Version information
This version is compatible with:
- Puppet Enterprise 3.x
- Puppet >=3.4.0 <5.0.0
- , , , , ,
Start using this module
Add this module to your Puppetfile:
mod 'cristifalcas-etcd', '1.10.0'
Learn more about managing modules with a PuppetfileDocumentation
etcd
This module installs and configures etcd.
A basic provider is also implemented that can add/update/delete node keys
Because of the way etcd is working, you can't change any of the initial cluster variables after first run:
initial_advertise_peer_urls
initial_cluster
initial_cluster_state
initial_cluster_token
This is annoying if you first bootstraped the cluster in http mode and you want to add ssl after that to initial_cluster parameter.
Solution:
- Don't care. Even if the protocol is http, the communication will be over ssl
- redeploy the cluster (rm -rf /var/lib/etcd/$data_dir)
##Usage:
Basic usage:
include etcd
or
class { 'etcd':
ensure => 'latest',
etcd_listen_client_urls => 'http://0.0.0.0:2379',
}
Add a key/value pair to etcd:
etcd_key { '/coreos.com/network/config': value => '{ "Network": "10.1.0.0/16" }' }
Remove a key:
etcd_key { '/coreos.com/network1/config': ensure => absent }
Deploy a cluster:
class { 'etcd':
listen_client_urls => 'http://0.0.0.0:2379',
advertise_client_urls => "http://${::fqdn}:2379,http://127.0.0.1:2379",
listen_peer_urls => 'http://0.0.0.0:2380',
initial_advertise_peer_urls => "http://${::fqdn}:2380,http://127.0.0.1:2379",
initial_cluster => [
"${::hostname}=http://${::fqdn}:2380",
'infra1=http://infra1.domain.net:2380',
'infra2=http://infra2.domain.net:2380'],
}
Enable ssl for client communication:
class { 'etcd':
ensure => 'latest',
etcd_name => $::hostname,
listen_client_urls => 'https://0.0.0.0:2379',
advertise_client_urls => "https://${::fqdn}:2379",
# clients should speak over ssl
cert_file => "${::settings::ssldir}/certs/${::clientcert}.pem",
key_file => "${::settings::ssldir}/private_keys/${::clientcert}.pem",
# authorize clients
client_cert_auth => true,
# and verify clients certificates
trusted_ca_file => "${::settings::ssldir}/certs/ca.pem",
initial_cluster => [
"${::hostname}=http://${::fqdn}:2380",
'infra1=http://infra1.domain.net:2380',
'infra2=http://infra2.domain.net:2380'],
}
Use the etcd provider with ssl certificates:
etcd_key { '/coreos.com/network/config':
value => '{ "Network": "10.1.0.0/18" }',
peers => "https://${::fqdn}:2379",
cert_file => "${::settings::ssldir}/certs/${::clientcert}.pem",
key_file => "${::settings::ssldir}/private_keys/${::clientcert}.pem",
# verify server ceretificate
ca_file => "${::settings::ssldir}/certs/ca.pem",
}
Deploy a cluster with full ssl for both clients and peers
class { 'etcd':
ensure => 'latest',
etcd_name => $::hostname,
# clients
listen_client_urls => 'https://0.0.0.0:2379',
advertise_client_urls => "https://${::fqdn}:2379",
# clients ssl
cert_file => '/etc/pki/puppet_certs/etcd/public_cert.pem',
key_file => '/etc/pki/puppet_certs/etcd/private_cert.pem',
# authorize clients
client_cert_auth => true,
# verify clients certificates
trusted_ca_file => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
# cluster
listen_peer_urls => 'https://0.0.0.0:2380',
initial_advertise_peer_urls => "https://${::fqdn}:2380",
initial_cluster => [
"${::hostname}=http://${::fqdn}:2380",
'infra1=http://infra1.domain.net:2380',
'infra2=http://infra2.domain.net:2380'],
# peers ssl
peer_cert_file => '/etc/pki/puppet_certs/etcd/public_cert.pem',
peer_key_file => '/etc/pki/puppet_certs/etcd/private_cert.pem',
# authorize peers
peer_client_cert_auth => true,
# verify peers certificates
peer_trusted_ca_file => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
debug => true,
}
Deploy a proxy
If the $proxy parameter is undef, we will try to guess if the node should be a proxy by checking if $::fqdn or $::ipaddress appears in initial_cluster parameter.
class { 'etcd':
ensure => 'latest',
etcd_name => $::hostname,
proxy => 'on',
# clients
listen_client_urls => 'https://0.0.0.0:2379',
advertise_client_urls => "https://${::fqdn}:2379",
# clients ssl
cert_file => '/etc/pki/puppet_certs/etcd/public_cert.pem',
key_file => '/etc/pki/puppet_certs/etcd/private_cert.pem',
# authorize clients
client_cert_auth => true,
# verify clients certificates
trusted_ca_file => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
# cluster
listen_peer_urls => 'https://0.0.0.0:2380',
initial_cluster => [
'infra0=http://infra0.domain.net:2380',
'infra1=http://infra1.domain.net:2380',
'infra2=http://infra2.domain.net:2380'],
# peers ssl
peer_cert_file => '/etc/pki/puppet_certs/etcd/public_cert.pem',
peer_key_file => '/etc/pki/puppet_certs/etcd/private_cert.pem',
# authorize peers
peer_client_cert_auth => true,
# verify peers certificates
peer_trusted_ca_file => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
debug => true,
}
Journald forward:
The class support a parameter called journald_forward_enable.
This was added because of the PIPE signal that is sent to go programs when systemd-journald dies.
For more information read here: https://github.com/projectatomic/forward-journald
Usage:
include ::forward_journald
Class['forward_journald'] -> Class['etcd']
Types in this module release
Dependencies
- puppetlabs/stdlib (>= 4.6.0 < 5.0.0)
Copyright (C) 2014 R. Tyler Croy <tyler@monkeypox.org> Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.