Installing Puppet Open Source Server

Prerequisites

I'm using a new CentOS 8 VM to deploy the puppet server. You can use other operating systems but you'll need to adjust the steps below to suit.

First, ensure you have the following setup on your CentOS server:

• Static IP address
• Hostname
• Correct DNS server(s) configured
• NTP configured
• Another VM to test puppet with (An agent VM)

Install Puppet Server

For CentOS 8, we need to install the correct repo for Puppet 7:

sudo rpm -Uvh https://yum.puppet.com/puppet7-release-el-8.noarch.rpm

Next, install the server software:

sudo yum install -y puppetserver

Once puppet is installed, ensure it is configured to start on boot

sudo systemctl enable puppetserver

Run the following to configure the puppet server

source /etc/profile.d/puppet-agent.sh

And start the server

sudo systemctl start puppetserver

You can restart it with the below command if required

sudo systemctl restart puppetserver

Puppet Agent Installation

On your test VM, we will now install the puppet agent and connect it to the puppet server.

Setup the puppet repo:

sudo rpm -Uvh https://yum.puppet.com/puppet7-release-el-8.noarch.rpm

Install the puppet agent:

sudo yum install -y puppet-agent

Source the puppet script to configure the system after install:

source /etc/profile.d/puppet-agent.sh

Set the puppet server with the following puppet command:

Replace puppet.lab.local with the hostname of your puppet server, ping it first to be sure it resolves to an IP address

puppet config set server puppet.lab.local --section main

If you get a "No route to host" error, then ensure the VM can resolve the DNS name you specified above for the puppet server. Also, ensure that port 8140 is open on the puppet server.

You can open TCP port 8140 on the puppet server as follows:

Be aware that this might need to be changed, depending on your security requirements and firewall configuration

sudo firewall-cmd --zone=public --permanent --add-port=8140/tcp

sudo systemctl restart firewalld

You should get an error stating that you need to sign the SSL certificate for the agent VM.

To sign the certificate, on the puppet server run the following command

Replace centos-vm-1.lab.local with your agent VM's name

puppetserver ca sign --certname centos-vm-1.lab.local

Looking back on the agent VM, you should see that the SSL certificate has been signed.

If you do not see this, just run the command again:
puppet config set server puppet.lab.local --section main

Creating puppet packages for deployment

Here we will create a puppet package and link it to our agent VM. This will demonstrate the power and core features of puppet.

The chrony example

For this example,we are going to use puppet to ensure that the time is synced up to NTP servers. CentOS 8 uses chrony for this rather than the older ntpd service

Once you have this example working, you can use it as a baseline for other things that you want to manage with puppet.

Ensure chrony is not installed

First check that chrony is not installed on the CentOS VM. It probably is, so remove it for the demo.

sudo systemctl status chronyd

sudo dnf remove chrony

A note on environments

You can and should make other environments and store different configurations in different environments.

IMPORTANT: On the agents, for this example to work, ensure you place them in the production environment. If you have created other environments, then reflect that change in the command below:

On your client/agent VMs edit your puppet configuration file as required:

vi /etc/puppetlabs/puppet/puppet.conf

Puppet manifest files

With your agents now in the production environment, we can create a config to push to them.

Use vi or another editor to create a file named chrony.pp with the below contents (changing the NTP  server pool config as required)

Since we have placed our agent VMs in the production environment, you'll want to save the file in the production manifests folder for this example: /etc/puppetlabs/code/environments/production/manifests/chrony.pp

As you can see, this will:

• Ensure chrony is installed
• Ensure a chrony configuration file exists
• Ensure a config entry for the correct pool exists
• Ensures that the chronyd service is running

Save the file

Check for syntax errors with:

puppet parser validate /etc/puppetlabs/code/environments/production/manifests/chrony.pp

Apply the configuration in noop mode

Next, run the puppet command on the agent VM to test what would happen without actually changing anything. You could, of course, use a new "testing" environment, instead of saving the file earlier directly in the "production" environment.

This would be my suggestion if you are going to use puppet in a real-world scenario as you would want to test the configurations before putting them into the production folder.

This command will force the agent VM to get the latest configuration and apply it in NOOP mode, meaning that it will test to see what would happen if you were running it for real

Note that the --test option here, means do it now rather than wait for the schedule to kick in. It has nothing to do with testing, it's just used to force the command tor un now.

puppet agent --test --noop

You will see that our config would have been applied because the status was different for more than one element of the configuration

Now we can run the command for real, to update our clients (agent VMs) with this configuration:

You can of course, just wait for the scheduler to run and update automatically (every 30 minutes by default)

puppet agent --test

You should see that it has been applied successfully.

Also, note here that it was applied to the production environment

Now check to see if chrony is installed and running:

sudo systemctl status chronyd

And that's all we need to do.

Some other notes

For other manifest configurations, just save them in the correct environment folders and let the built-in puppet scheduler apply them.

Be sure the first save them in a "test" or "staging" environment and run them in a testing mode on an agent before rolling them out to every other server in your network!

If your agent is linked to the "production" puppet environment but you want to test the agent VM against a manifest in a "testing" environment, then on the agent you would run:

puppet agent --test --environment testing --noop

If you omit the --environment option, then the command will run with whatever environment the system is assigned to.

To find the environment that a test is assigned to, you can check and change it in the puppet configuration file on the agent VM as we did above

vi /etc/puppetlabs/puppet/puppet.conf

In the next post, we will explore how to configure VMware to work with Puppet so that we can automatically provision new VMs.

Be sure to subscribe to be alerted of new posts on the blog and for the weekly newsletter 

If you are familiar and wish to migrate from CentOS 8 to CentOS stream 8, then this post goes through the steps.

Pre-migration steps

Fortunately, the procedure is incredibly easy but you will need to ensure compatibility of your existing apps and upgrade them to ensure support for them going forwared.

So, before we begin, ensure you have good backups and snapshots of your systems, ensuring a frustration-free roll-back should anything go wrong.

Install the release stream

The first command is

sudo dnf install centos-release-stream

Swap repos

To switch your repos from CentOS Linux to Stream, run the following

sudo dnf swap centos-{linux,stream}-repos

Sync distros

Finally, run the following to sync up the distros

sudo dnf distro-sync

Review and accept the output to continue

Confirm CentOS Stream 8

To check if you have successfully migrated to CentOS Stream 8, check the /etc/0s-release file.

cat /etc/0s-release

Test!

Now test your applications!