|
| 1 | +#!/opt/puppetlabs/bin/puppet apply |
| 2 | +function param($name) { inline_template("<%= ENV['PT_${name}'] %>") } |
| 3 | + |
| 4 | +class configure_node_groups ( |
| 5 | + String[1] $primary_master_host = param('primary_master_host'), |
| 6 | + String[1] $primary_master_replica_host = param('primary_master_replica_host'), |
| 7 | + String[1] $puppetdb_database_host = param('puppetdb_database_host'), |
| 8 | + String[1] $puppetdb_database_replica_host = param('puppetdb_database_replica_host'), |
| 9 | + String[1] $compile_master_pool_address = param('compile_master_pool_address'), |
| 10 | + Pattern[/\A[a-z0-9_]+\Z/] $default_environment = 'production', |
| 11 | + Array[Pattern[/\A[a-z0-9_]+\Z/]] $environments = ['production'], |
| 12 | +) { |
| 13 | + |
| 14 | + ################################################## |
| 15 | + # PE INFRASTRUCTURE GROUPS |
| 16 | + ################################################## |
| 17 | + |
| 18 | + # We modify this group's rule such that all PE infrastructure nodes will be |
| 19 | + # members. |
| 20 | + node_group { 'PE Infrastructure Agent': |
| 21 | + rule => ['and', ['~', ['trusted', 'extensions', 'pp_role'], '^pe_xl::']], |
| 22 | + } |
| 23 | + |
| 24 | + # We modify this group to add, as data, the compile_master_pool_address only. |
| 25 | + # Because the group does not have any data by default this does not impact |
| 26 | + # out-of-box configuration of the group. |
| 27 | + node_group { 'PE Master': |
| 28 | + rule => ['or', |
| 29 | + ['and', ['=', ['trusted', 'extensions', 'pp_role'], 'pe_xl::compile_master']], |
| 30 | + ['=', 'name', $primary_master_host], |
| 31 | + ], |
| 32 | + data => { |
| 33 | + 'pe_repo' => { 'compile_master_pool_address' => $compile_master_pool_address }, |
| 34 | + }, |
| 35 | + } |
| 36 | + |
| 37 | + # We need to pre-create this group so that the primary master replica can be |
| 38 | + # identified as running PuppetDB, so that Puppet will create a pg_ident |
| 39 | + # authorization rule for it on the PostgreSQL nodes. |
| 40 | + node_group { 'PE HA Replica': |
| 41 | + ensure => 'present', |
| 42 | + parent => 'PE Infrastructure', |
| 43 | + rule => ['or', ['=', 'name', $primary_master_replica_host]], |
| 44 | + classes => { |
| 45 | + 'puppet_enterprise::profile::primary_master_replica' => { } |
| 46 | + }, |
| 47 | + } |
| 48 | + |
| 49 | + # Create data-only groups to store PuppetDB PostgreSQL database configuration |
| 50 | + # information specific to the primary master and primary master replica nodes. |
| 51 | + node_group { 'PE Master A': |
| 52 | + ensure => present, |
| 53 | + parent => 'PE Infrastructure', |
| 54 | + rule => ['and', |
| 55 | + ['=', ['trusted', 'extensions', 'pp_role'], 'pe_xl::primary_master'], |
| 56 | + ['=', ['trusted', 'extensions', 'pp_cluster'], 'A'], |
| 57 | + ], |
| 58 | + data => { |
| 59 | + 'puppet_enterprise::profile::primary_master_replica' => { |
| 60 | + 'database_host_puppetdb' => $puppetdb_database_host, |
| 61 | + }, |
| 62 | + 'puppet_enterprise::profile::puppetdb' => { |
| 63 | + 'database_host' => $puppetdb_database_host, |
| 64 | + }, |
| 65 | + }, |
| 66 | + } |
| 67 | + |
| 68 | + node_group { 'PE Master B': |
| 69 | + ensure => present, |
| 70 | + parent => 'PE Infrastructure', |
| 71 | + rule => ['and', |
| 72 | + ['=', ['trusted', 'extensions', 'pp_role'], 'pe_xl::primary_master'], |
| 73 | + ['=', ['trusted', 'extensions', 'pp_cluster'], 'B'], |
| 74 | + ], |
| 75 | + data => { |
| 76 | + 'puppet_enterprise::profile::primary_master_replica' => { |
| 77 | + 'database_host_puppetdb' => $puppetdb_database_replica_host, |
| 78 | + }, |
| 79 | + 'puppet_enterprise::profile::puppetdb' => { |
| 80 | + 'database_host' => $puppetdb_database_replica_host, |
| 81 | + }, |
| 82 | + }, |
| 83 | + } |
| 84 | + |
| 85 | + # Configure the compile masters for HA, grouped into two pools, each pool |
| 86 | + # having an affinity for one "availability zone" or the other. Even with an |
