Puppet Class: mcollective::server

Inherits:
mcollective
Defined in:
manifests/server.pp

Overview

Class: mcollective::server

This module manages the MCollective server agent

Parameters

etcdir

Location of mcollective configuration files. Defaults to $mcollective::etcdir which defaults to os-dependent location

libdir

Location of mcollective ruby lib directory. Defaults to an os-dependent location in mcollective::params

hosts

An array of middleware brokers for the server to connect Defaults to $mcollective::hosts

collectives

An array of collectives for the server to subscribe to Defaults to $mcollective::collectives

package

The name of the package to install or remove Defaults to os-dependent value from mcollective::params

version

The version or state of the package Values: latest (default) , present, absent, or specific version number

service

The name of the service to manage Defaults to os-dependent value from mcollective::params

ensure

Should the service be running? Values: running (default), stopped

enable

Should the service start at boot? Values: true (default), false

allow_managed_resources

Allow management of Puppet RAL-style resources? Values: true (default), false

resource_type_whitelist

Which resources are allowed to be managed? Default: none

resource_type_blacklist

If whitelist is empty, which resources should be blocked? Default: null

audit_logfile

If this logfile is specified then auditing is enabled.

authorization_enable

Where or not to enable authorization Values: false (default), true

authorization_default_policy

What authorization policy should be applied to agents with a specific policy?

logger_type

Where to send log messages. You usually want the user to see them. Values: syslog (default), file, console

log_level

How verbose should logging be? Values: fatal, error, warn, info (default), debug

logfacility

If logger_type is syslog, which log facility to use? Default: user

logfile

If logger_type is file, what file should the logs be put in? Default is os-dependent, often /var/log/mcollective.log

keeplogs

Any positive value will enable log rotation retaining that many files. A blank or 0 value will disable log rotation. Default: 5

max_log_size

Max size in bytes for log files before rotation happens. Default: 2097152 (2mb)

logrotate_directory

Directory where logrotate files are stored. Default: /etc/logrotate.d Nil or Undef value will disable logrotate installation

sshkey_authorized_keys

Defines a authorized keys file for use instead of ~/.ssh/authorized_keys Default: undefined (only matters if security_provider is sshkey)

Variables

This class makes use of these variables from base mcollective class

server_user

The username servers will use to authenticate. Default: server

server_password

The password servers will use to authenticate. Required: The password servers will use to authenticate

connector

Which middleware connector to use. Values: ‘activemq’ (default) or ‘rabbitmq’

port

Which port to connect to. Default: 61613

connector_ssl

Use SSL connection to the service? Values: false (default), true

connector_ssl_type

Which type of SSL encryption should be used? (ActiveMQ only) Values: anonymous (default), trusted

security_provider

Values: psk (default), ssl, aes_security, sshkey

psk_key

Pre-shared key if provider is psk

registerinterval

How often to resend registration information in seconds. Default 600

Examples

class { 'mcollective::server':
  authorization_enable => true,
}

Hiera

mcollective::server::authorization_enable : true,

Parameters:

  • package (Any) (defaults to: $mcollective::params::package_name)
  • service (Any) (defaults to: $mcollective::params::service_name)
  • libdir (Any) (defaults to: $mcollective::params::libdir)
  • etcdir (Any) (defaults to: $mcollective::etcdir)
  • version (Any) (defaults to: 'latest')
  • ensure (Any) (defaults to: 'running')
  • enable (Any) (defaults to: true)
  • hosts (Any) (defaults to: $mcollective::hosts)
  • collectives (Any) (defaults to: $mcollective::collectives)
  • allow_managed_resources (Any) (defaults to: true)
  • resource_type_whitelist (Any) (defaults to: 'none')
  • resource_type_blacklist (Any) (defaults to: undef)
  • audit_logfile (Any) (defaults to: undef)
  • authorization_enable (Any) (defaults to: undef)
  • authorization_default_policy (Any) (defaults to: undef)
  • ssh_authorized_keys (Any) (defaults to: undef)
  • logrotate_directory (Any) (defaults to: $mcollective::params::logrotate_directory)
  • logfile (Any) (defaults to: $mcollective::params::logfile)
  • logger_type (Any) (defaults to: 'syslog')
  • log_level (Any) (defaults to: 'info')
  • logfacility (Any) (defaults to: 'user')
  • keeplogs (Any) (defaults to: '5')
  • max_log_size (Any) (defaults to: '2097152') 


140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
 
# File 'manifests/server.pp', line 140

class mcollective::server(
  # Package and Service defaults that are OS-specific, can override in Hiera
  $package                      = $mcollective::params::package_name,
  $service                      = $mcollective::params::service_name,
  $libdir                       = $mcollective::params::libdir,
  $etcdir                       = $mcollective::etcdir,

  # Connector settings
  # These values can be overridden for a given server in Hiera
  $version                      = 'latest',
  $ensure                       = 'running',
  $enable                       = true,
  $hosts                        = $mcollective::hosts,
  $collectives                  = $mcollective::collectives,

  # Authorization
  $allow_managed_resources      = true,
  $resource_type_whitelist      = 'none',
  $resource_type_blacklist      = undef,
  $audit_logfile                = undef,
  $authorization_enable         = undef,
  $authorization_default_policy = undef,
  $ssh_authorized_keys          = undef,

