml example that ensures local changes to .pdkignore and .gitignore persist across PDK updates:

Use content of a file as a variable with Puppet

Sat, 16 Jul 2022 00:00:00 +0000

Every now and then a need to use the content of a file as a variable on an agent node arises. Here’s one way to do it with the help of a custom fact.

First create a custom fact on the puppet server:

Facter.add(:my_file_content) do
  setcode do
    path = "/path/to/my_file"
    File.read(path) if File.exist?(path)
   end
end

You can confine this to restrict it to be available only on selected nodes, for example:

How to add OpenID to WordPress with Keycloak

Thu, 14 Jul 2022 00:00:00 +0000

Adding OpenID to Wordpress allows for existing users on a domain to connect without having to manage another account. In this setup, we will be using Keycloak to provide the existing accounts which the OpenID plugin will use.

There are a few plugins for Wordpress that allow this functionality, but we will be using OpenID-Connect-Generic by Daggerhart.

Keycloak Client Setup

First step is to create a client in Keycloak. In the Keycloak web UI, create an openid-connect client by going to Clients and click Create.

Multi-part cloud-init provisioning with Terraform

Thu, 28 Apr 2022 00:00:00 +0000

Cloud-Init is “a standard for customizing” cloud instances, typically on their first boot. It is allows mixing state-based configuration management with imperative provisioning commands (details in our IaC article). By using cloud-init most of the annoyances of SSH-based provisioning can be avoided:

Having to use (possibly shared) SSH keys for provisioning
Having to have direct network access to the VM being provisioned (may require a VPN connection)

That said, neither cloud-init itself, nor its use within Terraform is particularly well documented. Therefore it can be an effort to create cloud-init-based provisioning that works and adapts easily to different use-cases. This article attempts to fill that gap to some extent.

X11 Connection Rejected

Thu, 28 Apr 2022 00:00:00 +0000

When switching to root after the typical SSH with X11 forwarding enabled this error can appear:

$ X11 connection rejected because of wrong authentication.
$ Error: Can't open display: localhost:10.0

The workaround seems to include copying the MIT-MAGIC-COOKIE-1 from the user who ssh’d in to the root user using xauth. Here’s how:

First verify the $DISPLAY being used and list the MIT-MAGIC-COOKIE-1 used for it :

Data-driven Terraform: Kubernetes cluster in Hetzner Cloud

Fri, 15 Apr 2022 00:00:00 +0000

Terraform does not have a particularly strong decoupling between data and code, at least not from a best practices perspective. It is possible and useful, however, to use data to define Terraform resources - if not for any other reason but to reduce code repetition for common resources that require defining lots of parameters. Here’s an example of setting up a Kubernetes cluster in Hetzner Cloud using Terraform with a “data-driven” approach:

Enabling system tray on Fedora 35 and 36

Tue, 12 Apr 2022 00:00:00 +0000

System tray is a “legacy” tray where various applications (e.g. Nextcloud, Pidgin and Signal) have an icon with which you can interact with the application without actually opening the main application window. I said “legacy”, because phasing it out was the plan in the Gnome 3 project, but it seems like we’re not getting rid of the tray any time soon, if ever.

In any case the system tray is not enabled by default in recent Fedoras, and the proper way to enable it has changed several times in the recent past as Gnome has been upgraded. This outlines the most recent way to do it, and hopefully this one sticks for longer than a year or so.

Terraform Enum data type

Tue, 12 Apr 2022 00:00:00 +0000

In Terraform you have access to basic data types like bool or string. Defining the data type is a good start for starting to improve the quality of your modules. However, you may want to validate that a certain string matches a list of pre-defined options, and if not, fail validation early.

Terraform, unlike Puppet, does not have a built-in Enum data type. However, you can emulate an Enum like this:

Debugging Puppet Bolt inventory plugins

Mon, 14 Mar 2022 00:00:00 +0000

Puppet Bolt handles inventories in a very flexible and powerful manner: you can combine static target definitions and different targets into a single inventory. For example, you can have an inventory which defines some static node names combined with the AWS inventory, or one that combines static nodes with the Vagrant inventory.

Puppet Bolt inventory plugins do their magic and then output what is essentially a static inventory generated dynamically. When dynamic inventory plugins do not work (as in my case) it can be challenging to figure out what is wrong, let alone how to fix it. However, there’s is a very handy way to print out a static version of the entire inventory, including the dynamically created content:

Terraform remote-exec: wait until a webpage is reachable

Fri, 18 Feb 2022 00:00:00 +0000

Terraform’s remote-exec provisioner fails immediately if any command in a script exists with a non-zero exit code. This makes building polling loops a bit more involved than it normally is. So, here is an example loop that checks if a URL can be reached:

while true; do
    curl -k https://puppet:8140/puppet-ca/v1 && break || sleep 3
done

When the URL is unreachable, the “||” will ensure that “sleep” gets run, which returns 0. If the URL is reachable, curl itself will return 0 and “&&” ensures that we break out of the loop.

Are Corporate Vision awards fake?

Thu, 10 Feb 2022 00:00:00 +0000

This was a burning question in my head in September 2021 but didn’t have much luck googling it. Here’s our experience and analysis of Small Business Awards by Corporate Vision. Read on to find out whether the awards handed out by Corporate Vision awards truly are a legit or not.

How did we hear about Corporate Vision?

Corporate Vision contacted us in September 2021 announcing us that we were nominated as candidate for being the best company in the ‘IT Infrastructure Management Specialists - Finland’ category for Small Business Awards. At that time (before this blog post) there was very little information online about Small Business Awards or the company behind them. What I learned at that time was that they seemed to be a so-called ‘vanity award’, where winners have been preselected and everything else was just for show. We could not be absolutely sure about that then, and we thought that “winning” might have some marketing value, so we decided to play along and see where it leads us. I will first go through the process, then I’ll try to give an answer the question in the title.

How software companies can end up in a Cloud hell, and how to fix it

Thu, 10 Feb 2022 00:00:00 +0000

The slippery slope

Custom software development services are in high demand today. Organizations are willing to pay considerable amounts of money for development of custom software, be it mobile applications relying on backend services in the Cloud, or tailoring of open source software to better fit their needs. This has provided the impetus for rapid growth of companies that provide software development services. Some of these companies simply rent developers to clients, others work on customer projects handling both project management and development.

Hiera lookups in rspec-puppet

Wed, 09 Feb 2022 00:00:00 +0000

While rspec-puppet documentation is quite decent, it does not really explain how to test classes that get their parameters via Hiera lookups, such as profiles in the roles and profiles pattern. Several parameters related to Hiera are listed in the rspec-puppet configuration reference, but that’s all. The other documentation you find on the Internet is generally outdated and not applicable for modules converted with PDK.

In this article we show how to test an “ipa_client” class that uses lookups to get its parameter from Hiera. It used to be a profile that was later separated from the control-repo into a separate module, which means that rspec-puppet does not have access to the control-repo’s Hiera data.

Mautic spam prevention

Mon, 07 Feb 2022 00:00:00 +0000

Mautic is a widely used open source email marketing automation application written in PHP. Email marketing is typically used in conjunction with inbound marketing done by asking people to give their email address in exchange for something, like a free ebook or a newsletter with good content. As you’re asking for the email address on a publicly facing webpage, spambots will find your form, and start misusing it to send your “Welcome” emails all over the place. This in turn may result in lots of bounces and/or complaints, which may get you locked out from your email service provider unless you pay attention. So, you need a way to block or fool those spam bots to prevent such issues, and to keep the Mautic database clean.

Windows domain in Azure

Tue, 11 Jan 2022 00:00:00 +0000

I wrote this article to better understand all the pieces called “AD” or “Active Directory” in Microsoft Azure fit together. The pieces are as follows:

Active Directory (AD): The is the classic on-premise Active Directory with LDAP, Kerberos, group policies and all that. Traditionally Windows machines in larger environments have been domain-joined to on-premise AD.
Active Directory Federation services (AD FS): adds support for modern web-SSO protocols (SAML, OAuth 2.0 and OIDC) to on-premise Active Directory.

Conditional provisioner blocks in Terraform

Wed, 05 Jan 2022 00:00:00 +0000

I’ll start with a spoiler: what the title suggests is not possible. It is, however, possible to accomplish this with cloud-init and Terraform templates as described in the Multi-part cloud-init provisioning with Terraform blog post.

If you need to use SSH/WinRM provisioning, then there are various workarounds you can apply, and this article explains some of them and goes into depth into one in particular.

The first workaround is relatively clean, but is not usable in all cases, especially when working with complex modules. The idea is to have two resources, here of type aws_instance. Those resources are identical except for the provisioner blocks:

Showing SQL statements with Keycloak

Fri, 31 Dec 2021 00:00:00 +0000

Sometimes you might find yourself wondering whether there is some paranormal activity going on with your keycloak and its database. To check if things are still in the realm of physical reality, and to restore your child’s faith in the programmer who never makes mistakes, it might be soothing to check what’s actually happening to the database. To do this, create a new property named showSql and give it a value of true in your connectionsJpa spi. This is located in standalone.xml, standalone-ha.xml, or in domain.xml (if you’ve already graduated from kindergarten).

Serverless Puppet with control repo, Hiera, roles and profiles and Puppet Bolt

Tue, 28 Dec 2021 00:00:00 +0000

The traditional way of managing systems with Puppet is to install Puppet agent on the nodes being managed and point those agents to a Puppet server (more details here). This approach works well for environments with tens or hundreds of nodes, but is an overkill for small environments with just a handful of nodes. Fortunately nowadays Puppet Bolt enables you to push configurations to the managed nodes via SSH and WinRM. When using Bolt the catalog (desired state) is created on the computer running Puppet Bolt using facts from managed nodes and then sent to the managed nodes to be applied.

Multiple Bitbucket Cloud accounts with SSH authentication

Tue, 07 Dec 2021 00:00:00 +0000

In Bitbucket usernames are unique across whole of Bitbucket. Moreover, the same SSH key can only be configured for one user. If you registered your Bitbucket account using a corporate email and used your primary SSH key with it, you’re pretty much hosed if you then need to create another corporate Bitbucket account and wanted to use the same SSH key with it - that’s just not going to happen. The solution to this dilemma is to create another SSH keypair and somehow make SSH, Git and Bitbucket co-operate. As the correct solution was not immediately obvious it is documented here.

Managing OpenVPN-based Azure VPN Gateway certificates with easyrsa3

Fri, 19 Nov 2021 00:00:00 +0000

The Azure VPN Gateway supports the OpenVPN protocol (except the “Basic SKU”). Unlike, for example, the commercial Access Server, the VPN Gateway does not have a built-in certificate authority (CA) tool for managing client certificates. And client certificates are essentially a requirement if you need to support clients other than Windows and Mac, such as Linux, iOS or Android. The use of easy-rsa-old as a CA for Azure VPN Gateway is documented quite well in this blog post, but this post is about using the newer easyrsa3 instead. Basic familiarity with easyrsa3 is assumed, so we just go through the steps you’d normally take.

Dealing with multiple AWS accounts with one Keycloak client for Single-Sign On

Thu, 18 Nov 2021 00:00:00 +0000

This article assumes that the user backend for Keycloak is FreeIPA. Regardless of that the instructions will apply to any other setup with minor modifications. Here we use two different AWS accounts renamed to 123412341234 and 567856785678 to protect the personal information of the innocent. The Keycloak staging cluster on which this integration was done is called id-staging.example.org and the production cluster is called id.example.org. The Keycloak realm is EXAMPLE.ORG. Replace those with the values correct for your environment.

Allowing external email forwarding in Office 365

Tue, 16 Nov 2021 00:00:00 +0000

We use Zimbra as our main email server. We also have Office 365 subscription to make working with our clients a bit easier. The challenge is that when customers send us, say, Teams meeting invites, they typically use autofill and the email gets sent to our Office 365 mailboxes which nobody really looks at.

It is possible to fix this by configuring email forwarding. That is theoretically possible out of the box on a per-user basis in https://outlook.office.com/mail/options/mail/forwarding. However, when you actually try it out you will get an error message in your Office 365 inbox because forwarding is disabled on the organizational level by default:

Short introduction to Packer and Vagrant

Sun, 31 Oct 2021 00:00:00 +0000

This article is a short introduction to Packer and Vagrant - tools that we often recommend to our customers but which may be a bit hard to understand if you have no previous expose to them.

Packer

Packer is used to “create identical machine images for multiple platforms from a single source configuration”. Packer works in a very simple fashion:

It reads its configuration file
It launches a virtual machine based on the “base box” you’ve defined. The base box would be a “vanilla” Linux distribution such as Ubuntu 20.04.
It runs the provisioning scripts you’ve written on the base box (via SSH)
It removes deployment-specific things (e.g. SSH host keys)
It shuts down the VM
It creates a VM image out of base box + your changes

After this you can distribute the base box to people and they will have an identical system at their disposal. If you need to modify the image you can just change the provisioning scripts and/or the base image and rebuild. The configuration file can and should be stored in version control repository.

Enabling AWS EC2 instance automatic recovery with Terraform

Thu, 28 Oct 2021 00:00:00 +0000

AWS EC2 instances are subject to two types of status checks (AWS docs):

System status check (issues with the underlying hardware/networking: “the AWS side”)
Instance status check (issues with the OS, e.g. OOM, file system corruption, broken networking, etc: “our side”)

The official AWS EC2 instance recovery documentation claims that automatically recovering from an EC2 instance failure is only possible for system status checks, but the AWS documentation is outdated: Cloudwatch metrics are available for both types of check failures and people have set up recovery for both types of failures using AWS CLI.

Terraform Azure resource provider registration fails

Tue, 26 Oct 2021 00:00:00 +0000

Terraform has good support for Microsoft Azure through the Terraform Azure provider and the AzureRM backend. However, you may hit a glitch when adding or importing resources if you lack permissions to register Azure resource providers:

│ Error: Error ensuring Resource Providers are registered.
|
│ Terraform automatically attempts to register the Resource Providers it supports
| to ensure it's able to provision resources.
│                                                                                                                                                                                   
│ If you don't have permission to register Resource Providers you may wish to use
| the "skip_provider_registration" flag in the Provider block to disable this
| functionality.
│                                                                                                                                                                                   
│ Please note that if you opt out of Resource Provider Registration and Terraform
| tries to provision a resource from a Resource Provider which is unregistered,
| then the error may appear misleading - for example
|                                                                                                                                                                                   
│ > API version 2019-XX-XX was not found for Microsoft.Foo
|                                                                                                                                                                                   
│ Could indicate either that the Resource Provider "Microsoft.Foo" requires
| registration, but this could also indicate that this Azure Region doesn't support | this API version.
|
│ More information on the "skip_provider_registration" flag can be found here:
|
│ https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs#skip_provider_registration
│
│ Original Error: Cannnot register providers: Microsoft.DataLakeAnalytics, Microsoft.DBforPostgreSQL, Microsoft.AVS, Microsoft.Media, Microsoft.ApiManagement, Microsoft.Search, Mic
rosoft.Maintenance, Microsoft.ServiceBus, Microsoft.HealthcareApis, Microsoft.Relay, Microsoft.DesktopVirtualization, Microsoft.NotificationHubs, Microsoft.SecurityInsights, Micros
oft.DBforMariaDB, Microsoft.Kusto, Microsoft.DataLakeStore, Microsoft.Automation, Microsoft.CognitiveServices, Microsoft.ManagedServices, Microsoft.EventGrid, Microsoft.BotService,

--- snip ---

At first glance this error look cryptic, but it is quite clear once you understand what Azure resource providers are - I like to think of them as “enabled Azure services” or “enabled Azure features”.

OpenVPN server options in Azure

Thu, 21 Oct 2021 00:00:00 +0000

OpenVPN is among the best VPN solutions, especially when you need a cross-platform (Windows, Mac, Linux, Android, iOS) solution that just works. It is best suited for point to site (P2S) or “road warrior” setups where users access internal resources using a VPN client when on the road.

When setting up OpenVPN server in Azure you have several options at your disposal:

Set up your own open source OpenVPN 2 server

Recruiting for a small business - lessons learned, part 2: Tips for job seekers

Fri, 20 Aug 2021 00:00:00 +0000

I previously wrote about takeaways from our first recruitment process as a recruiter in January 2021. This time I’m looking back to the recruitment process in order to gather tips for the other half, job applicants and seekers. Part of the advice are also based on my own experiences as a job seeker and some even on common sense. A recruiter of a bigger company could formulate this article a bit differently but these aspects mattered to us, as a small business.

Poor marketing, part #1

Tue, 10 Aug 2021 00:00:00 +0000

As an entrepreneur you are flooded with attempts to persuade you to buy something. Typically what is sold is services like website development, mobile application development or outsourced developer/devops workforce. Most attempts are mediocre, but only a few can be classified as outright bad. As inbound marketing and sales are dear to our heart, in this series we present some of the worst marketing attempts we’ve seen, in the order of appearance. We try to add some value by adding a humoristic analysis on top. All the names and emails have been converted to John or Jane Doe and example.org so that you don’t accidentally buy anything from these guys. However, with pinch of luck you may find the exact same message in your INBOX if you feel the urge to buy something from these guys.

Software release: net-snmp-systemd-services-status

Fri, 06 Aug 2021 00:00:00 +0000

Puppeteers is proud to release the first version of net-snmp-systemd-services-status. It is a net-snmp pass_persist script written in Python that queries the status of all systemd services on a system, dynamically generating OIDs based on the systemd service names. This gives the services a predictable name. Querying all services on a typical Linux VM takes less than 0.2 seconds. The information is presented to snmpd in a way that both get (snmpget) and getnext (snmpwalk) work.

Extending snmpd with custom scripts

Fri, 16 Jul 2021 00:00:00 +0000

Traditional network monitoring systems tend to get their monitoring data via SNMP. In case of Linux snmpd is usually the system application that’s responsible for providing that data. The data consists mostly, but not entirely, of metrics. For example, the data contains strings such as operating system version, administrative contacts and network interface names.

It is possible to make snmpd run custom scripts and programs to gather more data from the system. The options are described in snmpd.conf man page, but here are the most important ones for this use-case:

Making modals responsive in Oxygen Builder for Wordpress

Wed, 14 Jul 2021 00:00:00 +0000

I always thought that it would be impossible for me to make convincing looking websites. But I did learn it and enjoy it very much. But as soon as I’m ready with a new, beautiful web page on my screen, my joy is cut short by the fact that I still need to make it responsive. Learning website development is in fact a double battle: first learning the techniques to make nice things on a web page, and then learning another set of techniques on how to keep the design beautiful on smaller screens. In my experience, the latter battle is way bigger, and thus hope that sharing the lesson I learned will save someone from the agony I had to go through. I’ll focus on modals because making them responsive has been the toughest part for me.

Packer QEMU performance: speed things up with two-stage builds

Thu, 08 Jul 2021 00:00:00 +0000

Introduction

In the “Packer QEMU: Building Ubuntu 20.04/22.04/24.04 VM images” blog post we briefly mentioned ways to improve Packer QEMU performance. In this article we’ll go into the details on how this is implemented. The key in improving Packer QEMU performance is to split the build into two distinct stages:

Operating system installation stage
Provisioning stage

This setup cuts down development time considerably as repeating the provisioning stage becomes a lot faster.

