Bare-metal and Virtual Provisioning using Puppet Razor

1. @STL_PUG
GITHUB.COM/STLPUG
WELCOME
ST LOUIS PUPPET USERS GROUP

2. PUPPETCONF WRAP-UP
STLPUG GITHUB UPDATES
RAZOR
MCOLLECTIVE PLUGIN
DEVELOPMENT
Agenda
OVERVIEW

3. CONFERENCE
PUPPETCONF WRAP-UP
▸ training
▸ experience
▸ user sessions
▸ unit testing
▸ types & providers
▸ best practices / patterns
▸ Puppet on Windows
▸ PuppetConf 2017

4. STLPUG GITHUB UPDATES — GITHUB.COM/STLPUG

5. PUPPET AUTOMATED
PROVISIONING
RAZOR
Kris Reese
Lenny Ilyashov

6. PROVISIONING APPLICATION THAT
DEPLOYS BARE-METAL AND VIRTUAL
SYSTEMS BASED ON
CHARACTERISTICS OF THE
HARDWARE
What is Razor?

7. WHY RAZOR?
▸Synergy with Configuration Management
▸Bare-metal & Virtual
▸Deployment of multiple OS
▸Hand off to Puppet
▸RESTful API
▸Consistent Minimal OS install
▸Capability to redeploy on demand
▸pe_razor (ships with Puppet Enterprise!)

8. SETUP
RAZOR REQUIREMENTS
▸A DHCP/DNS/TFTP service with SELinux configured to enable PXE boot
▸iPXE Software
▸undionly.kpxe file from the iPXE open source software stack
▸Razor specific bootstrap.ipxe script
▸Razor Client (pe-razor-client ruby gem)
▸Puppet Enterprise
▸The Razor Server
▸bootstrap.ipxe

9. PREREQUISITES
- DNSMASQ FOR DHCP, DNS, TFTP
- UNDIONLY.KPXE
- PE-RAZOR-CLIENT
Setup via Vagrantfile shell provisioner

10. SETUP
PUPPET ENTERPRISE (PE_RAZOR)

11. SETUP
PUPPET ENTERPRISE (PE_RAZOR)
STLPUG razor ~ # puppet agent -t
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for razor.stlpug.com
Info: Applying configuration version '1480995491'
Notice: /Stage[main]/Pe_razor/Pe_razor::Server[razor]/Exec[unpack the microkernel]/returns: executed
successfully
Notice: /Stage[main]/Pe_razor/Pe_razor::Server[razor]/Pe_razor::Server::Repo[razor]/Exec[unpack the
razor repo]/returns: executed successfully
Notice: /Stage[main]/Pe_razor/Pe_razor::Server[razor]/Pe_razor::Server::Repo[razor]/Yumrepo[pe-
razor]/ensure: created
Info: changing mode of /etc/yum.repos.d/pe-razor.repo from 600 to 644
Notice: /Stage[main]/Pe_razor/Pe_razor::Server[razor]/Package[pe-razor-server]/ensure: created
...

12. SETUP
POST PE_RAZOR
STLPUG razor ~ # cat /vagrant/files/bootstrap.sh | grep "#"
# Get bootstrap.ipxe
# Create Razor Broker
# Create Razor Repo
# Create Razor Tag
# Create Razor Policy
# Prep for Windows deployment

13. SETUP
RAZOR COMMANDS
STLPUG razor ~ # razor commands
From https://razor.stlpug.com:8151/api/collections/commands:
+------+---------------+----------------+--------+----------+
| name | command | name parameter | errors | status |
+------+---------------+----------------+--------+----------+
| 11 | create-policy | esxi6 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 10 | create-policy | win2k12r2 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 9 | create-policy | centos6 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 8 | create-tag | esxi6 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 7 | create-tag | win2k12r2 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 6 | create-tag | centos6 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 5 | create-repo | esxi6 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 4 | create-repo | win2k12r2 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 3 | create-repo | centos6 | 0 | finished |
+------+---------------+----------------+--------+----------+
| 2 | create-broker | noop | 0 | finished |
+------+---------------+----------------+--------+----------+
| 1 | create-broker | pe | 0 | finished |
+------+---------------+----------------+--------+----------+
Query an entry by including its name, e.g. `razor commands 11`

14. WORKFLOW
HOW RAZOR WORKS
▸Repositories
▸Repositories contain – or point to – the operating system to install on a node
razor create-repo --name centos6
--task centos
--iso-url “http://archive.kernel.org/centos-
vault/6.6/isos/x86_64/CentOS-6.6-x86_64-minimal.iso”
extracts to /opt/puppetlabs/server/data/razor-server/repo/centos6

15. WORKFLOW
HOW RAZOR WORKS
▸Tags (Optional)
▸Tags let you group nodes based on their characteristics
▸Apply policies based on tags to install appropriate operating systems on tagged
nodes
▸If you don’t specify tags for a policy, the policy binds to any node
razor create-tag --name centos6 --rule '["has_macaddress",
"08:00:27:41:1f:6f"]'

16. WORKFLOW
HOW RAZOR WORKS
▸Policies
▸Tell Razor what OS to install on the provisioned node
▸Where to get the OS software
▸How it should be configured
▸How to communicate between the node and PE
razor create-policy --name centos6
--repo centos6
--task centos
--broker pe
--enabled
--hostname ‘apache${id}.stlpug.com'
--root-password secret
--tag centos6

17. WORKFLOW
HOW RAZOR WORKS
▸Broker (Optional)
▸Brokers hand off nodes to configuration management systems like PE
razor create-broker --name pe --broker-type puppet-pe
--configuration server=puppetmaster.stlpug.com
razor create-broker --name=noop --broker-type=noop

18. WORKFLOW
HOW RAZOR WORKS
▸Phases
▸Discovery
▸Task
▸Broker

19. Discovery Phase

20. Discovery Phase

21. Discovery Phase

22. Discovery Phase

23. Discovery Phase

24. Discovery Phase

25. Task Phase
OS is now deployed
Hand off to broker for day
2 commencement!

26. Broker Phase

29. ADVANCED
RAZOR HOOKS
▸Trigger invocation of scripts during certain events in a node’s lifecycle
▸node-registered: triggered after a node has been registered
▸node-bound-to-policy: triggered after a node has been bound to a policy
▸node-unbound-from-policy: triggered after a node has been marked as uninstalled by the reinstall-node
command
▸node-deleted: triggered after a node has been deleted.
▸node-booted: triggered every time a node boots via iPXE.
▸node-facts-changed: triggered whenever a node changes its facts.
▸node-install-finished: triggered when a policy finishes its last step.

30. ADVANCED
RAZOR HOOKS
▸Scripts must exist on disk
▸Executable scripts named after their triggering event
▸Scripts receive input including node info

32. REFERENCES
▸Razor Workflow Slides 9 - 16
▸Slides borrowed from May 2015 Austin PUG
▸https://github.com/stlpug/pe-vagrant/tree/razor
▸https://puppet.com/product/capabilities/automated-provisioning
▸https://github.com/puppetlabs/razor-server/wiki
▸https://docs.puppet.com/pe/latest/razor_using.html
▸https://github.com/npwalker/pe-razor-vagrant-stack