unkin/puppet-prod
2
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'develop' into neoloc/bind_resolver

Browse Source
This commit is contained in:
Ben Vincent 2023-11-13 21:45:02 +11:00
commit 49f31edb03
20 changed files with 219 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hiera.yaml
View File

@ -9,7 +9,10 @@ hierarchy:
- "nodes/%{trusted.certname}.yaml"
- name: Role-specific data
paths:
- "%{facts.enc_role_path}.yaml"
- "roles/%{::enc_role_tier1}.yaml"
- "roles/${::enc_role_tier1}/%{::enc_role_tier2}.yaml"
- "roles/${::enc_role_tier1}/%{::enc_role_tier2}/%{::enc_role_tier3}.yaml"
- "%{::enc_role_path}.yaml"
- name: "OS Related"
paths:
- "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"

61
hieradata/common.yaml
View File

@ -27,74 +27,15 @@ profiles::packages::base:
profiles::base::scripts::scripts:
puppet: puppetwrapper.py
profiles::puppet::autosign::subnet_ranges:
- '198.18.17.0/24'
profiles::puppet::autosign::domains:
- '*.main.unkin.net'
# profiles::puppet::autosign::nodes:
# - 'somenode.main.unkin.net'
profiles::puppet::client::environment: 'develop'
profiles::puppet::client::runinterval: 1800
profiles::puppet::client::runtimeout: 3600
profiles::puppet::client::show_diff: true
profiles::puppet::client::usecacheonfailure: false
profiles::puppet::enc::repo: https://git.unkin.net/unkinben/puppet-enc.git
profiles::puppet::enc::release: '0.4'
profiles::puppet::enc::force: true
profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkinben/puppet-r10k.git
profiles::puppet::g10k::bin_path: '/opt/puppetlabs/bin/g10k'
profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
profiles::puppet::g10k::default_environment: 'develop'
profiles::puppet::puppetdb::puppetdb_host: prodinf01n04.main.unkin.net
profiles::puppet::puppetdb::postgres_host: prodinf01n05.main.unkin.net
puppetdb::master::config::create_puppet_service_resource: false
#puppetdb::master::config::puppetdb_host: "%{lookup('profiles::puppet::puppetdb::puppetdb_host')}"
profiles::accounts::sysadmin::sshkeys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ8SRLlPiDylBpdWR9LpvPg4fDVD+DZst4yRPFwMMhta4mnB1H9XuvZkptDhXywWQ7QIcqa2WbhCen0OQJCtwn3s7EYtacmF5MxmwBYocPoK2AArGuh6NA9rwTdLrPdzhZ+gwe88PAzRLNzjm0ZBR+mA9saMbPJdqpKp0AWeAM8QofRQAWuCzQg9i0Pn1KDMvVDRHCZof4pVlHSTyHNektq4ifovn0zhKC8jD/cYu95mc5ftBbORexpGiQWwQ3HZw1IBe0ZETB1qPIPwsoJpt3suvMrL6T2//fcIIUE3TcyJKb/yhztja4TZs5jT8370G/vhlT70He0YPxqHub8ZfBv0khlkY93VBWYpNGJwM1fVqlw7XbfBNdOuJivJac8eW317ZdiDnKkBTxapThpPG3et9ib1HoPGKRsd/fICzNz16h2R3tddSdihTFL+bmTCa6Lo+5t5uRuFjQvhSLSgO2/gRAprc3scYOB4pY/lxOFfq3pU2VvSJtRgLNEYMUYKk= ben@unkin.net
profiles::reposync::repos_list:
almalinux_8_8_baseos:
repository: 'BaseOS'
description: 'AlmaLinux 8.8 - BaseOS'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/BaseOS/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
almalinux_8_8_appstream:
repository: 'AppStream'
description: 'AlmaLinux 8.8 - AppStream'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/AppStream/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
almalinux_8_8_highavailability:
repository: 'HighAvailability'
description: 'AlmaLinux 8.8 - HighAvailability'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/HighAvailability/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
epel_8_everything:
repository: 'Everything'
description: 'EPEL 8 Everything'
osname: 'epel'
release: '8'
baseurl: 'https://dl.fedoraproject.org/pub/epel/8/Everything/x86_64/'
gpgkey: 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8'
epel_8_modular:
repository: 'Modular'
description: 'EPEL 8 Modular'
osname: 'epel'
release: '8'
baseurl: 'https://dl.fedoraproject.org/pub/epel/8/Modular/x86_64/'
gpgkey: 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8'
profiles::base::hosts::additional_hosts:
- ip: 198.18.17.3
hostname: prodinf01n01.main.unkin.net
@ -130,4 +71,4 @@ profiles::base::hosts::additional_hosts:
hostname: prodinf01n22.main.unkin.net
aliases:
- prodinf01n22
- repo.main.unkin.net
- repos.main.unkin.net