Packer QEMU: Building Ubuntu 20.04/22.04/24.04 VM images

Mon, 05 Jul 2021 00:00:00 +0000

Introduction

Packer QEMU builder allows you to build virtual machine images from scratch. You need a Packerfile, an automatic installation configuration file (autoinstall, kickstart or preseed) and the operating system installer (e.g. ISO). The benefit of Packer QEMU in particular are that you can have fine-grained control over the virtual machine image content such as disk partitioning. Moreover you don’t need to rely on official base images produced by other people, such as the official Ubuntu Cloud images.

Creating Puppet Bolt groups based on AWS tags

Thu, 01 Jul 2021 00:00:00 +0000

The Using tags in Puppet Bolt aws_inventory target_mapping showed how to use AWS “Name” tag as the target name for Puppet Bolt. Use of tags can be extended to creating Bolt target groups:

groups:
  - name: webservers
    targets:
     - _plugin: aws_inventory
       region:
         _plugin: env_var
         var: AWS_DEFAULT_REGION
       filters:
         - name: tag:Type
           values: [webserver]
       target_mapping:
         name: tags.Name
         uri: public_ip_address

All you need to do is add a “filter” section with one filter. The “name” parameter tells Bolt that the filter is based on tags and what tag to look for. The “Type” that follows “tag” is the name of the tag you want to filter by. The “values” array lists acceptable values for that tag. Any nodes that don’t have the tag (here: “Type”) or where tag value is not acceptable (e.g. “db”) will not be shown in the group.

Making wpcal.io work with Zimbra calendars

Thu, 01 Jul 2021 00:00:00 +0000

Scheduling meetings with email is annoying. When everyone is on the same timezone that kind of works, but tends to be slow. When you factor in timezone differences the process becomes really error-prone and slows down even more, often to several days. For this reason we wanted to provide people - including our customers - a way to easily schedule meetings with us.

We’re special in the sense that we self-host almost everything we use. For email and calendars we use Zimbra and for our website we use Wordpress. Most people seem to use Calendly as a meeting scheduler, but we ended up choosing wpcal.io which is a native Wordpress plugin and seems to work quite nicely.

Testing Puppet feature environments with Puppet Bolt

Fri, 18 Jun 2021 00:00:00 +0000

Puppet feature environments are an excellent way to test code before deploying it, typically to production. They allow testing Puppet runs on no-operation mode across the whole node population managed by Puppet. There are sometimes cases where your code changes potentially impact many nodes and you’re not exactly sure of their scope or effect. In that case it helps to test your code on all Puppet-managed nodes. The challenge is that Puppet open source does not have any built-in mechanism to do that. This is where we can make good use of Puppet Bolt.

To containerize in AWS or not: the cost perspective

Tue, 15 Jun 2021 00:00:00 +0000

I recently checked the pricing model for Amazon Fargate to see if migrating a fair number of EC2 instance-based workloads to containers would save money. In theory this should have been the case, as a container has less “fat” compared to a full virtual machine. In this case the workload itself was perfectly suited for a container: a single process with single configuration file that was mostly network-bound running on t3.micro instances.

Using xfreerdp with Vagrant

Tue, 15 Jun 2021 00:00:00 +0000

Vagrant has built-in support for connecting to Windows VMs using the vagrant rdp command. It does basically does the same as vagrant ssh for Linux VMs. There are a few shortcomings, though: vagrant rdp fails to automatically accept the host key of the VM it is connecting to, at least when using it from Linux with xfreerdp. So, you first need to connect to the VM directly once with raw xfreerdp, then vagrant rdp will start working. Then, when you wipe out the VM, you need to repeat the process again. If you have a high resolution screen you will also notice that vagrant rdp will give you a tiny Windows desktop where you need a magnifying glass to read the text.

Installing individual components to Visual Studio 2019 from the command-line

Mon, 07 Jun 2021 00:00:00 +0000

I’ve been doing lots of Windows automation recently. My goal has been to be able to reproducibly create a Windows Server 2019-based Buildbot workers, first in a Vagrant environment, then later in AWS EC2 using pre-built images created with Packer. This task requires installing Visual Studio 2019 build tools automatically and fetching the project’s dependencies with vcpkg automatically. It is possible to install Visual Studio 2019 with Chocolatey quite easily, but what if you need to install additional components to Visual Studio without using the Visual Studio installer GUI? Looking around did not quickly reveal any de facto instructions on how to do it, so this article aims to fill that gap.

Using tags in Puppet Bolt aws_inventory target_mapping

Sat, 05 Jun 2021 00:00:00 +0000

We’re migrating away from Ansible to Puppet Bolt and the fact that Ansible updates broke the old ec2.py inventory script expedited that process. While that inventory script was quite rudimentary, it was able to automatically add human-readable names to the EC2 instance names. So, for example, you could target a node using “server_example_org” if the Name tag was set to “server.example.org”.

Puppet Bolt’s aws_inventory seemed to lack that feature, but after taking a good look at its code this was just a case of missing documentation, which I fixed in this PR. Here’s an example of inventory.yaml for Bolt that maps the value of the “Name” tag to the name of the Bolt target:

Making Vagrant work on Fedora 34

Tue, 01 Jun 2021 00:00:00 +0000

We use Vagrant and Virtualbox a lot because it is an excellent tool for infrastructure code development. Unfortunately it is also very prone to breakage during operating system upgrades, especially if you depend on many plugins. When I upgraded from Fedora 32 to 34 Vagrant broken even more than usual due to conflicting rspec dependencies. Basically every Vagrant plugin refused to install with this error message:

$ vagrant plugin install vagrant-vbguest
Installing the 'vagrant-vbguest' plugin. This can take a few minutes...

Vagrant failed to properly resolve required dependencies. These
errors can commonly be caused by misconfigured plugin installations
or transient network issues. The reported error is:

conflicting dependencies rspec (= 3.10.0) and rspec (= 2.14.1)
  Activated rspec-2.14.1
  which does not match conflicting dependency (= 3.10.0)

  Conflicting dependency chains:
    rspec (= 2.14.1), 2.14.1 activated

  versus:
    rspec (= 3.10.0)

  Gems matching rspec (= 3.10.0):
    rspec-3.10.0

The rspec dependency conflict does not sound particularly scary for somebody who is not developing Vagrant or Vagrant plugins. Therefore ignoring the dependencies is likely to be just fine:

What Vagrant plugins actually are?

Tue, 01 Jun 2021 00:00:00 +0000

This was a revelation that came to me when fixing Vagrant on my Fedora 34 laptop: Vagrant plugins seem to be just Ruby gems installed into an isolated runtime environment, with “vagrant plugin” ensuring that the gems are installed in the correct place.

The same gems that you can install with “vagrant plugiin install” can be found using vanilla gem command:

$ vagrant plugin list
rexml (3.2.5, global)
vagrant-hostmanager (1.8.9, global)
vagrant-vbguest (0.29.0, global)
winrm (2.3.6, global)
winrm-elevated (1.2.3, global)
winrm-fs (1.3.5, global)

$ gem info --remote rexml

*** REMOTE GEMS ***

rexml (3.2.5)
    Author: Kouhei Sutou
    Homepage: https://github.com/ruby/rexml

    An XML toolkit for Ruby

$ gem info --remote vagrant-vbguest

*** REMOTE GEMS ***

vagrant-vbguest (0.29.0)
    Author: Robert Schulze
    Homepage: https://github.com/dotless-de/vagrant-vbguest

    A Vagrant plugin to install the VirtualBoxAdditions into the guest
    VM

$ gem list|grep vagrant
<no output>

On the remote side you can find all the familiar Vagrant plugins as gems, but vanilla gem won’t find them installed locally, because they’re in a different path.

Puppet types and providers development part 5: self.instances

Sun, 30 May 2021 00:00:00 +0000

This blog post is a part of this blog post series:

The self.instances is a provider class method that is used to produce an array containing all resources found from the system. For example, a yum package provider might run “rpm -qa” in self.instances to get a list of packages installed on the system. This serves two main purposes:

Allows using of “puppet resource type” to produce Puppet code for all resources of type found on the system.
Data created by self.instances can be passed to self.prefetch to cache resource properties. The cached properties are then reused for every resource of that provider type. For example, a yum package provider might create a list of packages installed on a system when Puppet encounters the first “yum” package resource of “yum” type. That cache would then be reused, thus removing the need to individually check each package’s state.

As discussed in Puppet types and providers development part 4: caching resource properties to improve performance self.instances or self.prefetch are not really suitable for scenarios where you need to manage (multiple) remote systems using the same provider, because things like connection would be given in the Puppet resource definition are at the provider instance level, to which provider class level methods like self.instance and self.prefetch do not have access to.

Puppet types and providers development part 6: mysteries of self.prefetch

Sun, 30 May 2021 00:00:00 +0000

This blog post is a part of this blog post series:

I will open this blog post with a quote from the famous Gary Larizza:

After wading the waters of self.prefetch, I’m PRETTY SURE its implementation might have come to uncle Luke after a long night in Reed’s chem lab where he might have accidently synthesized mescaline.

http://garylarizza.com/blog/2013/12/15/seriously-what-is-this-provider-doing/

After reading Gary’s rather elaborate explanation about self.prefetch I still did not fully get what self.prefetch actually does and the official documentation surely does not help:

Limiting concurrent builds in Buildbot

Fri, 21 May 2021 00:00:00 +0000

Buildbot is a continuous integration framework which many open source projects seem to be using. Unlike continuous integration applications or automation servers like Jenkins Buildbot does not make many assumptions about your use-case. In fact, when you build your CI or CD pipeline you’re actually writing Python code and hence have all the flexibility of Python directly at your disposal. In other words, you’re not being blocked or obstructed by assumptions hidden in the tool itself, like often tends to happen with Jenkins.

How to Setup a Staging Wordpress Server

Tue, 18 May 2021 00:00:00 +0000

Having a staging server for Wordpress is quite useful for testing new features without the worry of breaking something in production. It is also helpful when you have a multi user environment and need to test something that could impact others. In this article it is assumed that your Wordpress instance has SELinux enabled as is the case on RHEL/CentOS for example. On other distros like Ubuntu or Debian you can omit the steps specific to SELinux.

Managing self-hosted GitLab with Terraform

Sun, 16 May 2021 00:00:00 +0000

GitLab has an extensive API which allows managing its internal configuration such as users, groups and projects. The official GitLab Terraform provider builds on top of this API.

It assumed here that the Terraform controller (e.g. your laptop) is able to reach your GitLab instance’s TCP port 443 - if it can’t there’s no way Terraform’s API calls will work. The same approach should work with gitlab.com - you can probably (=untested) skip the base_url parameter in that case.

Delegating external parties access to AWS

Fri, 14 May 2021 00:00:00 +0000

This blog post shows how to grant access to an AWS account for some external party. For simplicity we will call this external party a “contractor”. If you want to do the same for Microsoft Azure look at this blog post instead.

This method requires the contractor to have its own AWS account, but it has several benefits:

No need to create AWS user accounts for every single person working for the contractor
You can force the contractor’s personnel to use two-factor authentication (2FA)
You can force the contractor to use an additional password (shared secret)
You can disable contractor’s access completely by just removing the IAM role

This approach works equally well for AWS Console access, AWS CLI and tools like Terraform. Some tools may not like the extra security measures required here or be able to assume a role out of the box.

Delegating external parties access to Azure

Fri, 14 May 2021 00:00:00 +0000

In Microsoft Azure you can grant an external user (“contractor”) guest access to your Azure subscription. The approach is quite different from what AWS uses (see Delegating external parties access to AWS).

Here we grant access to john.doe@contoso.com using the Azure Portal. Preferably john.doe@contoso.com would already exist as a Microsoft account.

Login to your Azure Portal
Type “Users” in the search box
Click on the “Users” service
Click on “New guest user”
Select “Invite User”
Fill in the fields. The email address should be the one given by the external user.
Click on “Invite” at the bottom
The external user will receive an invite to your Azure in the email address you defined above.

Now the user has been created. However, it is lacking permissions to do anything useful. We will fix that in the next steps by assigning it a role:

Dynamic partitioning in Foreman kickstart templates

Wed, 12 May 2021 00:00:00 +0000

Foreman’s provisioning system allows creating provisioning templates with highly dynamic content. This article describes how to create dynamic content in your Foreman provisioning templates. While the example is related to dynamic partitioning in kickstart, the basic mechanisms for setting this up applies to any kind of template.

Foreman provisioning templates are written in ERB format. This allows having logic in the template itself based on user-defined host parameters. For example the Kickstart default template consumes a bunch of host parameters that allow you to define what kind of kickstart file you want Foreman to spit out for each host or host group. To give a simple example there’s the “lang” parameter which sets the value for “lang” kickstart option:

Gitlab SAML to Keycloak Setup

Wed, 12 May 2021 00:00:00 +0000

Introduction

Integrating Keycloak with Gitlab SAML makes it easier to manage users in an organization from a central point. You could manage separate accounts on Gitlab, but for us it makes sense to utilize Keycloak as we are already using it for other applications.

Setting up Keycloak

The first step is to create a Gitlab SAML client in the Keycloak dashboard. With the correct realm selected, navigate to the Clients configuration page and click the create button to add a new client.

Microsoft Teams redirect loop mystery

Tue, 11 May 2021 00:00:00 +0000

Some of our customers use Microsoft’s Office 365. Due to that they also use Microsoft Teams for collaboration. Recently, out of the blue, I ran into a “redirect loop mystery” in Teams. Basically I was able to login to our Teams (which we only use when recording video calls). But when I tried to switch to a customer workspace I was able to get in, but got immediately redirected back to our own workspace. This issue affected both the official Teams client for Linux, as well as the Chrome browser. Fortunately this was a well-known issue that could be fixed by relaxing cookie security settings in the browser.

Cutting down Azure storage costs for a Marketplace seller

Mon, 19 Apr 2021 00:00:00 +0000

A few days ago I looked at our Azure costs and they were around $8. That’s a ridiculously small amount, except for the fact that we don’t really use Azure for anything. So I started investigating.

After having published the Configuration Manager (Puppet master installer image) and LibreNMS in Azure Marketplace I knew that we had a bunch of BLOBs lying around. I knew how to find these blobs using the Storage Explorer. So I tested wiping them all out, as I knew Azure does not delete them immediately, but only after one day. Then I attempted to launch Configuration Manager and LibreNMS from the Azure Marketplace GUI. My thought was that those blobs had already been copied elsewhere (for global distribution) and would not be used by the Marketplace anymore, but it looked like I was wrong. At least I got odd behavior when trying to launch those images and reverting the blob deletion fixed things.

Making per-link DNS servers added by Wireguard to systemd-resolved survive NetworkManager connection changes

Tue, 13 Apr 2021 00:00:00 +0000

Update: the problem described in this article seems to be resolved in Fedora 36 (NetworkManager 1.38.0-2.fc36). It is still present in Fedora 35 (NetworkManager 1.32.12-2.fc35).

The title of this blog post may seem familiar to some, as I solved this problem for OpenVPN earlier. I won’t repeat myself here, so please check the OpenVPN article to understand why this is happening.

Wireguard servers - unlike OpenVPN servers - are not able to push any settings such as DNS servers to their clients. However, Wireguard client itself is able to run PostUp commands to configure per-link DNS. The same approach can be used with OpenVPN “up” scripts as well, if you prefer having full control at the client-side. Here’s a Wireguard example:

Product launch: 'Puppeteers Cloud Modeling'

Tue, 13 Apr 2021 00:00:00 +0000

Puppeteers has launched a new service product which allows you to gain control of your Cloud resources by having them imported to Terraform. This allows you to manage changes to your Cloud and radically reduces the need for the pesky “who changes this and why?”, “who set this up and is it still needed?” and “what does it do?” discussions. As a bonus you get much better visibility into your cloud.

Puppet Bolt: taking action based on exit codes

Tue, 13 Apr 2021 00:00:00 +0000

Puppet resources like Package, File or Service are idempotent. In other words, you define the state of the resource and Puppet enforces it. The resources can be used in Bolt plans as well, which frees you from having to do state checks yourself. However, if the thing you’re managing is not a Puppet resource you have to check its state manually and use that information to drive login in your plan. Here’s a crude but functional PoC for checking if a node’s certificate is present on the Puppetmaster and acting accordingly:

The four ways to install Puppet modules

Tue, 13 Apr 2021 00:00:00 +0000

When working with Puppet and Puppet modules in particular you quickly notice that there are several ways to manage module dependencies. Today I learned about a new way introduced in Puppet Bolt 3.x, so I thought I’d compile a list that celebrates this diversity:

metadata.json: used primarily to dependency metadata to Puppet Forge. Some tools like librarian-puppet and puppet-litmus use / can use this file to download dependency modules. The downside is that you can’t define the location of the modules, so you’re limited to Forge modules.

Terraform stalls when recreating security groups

Tue, 23 Mar 2021 00:00:00 +0000

Sometimes Terraform stalls when trying to remove AWS EC2 security groups and Terraform does no give any hint as to what is wrong. The problem is caused by that security group being attached to an EC2 instance or network interface.

Interestingly Terraform messes up the order of the AWS API calls even when it (attempts to) remove the security group and detach it from all EC2 instances that use it. In other words, Terraform tries to remove the security group before it has been detached from the EC2 instances, which results in the stall:

Puppeteers webinar recording: Infrastructure as Code

Wed, 10 Mar 2021 00:00:00 +0000

Here’s a recording on our webinar on March 9, 2021:

Infrastructure as Code

We covered the very basics of infrastructure as code, version control, quality assurance techniques and tools such as Puppet, Terraform, Ansible and Puppet Bolt.

The webinar slides:

Puppeteers-webinar-Infrastructure-as-Code-presentation-210309 Download

Notes about puppet-litmus testing

Sun, 07 Mar 2021 00:00:00 +0000

Puppet Litmus is a Puppet acceptance test harness that leverages on many existing, proven technologies. In the long run Litmus aims to replace Beaker. However, the latter is currently still the only way to run multi-machine (e.g. cluster) acceptance tests in a standardized way. For example we use Beaker for our Keycloak domain mode cluster tests in puppet-module-keycloak. On a high-level the test process is the same as with Beaker:

Provision the SUT (“System Under Test”)

Passing Vagrant parameters to Puppet Litmus

Sun, 07 Mar 2021 00:00:00 +0000

Puppet Litmus allows creating SUTs (“System Under Test”) with Vagrant using Virtualbox or Hyper-V as the virtualization backend. However, the default virtual machine settings like 1024MB of memory are only suitable for very simple modules and applications. For example, Litmus testing our puppetmaster-installer will fail with the default settings.

Litmus documentation tells us that you can define parameters in provision.yaml which get then converted to environment variables. What it does not tell what to use these environment variables for. Looking at the Vagrant code in Litmus you can see that those environment variables can be used to drive the Virtualbox settings, among other things:

Recruiting for a small business - lessons learned, part 1: Tips for recruiters

Thu, 04 Mar 2021 00:00:00 +0000

Throw a job ad on a recruitment portal, wait for applications, hold a couple of interviews and that’s it, right? This is what recruiting can look like from the outside but there’s quite a bit more to it. A recruitment campaign can be a massive effort especially for small businesses. In addition, if you’re doing it for the first time, you may want some advice.

We’re a small company (with 3 more or less part-time employees) who recently ran our first official recruitment campaign so we know what we’re talking about! We hope that sharing our experiences will help other small businesses and organizations to get the most out of a recruitment campaign without losing too much time and money and building a good employer brand at the same time.

