Merge pull request 'feat: add consul server profile' (#111) from neoloc/consul_server into develop
Reviewed-on: unkinben/puppet-prod#111
This commit is contained in:
Ben Vincent
commit
f8b30f335b
@ -27,6 +27,7 @@ mod 'puppet-nginx', '5.0.0'
|
||||
mod 'puppet-selinux', '4.1.0'
|
||||
mod 'puppet-prometheus', '13.4.0'
|
||||
mod 'puppet-grafana', '13.1.0'
|
||||
mod 'puppet-consul', '8.0.0'
|
||||
|
||||
# other
|
||||
mod 'ghoneycutt-puppet', '3.3.0'
|
||||
|
||||
@ -0,0 +1,4 @@
|
||||
---
|
||||
profiles::consul::server::gossip_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEADwwYLK+fU0M/uLqQpRjHnIAyrt6yPEZSXpUX2jvOGVOA63X8LOYpLVfEGWMmkZ7BHRO0fgr847UUI/xI8otIuiOpgtW2E7QLWs806KUNXz+L8c7kSnQ1XAD5R81/5joDHl4AIxl5fAGryTXH1gfnpTMWh2yjFzU/KYuk2GhrU0M9ewCGJErQG4pT4u3ymGmkLjx6AiZ8r9xb4Eos2bhCCpFWfyb0kKcJqdKU9mzy508byNCfp8lr1DoKxEQrdqSSAQdepn6wCgBZtlAK/k63tOqM9dxyDaCsK8vLG9LlvuEwi3OL2lzTtc1mAcdYxahDo3uBX0/VcCswaXq3nPnu3TBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCUwXPoMh/dylvFwyRzAsnRgDDvh5CHrzJYdUXWGsauYlifOOukYokkwG3yqqtCByveMqVWfWsQukiDTixdqpCgfzw=]
|
||||
profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
|
||||
profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAPRZN7DnYUhVL81p7xC9rUYPutoO3UrF2Sl8DlopfYoAG9omnXZlrut8wIffDZJSiU5XkOGv8x2QsXZc+bWqiplJ0VfzLClxEM2onWaT/GGGg7E+2YhrYuMG7mZYaqRYQ6/AgLDcIMBIdQBdL5mlpy+fVZn7Mu4cmsQYJTIe+yrNQtGMWMiNaHpwLGXvoXgwT6giX6L6VNiN51dAnHAdMYZ9Hf3G5CZEs6x8uOveqf6+qy+df24ItRUcsfQlSwsEaQRY+xjIVYIoiV8l8D8HiO+mVqbxtfQgyJIMv+0hl95zHGlc2W5lb6MvIFcJGu2xKIc00D7YOYgxLUx1aegixxzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBnYSZmhDFSDoO1s329ktFegDC2Z7A+TGqTtZXKXaj2qQmowIvTZOVoUyF/5G0aED0wo/h+vfgosSS3Tx1dam0KUl0=]
|
||||
@ -0,0 +1,3 @@
|
||||
---
|
||||
profiles::consul::server::bootstrap_count: 3
|
||||
profiles::consul::server::raft_multiplier: 10
|
||||
@ -8,3 +8,4 @@ profiles::yum::managed_repos:
|
||||
- 'highavailability'
|
||||
- 'puppet7'
|
||||
- 'yum.postgresql.org'
|
||||
- 'unkin'
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
---
|
||||
profiles::yum::base::baseurl: http://repos.main.unkin.net/almalinux
|
||||
profiles::yum::epel::baseurl: http://repos.main.unkin.net/epel
|
||||
profiles::yum::unkin::baseurl: http://repos.main.unkin.net/unkin
|
||||
profiles::firewall::firewalld::ensure_package: 'absent'
|
||||
profiles::firewall::firewalld::ensure_service: 'stopped'
|
||||
profiles::firewall::firewalld::enable_service: false
|
||||
|
||||
2
hieradata/roles/infra/storage/consul.eyaml
Normal file
2
hieradata/roles/infra/storage/consul.eyaml
Normal file
@ -0,0 +1,2 @@
|
||||
---
|
||||
profiles::consul::server::acl_master_token: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAFCDnJyImf/X8f6WGqt37XbuuSg5hCeC5Uhdd0u1/Jjlz4AzMyhF41Vs6iVrV6irlsMDziSQrcEvGumTPmYShRQiRv0GvkhHUpn2XROKd63KolsWRj2K2S5FhgwolgtQc05DLmGaQ6FIUMVk3aKU/v8IGSDopcjdhwTJtheOLgiiEjv8TsjWKOOIa0H7caa6ZiZxcf2Y99Wv9gIZdt+LnXGdlDuO88+gkYTpRM07RY21nr4VS821y0MwFcYx2SyzMDk60RvgCmvA6RdoyHBUYAu07IX6IjP5LZwpAkcPcA4gADVP7vOPT2WhVAtkzpg+RwNxkuWYA5roO2r1UhERixjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC9TM/c8nXJswHAUSU6kFCDgDBob2r0tFLq1Jw313Ys8jUtKsetsrc5x7uIDYzOqr7ulEM9B0VOD2ekR9IRYZMsBCg=]
|
||||
22
hieradata/roles/infra/storage/consul.yaml
Normal file
22
hieradata/roles/infra/storage/consul.yaml
Normal file
@ -0,0 +1,22 @@
|
||||
---
|
||||
profiles::consul::server::members_role: roles::infra::storage::consul
|
||||
profiles::consul::server::members_lookup: true