3
hieradata/os/AlmaLinux/AlmaLinux8.yaml
View File

@ -2,8 +2,9 @@
---
profiles::yum::managed_repos:
- 'base'
- 'extras'
- 'appstream'
- 'epel'
- 'powertools'
- 'highavailability'
- 'puppet7'
- 'yum.postgresql.org'

1
hieradata/os/AlmaLinux/AlmaLinux9.yaml
View File

@ -2,7 +2,6 @@
---
profiles::yum::managed_repos:
- 'base'
- 'extras'
- 'appstream'
- 'epel'
- 'puppet7'

4
hieradata/os/AlmaLinux/all_releases.yaml
View File

@ -1,7 +1,7 @@
# hieradata/os/almalinux/all_releases.yaml
---
profiles::yum::base::baseurl: http://almalinux.mirror.digitalpacific.com.au
profiles::yum::epel::baseurl: http://mirror.aarnet.edu.au/pub/epel
profiles::yum::base::baseurl: http://repos.main.unkin.net/almalinux
profiles::yum::epel::baseurl: http://repos.main.unkin.net/epel
profiles::firewall::firewalld::ensure_package: 'absent'
profiles::firewall::firewalld::ensure_service: 'stopped'
profiles::firewall::firewalld::enable_service: false

51
hieradata/roles/infra/packagerepo.yaml Normal file
View File

@ -0,0 +1,51 @@
---
profiles::reposync::repos_list:
almalinux_8_8_baseos:
repository: 'BaseOS'
description: 'AlmaLinux 8.8 - BaseOS'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/BaseOS/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
almalinux_8_8_appstream:
repository: 'AppStream'
description: 'AlmaLinux 8.8 - AppStream'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/AppStream/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
almalinux_8_8_highavailability:
repository: 'HighAvailability'
description: 'AlmaLinux 8.8 - HighAvailability'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/HighAvailability/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
almalinux_8_8_powertools:
repository: 'PowerTools'
description: 'AlmaLinux 8.8 - PowerTools'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/PowerTools/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
almalinux_8_8_extras:
repository: 'extras'
description: 'AlmaLinux 8.8 - extras'
osname: 'almalinux'
release: '8.8'
baseurl: 'http://mirror.aarnet.edu.au/pub/almalinux/8.8/extras/x86_64/os/'
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
epel_8_everything:
repository: 'Everything'
description: 'EPEL 8 Everything'
osname: 'epel'
release: '8'
baseurl: 'https://dl.fedoraproject.org/pub/epel/8/Everything/x86_64/'
gpgkey: 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8'
epel_8_modular:
repository: 'Modular'
description: 'EPEL 8 Modular'
osname: 'epel'
release: '8'
baseurl: 'https://dl.fedoraproject.org/pub/epel/8/Modular/x86_64/'
gpgkey: 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8'

5
hieradata/roles/puppet.yaml Normal file
View File

@ -0,0 +1,5 @@
---
profiles::puppet::puppetdb::puppetdb_host: prodinf01n04.main.unkin.net
profiles::puppet::puppetdb::postgres_host: prodinf01n05.main.unkin.net
puppetdb::master::config::create_puppet_service_resource: false
#puppetdb::master::config::puppetdb_host: "%{lookup('profiles::puppet::puppetdb::puppetdb_host')}"

18
hieradata/roles/puppet/puppetmaster.yaml Normal file
View File

@ -0,0 +1,18 @@
---
profiles::puppet::autosign::subnet_ranges:
- '198.18.17.0/24'
profiles::puppet::autosign::domains:
- '*.main.unkin.net'
# profiles::puppet::autosign::nodes:
# - 'somenode.main.unkin.net'
profiles::puppet::enc::repo: https://git.unkin.net/unkinben/puppet-enc.git
profiles::puppet::enc::release: '0.5'
profiles::puppet::enc::force: true
profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkinben/puppet-r10k.git
profiles::puppet::g10k::bin_path: '/opt/puppetlabs/bin/g10k'
profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
profiles::puppet::g10k::default_environment: 'develop'