Fixing foreman-installer "Forward DNS points to x" errors

Wed, 03 Mar 2021 00:00:00 +0000

This posting comes strictly from the land of esoteria. We have a Vagrant + Virtualbox environment that sets up Foreman used for PXE booting baremetal servers. The environment work fine on Linux and MacOS. But we needed to make this environment work also on Windows. Easy, right? Vagrant and Virtualbox are supposed to abstract all those pesky operating system settings away, correct? After resolving a non-Windows related challenge provisioning of Foreman on Windows almost worked. Except that it failed when foreman-installer attempted to start[*]. The error message was this:

Making vagrant-hostmanager UAC prompts go away on Windows

Wed, 03 Mar 2021 00:00:00 +0000

The vagrant-hostmanager plugin is a really nice plugin which helps Vagrant VMs communicate with each other using names instead of IP addresses. Essentially it manages hosts entries for the VMs, acting like a poor-man’s DNS. Now, on *NIX operating systems you typically use sudo, which caches your authorization. So, when hostmanager starts, you type your password once and then it is able to add all the host entries it needs to /etc/hosts. This is not so on Windows: you will get one UAC prompt per modification to c:\windows\system32\drivers\etc\hosts. This will eventually drive you crazy. To fix this you need to permit your Windows user account to modify the hosts-file without privilege elevation. To pull this off, you will need to modify that file’s access control lists. The process is quite convoluted imho, but here it goes:

Solving an Apache Mellon redirect loop mystery

Sat, 27 Feb 2021 00:00:00 +0000

If you’re at all like me, you every now and then find yourself thrown out of your comfort zone, when you should actually be in it.

The pattern usually goes something like this:

It’s something simple. I’ll fix it in a couple of minutes and document it for others. I know my stuff.
Hmm, this seems to be a bit stubborn. I need to take a closer look.
Still doesn’t work. I need to run this in a debugging set up and break it into pieces, to see where the problem is.

Fixing vagrant-vbguest for the centos/7 base box

Thu, 25 Feb 2021 00:00:00 +0000

We’re using the centos/7 base box in Vagrant a lot and often hit this problem when bringing up new VMs with Vagrant:

umount: /mnt: not mounted

This error comes from vagrant-vbguest plugin which tried to install the Virtualbox Guest Additions but failed. The error message is misleading, because the real issue is related to upstream (CentOS) yum repositories. As explained in this Vagrant bug report:

“Basically the CentOS that you’re installing is containing an old kernel version which has been removed from CentOS repositories. Vagrant is trying to install Guest Additions, which has as a dependency the kernel-devel package. kernel-devel package must be the same version as the kernel package that you have it installed in your CentOS box, version which is removed from the CentOS repos.”

Creating PXE bootable Virtualbox VMs

Wed, 24 Feb 2021 00:00:00 +0000

We use Vagrant and Virtualbox heavily when developing Puppet code. We also do provisioning of baremetal servers with Foreman. While Vagrant is a really powerful tool, it is not designed for creating VMs that boot from the network (PXE boot). Fortunately Virtualbox itself provides a rich command-line with which you can create and configure virtual machines and configure them to boot from the network. It is assumed below that there is a PXE boot server (e.g. Foreman) created into a hostonly network with Vagrant. Here’s an example script that create a VM with vboxmanage and adds it the same hostonly network interface (vboxnet15) as the PXE boot server:

Configuring ejabberd multi-user chatrooms

Fri, 12 Feb 2021 00:00:00 +0000

Ejabberd is a very flexible and scalable XMPP server. We use it because it can be configured using a simple yaml configuration file and managed via ejabberdctl commands. This makes it a good fit for our infrastructure as code approach. That said, ejabberd does require one to understand the XMPP protocol/jargon as it does not abstract away any of it. So simple things like creating chatrooms, limiting access to them and playing history backlog to users who connected them can be an effort if you’ve never done it.

Ejabberd message archiving and history playback

Fri, 12 Feb 2021 00:00:00 +0000

When using ejabberd in a company for multi-user chat (see my earlier blog post) people will quickly start complaining that they missed discussions because they had been offline. Ejabberd does play back last 20 messages when user joins a room, but that is too little for an active chatroom. The simplistic approach is to set history_size in mod_muc settings in ejabberd.yml to a higher value:

mod_muc:
  history_size: 200
  --- snip ---

This simplistic approach should work with any XMPP clients.

Terraform resources with dynamic provider values

Thu, 11 Feb 2021 00:00:00 +0000

Sometimes you’d like to pass a dynamic value to a Terraform resource’s provider parameter. This can be done, but some background first.

Terraform allows you to define multiple providers of the same type using provider aliases. This is useful when you’re working with a provider that is tied to a region, the AWS provider being a prime example. The moment you want to create resources in multiple regions you will have to learn provider aliases.

Getting the last inactive vboxnet interface with Ruby

Sat, 30 Jan 2021 00:00:00 +0000

This could possibly be the most esoteric blog post I’ve ever written, but here it goes. So, for reasons even we have difficulty comprehending (hint: related to PXE booting in a Vagrant/Virtualbox environment) we had to find out which inactive vboxnet (hostonly) interface had the highest index. We wanted the code to (hopefully) run on all platforms (Linux, MacOS, Windows) so we wanted to write this code in Ruby. So, this was the brutal but working end-result:

Authenticate and authorize Grafana users from FreeIPA groups via Keycloak

Thu, 28 Jan 2021 00:00:00 +0000

Grafana is a common tool to visualize data from multiple datasources. Perhaps the most common datasource is Prometheus. If an organization has a Single-Sign On solution, it makes sense to authenticate users centrally with that solution That will make authentication easier and friendlier for end users (authenticate once and then access multiple services), and also enable stronger authentication by adding multifactor authentication.

In addition to authenticating user, it is also possible to authorize Grafana users based on their group membership.

Making sense of JBOSS/Wildfly interfaces in domain mode

Thu, 28 Jan 2021 00:00:00 +0000

In this blog we consider JBoss/Wildfly domain mode in the context of the wonderful Keycloak software. It is not necessarily trivial to understand how the interfaces should be configured, especially if you want to do something other than the defaults, for example to secure your Wildfly/JBOSS configuration, or if you are dealing with a more complex nodes with multiple network interfaces.

Assumptions:

We want to use Keycloak in domain mode. In this operating mode Keycloak application is clustered and also the caches, like user sessions are replicated in the cluster.

Limiting the scope of puppet-rspec tests

Fri, 22 Jan 2021 00:00:00 +0000

Some Puppet modules like puppet-module-keycloak have hundreds of unit tests. That is good for test coverage, but waiting for test results hurts your productivity when you’re developing tests for your new code. There are at least two ways to (temporarily) limit the scope of the tests that you run. First method is baked in into the Puppet Development Kit command-line:

$ pdk test unit --tests=spec/classes/init_spec.rb

This runs only the tests in the specified file.

RIP: Puppeteers Finnish website

Mon, 18 Jan 2021 00:00:00 +0000

Today was a special day. Our Finnish website went to greener pastures after having spent its golden months serving permanent HTTP redirects to our current website while having been taken our of our Terraform codebase. It is customary to speak a few words in occasions like this, so here we go.

“Beloved www.puppeteers.fi. You were a well-liked website that brought us our first customer. Occasionally you were down because MySQL innodb_buffer_pool_size was set too low. Or because overall system memory went too low and the OOM killer broke you. But we cannot blame you for that - it was just us trying to spare some €€€ that caused all that. You served us well, but it was time to finally move on.”

AWS to Azure resource translation table

Sun, 17 Jan 2021 00:00:00 +0000

We use Terraform for managing our Cloud infrastructure. Our customers typically use AWS and that’s what we’re most familiar with. Each public Cloud has its own terminology, so this page is a translation table between Terraform resource names in the AWS and Azure providers:

AWS	Azure
aws_instance	azurerm_linux_virtual_machine
aws_network_interface	azurerm_network_interface
aws_security_group	azurerm_network_security_group
aws_security_group_rule	azurerm_network_security_rule
aws_vpc	azurerm_virtual_network
aws_subnet	azurerm_subnet
inapplicable	azurerm_resource_group
aws_s3_bucket	azurerm_storage_account
region	location

Mapping of Terraform AWS resource names to Azure resource names

High-level and low-level tasks in Kanban

Sun, 17 Jan 2021 00:00:00 +0000

We use Kanban to coordinate our projects and tasks. Kanban is focused on visualizing and improving throughput, that is, making projects (high-level) and tasks (low-level) go through the system as fast as by limiting work in progress, which in turn minimizes waste (time and money).

Our field of work is IT operations and we’re generally quite busy with fulfilling requests from our internal and external stakeholders. Most of our tasks are quite small, about 1-4 hours each, and produce value immediately. We can generally get these done (“through the system”) quickly without having to stop in the middle and can then forget about them. However, we also have bigger tasks that tend to take a lot longer, maybe 8-24 hours of focused work and often involve multiple persons.

Querying DNS in Puppet code

Wed, 06 Jan 2021 00:00:00 +0000

I recently had to add access control rules to OpenVPN Access Server to permit certain groups to access certain IP addresses. As we manage our Access Server configurations with Puppet using puppet-openvpnas (by the author), we needed a way to parameterize the allowed IP addresses while keeping the Puppet code readable.

This is where puppet-dnsquery came really handy. It allows using data that’s already available in DNS and using it in Puppet code. A simplistic example:

Migrating from Puppet 5 to 6 with Puppet Bolt

Thu, 31 Dec 2020 00:00:00 +0000

The main annoyance with agent-based configuration management is the management of the agents themselves. They usually don’t require any handholding after the initial install, except when you need to migrate them to a new environment. For example, migrate from a Puppet 5-based server to Puppet 6.

The migration process is not overly difficult, but in order to scale to more than a handful of nodes you will need to orchestrate the process. Historically we would have used Ansible for this task, but nowadays we prefer Puppet Bolt, which is more powerful and flexible in our use-cases. The Bolt plans typically end up being ugly, but based on my experience with Ansible Playbooks that tends to be the case anyways. I guess this is the natural result of mixing state-based configuration management, ad hoc commands and orchestration together.

Sed spell to ease moving to Terraform 0.13

Mon, 28 Dec 2020 00:00:00 +0000

When moving from older versions of Terraform 0.12.x to latest 0.12.x (now: 0.12.29) you may notice the following warnings:

Warning: Interpolation-only expressions are deprecated                                                                                                                              

  on backup.tf line 11, in resource "hcloud_server_network" "backup_example_org":                                                                                                 
  11:   server_id = "${module.backup_example_org.id}"

These make sense, but may come as a surprise as earlier 0.12.x versions were perfectly fine with them.

You may have tons of these, so fixing them manually gets tiresome. The fix is not too difficult, but is quite unreadable due to escaping:

Creating custom facts programmatically

Fri, 18 Dec 2020 00:00:00 +0000

Writing static facts is fairly easy even with a low level of Ruby skills. Below is an example of a fact that returns true or false depending on whether the node has a /boot partition:

Facter.add(:has_bootfs) do
  setcode do
    if Facter.value(:mountpoints)['/boot'].nil?
      false
    else
      true
    end
  end
end

As you can see above the required information was already inside the “mountpoints” fact of Facter.

Using the fact is easy:

Keycloak, Wildfly and Infinispan caches

Wed, 16 Dec 2020 00:00:00 +0000

We recently hit an interesting issue with an “almost in production” Keycloak high-availability clustered domain mode setup that was behind an Amazon EC2 load balancer with sticky sessions enabled. The symptom was that changes from the domain controller did not propagate to the slave. This included:

Changes made to realms and clients using the Admin REST API
User sessions

This lead us into a quest to truly understand how Infinispan caches in the Wildfly application server and consequently in Keycloak work. Before you read this article you should probably read all of these:

Automatic publishing to LinkedIn now in operation

Sat, 12 Dec 2020 00:00:00 +0000

Our company is about infrastructure automation and products built on top of it. That means we really don’t want to do manually what a computer can do. Therefore it was not an option to publish our blog posts first in Wordpress, then copy-and-paste them to LinkedIn. Rather, let a Wordpress plugin configured as a LinkedIn app do the hard word. So, from now on all of our blog posts should get published automatically on our “Puppeteers Oy” LinkedIn page. Let’s hope that the automation does not break too often :).

Using the Pomodoro technique to control distractions

Sat, 12 Dec 2020 00:00:00 +0000

We - like many others - have the problem that our work gets easily interrupted. Some interruptions come from the inside. For example, you remember “a thing you need to do” and without thinking start doing it immediately. Other interruptions are external, for example a colleague ask you for advise or a customer calls you asking for help. Almost always these things could wait a bit, but the person simply acted on an impulse.

Managing Keycloak configuration programmatically

Fri, 11 Dec 2020 00:00:00 +0000

Keycloak is an excellent Open Source Identity and Access Management solution that builds on top of the Wildfly application server. We manage several Keycloak installations for providing SSO with FreeIPA credentials for self-hosted and SaaS services via SAML and OIDC.

To keep our Keycloak configurations healthy and in a known-good state we manage their configurations programmatically. As we use Puppet for our configuration management needs we’ve contributed a lot to the treydock/puppet-module-keycloak project. There is also a Terraform Keycloak provider that covers the Keycloak API very well, but it won’t help you one bit with setting up Keycloak initially. This can be problematic if you’re setting up something more complex like clustered domain mode with TLS reverse proxies.

Making Prometheus and Alertmanager work behind a reverse proxy

Wed, 09 Dec 2020 00:00:00 +0000

We maintain a Prometheus and Alertmanager setup where both services are running on the same host and an Apache reverse proxy handles TLS and authentication, authorization and single sign-on with Apache mod_auth_mellon configured as a Keycloak SAML client. This way we can limit access to Prometheus and Alertmanager to people who belong to a certain FreeIPA group.

From end-user perspective Prometheus and Alertmanager are available at these locations:

In this setup both Prometheus and Alertmanager require additional startup options to work correctly. First Prometheus:

Fattening the workflow, part 5: Hiera and content encryption

Thu, 03 Dec 2020 00:00:00 +0000

Separating data from code in Puppet modules is advisable as it improves reusability of code. The separation can be accomplished with Hiera by having separate levels based on facts, organizational units, locations, etc.

Hiera can also be used for storing private data that needs to be protected and must not be readable by outsiders. Typically the data, like all other code, is stored in a version control system that may be located outside the organisation. In such a case Hiera encryption is a must.

Fattening the workflow, part 4: Roles and profiles

Wed, 02 Dec 2020 00:00:00 +0000

If the workflow that includes the control repository, r10k and GitLab still feels too light, there are yet more ways to make the workflow heavier by adding more abstraction to the Puppet modules themselves. This is done by adopting the “Roles and Profiles pattern” that was developed by Craig Dunn and popularized in the blog posts by Gary Larizza.

Roles and profiles are just Puppet classes. Profiles are usually used for creating technology stacks. A good example is a web application whose installation requires a web server (nginx, apache), a database server (postgresql, mysql) and several other components. The configurations for such an application could of course be done with a “regular” Puppet module but the reusability of the module would be rather limited for two reasons:

Fattening the workflow, part 2: r10k

Tue, 01 Dec 2020 00:00:00 +0000

In the previous post I discussed the control repository structure. In this post I’ll talk about r10k. That tool is used for deploying control repository branches into matching Puppet environments on the Puppet server. Installing r10k is very straightforward with the bundled gem:

$ /opt/puppetlabs/puppet/bin/gem install r10k

After this you’ll need a settings file for r10k, /etc/puppetlabs/r10k/r10k.yaml:

--- 
 :cachedir: /opt/puppetlabs/puppet/cache/r10k 
 :sources: 
 control: 
 basedir: /etc/puppetlabs/code/environments 
 prefix: false 
 remote: git@gitlab.com:myorg/control-repo.git

Several requirements must be met before the configuration above will work:

Fattening the workflow, part 3: GitLab and similar

Tue, 01 Dec 2020 00:00:00 +0000

In the previous posts of this series I discussed the control repository and r10k. The last component in fattening the workflow is Git provider such as GitLab, GitHub or Bitbucket. Nowadays all of them are reasonable choices for storing private Git modules, which Puppet control repositories and site-specific modules tend to be. One of the biggest advantages of GitLab over its competition is that it is open source and can be installed locally.

Fattening the Puppet workflow, part 1: The control repository

Thu, 26 Nov 2020 00:00:00 +0000

If editing Puppet code and Hiera directly with puppetmaster feels too easy, you can complicate the Puppet workflow as much you like by adding more components to the palette. Adding the so called control repository and r10k to Puppet environment maintenance instantly adds several phases to your initially simple workflow. There are also benefits that I’ll discuss later on.

The control repository (control repo for short) is a Git repository that is used to create dynamic Puppet environments on the Puppet master. Each Git branch can be turned into a matching Puppet environment. The name of the default branch, production, is the same as the environment the Puppet agents use by default. The content of the control repo branches look like this:

SEM tips: how to get started easily

Fri, 20 Nov 2020 00:00:00 +0000

Introduction

The purpose of this post is to show that search engine marketing (SEM) can be started rather easily. Small businesses, like our company, may not have resources (money, knowledge, time etc) to spend on marketing and consultancy so I’m hoping that sharing this experience will help and encourage other SEM newbies!

This blog post is in no means a complete SEM tutorial. There are plenty online, paid and free (I’ll list some in the next chapter). My idea instead is to focus on the main points for getting started with SEM and also to enlighten some of they key concepts and terms. I’m trying to write down things that I hope I had heard of before starting with SEM!

Making per-link DNS servers pushed from OpenVPN to systemd-resolved survive NetworkManager connection changes

Tue, 03 Nov 2020 00:00:00 +0000

Update: the problem described in this article seems to be resolved in Fedora 36 (NetworkManager 1.38.0-2.fc36). It is still present in Fedora 35 (NetworkManager 1.32.12-2.fc35).

Update: there a companion article about solving this problem for Wireguard in here.

In an the Manage Linux client DNS settings in OpenVPN and Wireguard article we described how to use the update-systemd-resolved script to update systemd-resolved per-link DNS servers automatically based on DNS servers pushed from an OpenVPN server. This is very convenient if you have to be connected to multiple remote locations each with their own DNS servers and zones.

Terraform 0.11->0.12 migration: stabs at the state file

Fri, 30 Oct 2020 00:00:00 +0000

We maintain a rather complex AWS environment built with Terraform that uses nested modules and lots of per-resource provider configurations. Recently the pain of staying with Terraform 0.11 became too much, so we had to start the migration to Terraform 0.12, with 0.13 going to follow soon after. In general the official upgrade instructions were pretty good. Of course there was a lot of manual fixing that had to be done, and as I did not keep detailed notes I can’t recall all the steps I went through. But I think all or most of those can be found from other sources.

Using Puppet Bolt to apply roles to nodes, part 1

Sat, 17 Oct 2020 00:00:00 +0000

NOTE: this article is somewhat outdated. Please refer to Serverless Puppet with control repo, Hiera, roles and profiles and Puppet Bolt instead.

Puppet Bolt is a designed to be an orchestration tool, but it can be used for configuration management as well. For example you may have a small environment of handful of nodes where having a dedicated Puppet server would be an overkill, or you have some nodes in the infrastructure where you can’t or don’t want to install a Puppet Agent.

