Rundeck module for Puppet

Table of Contents

1. Overview
2. Module Description - What the module does and why it is useful
3. Setup - Requirements and beginning with rundeck
4. Usage - Configuration options and additional functionality
5. Reference - Module references
6. Limitations - OS compatibility, etc.
7. Development - Guide for contributing to the module

Overview

The rundeck puppet module for installing and managing Rundeck

Supported Versions of Rundeck

Rundeck Version	Rundeck Puppet module versions
2.x - 3.0.X	v5.4.0 and older
3.1.x - 3.3.x	v8.0.1 until v6.0.0
3.4.x - up	v9.0.0 and newer

Module Description

This module provides a way to manage the installation and configuration of rundeck and plugins.

Setup

Requirements

You need a compatible version of Java installed. You can use puppetlabs/java module if there isn't already a suitable version.

On systems that use apt, there's a soft dependency on the puppetlabs/apt module.

Beginning with rundeck

To install a server and cli with the default options:

include rundeck

Beginning with rundeck cli

To install rundeck cli with the default options:

include rundeck::cli

Usage

Configure rundeck to connect to a MySQL database

To use an external MySQL database, the database_config hash must be set to override the default values which result in a local file based storage. To enable key and project storage in the database, you must also set the two associated parameters.

class { 'rundeck':
  key_storage_config => [
    {
      'type' => 'db',
      'path' => 'keys',
    },
  ],
  database_config    => {
    'url'             => 'jdbc:mysql://myserver/rundeck',
    'username'        => 'rundeck',
    'password'        => 'verysecure',
    'driverClassName' => 'com.mysql.jdbc.Driver',
  },
}

Configure SSL for rundeck

class { 'rundeck':
  ssl_enabled       => true,
  ssl_certificate   => '/path/to/cert',
  ssl_private_key   => '/path/to/key',
}

Configure HashiCorp vault as keystorage

An additional Rundeck Vault plugin is required.

class { 'rundeck':
  key_storage_config => [
    {
      'type'   => 'vault-storage',
      'path'   => 'keys',
      'config' => {
        'prefix'           => 'rundeck',
        'address'          => 'https://vault.example.com',
        'storageBehaviour' => 'vault',
        'secretBackend'    => 'rundeck',
        'engineVersion'    => '2',
        'authBackend'      => 'approle',
        'approleAuthMount' => 'approle',
        'approleId'        => 'xxx-xxx-xxx-xxx-xxx',
        'approleSecretId'  => 'xxx-xxx-xxx-xxx-xxx',
      },
    },
  ],
}

Configure multiple keystorage types

class { 'rundeck':
  key_storage_config => [
    {
      'type'   => 'file',
      'path'   => 'keys',
      'config' => {
        'baseDir => '/path/to/dir',
      },
    },
    {
      'type' => 'db',
      'path' => 'keys/database',
    },
  ],
}

Configure shared authentication credentials

To perform LDAP authentication and file authorization following code can be used.

class { 'rundeck':
  auth_config => {
    'file' => {
      'auth_flag'    => 'sufficient',
      'jaas_config'  => {
        'file' => '/etc/rundeck/realm.properties',
      },
      'realm_config' => {
        'admin_user'     => 'admin',
        'admin_password' => 'admin',
        'auth_users'     => [
          {
            'username' => 'testuser',
            'password' => 'password',
            'roles' => %w[user deploy]
          },
          {
            'username' => 'anotheruser',
            'password' => 'anotherpassword',
            'roles' => ['user']
          },
        ],
      },
    },
    'ldap' => {
      'jaas_config' => {
        'debug' => 'true',
        'providerUrl' => 'ldap://server:389',
        'bindDn' => 'cn=Manager,dc=example,dc=com',
        'bindPassword' => 'secret',
        'authenticationMethod' => 'simple',
        'forceBindingLogin' => 'false',
        'userBaseDn' => 'ou=users,ou=accounts,ou=corp,dc=xyz,dc=com',
        'userRdnAttribute' => 'sAMAccountName',
        'userIdAttribute' => 'sAMAccountName',
        'userPasswordAttribute' => 'unicodePwd',
        'userObjectClass' => 'user',
        'roleBaseDn' => 'ou=role based,ou=security,ou=groups,ou=test,dc=xyz,dc=com',
        'roleNameAttribute' => 'cn',
        'roleMemberAttribute' => 'member',
        'roleObjectClass' => 'group',
        'nestedGroups' => 'true'
      },
    },
  },
}

Configure rundeck class with projects

To add and manage rundeck projects through cli with the rundeck class following code can be used.

class { 'rundeck':
  'cli_token'    => 'very_secure',
  'cli_projects' => {
    'MyProject'   => {
      'update_method' => 'set',
      'config'        => {
        'project.description'        => 'This is My rundeck project',
        'project.disable.executions' => 'false',
      },
    },
    'TestProject' => {
      'config' => {
        'project.description'      => 'This is a rundeck test project',
        'project.disable.schedule' => 'false',
      },
    },
  },
}

Configure rundeck cli class with projects separately

To add and manage rundeck projects through cli with the rundeck class following code can be used.

class { 'rundeck':
  'manage_cli' => false,
}

class { 'rundeck::cli':
  'manage_repo' => false,
  'token'       => 'very_secure',
  'projects'    => {
    'MyProject'   => {
      'update_method' => 'set',
      'config'        => {
        'project.description'        => 'This is My rundeck project',
        'project.disable.executions' => 'false',
      },
    },
    'TestProject' => {
      'config' => {
        'project.description'      => 'This is a rundeck test project',
        'project.disable.schedule' => 'false',
      },
    },
  },
}

Reference

See REFERENCE.md

Limitations

For a list of supported operating systems please check the metadata.json

Development

Contributing

This module is maintained by Vox Pupuli. Vox Pupuli welcomes new contributions to this module, especially those that include documentation and rspec tests. We are happy to provide guidance if necessary.

Please see CONTRIBUTING for more details.

Transfer Notice

This plugin was originally authored by OpenTable Inc. The maintainer preferred that Vox Pupuli take ownership of the module for future improvement and maintenance. Existing pull requests and issues were transferred over, please fork and continue to contribute here instead of Camptocamp.