14
site/profiles/lib/facter/enc_role_path.rb Normal file
View File

@ -0,0 +1,14 @@
# frozen_string_literal: true
# create an enc_role_path fact from enc_role, to be used by hiera.yaml
#
# roles::infra::dns::resolver becomes roles/infra/dns/resolver
Facter.add(:enc_role_path) do
setcode do
enc_role = Facter.value(:enc_role)
if enc_role
enc_role_path = enc_role.gsub('::', '/')
enc_role_path
end
end
end

15
site/profiles/lib/facter/enc_role_tier1.rb Normal file
View File

@ -0,0 +1,15 @@
# frozen_string_literal: true
# split the enc_role fact into different tiers
#
# e.g.
# enc_role_tier2: roles::infra::dns::resolver -> infra
Facter.add(:enc_role_tier1) do
setcode do
role = Facter.value(:enc_role)
if role
parts = role.split('::')
parts[1] if parts.size > 1
end
end
end

14
site/profiles/lib/facter/enc_role_tier2.rb Normal file
View File

@ -0,0 +1,14 @@
# frozen_string_literal: true
# split the enc_role fact into different tiers
# e.g.
# enc_role_tier2: roles::infra::dns::resolver -> dns
Facter.add(:enc_role_tier2) do
setcode do
role = Facter.value(:enc_role)
if role
parts = role.split('::')
parts[2] if parts.size > 2
end
end
end

14
site/profiles/lib/facter/enc_role_tier3.rb Normal file
View File

@ -0,0 +1,14 @@
# frozen_string_literal: true
# split the enc_role fact into different tiers
# e.g.
# enc_role_tier3: roles::infra::dns::resolver -> resolver
Facter.add(:enc_role_tier3) do
setcode do
role = Facter.value(:enc_role)
if role
parts = role.split('::')
parts[3] if parts.size > 3
end
end
end

18
site/profiles/manifests/base/datavol.pp
View File

@ -17,7 +17,11 @@ class profiles::base::datavol (
String $lv = 'data',
Stdlib::Absolutepath $mount = '/data',
Optional[Variant[Pattern[/^\d+(M|G|T|P)$/], Integer]] $size = undef,
Array $mount_options = ['noatime', 'nodiratime'],
Array[Enum[
'defaults', 'ro', 'rw', 'sync', 'async',
'noatime', 'nodiratime', 'noexec', 'nosuid',
'nodev', 'remount', 'auto', 'noauto'
]] $mount_options = ['noatime', 'nodiratime'],
) {
# Ensure the physical volume exists
@ -49,14 +53,20 @@ class profiles::base::datavol (
before => Mount[$mount],
}
# Ensure the mountpath exists
file { $mount:
ensure => directory,
owner => 'root',
group => 'root',
mode => '0755',
}
# Ensure the logical volume is mounted at the desired location
mount { $mount:
ensure => $ensure,
device => "/dev/${vg}/${lv}",
fstype => $fstype,
options => 'defaults',
dump => 0,
pass => 2,
options => $mount_options.join(','),
require => Filesystem["/dev/${vg}/${lv}"],
}
}

14
site/profiles/manifests/puppet/client.pp
View File

@ -29,6 +29,20 @@ class profiles::puppet::client (
ensure => $puppet_version,
}
# if puppet-version is anything other than latest, set a versionlock
$puppet_versionlock_ensure = $puppet_version ? {
'latest' => 'absent',
default => 'present',
}
$puppet_versionlock_version = $puppet_version ? {
'latest' => undef,
default => $puppet_version,
}
yum::versionlock{'puppet-agent':
ensure => $puppet_versionlock_ensure,
version => $puppet_versionlock_version,
}
# Ensure the puppet service is running
service { 'puppet':
ensure => 'running',

