Re: [Puppet Users] hiera-gpg, CentOS6 and puppet 3.2.4
We're still using Puppet 2.7, but looking at our puppet-gpg config the
only major difference I see is we use :key_dir for the gpg key's instead
of the puppet users home directory. So our hiera.yaml file looks like:
# Hiera configuration file
---
:backends:
- yaml
- gpg
:yaml:
:datadir: /etc/puppet/hieradata
:gpg:
:datadir: /etc/puppet/hieradata
:key_dir: /srv/keyrings
:hierarchy:
- hosts/%{fqdn}
- %{environment}/hostgroups/%{hostgroup}
- hostgroups/%{hostgroup}
- %{environment}/servicegroups/%{servicegroup}
- servicegroups/%{servicegroup}
- %{environment}/%{calling_module}
- %{calling_module}
- %{environment}
- global
Of course you have to have the gpgme rpm and the gpgme ruby gem
installed on all your puppet masters. We install the same password-less
gpg private key on all the puppet masters and encrypt the yaml files
with the corresponding public key. .
JMN
On 9/3/2013 5:57 PM, Worker Bee wrote:
Has anyone been able to get this working?
For some reason, I am unable to get values decrypted via a puppet run,
despite being able to decrpyt via command line
I am starting to wonder if there is a bug or something I am missing??
I SO appreciate ANY help!
__
/etc/puppet/hiera.yaml
---
:backends: - gpg
- yaml
:logger: console
:hierarchy: - %{env}/%{calling_module}
- common
:yaml:
:datadir: /etc/puppet/hieradata
:gpg:
:datadir: /etc/puppet/hieradata
Here is my init.pp file
# Class: testdecry
#
# [Remember: No empty lines between comments and class definition]
class testdecry {
$env = 'live'
$pass = hiera(rootpwd)
notify{The value is: ${pass}:}
}
My encrypted file is in:
/etc/puppet/hieradata/live
[root@me]# ls
testdecry.gpg
___
Command line works:
[root@me ]# hiera -c /etc/puppet/hiera.yaml rootpwd
calling_module=testdecry env=live
rootpass
Running via puppet fails
[root@me]# puppet agent --test
Info: Retrieving plugin
Error: Could not retrieve catalog from remote server: Error 400 on
SERVER: can't convert nil into String at
/etc/puppet/modules/testdecry/manifests/init.pp:17 on node me.net
http://me.net
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
I am totally at a loss here
Thanks!
Bee
--
You received this message because you are subscribed to the Google
Groups Puppet Users group.
To unsubscribe from this group and stop receiving emails from it, send
an email to puppet-users+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.
--
You received this message because you are subscribed to the Google Groups Puppet
Users group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.
Re: [Puppet Users] packages and Solaris
We use virtual package declarations and realize the packages in the class they
are needed. We push a standard adminfile to all the Solaris hosts. The packages
are on an NFS share that is exported to all our servers:
file { noask_pkgadd:
path = /var/sadm/install/admin/noask_pkgadd,
ensure = present,
owner = root,
group = sys,
mode = 644,
source = puppet://$server/files/$operatingsystem/noask_pkgadd
}
@package{mcollective:
ensure = installed,
name = DUKmcoll,
source = /net/nas-server/pkgs/DUKmcoll.pkg,
adminfile = /var/sadm/install/admin/noask_pkgadd,
require = File[noask_pkgadd]
}
realize(Package['mcollective']
On Dec 28, 2011, at 12:08 PM, Aaron Grewell wrote:
We decided to distribute the pkg files the same way we do Linux
packages - via http. This define has been very useful to us:
define pkg_http($version,$source, $adminfile, $responsefile=undef){
exec {/usr/sfw/bin/wget $source -O /var/tmp/$name-$version.pkg:
unless = /usr/bin/test -f /var/tmp/$name-$version.pkg,
alias = wget_$name,
} # exec
package { $name:
ensure = 'installed',
provider = 'sun',
source = /var/tmp/$name-$version.pkg,
adminfile = $adminfile,
responsefile = $responsefile,
require = Exec[wget_$name],
} # package
} # define pkg_http
Our typical admin file looks like this:
mail=
instance=unique
partial=nocheck
runlevel=nocheck
idepend=nocheck
rdepend=nocheck
space=nocheck
setuid=nocheck
conflict=nocheck
action=nocheck
networktimeout=60
networkretries=3
authentication=quit
keystore=/var/sadm/security
proxy=
basedir=default
On Wed, Dec 28, 2011 at 8:55 AM, Bill Proud billpr...@yahoo.com wrote:
You need to use the adminfile and source parameters - once you have
done that the provider works just fine.
On Dec 28, 4:19 pm, Peter Berghold salty.cowd...@gmail.com wrote:
Hi folks,
I'm about to propose to my current company that we use puppet to manage
releases of home grown software. The environment is a mix of Solaris
8/9/10 and RHEL 56.
I've got a handle on how to create recipes to release software into the
RHEL environment. The unknown for me is how to manipulate the pkgadd
provider to load the locally grown package stream. Can someone guide me in
the right direction.
--
Peter L. Berghold
Owner, Shark River Technical Solutions LLC
Custom hosting provider.
--
You received this message because you are subscribed to the Google Groups
Puppet Users group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.
--
You received this message because you are subscribed to the Google Groups
Puppet Users group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.
--
You received this message because you are subscribed to the Google Groups
Puppet Users group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.