Improving Vim's Puppet integration

Thu, 15 Oct 2020 00:00:00 +0000

A recent package upgrade seemed to break Puppet syntax highlighting horribly on my Fedora 32 laptop. Not only did syntax highlighting not work, it was actually completely wrong and confusing. It seemed as if the Puppet file type detection was missing, so vim was probably using some a syntax highlighter for a wrong type. To see which file types are enabled I used :set filetype followed by a couple of tabs (more details on StackExchange).

LibreNMS image 1.65-20 released

Tue, 22 Sep 2020 00:00:00 +0000

LibreNMS image version 1.65-20 is now available in the AWS Marketplace. It is a a Cloud image that runs a pre-configured LibreNMS network monitoring system. It is the easiest and fastest way to get started with LibreNMS.

Pricing is based on usage: there are no up-front license fees or other costs. This means you can test it with zero risk. Also, there is currently a free trial!

Purchase now in AWS Marketplace!

I search

Fri, 04 Sep 2020 00:00:00 +0000

The keys on your laptop are the kind of item you don’t pay any attention until you lose them. The “O” key came off from my Carbon X1 keyboard a few days ago. I was able to postpone the ultimate solution by a couple of days by just pushing the “O” back. But doing that five times a day got old soon. So, I took of another key - “I” - to figure out the correct alignment for the metal hooks that hold the plastic hinges in place. That was a good idea on paper except that I was able to break the hinge when installing the “I” back. After a failed attempt of gluing the hinge together with a generous amount of epoxy I gave up and decided to order replacement keys.

Restrict access to a location in Apache reverse proxy with TLS

Fri, 04 Sep 2020 00:00:00 +0000

Ever had a case where you needed to use a name based Apache reverse proxy in front of some application server, while restring access to some proxied location at the same time? Here’s how to do it.

First define a virtual host:

<VirtualHost *:443>
    ServerName myserver.example.com

Set the request headers (you are of course using TLS, aren’t you):

RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"

Proxy to some internal address, here to localhost port 8080:

ProxyRequests Off
ProxyPreserveHost On
ProxyPass http://127.0.0.1:8080/
ProxyPassReverse http://127.0.0.1:8080/

Restrict access to the host or networks you need to:

<Location "/my/location/">
 Require ip 10.0.0.0/8
</Location>

Note: this will work with Apache 2.4 and up. With older versions you can use the same idea.

Debugging Packer provisioning

Wed, 05 Aug 2020 00:00:00 +0000

Packer is an excellent tool for automating creation of machine images such as AWS AMIs or Docker container images. This is particularly useful when you need to scale up by spinning up instances on-demand or if you want to package software that is challenging to manage with a configuration management system. It is also extremely useful when creating actual packaged product for AWS Marketplace, for example.

In Packer you take a “base box” such as Ubuntu 18.04 base image and modify its contents with provisioning, for example to install and configure software on the image. Several different types of provisioners are supported, including but not limited to shell scripts, Puppet manifests and Ansible playbooks. The concept of provisioners is the same as in Vagrant and Terraform.

Taming apt timers in Ubuntu 18.04

Wed, 05 Aug 2020 00:00:00 +0000

Ubuntu 18.04 AWS images - and probably other Cloud images as well - have automated upgrades turned on. This is done via two systemd timers, apt-daily.timer and apt-daily-upgrade.timer. The timers kick of periodically as well as when an instance is rebooted. This sounds reasonable until you are provisioning something: you’re unable to install or configure any packages while apt and/or dpkg are running. With a really fresh cloud base image this may not be an issue, but when the base image gets sufficiently old then apt-get upgrade starts taking enough time to cause issues.

Nagios-plugin-cloudwatch released

Fri, 26 Jun 2020 00:00:00 +0000

We recently wrote a Nagios plugin for getting metrics from AWS Cloudwatch to LibreNMS. As the customer was ok with releasing it as open source here it is. It is written in Ruby - we like the language and we’re also Puppet guys, so it felt like a natural choice for us.

The plugin allows getting as many metrics you want from Cloudwatch and setting alert thresholds (warning, critical) for each metric statistic (e.g. “average CPUUtilization percent”) separately. In many cases it is not useful to configure alerts for a metric (e.g. “minimum CPUUtilization percent”), but you do want to graph it regardless - this plugins allows that.

Testing connection recovery with ss

Sat, 30 May 2020 00:00:00 +0000

As mentioned in our earlier blog post we created an “email to XMPP bridge” called milter-xmpp for forwarding alert emails from monitoring systems to an XMPP chatroom. It was known that if the connection to the XMPP server ever died the bridge would stop working, but we wanted to know how fast that would happen. It took some days, but eventually the connection died.

The fix ended up being quite trivial, but we needed a way to break the connection. Fortunately the good folks at StackExchange already had a good solution: use the “ss” tool (“another utility to investigate sockets”) which provides output similar to netstat:

Email to XMPP bridge "milter-xmpp" released

Tue, 26 May 2020 00:00:00 +0000

We have used XMPP (Jabber) for our internal discussions for years. In the recent years it seems that XMPP has lost some of its traction. For example, Google and Facebook used to use XMPP for instant message and Slack used to have an XMPP bridge in their service. All of those are now gone and have been replaced with proprietary messaging protocols. In the context of a big company having all the control over the protocol probably makes sense, but it of course makes life difficult for users who have to have a separate client for each or have to use a multi-protocol client such Pidgin just to keep their sanity. And none of the big players seems to “winning the war” for users.

Ubuntu and Debian preseeding tips

Mon, 18 May 2020 00:00:00 +0000

Over the years I’ve had to automate installation of Ubuntu and Debian installers a number of times. The primary motivation has always been to avoid all the questions about timezone, locale, partitioning and which packages to install and to not have to babysit the installation. In theory automating the installation is as simple as writing a preseed file. In practice it is much harder for a number of reasons:

Documentation on the Internet around custom installation media and preseeding setup is anecdotal at best - it gets you going and then lets you fall on your face. The official documentation is pretty good, though.
The exact format of the preseed questions varies by operating system version, not just by operating system (Debian, Ubuntu).
In most cases questions about locale and keyboard layout must have answers before the installer preseed is even loaded. This is misleading, because the preseed file does have those questions, even though the answers have zero practical effect for the installer.
There are many ways to accomplish preseeding, most notably by creating a custom installation medium with the preseed file, or by getting the preseed from an URL (“auto mode”).
The default keyboard layout in most Ubuntu/Debian installer is en-US. This is fine, except when you don’t have an American keyboard: then you will be struggling to find characters such as “:” or “/”, which are relatively essential when loading the preseed file from an URL.
It is impossible to remember how to start “automated install” from a vanilla installer menu, let alone figure out what the keyboard and locale settings should look like on the kernel command-line.
The installer is happy to produce unworking configurations (e.g. no bootloader or no kernel) without giving any hints why things are not working.
Each mistake is costly in time, especially if it affects something like Grub configuration which happens at the end of the install.
Because of above, you tend to try to make as many changes to the kernel command line and/or preseeding as possible in one go. This means that when you get things working you don’t know what the proper fix was, and don’t feel like repeating the process to find out.

In order not to be completely negative here is the general recipe for success:

Using snmpwalk to debug SNMPv3 issues

Thu, 14 May 2020 00:00:00 +0000

Our puppet-snmpd module support SNMPv3 very well across a wide range of operating systems. Because o that SNMPv3 is what we use across the board in multiple environments. However, in the rare cases when I have to debug SNMP problems I can never remember the exact snmpwalk command-lines to use. So, here is the usual way to run snmpwalk to figure out if SNMP is providing data:

$ snmpwalk -Os -v 3 -u monitor -l authPriv -a sha -A <auth-pass> -x AES -X <encryption-pass> hostname

Run from the monitoring server (e.g. LibreNMS configured with puppet-librenms) to make sure basic connectivity and access controls are correct as well. Or against localhost if you’re interested in the data and not connectivity.

Webinaaritallenne: Infrastruktuurin rakentaminen koodilla

Wed, 06 May 2020 00:00:00 +0000

Järjestimme Turku Business Regionin kanssa yhteistyössä webinaarin 5.5.2020 aiheesta “Infrastruktuurin rakehtaminen koodilla”. Webinaaritallenne on saatavilla täällä:

Infrastruktuurin rakentaminen koodilla

Webinaarissa käsiteltiin perusasioita seuraavista aiheista: infrastruktuurin rakentaminen koodilla eli IaC, versionhallint, laadunhallintamenetelmät sekä työkalut kuten Puppet, Terraform, Ansible sekä Puppet Bolt.

Video: infrastruktuurin rakentaminen koodilla

Tue, 05 May 2020 00:00:00 +0000

Tässä webinaaritallenteessa esittelemme perusteet infrastruktuurin rakentamisesta koodilla, mukaan luettuna versionhallinnan, laadunvarmistuksen ja erilaiset työkalut kuten Puppetin, Terraformin, Ansiblen ja Puppet Boltin:

Infrastruktuurin rakentaminen koodilla

Toteutettu yhteistyössä Turku Business Regionin kanssa 5.5.2020.

Puppet types and providers development part 3: on resource uniqueness

Sat, 25 Apr 2020 00:00:00 +0000

This blog post is a part of this blog post series:

In the previous blog post we talked about how to create a resource, a LibreNMS service, in the provider implementation. This blog post will talk about identifying a resource that is being managed. This is a requirement for modifying existing resources.

Modifying existing resources can actually be more tricky than it seems, because you first need to figure out if the resource Puppet is managing already exists on the target system. In many cases the resource type you’re managing has an attribute - for example “name”, “hostname”, “fqdn”, “ip” - that is guaranteed to be unique at the target system and works well as the identifier at the Puppet end. This is the case, for example with files (fully-qualified path), packages (name of the package) and in our particular case, LibreNMS devices (hostname).

Puppet types and providers development part 4: caching resource properties to improve performance

Sat, 25 Apr 2020 00:00:00 +0000

This blog post is a part of this blog post series:

In the previous blog post we talked about how to identify the resources that are being managed. This post will talk about the various ways of fetching the current state of the resources you wish to manage.

Puppet manages a resource’s properties by checking their current state and if the current state differs from the state defined in the Puppet manifest (“desired state”) then Puppet will execute the commands necessary to fix the situation. So, when writing a Puppet provider you need to figure out a way to get the current state of all the resources of the type (e.g. file, package, LibreNMS service) you’re managing as efficiently as possible.

Integrating Puppet Bolt with PuppetDB

Fri, 24 Apr 2020 00:00:00 +0000

In the Puppet Bolt with a Puppet control repository blog post we showed how to integrate Puppet Bolt with an existing control repository. We used a static inventory file, which is ok for testing or when you have a few target nodes. However, if you have a Puppetserver running and are not using Bolt to manage the configurations of your nodes, then the chances are that you have a fairly large node population and maintaining a static inventory would be both tedious and error-prone. One option among many is to use the PuppetDB plugin to generate a dynamic inventory and that is what we describe here.

Webinaari: etäyhteydet tietoturvallisesti kuntoon VPN:llä

Tue, 14 Apr 2020 00:00:00 +0000

Turku Business Region webinaari 22.4.2020 kello 13–13.30, osana ICT-webinaarisarjaa.

Webinaarinaarissa kerromme lyhyesti mitä VPN (“Virtual Private Network”) tarkoittaa ja miksi VPN:n käyttö on käytännössä välttämätöntä turvallisten etäyhteyksien luomisessa. Lisäksi käymme lyhyesti läpi VPN-yhteyksien käyttöönoton yleiset vaatimukset.

Tämän jälkeen esittelemme OpenVPN:n, avoimen lähdekoodin VPN-sovelluksen, jota käytetään erittäin laajalti ympäri maailmaa. Sitten siirrymme OpenVPN:ään pohjautuvaan kaupalliseen OpenVPN Access Serveriin, joka tekee VPN-yhteyksien luomisesta ja ylläpidosta merkittävästi helpompaa. Esittelyn jälkeen teemme OpenVPN Access Serverin käyttödemon:

Puppet environment leakage

Wed, 01 Apr 2020 00:00:00 +0000

Occasionally when working with feature branch and updating types and providers you may run into environment leakage issues. They manifest themselves as issues that make no particular sense and are caused by the wrong version of a type/provider such as puppetlabs-apt (see this issue) leaking into your feature environment. This can happen when you update external modules in your Puppetfile. The solution (or band-aid) is fortunately fairly easy. On the Puppetmaster run this command:

Manage Linux client DNS settings in OpenVPN and Wireguard

Tue, 31 Mar 2020 00:00:00 +0000

OpenVPN and Wireguard are both used to provide secure, remote access to an organization’s internal services such as network shares (NFS and Samba), desktops and servers (SSH and RDP) or web services. Linux is generally a first-class citizen as far as clients are concerned but with one exception: accessing DNS through the VPN tunnel.

OpenVPN servers have the concept of pushing settings such as DNS servers to client. This happens by emulating a DHCP server. Windows OpenVPN clients for example are able to process this information automatically to update the (per-link) DNS server settings automatically. But Linux traditionally has not had this capability without support from “up” and “down” scripts. When one is using systemd-resolved the traditional ways such as using resolvconf or modifying /etc/resolv.conf directly no longer work or cause issues. Fortunately there is a good script, update-systemd-resolved, for automating the DNS server setup process for systemd-resolved. Basically it takes the list of DNS settings OpenVPN provides and converts them into dbus calls that modify the running systemd-resolved’s configuration.

Puppet Bolt with a Puppet control repository

Mon, 30 Mar 2020 00:00:00 +0000

NOTE: this article is somewhat outdated. Please refer to Serverless Puppet with control repo, Hiera, roles and profiles and Puppet Bolt instead.

Puppet Bolt is an orchestration tool similar to Ansible. It is suitable for multiple use-cases:

Running ad hoc commands on target nodes. We use this approach for testing Puppet feature branches before approving and merging them.
One-off configurations written in the Puppet language
Masterless Puppet environments (look here). You may not always have enough privileges, trust or will to manage a complete Puppet infrastructure including Puppetserver, PuppetDB and Puppet Agents.

Simple orchestration with Puppet Bolt

Mon, 30 Mar 2020 00:00:00 +0000

As discussed in the introductory post one of the use-cases for Puppet Bolt is orchestration - running actions on multiple targets in a certain order, possibly using results of actions or data from some targets on other targets. Orchestration with Bolt plans is quite easy: you just create a plan with multiple TargetSpec parameters, each representing a target or a type of target. A classic example is two or more web servers behind a load balancer. In this case we do something even simpler and just take a fact from a node called “first” and create a file on node “second” that uses the value of that fact in a file.

Puppet types and providers development part 2: creating a resource

Sat, 07 Mar 2020 00:00:00 +0000

This blog post is a part of this blog post series:

In the previous blog post we created the Puppet type librenms_service and created a dummy skeleton for the provider implementation. We were able to use the type, but it did not yet do anything. In this blog post we move to implementing the create method, which in this case was the low-hanging fruit. At this point we do not need to worry about any existence checks (the exists? method) or trying to minimizing the number of API calls with self.prefetch or something similar.

Puppet types and providers development part 1: creating the type

Tue, 03 Mar 2020 00:00:00 +0000

This article is a part of this blog post series:

Writing Puppet types and providers looks like black magic even to those who have lots of experience in the Puppet language itself. While the official types development documentation is quite ok, provider documentation is definitely lacking. Not only are there no practical examples from real life, the important features such as prefetching, resource methods and flushing are described only on a very high level. The usual answer to lack of examples is “have a look at the built-in resources”. But when you look at any built-in resource, you realize that the code is very complex because

Giving special treatment to the last entry when iterating over a Puppet hash

Thu, 20 Feb 2020 00:00:00 +0000

When you’re iterating over a hash you may end up having to treat the last hash entry differently. For example, if you’re creating entries to a JSON file you should have “},” in between the entries until you reach the last entry, where you must have just “}” or JSON data will be invalid.

Now, hashes do not have indexes, nor does Puppet support variable reassignment along the lines of $x = $x +1, so you’re out of luck trying to get the length and comparing that to a counter. So, you need some other way to detect when iteration has reached the last entry in the hash.

Debugging rspec-puppet

Fri, 07 Feb 2020 00:00:00 +0000

Usually writing rspec-puppet tests is straightforward. Then you run into some problem that does not make any sense. In my case I ran into a couple of duplicate resource declaration issues when adding rspec tests to our puppetmaster-installer. The error message was not that useful:

$ pdk test unit --tests=spec/classes/puppetboard_spec.rb
--- snip ---
 Failures:
 1) puppetmaster::puppetboard minimal settings on ubuntu-18.04-x86_64 is expected
    to compile into a catalogue without dependency cycles
    Failure/Error: it { is_expected.to compile }
      error during compilation: Evaluation Error: Error while evaluating a
      Resource Statement, Duplicate declaration: Class[Apache] is already
      declared; cannot redeclare (file: /home/samuli/opt/puppeteers/puppet-
      puppetmaster/spec/fixtures/modules/puppetmaster/manifests/puppetboard.pp,
      line: 156) (file: /home/samuli/opt/puppeteers/puppet-puppetmaster
      /spec/fixtures/modules/puppetmaster/manifests/puppetboard.pp, line: 156,
      column: 3) on node puppet.example.org
--- snip ---

That particular block of code in puppetboard.pp did include a parameterized call to the apache class. But nothing else (afaics) included that class. Also, in Vagrant the same code worked just fine, which made things seem even more bizarre. To add insult to the injury the error message did not tell where else the apache class was included. That would probably have been way too helpful.

Terraform: Importing resources from a non-default AWS region

Tue, 04 Feb 2020 00:00:00 +0000

I recently - again - had to import resources to Terraform (0.11.14) from AWS that were outside of the default AWS region and were managed in a nested (non-root) module. The root module contained the provider configuration, including multiple aliases to allow creation of resources in different regions, as well as the nested module call, here in a very simple version:

provider "aws" {
  region = "us-west-2"
}

provider "aws" {
  region = "us-east-1"
  alias  = "us-east-1"
}

provider "aws" {
  region = "us-west-2"
  alias  = "us-west-2"
}

module "cloud" {
  param = value
}

The goal was to import some aws_ses_email_identity resources into the “cloud” module. So, originally the cloud module had this:

Managing Jenkins with Puppet, part 1: Basic installation

Fri, 31 Jan 2020 00:00:00 +0000

It seems every other organization is using Jenkins these days. Jenkins is a continuous integration and continuous delivery server that can be used to automate building, testing, and delivering or deploying software.

Many organizations also use Puppet for their configuration management needs. Puppet is, if not the de facto configuration management solution, at least one of the most mature and field tested ones. It consists of several server components, agents, a declarative programming language, amongst others. Puppet can be used to install, set up and manage large number of all kinds of resources.

Modifying XML files with Puppet's Augeas resource

Fri, 31 Jan 2020 00:00:00 +0000

This article is based on an earlier article written in Finnish.

Here I describe how to make changes to an XML file with Augeas - a useful approach when managing the whole file as a template is out of the question. The configuration file used as an example, web.xml, belong to Pwm, and we intend to set the webapp context parameter.

