How To Install Puppet On CentOS 8 / RHEL 8

Puppet is an open-source configuration management tool that helps us to automate IT infrastructure, including provisioning, configuration management, patching of hundreds of client systems from the central location.

Puppet is available for Linux, Mac, BSD, Solaris, and Windows operating systems. It is written in “Ruby” language and released under Apache License,

This guide helps you to install Puppet on CentOS 8 / RHEL 8.

Architecture

Pupper is configured in an agent-master architecture. In this architecture, managed nodes run the puppet agent software, as a background service. On another hand, one or more servers run the master application, i,e. Puppet server.

Puppet agent periodically sends facts to the puppet master and request a catalog. The master compiles and returns that particular node’s catalog, using the sources of information it has access to.

Environment

Here, we will configure a puppet in Server/agent architecture.

Puppet Master

Host Name: puppetserver.itzgeek.local

IP Address: 192.168.0.10

Operating System: CentOS 8

Puppet client

Host Name: client.itzgeek.local

IP Address: 192.168.0.20

Operating System: CentOS 8

Prerequisites

Install NTP

The timing of the master and client nodes should be accurately in sync with the NTP server because the Puppet server will be acting as the certificate authority.

If you need to set up NTP Server, then:

READ: How To Configure NTP Server Using Chrony

If you need to set up NTP Client, then:

READ: How To Configure NTP Client Using Chrony

If needed, change the system timezone as well.

READ: How to Change Timezone in CentOS 8 / RHEL 8

DNS

The Puppet agent uses the hostname to communicate with the Puppet Server. So, make sure agent nodes can resolve the hostname of the Puppet Server with the help of /etc/hosts file or DNS server.

Install & Configure Puppet Server

Puppet Server is the server software that runs on the master node. Puppet Server controls the configurations of managed nodes (puppet-agent).

Add Repository

To install the Puppet Server, we would need to add the puppet repository by installing the repository configuration package.

rpm -Uvh https://yum.puppet.com/puppet6-release-el-8.noarch.rpm

Install Puppet

Install the Puppet server using the below command.

yum install -y puppetserver

Memory Allocation

By default, Puppet Server is configured to use 2GB of memory. You can change the memory allocation based on the number of nodes connected to it.

For this demo, I will allocate 512MB of memory.

To change the value of memory allocation, edit the below file.

vi /etc/sysconfig/puppetserver

Change the value.

From:

JAVA_ARGS="-Xms2g -Xmx2g -Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger"

To:

For 512MB, use the below settings.

JAVA_ARGS="-Xms512m -Xmx512m -Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger"

Configure Puppet Server

The Puppet’s configuration file consists of two sections named [master] and [main] for Pupper server and agent respectively.

vi /etc/puppetlabs/puppet/puppet.conf

Modify the file according to your environment. Pupper agents can use any of the hostnames mentioned in the dns_alt_names to connect with the Pupper server.

# Pupper Server Configuration
[master]
dns_alt_names = puppetserver,puppetserver.itzgeek.local

# Puppet Agent Configuration
[main]
certname = puppetserver.itzgeek.local
server = puppetserver.itzgeek.local
runinterval = 30m

Start Puppet Server

Generate the root and intermediate signing CA for Puppet Server.

puppetserver ca setup

Output:

Generation succeeded. Find your files in /etc/puppetlabs/puppet/ssl/ca

Start and enable the Puppet Server.

systemctl start puppetserver

systemctl enable puppetserver

Firewall

The Puppet server listens on port 8140. So, configure the firewall to let agents can connect to the master.

firewall-cmd --permanent --add-port=8140/tcp

firewall-cmd --reload

Install & Configure Puppet Agent

Add Repository

To install the Puppet agent, we would need to add the puppet repository on all the nodes.

rpm -Uvh https://yum.puppet.com/puppet6-release-el-8.noarch.rpm

Install Agent

Install the puppet agent on your client using the below command.

dnf install -y puppet-agent

Edit the puppet configuration file and set the Puppet server information.

Set server value as per your Puppet server hostname. In my case, the server is puppetserver.itzgeek.local and certname is my client hostname (client.itzgeek.local).

vi /etc/puppetlabs/puppet/puppet.conf

Set like below.

[main]
server = puppetserver.itzgeek.local
certname = client.itzgeek.local
runinterval = 30m

You can change the value of runinterval depends on the requirement. This setting controls how long the agent should wait between the two catalog requests. You can set the value in seconds (10 or 10s), minutes (10m), and hours (1h).

Start puppet agent on the node and make it start automatically on system boot.

puppet resource service puppet ensure=running enable=true

Output:

Notice: /Service[puppet]/ensure: ensure changed 'stopped' to 'running'
service { 'puppet':
  ensure   => 'running',
  enable   => 'true',
  provider => 'systemd',
}

Sign Agent Node Certificate on Master Server

We must approve a certificate request coming from each node. Agent nodes will request certificates for the first time if they attempt to run.

Run the below command on the agent node to make an initial connection. You can ignore the warnings/errors.

puppet agent -t

Log into the Pupper server and run below command to view outstanding requests.

puppetserver ca list

Output:

Requested Certificates:
    client.itzgeek.local       (SHA256)  06:D8:8E:AE:CA:0B:B1:E7:90:B5:B9:1B:75:3C:95:69:D8:EF:27:0A:5D:CC:45:BB:15:34:64:D2:6B:2C:CA:98

Run puppet cert sign command to sign a request.

puppetserver ca sign --certname client.itzgeek.local

Output:

Successfully signed certificate request for client.itzgeek.local

The Puppet server can now communicate to the client machine and control the node.

If you have multiple signing requests from nodes, you can sign all the requests in one command.

puppetserver ca sign --all

Sometimes, you may need to revoke the certificate of a particular node to read them back.

Replace the <AGENT_NAME> with your client hostname.

puppetserver ca revoke --certname AGENT_NAME

You can list all of the signed and unsigned requests with the below command.

puppetserver ca list --all

Output:

Signed Certificates:
    puppetserver.itzgeek.local       (SHA256)  E6:2C:6C:1E:9B:C6:AA:D9:84:09:F3:67:45:1B:36:C6:1F:FB:46:5F:92:64:37:19:E3:74:0C:0D:29:D5:C5:F6  alt names: ["DNS:puppetserver.itzgeek.local", "DNS:puppetserver", "DNS:puppetserver.itzgeek.local"]  authorization extensions: [pp_cli_auth: true]
    client.itzgeek.local             (SHA256)  EF:D8:1A:F2:E9:56:A3:1F:DA:A9:8D:9B:71:02:D8:52:F1:44:98:92:A7:5F:DE:FC:5F:55:37:97:EC:9C:9A:96

Verify Puppet Client

Once the Puppet Server has signed your client certificate, run the following command on the client machine to test it.

puppet agent --test

Output:

Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Retrieving locales
Info: Caching catalog for client.itzgeek.local
Info: Applying configuration version '1591351483'
Notice: Applied catalog in 0.01 seconds

Conclusion

That’s Al. I hope you have learned how to install Puppet on CentOS 8 / RHEL 8. As a further read, learn how to create a simple manifest file to create a file and directory on the client node. Please share your feedback in the comments section.