| 87 | + # affinity, note that data from each compile master is replicated to both |
| 88 | + # "availability zones". |
| 89 | + node_group { 'PE Compile Master Group A': |
| 90 | + ensure => 'present', |
| 91 | + parent => 'PE Master', |
| 92 | + rule => ['and', |
| 93 | + ['=', ['trusted', 'extensions', 'pp_role'], 'pe_xl::compile_master'], |
| 94 | + ['=', ['trusted', 'extensions', 'pp_cluster'], 'A'], |
| 95 | + ], |
| 96 | + classes => { |
| 97 | + 'puppet_enterprise::profile::puppetdb' => { |
| 98 | + 'database_host' => $puppetdb_database_host, |
| 99 | + }, |
| 100 | + 'puppet_enterprise::profile::master' => { |
| 101 | + 'puppetdb_host' => ['${clientcert}', $primary_master_replica_host], |
| 102 | + 'puppetdb_port' => [8081], |
| 103 | + } |
| 104 | + }, |
| 105 | + } |
| 106 | + |
| 107 | + node_group { 'PE Compile Master Group B': |
| 108 | + ensure => 'present', |
| 109 | + parent => 'PE Master', |
| 110 | + rule => ['and', |
| 111 | + ['=', ['trusted', 'extensions', 'pp_role'], 'pe_xl::compile_master'], |
| 112 | + ['=', ['trusted', 'extensions', 'pp_cluster'], 'B'], |
| 113 | + ], |
| 114 | + classes => { |
| 115 | + 'puppet_enterprise::profile::puppetdb' => { |
| 116 | + 'database_host' => $puppetdb_database_replica_host, |
| 117 | + }, |
| 118 | + 'puppet_enterprise::profile::master' => { |
| 119 | + 'puppetdb_host' => ['${clientcert}', $primary_master_host], |
| 120 | + 'puppetdb_port' => [8081], |
| 121 | + } |
| 122 | + }, |
| 123 | + } |
| 124 | + |
| 125 | + # This class has to be included here because puppet_enterprise is declared |
| 126 | + # in the console with parameters. It is therefore not possible to include |
| 127 | + # puppet_enterprise::profile::database in code without causing a conflict. |
| 128 | + node_group { 'PE Database': |
| 129 | + ensure => present, |
| 130 | + parent => 'PE Infrastructure', |
| 131 | + environment => 'production', |
| 132 | + override_environment => false, |
| 133 | + rule => ['and', ['=', ['trusted', 'extensions', 'pp_role'], 'pe_xl::puppetdb_database']], |
| 134 | + classes => { |
| 135 | + 'puppet_enterprise::profile::database' => { }, |
| 136 | + }, |
| 137 | + } |
| 138 | + |
| 139 | + ################################################## |
| 140 | + # ENVIRONMENT GROUPS |
| 141 | + ################################################## |
| 142 | + |
| 143 | + node_group { 'All Environments': |
| 144 | + ensure => present, |
| 145 | + description => 'Environment group parent and default', |
| 146 | + environment => $default_environment, |
| 147 | + override_environment => true, |
| 148 | + parent => 'All Nodes', |
| 149 | + rule => ['and', ['~', 'name', '.*']], |
| 150 | + } |
| 151 | + |
| 152 | + node_group { 'Agent-specified environment': |
| 153 | + ensure => present, |
| 154 | + description => 'This environment group exists for unusual testing and development only. Expect it to be empty', |
| 155 | + environment => 'agent-specified', |
| 156 | + override_environment => true, |
| 157 | + parent => 'All Environments', |
| 158 | + rule => [ ], |
| 159 | + } |
| 160 | + |
| 161 | + $environments.each |$env| { |
| 162 | + $title_env = capitalize($env) |
| 163 | + |
| 164 | + node_group { "${title_env} environment": |
| 165 | + ensure => present, |
| 166 | + environment => $env, |
| 167 | + override_environment => true, |
| 168 | + parent => 'All Environments', |
| 169 | + rule => ['and', ['=', ['trusted', 'extensions', 'pp_environment'], $env]], |
| 170 | + } |
| 171 | + |
| 172 | + node_group { "${title_env} one-time run exception": |
| 173 | + ensure => present, |
| 174 | + description => "Allow ${env} nodes to request a different puppet environment for a one-time run", |
| 175 | + environment => 'agent-specified', |
| 176 | + override_environment => true, |
| 177 | + parent => "${title_env} environment", |
| 178 | + rule => ['and', ['~', ['fact', 'agent_specified_environment'], '.+']], |
| 179 | + } |
| 180 | + } |
| 181 | + |
| 182 | +} |
| 183 | + |
| 184 | +include configure_node_groups |
0 commit comments