As discussed before it is important to get an idea of how Augeas sees the file before attempting to modify it with Puppet. First we tell which Augeas lens to use (here: Xml) and which file(s) to associate with the Xml lens. This can be done with in one step:

Using Augeas to manage resources in Puppet

Fri, 31 Jan 2020 00:00:00 +0000

This translated from the original Finnish article that is available here.

The Augeas resource in Puppet allows one to manage parts of a complex configuration file instead of managing the whole file using a template or a static file. For trivial cases stdlib’s file_line resource may be sufficient. While use of templates or static files is in general more reliable and easier than use of Augeas, the latter is quite useful in many cases. As using Puppet Augeas resource directly is quite challenging, a useful practice is to first make the changes manually with “augtool” and only then convert the results into Puppet Augeas resources. We use PostgreSQL’s pg_hba.conf file here as an example.

Allowing changes to a Puppet-managed resource outside of Puppet

Wed, 29 Jan 2020 00:00:00 +0000

When a resource is managed by Puppet it is typically managed fully, or not at all. Exceptions to this rule, such as the “replace” parameter in the File resource, are rare. However, sometimes you end up having to change the properties of a resource outside of Puppet without making Puppet overwrite those changes on the next run. A good example is a set of firewall rules managed with puppetlabs-firewall - you generally want to manage the whole ruleset with Puppet so that you can be sure of the state of the ruleset. For example, if you have libvirt installed, a bunch of virbr0-related rules may appear without your consent. On RedHat-based distros you may also see several rules getting removed by puppetlabs-firewall. Or a fellow sysadmin may have added some random iptables rules for debugging purposes. These are good reasons to have

Getting the interface that matches an IP in Puppet

Tue, 14 Jan 2020 00:00:00 +0000

I was recently in a situation where I needed to figure out which interface name matched a particular, static IPv4 address. On a single or a handful of nodes this could have been hardcoded in Hiera, for example, but there were dozens of nodes. The way I solved this was by creating a custom fact that uses the IPv4 address and loops through the interfaces list to find the matching interface name:

Why modules in Puppetfile should be sorted

Mon, 30 Dec 2019 00:00:00 +0000

This is probably one of the shortest blog postings in the history of this blog. But as this topic does not seem to be covered in more generic articles about avoiding Git merge conflicts (e.g. this, this and this), here it goes.

Adding modules to the Puppetfile is a quite common task. When you or your team has multiple feature branches at the same time many of those branches may add new Puppet modules to the Puppetfile. This is fine, unless the new modules are added to the bottom of the Puppetfile: Git will get confused because it sees that multiple commits have changed the exact same place in the Puppetfile.

Pidgin IRC with ZNC and Freenode SASL external auth

Thu, 12 Dec 2019 00:00:00 +0000

I use Pidgin as my instant messaging client because it is open source and because it supports almost all IM protocols directly or through plugins. In my case I need support for IRC, XMPP, Facebook, Slack and SIPE (Office 365). Apparently it would be possible to use Pidgin for Signal as well, but as official Signal client is open source and works quite well I’m fine with running it standalone. As I use Linux, I can rarely hope for a native client for the proprietary IM services. Plus even if there was one, I would not want to run 4-5 messaging applications when I can have one (or two). Or to have the same amount of IM web applications open just to get messages.

Puppet rspec testing: understanding describe and context

Fri, 06 Dec 2019 00:00:00 +0000

In the Puppet module rspec testing with PDK blog post I covered the procedure of creating and running puppet-rspec tests with PDK. This blog post will go more in-depth to that topic, in particular describe and context which you see in all puppet-rspec tests.

When looking at the puppet-rspec test syntax the first time it looks very “rubyesque”. Somebody used to staring at Python code, for example, could call the syntax “odd” or “1337”. Fortunately reading the Ruby rspec documentation helps understand what is going on under the hood and thus making the spec files look less magical. In my case rspec documentation helped understand how contexts work. In the previous blog post a context was created for every supported operating system listed in metadata, and rspec tests were run for each of them by using facts from facterdb.

Testing Puppet feature branches in Foreman

Tue, 26 Nov 2019 00:00:00 +0000

With default settings Foreman does not allow Puppet Agents to specify their own environment when connecting to the Puppetserver. This makes it impossible to use r10k and feature branch workflow like you can with a normal Puppetserver. This behavior can fortunately be reverted easily by modifying Foreman configuration file, /etc/foreman/settings.yaml:

# Allow testing feature branches on nodes
:enc_environment: false

After modifying settings restart the webserver, e.g.

Migrating from Fabric 1 to Fabric 2

Thu, 10 Oct 2019 00:00:00 +0000

Fabric is a Python library for executing shell commands remotely over SSH in serial or parallel mode. I used Fabric 1 for years and it was - and still is - an excellent tool. While Fabric’s use-cases overlap somewhat with those of Ansible, the difference is that Fabric is not state-based. In other words, in Fabric you don’t tell that “file a should have contents n and mode m”. Instead, you just run commands on the target host which hopefully result in the end state you’re looking for. Or maybe you’re not even interested in end-state per se, but just need to run some commands. Both approaches have their use-cases. Fabric and Ansible are quite powerful as orchestration tools: they allow running task a on server x, then task b on server y. For enforcing infrastructure to be in a certain state we prefer Puppet and Terraform over Ansible.

Explicit high-level dependencies in Puppet

Wed, 09 Oct 2019 00:00:00 +0000

I’ve noticed that some people - I won’t reveal their names here to protect them - love using contain and/or ordering arrows in Puppet. A typical use-case is for role classes:

class role::webserver { contain ::packetfilter::endpoint contain ::profile::monit contain ::profile::unixbase contain ::profile::ipa_client contain ::profile::webserver

Class[::packetfilter::endpoint] -> Class[::profile::monit] -> Class[::profile::unixbase] -> Class[::profile::ipa_client] -> Class[::profile::webserver] }

The above code nicely ensures that all the classes get applied in the exact order defined above. What happens under the hood is that Puppet generates dependencies between the classes and applies them in order.

Reprovisioning bare metal Linux servers with Foreman and IPMI

Wed, 25 Sep 2019 00:00:00 +0000

Recently we had to reprovision a bare metal server that was in Foreman and had IPMI support. The goal was to check if our automated “force-join to FreeIPA domain after reprovisioning” logic worked as intented. We did not have access to any graphical IPMI console, nor Foreman’s GUI, so we had to do everything from the command-line. The host we reprovisioned was a CentOS 7 instance. It is assumed that IPMI tools are installed. This post was inspired by the Automate SuperMicro Server Provisioning or Die Trying blog post.

Enabling PHP 7.4 on CentOS 7 with Puppet

Tue, 17 Sep 2019 00:00:00 +0000

The PHP version comes in default CentOS 7 repositories is rather horribly outdated. This is problematic when running Wordpress, which has to be upgraded constantly, and really old PHP versions may not be accepted, security-patched or not. The solution is to get updated PHP from the remi yum repositories. There are two sets of PHP packages as described here:

Install updated packages that replace the old PHP 5 packages (i.e. names are the same)

Terraform S3 access denied problems

Wed, 11 Sep 2019 00:00:00 +0000

I’ve stumbled upon interesting access denied problems with S3-based Terraform state files recently. Suppose you have two or more Terraform root modules which use the same bucket for storing the state and just use a different key (=state file):

terraform {   backend "s3" {     bucket = "terraform-state"     key    = "root-module-1"     region = "eu-central-1"   } }

and

terraform {   backend "s3" {     bucket = "terraform-state"     key    = "root-module-2"     region = "eu-central-1"   } }

However, trying to access the state file in one root module works, but on the other you get a generic S3 Access Denied error:

Puppet module rspec testing with PDK

Thu, 05 Sep 2019 00:00:00 +0000

If you’ve searched for instructions on how to write unit tests for Puppet code you’ve probably stumbled upon tutorials such as this that are of good quality, but suggest installing and using tools such as puppetlabs_rspec_helper directly. Or you may encounter references to rake, bundler, rvm and rspec. Then you start experimenting these tools, some of which (rvm and bundler) are aimed at managing the dependency hell that arises when you, or your team, works simultaneously on multiple projects with different dependency requirements. In the end you are maybe able to run spec tests on your Puppet module, but after all installations of gems and experiments you’re unsure what you did to make everything work. You also don’t want to become a hard-core Ruby developer who actually understands all these tools well - you just want to test your Puppet code.

Lack of default connection settings in Terraform 0.12.x

Thu, 29 Aug 2019 00:00:00 +0000

I was recently bit by a feature (one might call it a bug) in Terraform. We wanted to try out the “Networks” feature in Hetzner Cloud but that required upgrading terraform-provider-hcloud, which in turn required upgrading Terraform to 0.12.x. For the most part migration from 0.11.x code to 0.12.x code was straightforward with some help from the automated migration tool. I even went as far as read some of the migration documentation, but missed one important part: connection blocks no longer have default values. To make the matter worse Terraform 0.12 does not error out if values are unset: instead if just runs the provisioner and then times out. This seems to be related to Terraform bug #21690.

Moving Jenkins user home directory

Thu, 29 Aug 2019 00:00:00 +0000

Jenkins is a continuous integration (CI) / continuous delivery (CD) platform consisting of a Jenkins master - essentially a controller - which launches jobs on Jenkins slaves. Often slaves are controlled via SSH.

Recently I ran into an issue with a legacy Jenkins slave where the “jenkins” where Puppet tried to enforce the home directory of “jenkins” to be /home/jenkins instead of /var/lib/jenkins:

Error: Could not set home on user[jenkins]: Execution of '/usr/sbin/usermod -d /home/jenkins jenkins' returned 8: usermod: user jenkins is currently used by p rocess 802

The usermod command failed because several Jenkins processes (ssh-agent, Java) locked the user from modification. The solution was relatively straightforward:

Foreman and the Puppetserver environment cache

Sat, 17 Aug 2019 00:00:00 +0000

Importing classes is a two-phase process when you’re using r10k with Foreman. Say you’ve created a new class, “role::ipa_server” to the “production” environment; without Foreman it would be sufficient to deploy the change on the Puppetserver with r10k:

$ r10k deploy environment production -vp

At this point Foreman does not, however, know anything about this new class deployed with r10k:

$ hammer puppet-class list --environment production|grep ipa_server

The “Smart proxy” component in Foreman - also known as “foreman-proxy” - is responsible for fetching new classes from Puppetserver. With the latest Puppet versions it uses the Puppetserver API to do the import. It is fairly trivial to update Foreman’s list of classes using the command-line

Foreman ja puppetserverin environment cache

Wed, 07 Aug 2019 00:00:00 +0000

Kun käytetään r10k:ta ja Foremania yhdessä on uusien luokkien tuonti kaksivaiheinen prosessi. Oletetaan vaikka, että “production” environmentiin on luotu uusi luokka, esim. “role::ipa_server”. Ilman Foremania riittäisi tuoda muutos puppetmasterille r10k:lla:

$ r10k deploy environment production -vp

Foreman ei kuitenkaan vielä tiedä uudesta luokasta mitään:

$ hammer puppet-class list --environment production|grep ipa_server

Foremanin komponentti, joka hakee Puppetmasterilta uudet luokat on nimeltään “Smart proxy”, joka tunnetaan myös nimellä “foreman-proxy”. Uusimpien Puppetin versioiden kanssa se hakee luokat Puppetserverin API:a käyttäen. Luokat saa päivitettyä komentoriviltä melko triviaalisti:

Neulan erottaminen Git-muutosten heinäsuovasta

Mon, 15 Jul 2019 00:00:00 +0000

Toisinaan käy niin, että on tarpeen varmistua siitä aiheuttaako iso kasa Git-committeja jotain sivuvaikutuksia esimerkiksi Puppet-tuotantoympäristössä. Hyvistä commit-viesteistä on aina toki apua, mutta toisinaan commitit eivät ole täysin atomisia, eli tekevät enemmän kuin yhden (dokumentoidun) asian. Lisäksi esimerkiksi Puppet control reposta saattaa löytyä paitsi Puppet-koodia, myös Terraformia ja Ansiblea. Tälläisessä tapauksessa on kätevää näyttää vain muutokset, jotka ovat oikeasti relevantteja. Ensin tarkistetaan, mikä “production”-ympäristön viimeisin commit on:

$ ssh puppet$ cd /etc/puppetlabs/code/environments/production$ git rev-parse --short HEAD86c2152

Tämän jälkeen voidaan tarkista control reposta muutokset Puppetin kannalta oleellisiin kansioihin ja tiedostoihin:

FreeIPA:an liitettyjen hostien SSH-avaimien päivitys

Thu, 07 Feb 2019 00:00:00 +0000

FreeIPA on Linux-verkkojen “Active Directory”, jossa on integroitu lukuisia eri komponentteja (mm. LDAP, Kerberos, CA, sssd) siten, että Linux-koneet saadaan liitettyä domainiin. Domainiin liittäminen mahdollistaa mm. keskitetyt käyttäjätunnukset, kertakirjautumisen ja SSH-avaimien ja SSH host-avaimien jakelun. FreeIPA:n voi pystyttää sen omalla asennusohjelmalla, johon iso osa myös puppet-ipa moduulin toiminnallisuudesta perustuu.

FreeIPA:ssa on kuitenkin yksi pieni ärsyttävyys: mikäli noodi (esim. palvelin) rakennetaan (esim. AWS EC2 snapshotista) tai provisioidaan (esim. PXE boot) uudelleen, saattavat FreeIPA:ssa säilytettävät SSH host-avaimet mennä epäsynkkaan todellisuuden kanssa. Käytännössä koneelle ei enää silloin pääse kirjautumaan ilman SSH:n tietoturvamekanismien härskiä kiertämistä:

Puppeteersin Puppetmaster installer-tuote nyt AWS:ssä

Mon, 07 Jan 2019 00:00:00 +0000

HUOM: Tuote on poistunut!

Pitkällisen kehitystyön tuloksena saimme kuin saimmekin tehtyä Puppetmasterin Kafo-pohjaisesta asentimestamme oikean AWS Marketplace-tuotteen: Configuration Manager By Puppeteers Oy.

Tuotteen hinnoittelu perustuu käyttötunteihin. Tuote tukee kolmea eri skenaariota:

Pelkkä Puppetserver
Puppetserver ja PuppetDB
Puppetserver, PuppetDB ja Puppetboard

Installer tekee aiemmin jokseenkin rasittavasti Puppetmasterien asentelusta suorastaan naurettavan helppoa:

$ ssh -i ~/.ssh/mykey.pem ubuntu@instance-ip
 $ sudo -i
 $ puppetmaster-installer -i

Tämän jälkeen valitaan skenaario ja mahdollisesti muutetaan joitain parametreja ja ajetaan asennin. PuppetDB:n ja Puppetboardin salasanat luodaan automaattisesti jos niitä ei ole määritetty.

Puppet-moduulien dokumentaation automaattinen päivittäminen

Mon, 19 Nov 2018 00:00:00 +0000

Puppet-moduulien dokumentaation saa helposti päivitettyä “puppet strings”-työkalulla, jonka käyttö yleisellä tasolla on dokumentoitu varsin hyvin. Kun komento vielä yhdistetään Gitin pre-commit -hookiin, saadaan dokumentaatio päivitettyä automaattisesti joka commitilla. Alla näytetään, miten tämä saadaan toteutettua niin Linuxissa kuin Windowsissa. Oletuksena on, että molemmissa tapauksissa Puppet Agent 5.x on asennettu virallisista Puppetlabsin paketeista.

Aloitan helpommasta eli Linuxista käyttäen esimerkkinä Debian 9:iä: ohjeiden pitäisi kuitenkin toimia myös Ubuntuissa aivan samalla tavoin. Ensin asennetaan Git:

$ sudo -s
 $ apt-get update && apt-get install git

Sen jälkeen asennetaan tarvittavat gemmit käyttäen Puppetin gem-komentoa:

Kansioiden siistiminen turhasta tauhkasta Powershellillä

Wed, 08 Aug 2018 00:00:00 +0000

Toisinaan voi tulla tarve säilyttää jonkin kansion hakemistorakenne, mutta poistaa sieltä suuria määriä tiedostoja. Näin voi käydä esimerkiksi silloin, kun halutaan säästää käännösprosessin tulokset, esim. exe-tiedostot, mutta päästä eroon lähdekoodista ja käännöksen tuottamista väliaikaistiedostoista. Tämä onnistuu kätevästi Powershellin Where-Object CmdLetillä. Alla oletetaan, että komennot ajetaan kansiosta, jonka sisältö halutaan siistiä. Lähtötilanteessa kansiossa on 91 tiedostoa ja hakemistoa:

PS> Get-Childitem -Recurse|Measure-Object|Select Count|Format-List
 Count : 91

Seuraavaksi poistetaan ne ei-hakemistot (~tiedostot), joiden tiedostopääte ei ole .exe:

Zip-arkistojen käsittely Powershellillä

Wed, 08 Aug 2018 00:00:00 +0000

Powershell 5:n myötä myös ZIP-arkistoja voi käsitellä Powershellillä. Tätä aiemmin piti käyttää jos jonkinmoisia kikkoja arkistojen purkamiseen, mikä etenkin komentoriviltä työskenneltäessä oli erittäin ärsyttävää. Arkisto luodaan tähän tapaan:

PS> Compress-Archive -LiteralPath tap-windows6 -DestinationPath tap-windows6-9.22.3.zip

Yleensä ottaen kohdetiedoston nimeen ei tarvitse lisätä tiedostopäätettä (.zip). Tässä tapauksessa Compress-Archive CmdLet kuitenkin hämmentyy, jos sitä ei ole:

PS> Compress-Archive -LiteralPath tap-windows6 -DestinationPath tap-windows6-9.22.3
 Compress-Archive : .3 is not a supported archive file format. .zip is the only supported archive file format.
 --- snip ---

Syynä ovat tietenkin kohdetiedoston nimessä olevat pisteet. Compress-Archive CmdLetissä on dokumentoimaton ja jokseenkin ärsyttävä bugi tai ominaisuus: se ei lisää pisteellä alkavia piilohakemistoja arkistoon paitsi jos ne määritellään eksplisiittisesti lähdetiedostolistauksessa (-LiteralPath). Lisäksi kaikki lähdetiedostolistauksen tiedostot ja kansiot lisätään suoraan arkiston juureen, eikä niiden polkua kunnioiteta. Siis esimerkiksi

Windows-ajurien tietojen näyttäminen Powershellillä

Thu, 26 Jul 2018 00:00:00 +0000

Windowsissa on useita komentorivityökaluja asennettujen ajurien tietojen selvittämiseen. Usein törmää seuraavaan komentoon:

PS> Get-WmiObject Win32_PnPSignedDriver

Luokka Win32_PnpSignedDriver sisältää tiedot ajurien digitaalisista allekirjoituksista sekä lisätietoja, kuten ajurin version. Useimmissa tapauksissa tämä komento riittää, sillä Windows ei ole Windows Vistan jälkeen suostunut lataamaan kuin kaupallisin varmentein allekirjoitettuja ajureita ilman, että se on test-signing -tilassa. Windows 10:n mukana tuli vaatimus siitä, että ajuri sisältää Microsoftin digitaalisen allekirjoituksen. Windows Server 2016 vaatii myöskin Microsoftin allekirjoituksen, mutta sen saaminen ajurille vaatii lisäksi, että Windows Hardware Lab Kit -testit on läpäisty. Käytännössä kehitys- ja testikoneita lukuun ottamatta kaikkien ajurien voidaan siis olettaa olevan kaupallisin varmentein allekirjoitettuja.