  # Logging
  $logrotate_directory          = $mcollective::params::logrotate_directory,
  $logfile                      = $mcollective::params::logfile,
  $logger_type                  = 'syslog',
  $log_level                    = 'info',
  $logfacility                  = 'user',
  $keeplogs                     = '5',
  $max_log_size                 = '2097152',
)
  inherits mcollective {

  validate_array( $hosts )
  validate_array( $collectives )
  validate_re( $version, '^present$|^latest$|^[._0-9a-zA-Z:-]+$' )
  validate_re( $ensure, '^running$|^stopped$' )
  validate_bool( $enable )

  # Validate that server username and password were supplied
  validate_re( $server_user, '^.{5}', 'Please provide a server username' )
  validate_re( $server_password, '^.{12}', 'Please provide at last twelve characters in server password' )

  # Ensure the facts cronjob is set up or removed
  include mcollective::facts::cronjob

  # Now install the packages
  package { $package:
    ensure => $version,
    notify => Service[ $service ],
  }

  file { "${etcdir}/server.cfg":
    ensure  => file,
    owner   => 0,
    group   => 0,
    mode    => '0400',
    content => template( 'mcollective/server.cfg.erb' ),
    require => Package[ $package ],
    notify  => Service[ $service ],
  }

  # Management of SSL keys
  if( ( $mcollective::security_provider == 'aes_security' ) or ( $mcollective::security_provider == 'ssl' ) ) {
    Package[$package] -> File["${etcdir}/ssl"]

    # copy client public keys to all servers
    file { "${etcdir}/ssl/clients":
      ensure  => directory,
      owner   => 0,
      group   => 0,
      mode    => '0755',
      links   => follow,
      purge   => true,
      force   => true,
      recurse => true,
      source  => 'puppet:///modules/mcollective/ssl/clients',
      require => Package[ $package ],
      before  => Service[ $service ],
    }

    # For SSL module One keypair is shared across all servers
    if( $mcollective::security_provider == 'ssl' ) {
      # Get the public key
      realize File["${etcdir}/ssl/server/public.pem"]

      # ...and the private key
      file { "${etcdir}/ssl/server/private.pem":
        ensure  => file,
        owner   => 0,
        group   => 0,
        mode    => '0400',
        links   => follow,
        replace => true,
        source  => 'puppet:///modules/mcollective/ssl/server/private.pem',
        require => [ Package[ $package ], File["${etcdir}/ssl/server/public.pem"] ],
        before  => Service[ $service ],
      }
    }
  }

  # Policies used by the authorization plugins
  if( $authorization_enable ) {
    # Copy any files from the policies directory
    file { "${etcdir}/policies":
      ensure  => directory,
      owner   => 0,
      group   => 0,
      mode    => '0444',
      links   => follow,
      recurse => true,
      replace => true,
      force   => true,
      purge   => false,
      source  => 'puppet:///modules/mcollective/policies',
      require => Package[ $package ],
      before  => Service[ $service ],
    }

    file { "${libdir}/mcollective/util":
      ensure  => directory,
      owner   => 0,
      group   => 0,
      mode    => '0755',
      require => Package[ $package ],
      before  => Service[ $service ],
    }

    file { "${libdir}/mcollective/util/actionpolicy.rb":
      ensure  => file,
      owner   => 0,
      group   => 0,
      mode    => '0444',
      source  => 'puppet:///modules/mcollective/actionpolicy-auth/util/actionpolicy.rb',
      require => File["${etcdir}/server.cfg"],
      before  => Service[ $service ],
    }

    file { "${libdir}/mcollective/util/actionpolicy.ddl":
      ensure  => file,
      owner   => 0,
      group   => 0,
      mode    => '0444',
      source  => 'puppet:///modules/mcollective/actionpolicy-auth/util/actionpolicy.ddl',
      require => File["${etcdir}/server.cfg"],
      before  => Service[ $service ],
    }

    # Create rules from YAML for the ActionPolicy module
    $actionpolicies  = hiera_hash( 'mcollective::plugin::actionpolicies', false )
    if is_hash( $actionpolicies ) {
      create_resources( mcollective::plugin::actionpolicy, $actionpolicies )
    }
  }

  # Now start the daemon
  service { $service:
    ensure  => $ensure,
    enable  => $enable,
    require => Package[ $package ],
  }

  # Load in all the appropriate mcollective agents
  $defaults  = { version => 'present' }
  $agents  = hiera_hash( 'mcollective::plugin::agents', false )
  if is_hash( $agents ) {
    create_resources( mcollective::plugin::agent, $agents, $defaults )
  }

  # Create or remove a logrotate config for the audit log
  if( $audit_logfile == undef ) {
    $auditlog_ensure = absent
  }
  else {
    $auditlog_ensure = file
  }

  # Only install logrotate if the logrotate directory is installed
  if( $logrotate_directory ) {
    file { 'logrotate-directory':
      ensure => directory,
      path   => $logrotate_directory,
      owner  => 0,
      group  => 0,
      mode   => '0755',
    }
    file { 'logrotate-auditlog':
      ensure  => $auditlog_ensure,
      path    => "${logrotate_directory}/mcollective-auditlog",
      owner   => 0,
      group   => 0,
      mode    => '0444',
      content => template( 'mcollective/logrotate-auditlog.erb' ),
    }
  }
}