Puppet Conf 2012 - Managing Network Devices with Puppet

Managing Network Devices
Nan Liu // Sept. 27, 2012

Monday, September 17, 12

Network Devices

• Why Puppet?
• Puppet Device
• Load Balancer Demo
• Developing Devices (Advanced)


Application Deployment

• Server + Puppet
• ???
• Proﬁt!


Missing Step?
• Linking Application Services


#puppetize
• Network Device + Puppet


Puppet Proxy Agent

• Certiﬁcates
• Retrieves Device Plugins
• Retrieves Device Catalog
• Connects to Device
• Apply Device Resources
• Reports to Master


Proxy Agent
• Workﬂow Device Proxy Agent Puppet Master

Device Cert
Plugins

Device Connect

Custom Facts

Compile Catalog
(functions)

Apply Catalog

Device resource
puppet report

Report? Report Procesor

Finish


Commands

• facter
• puppet resource
• puppet apply (maybe)
• puppet device


Device.conf

• $confdir/device.conf:
[node1_name]
type <device_type>
url <protocol://username:password@url/>

[node2_name]
type <device_type>


Device $vardir

• $vardir(/var/lib/puppet /var/opt/lib/pe-puppet)
# tree ./devices
└── f5.puppetlabs.lan
├── client_yaml
├── facts
├── ssl
└── state


Puppet Resource

• Abstraction (Type/Provider)
• Declarative (Language)
• Idempotent (Enforcement)


Manifest v.s. GUI
f5_pool { 'apt.puppetlabs.com':
  ensure => 'present',
  action_on_service_down => 'SERVICE_DOWN_ACTION_NONE',
  allow_nat_state => 'STATE_ENABLED',
  allow_snat_state => 'STATE_ENABLED',
  client_ip_tos => '65535',
  client_link_qos => '65535',
  gateway_failsafe_unit_id => '0',
  lb_method => 'LB_METHOD_ROUND_ROBIN',
  member => {'10.10.0.22:8080' => {...},
'10.10.0.23:8080' => {...},
'10.10.0.24:80' => {...}},
  minimum_active_member => '0',
  minimum_up_member => '0',
  minimum_up_member_action => 'HA_ACTION_FAILOVER',
  minimum_up_member_enabled_state => 'STATE_DISABLED',
  monitor_association => {...},
  server_ip_tos => '65535',
  server_link_qos => '65535',
  simple_timeout => '0',
  slow_ramp_time => '10',
}


Manifests = Text

• Version Control
• Auditing
• Workﬂow


Resource Demo

• export FACTER_url=https://admin:admin@f5/
• puppet resource f5_*


Web Module
• web::site deﬁnition:
define web::site (
  $port = '80',
# F5 pool member settings:
  $connection_limit = '0',
  $dynamic_ratio = '1',
  $priority = '0',
  $ratio = '1'
) {
# setup web service.
}


Web Server Nodes
• webservers nodes:
node /^webserver21/ {
  web::site { 'apt.puppetlabs.com':
    port => '8080',
  }
}

node /^webserver22/ {
  web::site { 'apt.puppetlabs.com':
    port => '80',
    connection_limit => '100',
  }
  web::site { 'yum.puppetlabs.com':
    port => '8080',
  }
}


Composing Services
• Network Device = Nodes
node 'f5.puppetlabs.lan' {
f5_virtualserver { 'apt.puppetlabs.com':
   ...
  }
  ...
  }
  f5_monitor { 'apt.puppetlabs.com':
   ...
  }
}


Problem?
• f5_pool member ip address:


Export Resources?
• ONLY export/collect resources.
  member => { '10.10.0.22:8080' => {},
                 '10.10.0.23:8081' => {},
            '10.10.0.24:80' => {},
  },
}

• f5_poolmember ?


Resources Meta Type

• Puppet Resources:
resources { 'f5_poolmember':
purge => true,
}

• Does not support Resource subset =/
purge poolmember in pool ‘X’ ?