|
||||
profiles::consul::server::data_dir: /data/consul
|
||||
profiles::consul::server::primary_datacenter: 'au-drw1'
|
||||
profiles::consul::server::addresses:
|
||||
dns: "%{::networking.ip}"
|
||||
http: "%{::networking.ip}"
|
||||
https: "%{::networking.ip}"
|
||||
grpc: "%{::networking.ip}"
|
||||
grpc_tls: "%{::networking.ip}"
|
||||
profiles::consul::server::ports:
|
||||
dns: 8600
|
||||
http: 8500
|
||||
https: -1
|
||||
profiles::consul::server::acl:
|
||||
enabled: true
|
||||
default_policy: 'deny'
|
||||
down_policy: 'extend-cache'
|
||||
tokens:
|
||||
initial_management: "%{alias('profiles::consul::server::acl_tokens_initial_management')}"
|
||||
default: "%{alias('profiles::consul::server::acl_tokens_default')}"
|
||||
@ -11,6 +11,7 @@
|
||||
#
|
||||
class profiles::base::datavol (
|
||||
Enum['present', 'absent'] $ensure = 'present',
|
||||
Enum['present', 'absent', 'mounted'] $mountstate = 'mounted',
|
||||
Enum['ext2', 'ext3', 'ext4', 'xfs', 'btrfs'] $fstype = 'xfs',
|
||||
String $vg = 'datavg',
|
||||
String $pv = '/dev/vdb',
|
||||
@ -63,7 +64,7 @@ class profiles::base::datavol (
|
||||
|
||||
# Ensure the logical volume is mounted at the desired location
|
||||
mount { $mount:
|
||||
ensure => $ensure,
|
||||
ensure => $mountstate,
|
||||
device => "/dev/${vg}/${lv}",
|
||||
fstype => $fstype,
|
||||
options => $mount_options.join(','),
|
||||
|
||||
125
site/profiles/manifests/consul/server.pp
Normal file
125
site/profiles/manifests/consul/server.pp
Normal file
@ -0,0 +1,125 @@
|
||||
# profiles::consul::server
|
||||
class profiles::consul::server (
|
||||
String $gossip_key,
|
||||
String $primary_datacenter,
|
||||
Hash $acl,
|
||||
Hash $ports,
|
||||
Hash $addresses,
|
||||
Boolean $members_lookup = false,
|
||||
String $members_role = undef,
|
||||
Array $consul_servers = [],
|
||||
Boolean $enable_ui = true,
|
||||
Boolean $enable_ui_config = true,
|
||||
Boolean $manage_repo = false,
|
||||
String $package_ensure = 'latest',
|
||||
String $package_name = 'consul',
|
||||
Integer $bootstrap_count = 1,
|
||||
String $domain = 'consul',
|
||||
Integer $raft_multiplier = 1,
|
||||
Enum[
|
||||
'allow',
|
||||
'deny',
|
||||
'extend-cache',
|
||||
'async-cache'
|
||||
] $acl_down_policy = 'extend-cache',
|
||||
Enum[
|
||||
'allow',
|
||||
'deny'
|
||||
] $acl_default_policy = 'deny',
|
||||
Enum[
|
||||
'url',
|
||||
'package',
|
||||
'docker',
|
||||
'none'
|
||||
] $install_method = 'package',
|
||||
Stdlib::IP::Address $client_addr = '0.0.0.0',
|
||||
Stdlib::Absolutepath $data_dir = '/opt/consul',
|
||||
Stdlib::Absolutepath $bin_dir = '/usr/bin',
|
||||
Boolean $disable_remote_exec = true,
|
||||
Boolean $disable_update_check = true,
|
||||
) {
|
||||
|
||||
# set a datacentre/cluster name
|
||||
$consul_cluster = "${::facts['country']}-${::facts['region']}"
|
||||
|
||||
# if lookup is enabled, find all the hosts in the specified role and create the servers_array
|
||||
if $members_lookup {
|
||||
|
||||
# check that the role is also set
|
||||
unless !($members_role == undef) {
|
||||
fail("members_role must be provided for ${title} when members_lookup is True")
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
$servers_array = $consul_servers
|
||||
}
|
||||
|
||||
# if $data_dir starts with /data, ensure the data mount exists
|
||||
if ($data_dir.stdlib::start_with('/data') and $::facts['mountpoints']['/data']) or ! $data_dir.stdlib::start_with('/data') {