Select-Stringin käyttö grepin korvikkeena

Thu, 07 Jun 2018 00:00:00 +0000

Kun unixeissa pitää etsiä neula tekstimuotoisen datan heinäsuovasta, käytetään yleensä grep-komentoa. Jos tekstirivi täsmää annettuun hakuparametriin tulostetaan se oletustulostevirtaan (stdout). Grepin kanssa voidaan käyttää hakuparametreina yksinkertaisten merkkijonojen lisäksi säännöllisiä lausekkeita ja käyttää vaikka mitä muita hienoja kikkoja.

Powershellissä ei (ilmeisesti) ole mitään näin hienoa työkalua, mutta onneksi tekstimassasta saa useimmiten seulottua esille oleellisen Select-Stringin merkkijonohaulla. Esimerkiksi Windowsissa on oletuksena palomuurisääntöjä niin valtavat määrät, että niiden kaikkien läpikäynti jonkin tietyn säännön löytämiseksi on hullun hommaa. Hommaa voi helpottaa Select-Stringillä:

Funktioiden kirjoittaminen Puppet-kielellä

Wed, 23 May 2018 00:00:00 +0000

Puppetissa on suuri määrä erilaisia rakenteita, joilla turhaa toistoa koodissa voidaan vähentää. Aiemmin käsiteltiin jo resurssien oletusarvoja ja each-funktiota, joilla toistoa voidaan vähentää yksittäisessä manifest-tiedostossa. Funktiolla samalle koodilohkolle voidaan välittää parametreja, joiden perusteella se laskee mekaanisesti jonkin paluuarvon. Kuten Puppetin virallisten funktioiden listasta näkyy, tätä funktioiden ominaisuutta hyödynnetään mitä erilaisimpiin käyttötarkoituksiin. Funktioita voi paitsi käyttää eri manifesteissa, myös eri moduuleissa kuin missä ne on määritetty.

Perinteisesti funktioita kirjoitettiin Ruby-kielellä. Sittemmin on tullut mahdolliseksi kirjoittaa niitä myös Puppet-kielellä. Alla yksinkertainen esimerkki puppetfinland/openvpn-moduulista:

Windowsien palomuurin hallinta Puppetilla

Wed, 23 May 2018 00:00:00 +0000

Linuxissa palomuurina - tai tarkemmin pakettisuodattimena - käytetään netfilteriä, jota hallitaan yleensä iptables (IPv4) ja ip6tables (IPv6) komennoilla. Iptables-sääntöjen määritys Puppetissa onnistuu helpoiten puppetlabs/firewall -moduulilla. Tyypillinen käyttötapaus on portin avaaminen palomuuriin; tästä tyypillisenä esimerkkinä Puppet-Finland-projektin ::snmp::packetfilter -luokka, jossa avataan pääsy UDP-portiin 161 määritetyistä IPv4 ja IPv6-osoitteista.

Myös Windowsin palomuurisääntöjä voi muokata Puppetilla käyttämällä puppet/windows_firewall -moduulia. Kyseinen moduuli on melko yksinkertainen kääre “netsh advfirewall”-komennon ympärillä, mutta se hoitaa hommansa hyvin.

Linuxissa koko palomuurisäännöstö on helppo pitää ruodussa Puppetilla (ks. esim. puppetfinland/packetfilter moduuli), mutta Windowsissa on pitkälti tyytyminen sääntöjen kevyeen lisäämiseen ja muokkaamiseen. Tämä käy ilmeiseksi, kun listaa tuoreen Windows-koneen palomuurisäännöt:

Puppet-moduulien julkaisu Puppet Forgessa

Wed, 02 May 2018 00:00:00 +0000

Puppet Forge on Puppetlabsin tarjoama repo Puppet-moduuleille. Forge-moduuleja voi asentaa “puppet module install”-komennolla, mutta niihin voi viitata myös r10k:n tai librarian-puppetin Puppetfilessä. Nykyisin Puppet Forge on ensimmäinen paikka, josta katson, onko joku muu jo ratkaissut käsilläni olevan ongelman Puppetilla - pyörää kun on toisinaan turha keksiä uudelleen.

Olen itse käyttänyt vuosia Git Submoduleja, koska niiden avulla Puppet-moduuleihin ulkopuolelta tulevat muutokset on helppo tarkistaa Gitin lokeista ja diffeistä. Niiden käyttö menee kuitenkin kankeaksi kun moduulien määrä kasvaa suureksi: sekä päärepo että submodulet vaativat jatkuvaa paapomista. Tuloksena on turhanpäiväisiä, samankaltaisina toistuvia commit-viestejä kuten “Update Git submodule pointers”, joilla ei ole mitään muuta käytännön merkitystä kuin Gitin pitäminen tyytyväisenä.

Bashin ja Powershellin komentohistorian käyttö

Mon, 23 Apr 2018 00:00:00 +0000

Unix-komentotulkeissa kuten Bashissa on ollut vuosikaudet varsin monipuoliset tavat palata komentotulkin historiasta löytyviin komentoihin. Nuoli ylös palaa komentohistoriassa taaksepäin ja nuoli alas vie eteenpäin. Koko historian näkee komennolla “history”:

$ history
 1257 git remote -v
 1258 cd /tmp/
 --- snip ---
 2242 id -un 0
 2243 id -gn 0

Tämän voi yhdistää grepin kanssa:

$ history|grep remote
 1264 git remote -v
 --- snip --

Yksi kätevimmistä on haku historiasta: ensin painetaan Ctrl-R ja sen jälkeen syötetään hakusana (alla “gpg”):

RAL ja järjestelmän tilan muuntaminen puppet-koodiksi

Mon, 23 Apr 2018 00:00:00 +0000

Joskus käy niin että verkosta löytyy huolellisesti vuosien mittaan käsin säädetty, mahdollisesti jo edesmenneeltä sysadminilta peritty taideteos, jonka sielunelämästä ei kukaan enää ymmärrä, ja joka uhkaa romahtaa jos hengittää kohti liian kovaa. Se tuottaa mahdollisesti vielä jotakin yritykselle merkityksellistä palveluakin. Mikä avuksi?

Jos näin on päässyt käymään, tai odotetaan suoritettavan muun toistaiseksi villinä ja vapaana ajelevan järjestelmän hallinta puppetilla, on hyvä palauttaa mieleen, että puppet sisältää RAL-kuoren (Resource Abstraction Layer), jonka avulla voidaan tarkastella sitä miten puppet näkee järjestelmän. RAL-kuoren avulla voidaan järjestelmän tila muuntaa puppet-koodiksi pienellä vaivalla. Esimerkiksi hakemistopuun muuntaminen:

Puppet-koodin tiivistäminen each-funktiolla ja resurssien oletusarvoilla

Tue, 13 Mar 2018 00:00:00 +0000

Puppet-koodissa on monia tapoja vähentää koodiin määrää. Silloin, kun pitää luoda useita hyvin samankaltaisia resursseja, on each-funktio erittäin kätevä työkalu. Jos luotavien resurssien erot rajoittuvat yhden parametrin arvoon, riittää seuraava:

# testfiles.pp
 $testfiles = ['/tmp/foo','/tmp/bar']
 $testfiles.each |$testfile| {
 file { $testfile:
 ensure => 'present',
 }
 }

Yllä oleva koodi luo molemmat tiedostot:

$ puppet apply testfiles.pp
 Notice: Compiled catalog for computer.example.org in environment production in 0.13 seconds
 Notice: /Stage[main]/Main/File[/tmp/foo]/ensure: created
 Notice: /Stage[main]/Main/File[/tmp/bar]/ensure: created
 Notice: Applied catalog in 0.03 seconds

Each-funktio on erityisen voimallinen, kun sen käyttämä data määritetään Hash-tyyppisessä muuttujassa. Alla esimerkki ini-tiedoston muokkauksesta gitdaemon-moduulissa:

Ulkoisten faktojen perusteet

Wed, 28 Feb 2018 00:00:00 +0000

Aiemmassa blogikirjoituksessa käsittelin custom faktojen luontia dynaamisesti. Tällä kertaa käsittelemme ulkoisten faktojen (“external facts”) perusteita. Puppetlabsin oma dokumentaatio aiheesta on varsin laadukasta, kunhan sen vain malttaa lukea ajatuksen kanssa (toisin kuin allekirjoittanut).

Ulkoisilla faktoilla tarkoitetaan faktoja, joiden arvon Facter päättelee niiden tulosteesta ja joita ei tyypillisesti ole kirjoitettu Rubyllä vaan esim. Bashilla, Pythonilla tai PowerShellillä. Ne toimivat muutoin kuin “oikeat” faktat, mutta niissä ei voida viitata muihin faktoihin, eikä niitä voi rajata (“confine”) toimimaan vain jossain käyttöjärjestelmässä.

Custom faktojen luonti ohjelmallisesti

Wed, 21 Feb 2018 00:00:00 +0000

Staattisten faktojen kirjoittaminen on varsin helppoa melko vähäisinkin Ruby-taidoin. Alla esimerkki faktasta, joka palauttaa true tai false riippuen siitä, onko noodilla /boot-osiota:

Facter.add(:has_bootfs) do
 setcode do
 if Facter.value(:mountpoints)['/boot'].nil?
 false
 else
 true
 end
 end
 end

Kuten yltä näkyy, itse tieto löytyi jo valmiiksi Facterin “mountpoints”-faktan sisältä: yllä sen sisältöä vain muunnettiin erilliseksi, helposti käsiteltäväksi faktaksi visualisointia ja skriptausta helpottamaan.

Mountpoints-fakta sisältää myös paljon muuta kiinnostaa tietoa, kuten sen, miten suuri osio on ja paljonko siellä on tilaa vapaana. Jos näistäkin tiedoista halutaan luoda samaan tapaan erilliset faktat, voidaan ne helposti luoda dynaamisesti:

XML-tiedostojen muokkaus Puppetin Augeas-resurssilla

Sun, 18 Feb 2018 00:00:00 +0000

NOTE: this article is now also available in English (here).

Aiemmassa blogikirjoituksessa käsittelin Augeaksen käyttöä Puppetin kanssa esimerkkinä PostgreSQL:n pg_hba.conf -tiedoston muokkaus. Tässä kirjoituksessa käsitellään XML-tiedostojen muokkausta Augeaksella, mikä on luultavasti siistein ratkaisu silloin, kun ei haluta hallita koko tiedostoa esimerkiksi ERB-templatena. Alla muokataan Pwm:n web.xml-tiedostoa, johon on määritettävä asetushakemiston polku.

Ennen itse Augeas-resurssin kirjoitusta kannattaa tarkistaa, mikä Augeaksen käsitys muokattavan tiedoston rakenteesta on. Ensin augtoolille pitää kertoa, mistä hallittava tiedosto löytyy:

Lisää läskiä työnkulkuun, osa 5: Hiera ja sisällön kryptaaminen

Mon, 05 Feb 2018 00:00:00 +0000

Puppet-moduulien ja manifestien uudelleenkäytettävyyden vuoksi on suositeltavaa pitää data niistä erillään. Tämä tapahtuu käyttämällä hieraa. Moduulit voivat esimerkiksi tuottaa erilaisia asetuksia käyttämällä hieran perusteella organisaatiohin tai sijainteihin määriteltyä dataa

Hieraan tallennetaan tyypillisesti myös sellaista yksityistä dataa mikä pitää olla suojattua, ja minkä ei haluta joutuvan ulkopuolisten saataville. Tyypillisesti data tallennetaan muun koodin ohella versionhallintajärjestelmään, joka voi olla organisaation rajojen ulkopuolella. Tällöin on käytettävä hieran encryptionta.

Aiemmin yleisesti käytetty hieran salauksen menetelmä oli hiera-gpg. Hiera-gpg:n avulla salattiin koko tiedosto. Hiera-eyaml parantaa tilannetta sallimalla hieratiedoston sisällä haluttujen datalohkojen salaamisen, mikä parantaa käytettävyyttä.

Yleiskatsaus moderniin Puppet 5 ympäristöön

Mon, 05 Feb 2018 00:00:00 +0000

Puppetin palvelinpuoleen kuuluu on nykyisin aikamoinen tukku palvelinsovelluksia, työkaluja ja suositeltuja työnkulkuja:

Palvelinkomponentit
- Puppetserver: Varsinainen Puppet-palvelin, johon Puppet agentit ottavat yhteyttä. Toimii myös itsenäisesti ilman PuppetDB:tä ja Puppetboardia
- PuppetDB: Datasäilö, johon Puppet agentit tallentavat faktojaan ja raporttejaan. Dataan päästään haluttaessa käsin ohjelmallisesti.
- PostgreSQL: PuppetDB:n taustalla oleva tietokantapalvelin
- Puppetboard: PuppetDB:n datan visualisoitiin tarkoitettu webbisovellus.
- Apache 2: Puppetboardin taustalla oleva webbipalvelin
Työkalut
- Git: versionhallintajärjestelmä, josta hallintarepo, r10k ja monien Puppet moduulien käyttö on riippuvaista.
- Hiera: hierarkinen datasäilö Puppet-moduulien, esim. profiilien, parametreille. Voidaan käyttää asiakaskoneiden asetusten räätälöintiin eri luokitteluperustein. Luokittelu voi perustua faktoihin (esim. käyttöjärjestelmäversio, datakeskus) tai asiakaskoneelle erikseen määritettyihin arvoihin (esim. asiakas, koneen kriittisyys liiketoiminnan kannalta).
- Eyaml: Hieran datatiedostossa (yaml) olevan datan kryptaukseen tarkoitettu työkalu. Tärkeä erityisesti silloin, kun Hieran dataa säilötään organisaation ulkopuolella kuten esimerkiksi GitLabissa.
- R10k: työkalu dynaamisten Puppet environmentien hallintaan. Käytännössä r10k luo kustakin hallintarepon haarasta Puppet environmentin. Kukin haara sisältää environmentin vaatimat Puppet-moduulit sekä niiden tarvitsemat parametrit.
Suositellut työnkulut
- Komponenttimoduulien, roolien ja profiilien käyttö
- Hallintarepon ja r10k:n käyttö
- Versionhallinnan (Gitin) käyttö on perusoletus

Lisää läskiä työnkulkuun, osa 1: Hallintarepo

Wed, 31 Jan 2018 00:00:00 +0000

Mikäli muutosten tekeminen Puppet-koodiin ja Hieraan suoraan puppetmasterilla tuntuu liian kevyeltä ja helpolta, voi Puppet-työnkulusta tehdä asteittain vaikeammaksi oman sietokyvyn mukaan lisäämällä palettiin lisää komponentteja. Esimerkiksi ns. control repon ja r10k:n käyttö Puppetin environmentien ylläpitoon lisää heti useita vaiheita aiemmin yksinkertaiseen työnkulkuun. Toki tällä saavutetaan myös ihan oikeita etuja, joista lisää tuonnempana.

Control repo - tästä lähtien osin suomennettuna “hallintarepo” - on käytännössä Git repository, jonka jokaisesta haarasta (branch) luodaan (tai ainakin voidaan luoda) dynaamisesti Puppet masterille vastaava Puppet-environment. Hallintarepon oletushaaran nimi, “production”, on tästä syystä sama, kuin Puppet agenttien oletuksena käyttämä environment. Hallintarepon haaroissa on pitkälti sama sisältö kuin tavanomaisessa /etc/puppetlabs/code/environments/production -kansiossakin olisi:

Lisää läskiä työnkulkuun, osa 2: r10k

Wed, 31 Jan 2018 00:00:00 +0000

Edellisessä blogipostauksessa esiteltiin tyypillinen hallintarepon rakenne. Tässä artikkelissa käsitellään r10k:ta, jolla hallintarepon haaroista muodostetaan Puppet-palvelimelle vastaavat Puppet-environmentit. R10k:n asennus Puppet 4:een tai uudempaan on suoraviivaista Puppet-pakettien mukana tulevalla gem-ohjelmalla:

$ /opt/puppetlabs/puppet/bin/gem install r10k

Tämän jälkeen luodaan r10k:lle asetustiedosto /etc/puppetlabs/r10k/r10k.yaml:

---
 :cachedir: /opt/puppetlabs/puppet/cache/r10k
 :sources:
 control:
 basedir: /etc/puppetlabs/code/environments
 prefix: false
 remote: git@gitlab.com:myorg/control-repo.git

Yllä oletetaan, että hallintarepo (“control repo”) on jo olemassa GitLabissa tai vastaavassa, ja että SSH-avaimet on luotu ja lisätty hallintarepoon sekä mahdollisiin yksityisiin Puppet-moduulirepoihin, joihin Puppetfilessä viitataan.

Lisää läskiä työnkulkuun, osa 3: GitLab ja vastaavat

Wed, 31 Jan 2018 00:00:00 +0000

Edellisissä artikkeleissa käsiteltiin hallintarepoa ja r10k:ta. Vaikka mikään ei estäkään hallintarepon pitämistä Puppetmaster-koneella ja r10k.yaml:n osoittamista siihen, menetettäisiin silloin monta työvaihetta eikä ratkaisu siten sopisi tämän artikkelisarjan teemaan. Viimeinen puuttuva komponentti työnkulun läskiyttämisessä onkin GitLab tai vastaava, kuten GitHub tai Bitbucket. Näistä ensimmäinen soveltuu parhaiten tilanteeseen, jossa halutaan luoda paljon yksityisiä Git-repoja, joista ei haluta maksaa, eikä GitLabin edistyneemmille ominaisuuksille ole käyttöä. GitHubissa jokainen yksityinen repository maksaa, joten se on kallis ratkaisu yksityisten puppet-moduulien säilömiseen. Bitbucket sallii GitLabin tavoin rajoittamattomasti yksityisiä repositoryjä, mutta rajoittaa käyttäjien määrän tällä hetkellä viiteen, eikä tarjoa merkittävästi etuja, paitsi ehkä Trello-integraation, jos Kanbania haluaa käytellä. GitLabilla on puolellaan vielä se etu, että se on avointa lähdekoodia, joten sen voi asentaa myös omaan sisäverkkoon ja käyttää sieltä.

Lisää läskiä työnkulkuun, osa 4: Roolit ja profiilit

Wed, 31 Jan 2018 00:00:00 +0000

Mikäli hallintarepon, r10k:n ja GitLab:in sisältävä työnkulku tuntuu vielä liian kevyeltä, on läskiä ja abstraktiotasoja lisättävissä onneksi toisaalla, nimittäin itse Puppet-moduuleissa. Pelastuksen tarjoaa ns. “Roles and Profiles pattern”, jonka kehitti alunperin Craig Dunn, ja joka löi läpi todennäköisesti Gary Larizzan blogikirjoitusten myötä. Alla käytämme englanninkielisen termin sijaan lähes suomenkielistä termiä “roolit ja profiilit”.

Roolit ja profiilit ovat aivan tavallisia Puppet-luokkia. Ne eivät ole kuitenkaan ole Gary Larizzan termiä käyttäen ns. komponenttimoduuleja, jotka on suunniteltu jonkin yksittäisen asian tekoon, ja jotka olisivat siten (ainakin periaatteessa) jaettavissa muiden käyttäjien kesken esim. Puppet Forgessa.