43
site/profiles/manifests/yum/base.pp
View File

@ -1,6 +1,6 @@
# Class: profiles::yum::base
#
# This class manages the 'base', extras' and 'appstream' yum
# This class manages the 'base', extras' and 'appstream' yum
# repositories for a system, based on the provided list of managed repositories.
#
# Parameters:
@ -17,7 +17,7 @@
# - Sets up the 'base', extras', and 'appstream' yum repositories
# as specified in the $managed_repos parameter, all using the provided baseurl.
#
# - Each repo configuration includes the baseurl parameterized with the OS
# - Each repo configuration includes the baseurl parameterized with the OS
# release version and architecture, and specifies the GPG key.
#
# Example usage:
@ -31,8 +31,13 @@
class profiles::yum::base (
Array[String] $managed_repos,
String $baseurl,
Enum[
'daily',
'weekly',
'monthly'
] $snapshot = 'daily',
) {
$releasever = $facts['os']['release']['major']
$release = $facts['os']['release']['full']
$basearch = $facts['os']['architecture']
if 'base' in $managed_repos {
@ -40,8 +45,8 @@ class profiles::yum::base (
name => 'base',
descr => 'base repository',
target => '/etc/yum.repos.d/base.repo',
baseurl => "${baseurl}/${releasever}/BaseOS/${basearch}/os/",
gpgkey => "${baseurl}/RPM-GPG-KEY-${facts['os']['name']}",
baseurl => "${baseurl}/${release}/BaseOS-${snapshot}/${basearch}/os/",
gpgkey => "${baseurl}/${release}/BaseOS-${snapshot}/${basearch}/os/RPM-GPG-KEY-${facts['os']['name']}",
}
}
@ -50,8 +55,8 @@ class profiles::yum::base (
name => 'extras',
descr => 'extras repository',
target => '/etc/yum.repos.d/extras.repo',
baseurl => "${baseurl}/${releasever}/extras/${basearch}/os/",
gpgkey => "${baseurl}/RPM-GPG-KEY-${facts['os']['name']}",
baseurl => "${baseurl}/${release}/extras-${snapshot}/${basearch}/os/",
gpgkey => "${baseurl}/${release}/extras-${snapshot}/${basearch}/os/RPM-GPG-KEY-${facts['os']['name']}",
}
}
@ -60,8 +65,28 @@ class profiles::yum::base (
name => 'appstream',
descr => 'appstream repository',
target => '/etc/yum.repos.d/appstream.repo',
baseurl => "${baseurl}/${releasever}/AppStream/${basearch}/os/",
gpgkey => "${baseurl}/RPM-GPG-KEY-${facts['os']['name']}",
baseurl => "${baseurl}/${release}/AppStream-${snapshot}/${basearch}/os/",
gpgkey => "${baseurl}/${release}/AppStream-${snapshot}/${basearch}/os/RPM-GPG-KEY-${facts['os']['name']}",
}
}
if 'powertools' in $managed_repos {
yumrepo { 'powertools':
name => 'powertools',
descr => 'powertools repository',
target => '/etc/yum.repos.d/powertools.repo',
baseurl => "${baseurl}/${release}/PowerTools-${snapshot}/${basearch}/os/",
gpgkey => "${baseurl}/${release}/PowerTools-${snapshot}/${basearch}/os/RPM-GPG-KEY-${facts['os']['name']}",
}
}
if 'highavailability' in $managed_repos {
yumrepo { 'highavailability':
name => 'highavailability',
descr => 'highavailability repository',
target => '/etc/yum.repos.d/highavailability.repo',
baseurl => "${baseurl}/${release}/HighAvailability-${snapshot}/${basearch}/os/",
gpgkey => "${baseurl}/${release}/HighAvailability-${snapshot}/${basearch}/os/RPM-GPG-KEY-${facts['os']['name']}",
}
}
}