|
||||
|
||||
# install consul
|
||||
class { 'consul':
|
||||
install_method => $install_method,
|
||||
manage_repo => $manage_repo,
|
||||
package_name => $package_name,
|
||||
package_ensure => $package_ensure,
|
||||
bin_dir => $bin_dir,
|
||||
config_hash => {
|
||||
'primary_datacenter' => $primary_datacenter,
|
||||
'acl' => $acl,
|
||||
'ports' => $ports,
|
||||
'addresses' => $addresses,
|
||||
'disable_remote_exec' => $disable_remote_exec,
|
||||
'disable_update_check' => $disable_update_check,
|
||||
'domain' => $domain,
|
||||
'bootstrap_expect' => $bootstrap_count,
|
||||
'client_addr' => '0.0.0.0',
|
||||
'data_dir' => $data_dir,
|
||||
'datacenter' => $consul_cluster,
|
||||
'log_level' => 'INFO',
|
||||
'node_name' => $::facts['networking']['fqdn'],
|
||||
'server' => true,
|
||||
'ui' => $enable_ui,
|
||||
'ui_config' => { 'enabled' => $enable_ui_config },
|
||||
'performance' => { 'raft_multiplier' => $raft_multiplier },
|
||||
'bind_addr' => $::facts['networking']['ip'],
|
||||
'advertise_addr' => $::facts['networking']['ip'],
|
||||
'retry_join' => $servers_array
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
# consul before dnsmasq
|
||||
if defined(Class['consul']) {
|
||||
|
||||
# get the dns port from the $ports hash, otherwise use the default
|
||||
$dns_port = pick($ports['dns'], 8600)
|
||||
|
||||
# install dnsmasq
|
||||
package { 'dnsmasq':
|
||||
ensure => installed,
|
||||
}
|
||||
|
||||
# create the 10-consul.conf file
|
||||
file { '/etc/dnsmasq.d/10-consul.conf':
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => "server=/${domain}/${::facts['networking']['ip']}#${dns_port}\n",
|
||||
require => Package['dnsmasq'],
|
||||
notify => Service['dnsmasq'],
|
||||
}
|
||||
|
||||
# ensure dnsmasq service is running and enabled at boot
|
||||
service { 'dnsmasq':
|
||||
ensure => running,
|
||||
enable => true,
|
||||
subscribe => File['/etc/dnsmasq.d/10-consul.conf'], # Restart dnsmasq if the consul config changes
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -87,6 +87,11 @@ class profiles::yum::global (
|
||||
managed_repos => $managed_repos,
|
||||
}
|
||||
|
||||
# Setup unkin repo if included in managed_repos
|
||||
class { 'profiles::yum::unkin':
|
||||
managed_repos => $managed_repos,
|
||||
}
|
||||
|
||||
# setup dnf-autoupdate
|
||||
include profiles::yum::autoupdater
|
||||
|
||||
|
||||
23
site/profiles/manifests/yum/unkin.pp
Normal file
23
site/profiles/manifests/yum/unkin.pp
Normal file
@ -0,0 +1,23 @@
|
||||
# Class: profiles::yum::unkin
|
||||
class profiles::yum::unkin (
|
||||
Array[String] $managed_repos,
|
||||
String $baseurl,
|
||||
Enum[
|
||||
'daily',
|
||||
'weekly',
|
||||
'monthly'
|
||||
] $snapshot = 'daily',
|
||||
) {
|
||||
$release = $facts['os']['release']['major']
|
||||
$basearch = $facts['os']['architecture']
|
||||
|
||||
if 'unkin' in $managed_repos {
|
||||
yumrepo { 'unkin':
|
||||
name => 'unkin',
|
||||
descr => 'unkin repository',
|
||||
target => '/etc/yum.repos.d/unkin.repo',
|
||||
baseurl => "${baseurl}/${::facts['os']['release']['major']}/${basearch}/os/",
|
||||
gpgcheck => false,
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -3,4 +3,6 @@
|
||||
class roles::infra::storage::consul {
|
||||
include profiles::defaults
|
||||
include profiles::base
|
||||
include profiles::base::datavol
|
||||
include profiles::consul::server
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user