Windows hallintaan Puppetilla

Tue, 16 Jan 2018 00:00:00 +0000

Puppet on jo pitkään tukenut Windowsia. Monet natiivit Puppet-resurssit, kuten File, Package ja Service ovat jo pitkään toimineet sekä *NIX-käyttöjärjestelmissä että Windowsissa. Lisäksi osa natiiveista Puppet-resursseista, kuten Registry on suunniteltu pelkästään Windows-käyttöön.

Puppetin käyttömukavuus Windows-järjestelmien ylläpidossa on parantunut mutkan kautta muutamien uusien teknologioiden myötä:

Powershell DSC perustuu resurssien tilan hallintaan, aivan kuten Puppetkin. Mikä parasta, Puppet-koodissa voi käyttää natiivien Puppet-resurssien lisäksi Powershell DSC-resursseja. Puppetlabsin blogikirjoitus on hyvä alustus tähän aiheeseen. DSC vaatii toimiakseen Powershell 5.0:n, joka tulee Windows Management Framework 5.0:n mukana.

Powershell ja Windows hosts-tiedoston muokkaaminen

Mon, 15 Jan 2018 00:00:00 +0000

Windowsissa voidaan käyttää hosts-tiedostoa ip-osoitteiden ja nimien liittämiseen toisiinsa, aivan kuten Linuxissakin. Linuxissa tiedoston sijainti on /etc/hosts, Windowsissa se on c:windowssystem32driversetchosts, tai oikeastaan $env:windirsystem32driversetchosts.

Hosts-tiedoston käyttäminen tulee ajankohtaiseksi silloin kun sovellus tarvitsee DNS-nimen, eikä DNS-palvelinta ole käytettävissä, tai sitä ei voida jostakin syystä käyttää.

Jos Puppet agentille ei ole määritetty palvelinta, se yrittää oletuksena yhteyttä palvelimeen jonka DNS-nimi on ‘puppet’, eli jos palvelimelle on määritetty domain ’example.com’, agent hakee palvelinta jonka DNS-nimi on ‘puppet.example.com’ Määrittämällä server-asetuksella palvelimen DNS-nimi, voidaan Puppet agent osoittaa haluttuun palvelimeen. Tämä määritetään Linuxeissa tyypillisesti uusimmissa puppet-versioissa tiedostossa /etc/puppetlabs/puppet/puppet.conf osiossa main tai agent.

Powershell-provisiointiskriptien käyttö Vagrantissa

Mon, 15 Jan 2018 00:00:00 +0000

Vagrantin shell-provisioner tukee suoraan Powershell-skriptejä. Toisin sanoen Windows-virtuaalikoneen asetuksia voi muokata Powershellillä ilman, että tarvitsee rakentaa uusi virtuaalikonekuva. Tyypillinen esimerkki on Windows liittäminen konfiguraationhallintajärjestelmään kuten Puppetiin.

Vagrantin dokumentaatiossa mainitaan, että Powershell-skriptille voi välittää parametreja powershell_args -valinnalla joko merkkijonona (string) tai listana (array). Esimerkkejä etenkin Powershell-provisioinnista on kuitenkin heikosti, mistä syystä tämäkin blogipostaus on kirjoitettu. Otetaan esimerkkinä skripti bootstrap_windows.ps1_,_ joka liittää Windows-virtuaalikoneen olemassa olevaan Puppetserveriin. Sitä käytetään käsin Powershellistä seuraavasti:

> .bootstrap_windows.ps1 -certName win2012r2.local
 -ServerName puppet.local
 -puppetServerAddress 192.168.137.10

Rivinvaihdot on lisätty selvyyden vuoksi.

Vagrant ja Windows-boxien rakentaminen

Mon, 15 Jan 2018 00:00:00 +0000

Vagrant on erittäin kätevä työkalu kehitys- ja testausympäristöjen rakentamiseen. Sillä voidaan helposti ja toistettavasti luoda virtuaalikoneita, joiden asetukset säädetään halutunlaisiksi provisioning-vaiheessa esimerkiksi skripteillä (shell, powershell) tai konfiguraationhallintatyökaluilla kuten Puppetilla. Vagrantin taustalla on yleensä käytössä Oraclen Virtuabox, mutta myös muita virtualisointialustoja tuetaan ns. providerien avulla.

Vagrantilla luodut virtuaalikoneen on myös helppo verkottaa keskenään. Vagrant toimiikin siten hyvin palvelinympäristöjen testauksessa; hyvänä esimerkkinä käy puppet-ipa -moduuli, jossa Vagrantilla luodaan FreeIPA multi-master -palvelinympäristö sekä useita asiakaskoneita eri käyttöjärjestelmillä. Toinen hyvä esimerkki on puppet-bacula -moduuli, jossa Vagrantilla luodaan täydellinen Bacula-varmuuskopiointiympäristö.

Vagrant ja Windows-virtuaalikoneet

Mon, 15 Jan 2018 00:00:00 +0000

Edellisessä artikkelissa rakennettiin Packerilla ja Boxcutter-templateilla Windows box Vagrant-käyttöön. Tässä artikkelissa näytetään, miten Vagrantilla rakennetaan varsinaisia Windows-virtuaalikoneita.

Vagrantia ohjataan Vagrantfile-tiedostolla, joka usein sijaitsee projektin (esim. Puppet-moduuli) päähakemistossa. Jopa hyvin yksinkertainen Vagrantfile riittää Windows-virtuaalikoneen pystyttämiseen:

# -*- mode: ruby -*-
 # vi: set ft=ruby :
 
 Vagrant.configure("2") do |config|
 config.vm.define "win2012r2" do |box|
 box.vm.box = "mwrock/Windows2012R2"
 box.vm.box_version = "0.6.1"
 box.vm.hostname = "windows2012r2a"
 box.vm.network "private_network", ip: "192.168.31.101"
 box.vm.provider "virtualbox" do |vb|
 # Poistetaan Virtualboxin konsolinäkymä käytöstä
 vb.gui = false
 vb.memory = 2048
 end
 end
 end

Yllä käytetään erästä julkista Windows 2012r2 boxia. Aivan yhtä hyvin voitaisiin käyttää aiemmassa artikkelissa Packerilla luotua boxia tähän tapaan:

Puppet-pohjaisten asennusohjelmien luonti Kafolla

Wed, 29 Nov 2017 00:00:00 +0000

Puppet on erittäin kätevä erityisesti hyvin monimutkaisten järjestelmien rakentamisessa ja ylläpidossa. Sen avulla on helppoa myös häivyttää suuriakin käyttöjärjestelmäeroja yhden luokkarajapinnan taakse. Hyvänä esimerkkinä käyvät Puppet-Finland-projektin thunderbird- ja openvpn-moduulit, jotka toimivat useilla eri Linux-jakeluilla ja Windowsilla.

Yleensä Puppettia varten rakennetaan palvelinympäristö, joka koostuu puppetserveristä, yleensä puppetdb:stä sekä mahdollisesti myös puppetboardista tai foremanista. Kullekin hallittavalle koneelle asennettu puppet-agent ottaa yhteyden puppetserveriin esim. kerran puolessa tunnissa, päivittää konfiguraationsa vastaamaan puppetserverillä määriteltyä tilaa ja lähettää raportin puppetserverin kautta puppetdb:lle.

Puppettia voidaan ajaa myös paikallisesti ilman puppetserveriä käyttämällä puppet apply-komentoa esimerkiksi seuraavasti:

Vagrant, Powershell ja parametrien välittäminen

Mon, 13 Nov 2017 00:00:00 +0000

Vagrant on näppärä väline myös Windows-virtuaalikoneiden luontiin esim. Puppet-resurssien testauksessa. Windows-virtuaalikoneille on luontevaa käyttää Powershell-provisiointia, minkä Vagrant tekee melkoisen yksinkertaiseksi. Aika nopeasti ilmenee tarve välittää Powershell-skriptille parametrejä Vagrantin kautta. Tästä on hieman hankalaa löytää esimerkkejä, joten tässä yksi.

Oletetaan että meillä on Powershell-skripti nimeltä bootstrap_windows.ps1 Vagrant-projektin alihakemistossa ‘provision’. Skripti asentaa ja konfiguroi Puppet-agentin Windows-virtuaalikoneelle. Skriptille pitää välittää kaksi parametria: Puppetserverin FQDN (serverName) ja mukavuusbonuksena virtuaalikoneelle haluttu FQDN (certName). (Käytän itse Vagrantille yaml-muotoista ns. data-driven vagrant-tiedostoa, joten syntaksi on hieman erilainen vakiomuotoiseen Vagrant-tiedostoon verrattuna).

Debian 9 automaattisen asennuksen tekeminen muistitikulta

Thu, 21 Sep 2017 00:00:00 +0000

Tässä artikkelissa näytetään kaksi tapaa Debianin asentamiseksi muistitikulta. Ensimmäisessä CD/DVD-asennin yksinkertaisesti kopioidaan muistitikulla, jolloin siitä tulee kätevämpi ja nopeampi CD-levyn korvike. Toinen tapa on monimutkaisempi, mutta mahdollistaa asennusten automatisoinnin helposti. Alla oletetaan, että muistitikun laitetiedosto on /dev/sdb ja että komennot ajetaan pääkäyttäjän oikeuksin esim. sudoa käyttämällä.

Koska väärän laitetiedoston käyttäminen voi ylikirjoittaa koko järjestelmälevyn, on muistitikun laitetiedosto syytä tarkistaa esimerkiksi “dmesg”-komennolla:

[79499.127904] usb 2-1.2: new high-speed USB device number 13 using ehci-pci
 [79499.230913] usb 2-1.2: New USB device found, idVendor=0951, idProduct=1607
 [79499.230918] usb 2-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
 [79499.230920] usb 2-1.2: Product: DataTraveler 2.0
 [79499.230921] usb 2-1.2: Manufacturer: Kingston
 [79499.230923] usb 2-1.2: SerialNumber: 5B840D0001DA
 [79499.231294] usb-storage 2-1.2:1.0: USB Mass Storage device detected
 [79499.231633] scsi16 : usb-storage 2-1.2:1.0
 [79500.230217] scsi 16:0:0:0: Direct-Access Kingston DataTraveler 2.0 PMAP PQ: 0 ANSI: 0 CCS
 [79500.230722] sd 16:0:0:0: Attached scsi generic sg1 type 0
 [79500.460385] sd 16:0:0:0: [sdb] 15646720 512-byte logical blocks: (8.01 GB/7.46 GiB)
 [79500.461321] sd 16:0:0:0: [sdb] Write Protect is off
 [79500.461327] sd 16:0:0:0: [sdb] Mode Sense: 23 00 00 00
 [79500.462022] sd 16:0:0:0: [sdb] No Caching mode page found
 [79500.462028] sd 16:0:0:0: [sdb] Assuming drive cache: write through
 [79500.465797] sdb: sdb1
 [79500.468449] sd 16:0:0:0: [sdb] Attached SCSI removable disk

Lisäksi on syytä vamistaa, että kyseiseltä muistitikulta on ylipäätään mahdollista bootata käyttöjärjestelmä tai sen asennin; kaikilta ei nimittäin voi.

Debian snapshots

Tue, 20 Dec 2016 00:00:00 +0000

Törmäsin eilen varsin hyödylliseen sivustoon nimeltään snapshot.debian.org. Sieltä löytyvät kaikki julkaistut Debian-projektin pakettien versiot. Tämä mahdollistaa pakettien päivittämisen sekä vanhempiin että uudempiin versioihin, mistä on hyötyä mm. selvitettäessä onko jonkin ongelman syy ohjelmistovirhe vai konfiguraatiovirhe.

Ohjelmistolähteenä snapshots.debian.org ei toimi, toisin kuin esim. backports.debian.org.

Sekalaisia komentoja Samban debuggaukseen

Tue, 20 Dec 2016 00:00:00 +0000

Alla tukku hyödyllisiä komentoja Samban debuggaukseen. Oletus on, että Samba AD DC ja Domain Member-palvelinten konfiguraatiot ovat pääosin kunnossa. Tähän pisteeseen päästään helpohkosti Puppet-Finland -projektin samba4-moduulilla. Täysin hands off -asennus on varsin haastava, joten debuggaustyökaluille tulee väistämättä tarvetta.

Tarkistetaan, onko member-nimisellä koneella jo machine account Samban LDAP:ssa, eli onko se jo liitetty domainiin:

$ net ads dn 'CN=member,CN=Computers,DC=smb,DC=domain,dc=com' cn -U administrator%password
 Got 1 replies
 
 cn: member

Tässä eräs toinen tapa selvittää, onko member-kone liitetty domainiin. Tähän vaaditaan Debianissa ldb-tools -paketin asentaminen ja komento on ajettava DC-koneella:

Prosessien tietojen etsiminen Powershellillä

Wed, 09 Nov 2016 00:00:00 +0000

UNIX-tyyppissä järjestelmissä prosessitaulun tarkastelu on helppoa ps-komennolla. Samainen komento löytyy Powershellistäkin, mutta se on vain alias Get-Process CmdLetille, jolla saadaan helposti selville, mitä prosesseja järjestelmässä on käynnissä (alla typistetty tuloste):

> Get-Process
 
 Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
 ------- ------ ----- ----- ----- ------ -- -----------
 136 8 6428 8084 569 0.08 916 bash
 26 3 1496 2272 16 0.02 1560 cmd
 57 7 1096 5852 57 0.03 2144 firefox
 0 0 0 4 0 0 openvpn
 88 7 988 3668 50 0.02 2676 openvpnserv
 34 3 500 2332 14 0.00 4940 openvpnserv
 562 27 151992 161440 615 4.27 2388 powershell

Jos prosessin nimi on jo tiedossa, voidaan se antaa -Name -parametrilla - huomaa, että .exe jätetään pois lopusta:

Cobbler autodetect system name

Wed, 05 Oct 2016 00:00:00 +0000

Cobblerissa on eräs varsin heikosti dokumentoitu ominaisuus, jonka avulla on mahdollista selvittää, mikä kyselyn tekevän koneen nimi Cobblerissa on. Tästä on hyötyä esimerkiksi Windowsin bootstrappauksessa, jotta saadaan noudettua oikeaan Cobbler System-olioon liittyvä Unattended.xml -tiedosto. Linuxien tapauksessa tähän kikkailuun ei ole tarvetta, koska Cobblerin parametrit välittyvät käyttöjärjestelmän asentimelle suoraan kickstart- tai preseed tiedoston mukana.

Itse ominaisuus on erittäin yksinkertainen käyttää, kunhan muistaa ajaa sen siltä koneelta, jonka System name halutaan tietää:

Cobbler templatet

Wed, 05 Oct 2016 00:00:00 +0000

Käytämme työasemien ja osin myös palvelimien provisioinnissa Cobbleria. Se on vahvimmillaan juuri fyysisten laitteiden provisionnissa, vaikka perustason tuki myös virtuaalikoneiden provisioinnille löytyykin. Cobbler nitoo yhteen lukuisia eri palveluita (dhcp, dns, tftp) Python-koodin avulla, joten aivojen vääntäminen sen vaatimiin asetuksiin vie aikansa. Cobblerin perusdokumentaatio on RedHatille tyypilliseen tyyliin varsin hyvää, mutta ongelmiin joutuu helposti, kun halua tehdä jotain virallisen dokumentaation ulkopuolelta. Esimerkiksi Cobblerin web-API on dokumentoitu varsin heikosti, lähinnä tässä Wiki-artikkelissa. Tässä ja tulevissa blogikirjoituksissa pyritään paikkaamaan Cobblerin dokumentaation puutetta.

Hieran debuggauksesta

Wed, 15 Jun 2016 00:00:00 +0000

Toisinaan Puppet-koodissa on tarve tehdä haku Hierasta, mutta se ei toimi odotetulla tavalla. Näissä tapauksissa auttaa “puppet lookup”-komento:

$ puppet lookup --node www.domain.com --explain bacula::filedaemon::backup_files
 Data Binding "hiera"
 Found key: "bacula::filedaemon::backup_files" value: [
 "/etc",
 "/var/lib/puppet/ssl",
 "/var/backups/local"
 ]

Erikoista kyllä, tämä komento löytää ainoastaan ne Hieran hierarkian tasot, jotka perustuvat faktoihin:

---
 :backends:
 - yaml
 :hierarchy:
 - "nodes/%{::trusted.certname}"
 - "roles/%{::role}"
 - "lsbdistcodename/%{::lsbdistcodename}"
 - "osfamily/%{::osfamily}"
 - "kernel/%{::kernel}"
 - common
 
 :yaml:
 :datadir:

Yllä muuttuja role ei siis ole fakta, vaan se on oikeastaan parametri tai käytänne, joka määritetään noodin yaml-tiedostossa:

Windowsin järjestelmätiedostojen ylikirjoittaminen Puppetilla

Sat, 09 Apr 2016 00:00:00 +0000

Windowsin järjestelmätiedostoja ei useinkaan pysty muuttamaan käsin - tai Puppetilla - ilman niiden suojaustason alentamista. Ongelma on siinä, että järjestelmätiedostojen omistaja on usein (pseudo)käyttäjä “TrustedInstaller”, eikä edes administrator-tason käyttäjillä ole niihin kirjoitusoikeutta. Onneksi rajoitukset voi kiertää melko suoraviivaisesti käyttämällä takeown.exe -komentoa sekä puppetlabs/acl -moduulia. Alla on muokattu erästä Group Policyn XML-tiedostoa, jonka merkistökoodaus oli siinä määrin poikkeuksellinen, että sen lukeminen Rubyn reXML -kirjastolla ei onnistunut:

include ::acl
 
 # Vaihda tiedoston omistaja
 exec { 'takeown-Search.admx':
 command => 'C:WindowsSystem32takeown.exe /f C:WindowsPolicyDefinitionsSearch.admx',
 }
 
 # Määritä uudet oikeudet
 acl { 'Search.admx':
 target => 'C:/Windows/PolicyDefinitions/Search.admx',
 permissions => [
 { identity => 'Järjestelmänvalvojat', rights => ['full'] },
 { identity => 'SYSTEM', rights => ['full'] }
 ],
 require => Exec['takeown-Search.admx'],
 }
 
 # Korvaa tiedosto
 file { 'C:/Windows/PolicyDefinitions/Search.admx':
 source => 'puppet:///modules/winpolicydefinitions/Search.admx',
 require => Acl['Search.admx'], 
 }

Tästä prosessista kannattaisi muokata oma määritelty resurssinsa, tai jopa peräti oma tyyppinsä, mikäli sille löytyisi runsaasti käyttöä. Takeown-komentoon kannattaisi lisätä myös “unless”-parametri, jotta sitä ei ajeta turhaan joka kerta. Jos Execissä olisi “provider => ‘powershell’”, niin tarkistuksen voisi tehdä muutamin eri tavoin.

Windowsin paikallisten ryhmäkäytäntöjen muokkaus Puppetilla

Sat, 09 Apr 2016 00:00:00 +0000

Monia Windowsien asetuksia on perinteisesti muokattu ryhmäkäytänteillä (“Group Policy”). Vaikka ryhmäkäytänteiden teho onkin melko rajallinen, pystyy niillä tekemään yhtä ja toista. Microsoft on kuitenkin Powershell DSC:n kuitenkin siirtymässä tilan hallintaan perustuviin modernimpiin ratkaisuja, joten Group Policyt jäänevät lähivuosina historiaan.