Query Puppet DB

• ruby-puppetdb:
https://github.com/ripienaar/ruby-puppetdb

• puppetdb query:
https://github.com/dalen/puppet-
puppetdbquery


Puppet Catalog
• Puppet Catalog = Resources + Relationship
• Facts + Manifests => compilation => Catalog

Facts
Agent Master


Puppet Catalog

Agent Master


Puppet Catalog

Catalog
Agent Master


Puppet DB
• Stores all client catalogs
Master Puppet DB

Web Server 1 Web Server 2


web::loadbalancer
define web::loadbalancer (
  $site = $name, $address, $port = 80
) {
  f5_virtualserver { $name:
    connection_limit => '0',
    default_pool_name => $name,
    destination => "${address}:${port}",
    require => F5_pool[$name],
  }
# $member = ???
  f5_pool { $name:
    member => $member,
  }
}


Query Puppet DB
• puppet query resource
--query='Class[web::server]'
--ﬁlter='Web::Site[apt.puppetlabs.com]'
--render-as yaml
"Web::Site[apt.puppetlabs.com]":
- parameters:
port: "8080"
nodes:
- webserver22
- webserver23
- parameters:
port: "80"
connection_limit: "100"
nodes:
- webserver24


Pool Member
$ip_facts = query_facts('ipaddress', 'Class[web::server]')
$websites = query_resources('Class[web::server]',
"Web::Site[${site}]")
$member = web_poolmember($ip_facts, $websites)

• Results
{ "10.0.2.24:80" =>
{ "connection_limit" => "0",
"ratio" => "1",
    "priority" => "3",
"dynamic_ratio" => "1" },
  "10.0.2.22:8080" =>
{ "connection_limit" => "0",
"ratio" => "1",
    "priority" => "1",
    "dynamic_ratio" => "1"}
}


Device Node
• F5 node:
node 'f5.puppetlabs.lan' {
  web::loadbalancer { 'apt.puppetlabs.com':
    address => '192.168.1.200',
  }
  web::loadbalancer { 'yum.puppetlabs.com':
    address => '192.168.1.201',
  }
  web::loadbalancer { 'download.puppetlabs.com':
    address => '192.168.1.202',
  }
}


Demo

• Update web::site deployment
• Update F5 Loadbalancer


Developing Devices

• WARNING:
Recommend developing regular Puppet Type/Provider ﬁrst.
...

• Puppet Type/Provider Session (Dan)


Developing Devices

• Transport
• Facter
• Type
• Provider (retrieve/set)


Transport
• device.conf
[node_name]
type <device_type>

• telnet
• ssh
• iControl (SOAP)
• (netconf)


Initialize Device
• puppet/util/network_device.rb
class Puppet::Util::NetworkDevice
  ...
  def self.init(device)
    require "puppet/util/network_device/#{device.provider}/device"
    @current = Puppet::Util::NetworkDevice.
const_get(device.provider.capitalize).
const_get(:Device).new(device.url)
  rescue => detail
    raise "Can't load #{device.provider} for #{device.name}:
#{detail}"
  end
end


device.rb
• puppet/util/network_device/<type>/device.rb
class Puppet::Util::NetworkDevice::Juniper

  attr_accessor :url, :transport

  def initialize(url)
    @url = URI.parse(url)
    @transport = Puppet::Util::NetworkDevice::Transport::Juniper.new
    end
  end

  def facts
    @facts ||=
Puppet::Util::NetworkDevice::Transport::Juniper::facts.new(@transport)
    @facts.retrieve
  end
end


Device Facts
• puppet/util/network_device/<type>/facts.rb


Type
• apply_to_all
• apply_to_host
• apply_to_device
Puppet::Type.newtype(:f5_monitor) do
  @doc = "Manage F5 monitor."
  apply_to_device
  ensurable
  ...
  newproperty(:template_state) do
    desc "The monitor templates' enabled/disabled states."
    newvalues(/^STATE_(DISABLED|ENABLED)$/)
  end
end


Provider
• ssh/telnet:
output = transport.command('sh interface')

• Access custom transport:
  def self.transport
    if Facter.value(:url) then
      Puppet.debug "F5: connecting via facter url."
      @device ||=
Puppet::Util::NetworkDevice::F5::Device.new(Facter.value(:url))
    else
      @device ||= Puppet::Util::NetworkDevice.current
      raise Puppet::Error, "Error Msg..." unless @device
    end

    @tranport = @device.transport
  end


Testing

• Puppet Resource (self.instances)
• Puppet Apply (apply_to_host)


Future

• Software deﬁned infrastructure
• Systems (Google Compute Engine as Resource)
• Application (puppet agent)
• Network (puppet device)


Questions?


Thank you for attending


Puppet Conf 2012 - Managing Network Devices with Puppet

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (17)

Similaire à Puppet Conf 2012 - Managing Network Devices with Puppet

Similaire à Puppet Conf 2012 - Managing Network Devices with Puppet (20)

Dernier

Dernier (20)

Puppet Conf 2012 - Managing Network Devices with Puppet