27
site/profiles/manifests/yum/epel.pp
View File

@ -11,14 +11,10 @@
# --------
# - Checks the OS release version.
#
# - If the release version is 7, 8, or 9, it sets up the 'epel' yum repository
# and installs the EPEL release RPM from the provided baseurl.
# - If the release version is 7, 8, or 9, it sets up the 'epel' yum repository
#
# - If the release version is not supported, it raises an error.
#
# - The repo configuration includes the baseurl parameterized with the OS
# release version and architecture, and specifies the GPG key.
#
# Example usage:
# --------------
# To use this class with the default parameters:
@ -31,27 +27,22 @@
class profiles::yum::epel (
Array[String] $managed_repos,
String $baseurl,
Enum[
'daily',
'weekly',
'monthly'
] $snapshot = 'daily',
) {
$releasever = $facts['os']['release']['major']
$release = $facts['os']['release']['major']
$basearch = $facts['os']['architecture']
if 'epel' in $managed_repos {
if ($releasever in [7,8,9]) {
$source = "${baseurl}/epel-release-latest-${releasever}.noarch.rpm"
yum::install { 'epel-release':
ensure => present,
source => $source,
}
} else {
err("Unsupported OS release ${releasever}")
}
yumrepo { 'epel':
name => 'epel',
descr => 'epel repository',
target => '/etc/yum.repos.d/epel.repo',
baseurl => "${baseurl}/${releasever}/Everything/${basearch}/",
gpgkey => "${baseurl}/RPM-GPG-KEY-EPEL-${releasever}",
baseurl => "${baseurl}/${release}/Everything-${snapshot}/${basearch}/os/",
gpgkey => "${baseurl}/${release}/Everything-${snapshot}/${basearch}/os/RPM-GPG-KEY-EPEL-${release}",
}
}
}

21
site/profiles/manifests/yum/global.pp
View File

@ -42,6 +42,7 @@
#
class profiles::yum::global (
Array[String] $managed_repos = lookup('profiles::yum::managed_repos'),
Boolean $purge = true,
){
class { 'yum':
keep_kernel_devel => true,
@ -58,14 +59,9 @@ class profiles::yum::global (
mirrorlist => 'absent',
}
# tidy { '/etc/yum.repos.d':
# matches => ['*.repo', '!*.managed.repo'],
# recurse => true,
# rmdirs => false,
# age => '0s',
# backup => false,
# type => 'ctime',
# }
resources { 'yumrepo':
purge => $purge,
}
# Generate the content for the .managed file
$managed_file_content = $managed_repos.map |$repo_name| { "${repo_name}.repo" }.join("\n")
@ -76,15 +72,6 @@ class profiles::yum::global (
content => $managed_file_content,
}
# Define exec resource to remove .repo files not listed in .managed
exec { 'cleanup_yum_repos':
command => '/bin/bash -c "comm -23 <(ls /etc/yum.repos.d | sort)
<(sort /etc/yum.repos.d/.managed) |
xargs -n1 rm -f /etc/yum.repos.d/{}"',
onlyif => '/bin/bash -c "comm -23 <(ls /etc/yum.repos.d | sort)
<(sort /etc/yum.repos.d/.managed) | grep .repo"',
}
# Setup base repos
class { 'profiles::yum::base':
managed_repos => $managed_repos,

1
site/profiles/manifests/yum/puppet7.pp
View File

@ -47,7 +47,6 @@ class profiles::yum::puppet7 (
err("Unsupported OS release ${releasever}")
}
yumrepo { 'puppet7':
name => 'puppet7',
descr => 'puppet7 repository',

1
site/profiles/templates/base/facts/enc_role.erb
View File

@ -1,2 +1 @@
enc_role=<%= @enc_role[0] %>
enc_role_path=<%= @enc_role[0].gsub('::', '/') %>

14
site/profiles/templates/reposync/autosyncer.erb
View File

@ -44,21 +44,15 @@ perform_rsync() {
}
create_repo_metadata() {
local basepath="${1}"
local osname="${2}"
local release="${3}"
local repository="${4}"
local current_date="${5}"
local repo_path="${basepath}/snap/${osname}/${release}/${repository}-${current_date}"
local repo_path="${1}"
if [[ -d "$repo_path" ]]; then
echo "Running createrepo on ${repo_path}..."
createrepo --update "${repo_path}"
if [[ $? -eq 0 ]]; then
echo "Successfully created repository metadata for ${repository}"
echo "Successfully created repository metadata for ${repo_path}"
else
echo "Failed to create repository metadata for ${repository}" >&2
echo "Failed to create repository metadata for ${repo_path}" >&2
return 1
fi
else
@ -92,6 +86,6 @@ for conf in /etc/reposync/conf.d/*.conf; do
perform_rsync "$live_path" "$snap_path"
# After syncing each repo, fix the repository metadata
create_repo_metadata "${BASEPATH}" "${OSNAME}" "${RELEASE}" "${REPOSITORY}" "${DATE}"
create_repo_metadata "${snap_path}"
done