Tästä huolimatta ryhmäkäytänteitä hyödynnetään yhä erityisesti Active Directory -toimialueiden (“domain”) kanssa silloin, kun halutaan standardisoida työasemien asetuksia. Myös Samba 4 tukee ryhmäkäytänteiden jakelua työasemille. Ryhmäkäytänteet eivät kuitenkaan vaadi Active Directoryn tai Samba 4:n käyttöä, sillä käytänteitä voidaan määrittää paitsi verkkoalueelle, myös paikallisesti (“Local Group Policy”). Käytänteet voidaan lisäksi jakaa käyttäjäkohtaisiin (“User policy”) ja tietokonekohtaisiin (“Machine policy”).

Powershelliä UNIX-ylläpitäjille, osa 12

Wed, 06 Apr 2016 00:00:00 +0000

Toisinaan tulee tarpeelliseksi etsiä yhdestä tai useammasta tiedostosta jotakin merkkijonoa ja tulostaa täsmäävä rivi sekä tiedosto, jossa se on, sekä rivinumero. GNU grepillä tämä onnistuu triviaalisti komennolla “grep -HN pattern”:

$ grep -Hn REXML *.rb
 group_policy.rb:71: dFile = REXML::Document.new( File.new("#{dDir}\#{array[0][0]}.admx"))
 group_policy.rb:72: eFile = REXML::Document.new( File.new("#{eDir}\#{array[0][0]}.adml"))
 group_policy.rb:154: dFile = REXML::Document.new( File.new("#{dDir}\#{sys_tShort}.admx"))
 group_policy.rb:155: eFile = REXML::Document.new( File.new("#{eDir}\#{sys_tShort}.adml"))
 group_policy.rb:428: dFile = REXML::Document.new( File.new("#{dDir}\#{tShort}.admx"))
 group_policy.rb:429: eFile = REXML::Document.new( File.new("#{dDir}\#{adml}"))

Sama homma onnistuu myös Powershellissä, mutta hieman vaikeammin:

Powershelliä UNIX-ylläpitäjille, osa 10

Thu, 10 Mar 2016 00:00:00 +0000

Windowsin käynnistyviin ohjelma- ja kirjastotiedostoihin liittyy paljon erilaista metatietoa, esimerkiksi ohjelman versionumero, julkaisija yms. Näiden metatietojen tarkastelu on toisinaan hyödyllistä, etenkin ohjelmistoja testattaessa. Alla OpenVPN:n bin -kansion sisältö kokonaisuudessaan:

PS C:Program FilesOpenVPNbin> Get-ChildItem 
 
 Directory: C:Program FilesOpenVPNbin 
 
 Mode LastWriteTime Length Name
 ---- ------------- ------ ----
 -a--- 7.3.2016 16:40 1753440 libeay32.dll 
 -a--- 7.3.2016 16:40 226432 liblzo2-2.dll
 -a--- 7.3.2016 16:40 123000 libpkcs11-helper-1.dll 
 -a--- 7.3.2016 16:40 465760 openvpn-gui.exe
 -a--- 7.3.2016 16:40 965984 openvpn.exe 
 -a--- 7.3.2016 16:40 65888 openvpnserv.exe 
 -a--- 7.3.2016 16:40 396640 ssleay32.dll

Metatiedot on tallennettu tiedosto-objektin VersionInfo-parametriin - alla tarkastellaan openvpn.exe -tiedoston metatietoja:

Powershelliä UNIX-ylläpitäjille, osa 11

Thu, 10 Mar 2016 00:00:00 +0000

Windowsin tuoteavain (“Product Key”) löytyy esiasennetuissa koneissa usein koneen pohjasta, mutta entäpä jos Windows onkin jälkiasennettu, tai koneen pohjassa oleva tarra ei edustakaan todellisuutta? Jos tällainen kone soseutuu, ei tuoteavainta löydy tietenkään mistään fyysisestä paikasta, ja tuloksena on kone ilman Windowsia; tämä voi toki olla toivottavakin asiaintila, mutta lähdetään siitä oletuksesta, ettei näin ole.

Tuoteavain on onneksi tallennettu Windowsin rekisteriin, mistä sen saa otettua talteen useilla eri tavoilla. Koska tässä blogissa keskitytään automaatioon ja Powershellin, mitkään graafiset kikkareet eivät luonnollisestikaan tule kyseeseen. Onneksi homma hoituu myös alla olevalla Powershell-skriptillä (lähde):

Powershelliä UNIX-ylläpitäjille, osa 9

Sun, 03 Jan 2016 00:00:00 +0000

Toisinaan on tarpeen lisätä tekstitiedoston loppuun rivejä. UNIX:ssa tämä onnistuu helposti echo-komennolla:

$ echo matti >> vpn.pass
 $ echo salasana >> vpn.pass
 $ cat vpn.pass
 matti
 salasana

Sama onnistuu Powershellissä, mutta ei suinkaan Write-Host -komennolla, joka olisi echo-komennon lähin vastine, vaan Add-Content -komennolla:

> Add-Content vpn.pass -Value matti
 > Add-Content vpn.pass -Value salasana
 > Get-Content vpn.pass
 matti
 salasana

Toinen melko yleinen tarve on tiedostojen lataaminen verkosta suoraan komentoriviltä. UNIX:ssa tämä onnistuu helpoiten wget-komennolla:

Powershelliä UNIX-ylläpitäjille, osa 8

Mon, 22 Jun 2015 00:00:00 +0000

Tietyn nimisten tiedostojen (tai tyyppisten) poistaminen hakemistosta on melko suoraviivaista GNU findilla:

$ ls
 README.txt stderr.log stdout.log
 $ find . -maxdepth 1 -type f -name "*.log" -exec rm -f {} +
 $ ls
 README.txt

Valinta “maxdepth 1” estää findia poistamasta tiedostoja mahdollisista alihakemistoista.

Toinen vaihtoehto on putkittaa tiedostolistaus xargsille:

$ ls
 README.txt stderr.log stdout.log
 $ ls *.log|xargs rm -f
 $ ls
 README.txt

Tässä ei kuitenkaan erotella toisistaan tiedostoja ja hakemistoja, joten myös mahdolliset .log -päätteiset hakemistot yrittäisiin poistaa siinä epäonnistuen.

Powershelliä UNIX-ylläpitäjille, osa 6

Wed, 17 Jun 2015 00:00:00 +0000

UNIX-tyyppisissä käyttöjärjestelmissä on tulee usein tarve etsiä jostain hakemistosta lähiaikoina (alla minuutin sisällä) muuttuneet tiedostot:

$ find /var/log/ -mmin -1
 /var/log/debug
 /var/log/user.log
 /var/log/auth.log
 /var/log/syslog

Sama onnistuu myös Powershellissä ainakin kahdella tavalla, joista ensimmäinen on toiminnallisesti identtinen yllä olevan komennon kanssa:

PS C:UsersAdministratorDownloads> Get-ChildItem . -Recurse|Where-Object { $_.LastWriteTime -ge $(Get-Date).AddMinutes(-120) }|Select LastWriteTime, Name
 
 LastWriteTime Name 
 ------------- ----
 6/18/2015 install.bat

Yllä oleva komento käy läpi koko hakemiston rekursiivisesti tarkistaen jokaisen tiedoston kohdalla viimeisimmän kirjoitusajan ja verraten sitä Date-objektiin, jossa nykyisestä kellonajasta on vähennetty 120 minuuttia. Toisin sanoen komento näyttää ne tiedostot tai hakemistot, joita on muokattu viimeisen 120 minuutin sisällä. Selkeyden vuoksi tiedostojen tiedoista näytetään selkeyden vuoksi vain nimi ja kirjoitusaika.

Powershelliä UNIX-ylläpitäjille, osa 7

Wed, 17 Jun 2015 00:00:00 +0000

Tulosteiden uudelleenohjaus ja paluuarvojen käsittely toimii lähes samoin *NIX-shelleissä ja Windowsin Powershellissä. Alla tarkistetaan Linuxin systemctl-komennolla olemassa olevan (“openvpn”) ja olemattoman (“fake”) palvelun tila, ohjataan sekä tuloste että virhetuloste bittitaivaaseen ja tulostetaan komennon paluuarvo:

$ systemctl status openvpn > /dev/null 2>&1
 $ echo $?
 0
 $ systemctl status fake > /dev/null 2>&1
 $ echo $?
 3

Kuten näkyy, paluuarvo on 0 jos palvelu on olemassa ja 3 jos sitä ei löydy.

Useiden resurssien luonti lista-parametrien avulla

Mon, 15 Jun 2015 00:00:00 +0000

Toisinaan tulee tarve luoda useita samankaltaisia resursseja, joissa vain jonkin yksittäisen ominaisuuden arvo muuttuu. Esimerkiksi intranetin webbipalvelimeen voi joutua sallimaan yhteydet palomuurin läpi sekä sisäverkon että VPN:n osoiteavaruudesta. Vaikka Puppet ei suoraan tuekaan iteraatiota, sitä voi emuloida antamalla resurssin nimeksi ($title) listan merkkijonon sijaan.

Esimerkiksi Puppet-Finlandin webserver-moduulissa on parametrit $allow_address_ipv4 ja $allow_address_ipv6. Ne voivat saada arvokseen joko merkkijonon (‘192.168.55.0/24’) tai listan ([‘192.168.55.0/24’, ‘10.69.0.0/16’]):

class webserver::packetfilter
 (
 $allow_address_ipv4,
 $allow_address_ipv6
 
 ) inherits webserver::params

Kummankin parametrin arvo annetaan ::webserver::packetfilter::allow_ip -resurssin nimeksi ($title):

Powershelliä UNIX-ylläpitäjille, osa 5

Wed, 13 May 2015 00:00:00 +0000

Windowsissa tekstimuotoisia lokitiedostoja UNIX:in tapaan ole, vaan niitä vastaa EventLog, jonka sisältöä voi tutkia kätevästi PowerShellillä. EventLogin lokit (Logs) voi listata seuraavasti:

PS C:> Get-EventLog -List 
 
 Max(K) Retain OverflowAction Entries Log 
 ------ ------ -------------- ------- --- 
 20 480 0 OverwriteAsNeeded 3 787 Application 
 20 480 0 OverwriteAsNeeded 0 HardwareEvents 
 512 7 OverwriteOlder 0 Internet Explorer 
 20 480 0 OverwriteAsNeeded 0 Key Management Service 
 20 480 0 OverwriteAsNeeded 2 606 Security 
 20 480 0 OverwriteAsNeeded 1 684 System 
 15 360 0 OverwriteAsNeeded 4 823 Windows PowerShell

Halutun lokin (alla System) viimeisimmät kirjaukset (alla 10) saa näytettyä -Newest -vivulla:

Puppet-moduulien laadunvarmistus, osa 1: automaattiset tarkistustyökalut

Mon, 27 Apr 2015 00:00:00 +0000

Puppet-moduulien laatu pysyy korkeana, kun syntaksi- ja tyylivirheitä päästetä edes versionhallintaan asti. Puppet-koodin syntaksivirheet löytyvät helposti:

$ puppet parser validate tiedosto

ERB-templateiden virheet saa selvitettyä seuraavalla tavalla:

$ erb -P -x -T '-' tiedosto|ruby -c

JSON-tiedostojen (metadata.json) virheet etsiminen vaatii hieman kikkailua:

$ cat tiedosto|json_pp -f json -t null

Tyylivirheitä voi etsiä puppet-lint -työkalulla:

$ puppet-lint tiedosto
 $ puppet-lint .

Puppet-lint tunnistaa myös puppet-koodin, joka on eteenpäin tai taaksepäin epäyhteensopivaa. Onkin hyvin järkevää ajaa puppet-koodi aina puppet-lintin läpi ennen suuria Puppet-ympäristön päivityksiä.

Käyttöjärjestelmäerojen hallinta Puppetissa, osa 1

Sun, 26 Apr 2015 00:00:00 +0000

Puppet-moduulit on melko helppo rakentaa siten, että ne saa helposti toimimaan eri käyttöjärjestelmissä ja käyttöjärjestelmäversioissa. Alla ovat itse hyväksi toteamani kolme korkea tason tapaa käyttöjärjestelmäerojen hallintaan kevyimmästä raskaimpaan:

Params-luokan käyttö
Käyttöjärjestelmäriippuvaisten aliluokkien käyttö
Uuden moduulin rakentaminen

Menetelmillä 1 ja 2 pystyy käytännössä hallitsemaan kaikki Unix-tyyppisten käyttöjärjestelmien väliset erot. Menetelmää 3 ei juuri tarvita, paitsi jos jokin käyttöjärjestelmä (lue: Windows) eroa muista käytössä olevista huomattavan paljon.

Pieniin eroihin riittää siis params-luokan käyttö. Otetaan esimerkiksi vaikkapa Puppet-Finlandin ntp-moduuli:

Augeas-resurssien luonnista ja debuggaamisesta

Tue, 14 Apr 2015 00:00:00 +0000

NOTE: this article is now also available in English.

Puppetin Augeas-resurssilla voidaan muokata konfiguraatiotiedostojen osia sen sijaan, että hallittaisiin koko tiedostoa esim. templatella tai staattisella tiedostolla. Koko tiedoston hallinta tuottaa yleensä varmemmin ja vähemmällä vaivalla halutun lopputuloksen, mutta erityisesti luettelomaisten konfiguraatiotiedostojen tapauksessa Augeas-resurssi on erittäin käyttökelpoinen. Augeaksen käyttö ei-triviaaleissa tapauksissa on kuitenkin varsin haastavaa, ja usein onkin hyödyllistä rakentaa oikeat komennot käsin “augtool”-kehotteessa ja vasta sitten muuntaa ne Puppetin Augeas-resurssiksi.

Aluksi kannattaa tutkia, mikä Augeaksen näkemys jonkin konfiguraatiotiedoston rakenteesta on (ylimääräisiä rivejä on poistettu):

Powershelliä UNIX-ylläpitäjille, osa 3

Thu, 19 Mar 2015 00:00:00 +0000

Powershelliä konffatessa on tullut taas törmättyä useisiin varsin käyttökelpoisiin komentoihin. Alla ei-kattava lista, sillä lisää on luvassa sopivalla hetkellä.

Hakemiston poistaminen rekursiivisesti:

$ rm -rf hakemisto
 > Remove-Item -Recurse -Path hakemisto

Tiedoston viimeisten rivien näyttäminen:

$ cat tiedosto|tail -n <rivien_määrä>
 > Get-Content tiedosto -Last <rivien_määrä>

Tiedoston ensimmäisten rivien näyttäminen

$ cat tiedosto|head -n <rivien_määrä>
 > Get-Content tiedosto -First <rivien_määrä>

Tiedoston rivien määrän laskeminen:

Powershelliä UNIX-ylläpitäjille, osa 4

Thu, 19 Mar 2015 00:00:00 +0000

Lisävinkkejä tuli keksittyä nopeammin kuin alunperin osasin uumoillakaan. Näille on ollut käyttöä jo useaan kertaan.

Prosessin ID:n löytäminen:

$ ps aux|grep nimi
 > Get-Process -Name nimi

Prosessin tappaminen PID:n perusteella

$ kill pid
 > Stop-Process -Id pid

Prosessin tappaminen nimen perusteella

$ pkill nimi
 > Stop-Process -Name nimi

Powershelliä UNIX-ylläpitäjille -artikkelisarjan muut osat:

Powershelliä UNIX-ylläpitäjille, osa 2

Mon, 23 Feb 2015 00:00:00 +0000

Alla on varsin hyvä vertailu Bashin ja Powershellin komennoista englanniksi (EDIT: sivu on sittemmin valitettavasti poistunut):

BASH and PowerShell Quick Reference

Kuten näkyy, Powershellissä on valmiina melko suuri määrä UNIX-tyyppisiä komentojen aliaksia. Aliakset viittaavat kuitenkin Powershell-komentoihin, joten esimerkiksi niiden valitsimet poikkeavat merkittävästi UNIX-komentojen vastaavista.

Powershelliä UNIX-ylläpitäjille -artikkelisarjan muut osat:

Powershelliä UNIX-ylläpitäjille, osa 1

Wed, 18 Feb 2015 00:00:00 +0000

Windows-työasemien ja -palvelinten ylläpidosta voi tehdä huomattavasti tehokkaampaa ja hauskempaa Windows Powershellillä. Aiempaan Windowsin komentoriviin (cmd.exe) verrattuna Powershell on varsin ylivoimainen. Tietyt toimet ovat Powershellissä jopa helpompia kuin Unixin komentorivissä kuten Bashissa.

Powershellissä käsitellään tekstirivien tai binääridatan sijaan objekteja. joita voidaan putkittaa komennolta toiselle. Objektien käsittely on usein huomattavasti yksinkertaisempaa kuin tekstin, koska komennoissa voidaan viitata objektien ominaisuuksiin, eikä syötettä tarvitse UNIX:in komentorivien tapaan ensin siistiä ja pilkkoa lukuisilla komennoilla (esim. sed, cut, tr ja awk) oleellisen tiedon erottelemiseksi.

Määriteltyjen resurssien luonti suoraan Puppet-luokista

Mon, 02 Feb 2015 00:00:00 +0000

Jotkin Puppet ENC:t (External Node Classifier), hyvänä esimerkkinä Foreman, eivät tue määriteltyjen resurssien (Defined Resource Types) käyttöä suoraan, vaan kaikki konfiguraatiot pitää sisällyttää Puppet-luokkiin.

Myös Hieran kanssa määritellyt resurssit ovat hieman ongelmallisia, koska ne pitää erikseen luoda create_resources funktiolla. Eräs ratkaisu on määrittää kaikki create_resources -funktiot site.pp-tiedostossa (sovellettu täältä):

create_resources('mysqldump::backup',hiera('mysqldump_backups', {}))

Tämän lähestymistavan ongelma on se, että uudet määritellyt resurssit pitää muistaa lisätä site.pp-tiedostoon.

Yksinkertaisempi ja myös Foremanin kanssa toimiva ratkaisu on luoda määritellyt resurssit suoraan Puppet-moduulin pääluokasta (sovellettu täältä):

Hakemistorakenteen luonti rekursiivisesti Puppetilla

Tue, 20 Jan 2015 00:00:00 +0000

Puppetin File-resurssilla hallitaan tyypillisesti yksittäisiä tiedostoja, hakemistoja tai linkkejä. Tämä on ongelmallista, jos hallittava tiedosto on syvän hakemistorakenteen alla, eikä hakemistorakennetta ole luotu esimerkiksi ohjelman asennuksen yhteydessä. File-resurssi osaa kuitenkin luoda useita tiedostoja, kun sen otsakkeelle ($title) annetaan merkkijonon sijaan lista-tyyppinen muuttuja. Alla esimerkki bind-moduulista

file { [ '/var/named/chroot',
 '/var/named/chroot/var',
 '/var/named/chroot/var/named',
 '/var/named/chroot/Var/named/data' ]:
 ensure => directory,
 owner => root,
 group => "${::os::params::admingroup}",
 mode => 755,
 require => Class['bind::install'],
 }

Bindin zone-tiedostoja ei voi asentaa, ennen kuin hakemisto /var/named/chroot/var/named/data on olemassa. Siis zone-tiedostoon pitää lisätä riippuvuus (Require) yllä olevan luettelon viimeiseen tiedostoon:

Privacy policy

Mon, 01 Jan 0001 00:00:00 +0000