Our infrastructure uses puppet with public puppet modules. All our secrets and our installation-spesific parameters are thus placed in hiera.
Data distribution
The hieradata directory contains multiple .yaml files holding our information. When we have multiple puppet masters its important that each of the puppetmasters have an updated version of the hieradata, in addition to an updated list of puppet-modules. As the hiera-data are full of secrets we cannot publish them on github, and have all puppetmasters pull the information from there. What we do instead is to let the hieradata be a local git-repo which each puppetserver is pulling from eachother.
Hiera keys
Depending on what services you are handling with puppet, you might need various keys in hiera. This page tries to list which keys needs to be present to use our role/profile repositories.
General information
There are quite a bit of data which are not associated to a specific service, but are rather used by various modules, and should thus generally allways be present:
DHCP server
When running DHCP servers, the following keys are needed:
| Key | Description | Example | Created by | Data-type | Used by: |
|---|---|---|---|---|---|
| profile::dhcp::omapi::key | The omapi key used to update the DHCP servers | '==omapi_key' | dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST key_name | String | role::bootstrap, role::dhcp |
| profile::dhcp::omapi::name | The omapi key name | 'key_name' | String | role::bootstrap, role::dhcp | |
| profile::dhcp::searchdomain | The default search-domain handed to DHCP clients | 'cloud.domain.com' | N/A | String | role::bootstrap, role::dhcp |
| profile::dns::resolvers | The DNS resolvers for clients to use | - '<ip-addres-DNS1>' - '<ip-address-DNS2>' | N/A | List of strings | role::bootstrap, role::dhcp |
DNS server
If you are hosting a DNS server the following keys are needed:
profile::dns::forwarders:
- '129.241.0.200'
- '129.241.0.201'
profile::dns::key::transfer: 'UvetjoX5zMiw/NbQr3biug=='
profile::dns::key::update: 'RIrdwoP3xyCgbKuQb7E8iQ=='
profile::dns::ns1::ipv4: '192.168.254.11'
profile::dns::ns1::query::ipv4: '192.168.254.81'
profile::dns::ns1::name: 'ns1.sky.rothaugane.com'
profile::dns::ns1::key: "%{hiera('profile::dns::key::update')}"
profile::dns::resolvers:
- '192.168.254.11'
- '192.168.254.4'
profile::dns::slaves:
'ns2.sky.rothaugane.com': '192.168.254.80'
profile::dns::zones:
'sky.rothaugane.com': 'ns1'
'management.sky.rothaugane.com': 'ns1'
'services.sky.rothaugane.com': 'ns1'
'254.168.192.in-addr.arpa': 'ns1'
'255.168.192.in-addr.arpa': 'ns1'
Dashboard
The general configuration of the dashboard are based on the following keys:
profile::dashboard::api: 'http://%{hiera('profile::dashboard::name::v4only')}'
profile::dashboard::datadir: '/var/lib/machineadmin'
profile::dashboard::database::type: 'mysql'
profile::dashboard::database::name: '<mysql-database-name>'
profile::dashboard::database::user: '<mysql-database-user>'
profile::dashboard::database::pass: '<mysql-database-password>'
profile::dashboard::database::host: "%{hiera('profile::haproxy::management::ip')}"
profile::dashboard::database::grant: "%"
profile::dashboard::django::secret: '<pwgen -1 -y -s 50>'
profile::dashboard::ldap::url: 'ldaps://<ldaps-server>:636'
profile::dashboard::ldap::search_base: '<LDAP Search base>'
profile::dashboard::ldap::domain: '<LDAP domain>'
profile::dashboard::name: '<Main dashboard hostname (A and AAAA can be defined for this name)>'
profile::dashboard::name::v4only: '<v4-only dashboard hostname (Should only have an A record defined>'
The dashboard requires some service-specific keys in addition to the keys listed with each of the services:
profile::dhcp::servers:
'<server1-name>': '<server1-IP>'
- '<server2-name>': '<server2-IP>'