Andrew Bogott has submitted this change and it was merged.
Change subject: Simplify our puppet master setup.
......................................................................
Simplify our puppet master setup.
This patch reconciles Stafford and Sockpuppet somewhat, so that
their puppet file structures are the same. Now both will have
a git repo in /var/lib/git/operations/puppet with a checkout
of the private repo in /var/lib/git/operations/puppet/private.
Links are created in /etc/puppet for the puppet master to rely on.
On sockpuppet, the post-merge hook will now update stafford
and also force an update of submodules.
Change-Id: I1a90164b9664eb4d5a553d4e312aed6930cb89a8
---
A files/puppet/git/gitpuppet_authorized_keys
M files/puppet/git/puppet/post-merge
A files/puppet/git/puppet/pre-merge
A files/puppet/git/puppet/pre-rebase
M files/puppet/puppet-merge
M manifests/puppetmaster.pp
M manifests/site.pp
7 files changed, 112 insertions(+), 14 deletions(-)
Approvals:
Andrew Bogott: Looks good to me, approved
jenkins-bot: Verified
diff --git a/files/puppet/git/gitpuppet_authorized_keys
b/files/puppet/git/gitpuppet_authorized_keys
new file mode 100644
index 0000000..7d1efc4
--- /dev/null
+++ b/files/puppet/git/gitpuppet_authorized_keys
@@ -0,0 +1 @@
+ssh-rsa
AAAAB3NzaC1yc2EAAAADAQABAAABAQC905HaavYYVgE8uqq7amMO0Ec0Fg46VwLravClYI5XxnVa/723AeXiwVj/Bx7GjzzID2cTYG+DMGTZyBtkIC8xDezg45ai9NwSbRUzldmLuph1GH70WCWmi7tLU6JOCaGSxUO31eeSo8Diid6DY1J4sev438pSYthTQRh1AsWjFs5n90KrZ5ZExxJIE99XUhps0aLQ2gtsIzLzHBL+RFM3Rvn7GK8qlX9BNiTUnjnLOVN0XEVSqMgoTt26Kenaymr2V/oAElT48Wt1VIL1P+hOZjC61FX0/LXo4vAH2kO+M/RAxqCadQCYTfw33wlvwbGBDO26BPQaTRYWmeq0ebcv
command="/bin/sh -c 'cd /var/lib/git/operations/puppet && git pull && git
submodule update --init'"
diff --git a/files/puppet/git/puppet/post-merge
b/files/puppet/git/puppet/post-merge
index c821a36..87abc76 100644
--- a/files/puppet/git/puppet/post-merge
+++ b/files/puppet/git/puppet/post-merge
@@ -9,4 +9,10 @@
#/etc/init.d/apache2 reload
# This bug has allegedly been fixed, so let's try with touch site.pp again
-touch /etc/puppet/manifests/site.pp
\ No newline at end of file
+touch /etc/puppet/manifests/site.pp
+
+if [ `hostname` = 'sockpuppet' ]; then
+ # No need to specify a command; gitpuppet's key will automatically run
+ # 'cd /var/lib/git/operations/puppet && git pull && git submodule update
--init' on stafford.
+ ssh stafford.pmtpa.wmnet
+fi
diff --git a/files/puppet/git/puppet/pre-merge
b/files/puppet/git/puppet/pre-merge
new file mode 100644
index 0000000..dead707
--- /dev/null
+++ b/files/puppet/git/puppet/pre-merge
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+if [ "$USER" != "gitpuppet" ]
+then
+ echo "You should only be merging here as user 'gitpuppet', and only
via the 'puppet-merge' script."
+ exit 1
+fi
diff --git a/files/puppet/git/puppet/pre-rebase
b/files/puppet/git/puppet/pre-rebase
new file mode 100644
index 0000000..10dda4e
--- /dev/null
+++ b/files/puppet/git/puppet/pre-rebase
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [ "$USER" != "gitpuppet" ]
+then
+ echo "You should only be rebasing here as user 'gitpuppet', and mostly
shouldn't even be doing that."
+ echo "The puppet-merge script probably does what you are trying to do."
+ exit 1
+fi
diff --git a/files/puppet/puppet-merge b/files/puppet/puppet-merge
index e91bd39..facb25c 100755
--- a/files/puppet/puppet-merge
+++ b/files/puppet/puppet-merge
@@ -22,14 +22,15 @@
echo "$usage" && exit 0;
fi
+git_user='gitpuppet'
-# Default to /root/puppet unless $1 is specified
-basedir=${1:-/root/puppet}
+# Default to /var/lib/git/operations/puppet unless $1 is specified
+basedir=${1:-/var/lib/git/operations/puppet}
cd "${basedir}"
echo "Fetching new commits from $(git config --get remote.origin.url)"
-git fetch
+sudo -u $git_user "git fetch"
fetch_head_sha1=$(git rev-parse FETCH_HEAD)
submodule_changes="$(git diff --submodule=log HEAD..${fetch_head_sha1} | grep
-e '^Submodule ')" || true
@@ -87,7 +88,7 @@
echo "Updating submodules..."
cmd="git submodule update --init --no-fetch"
echo "${cmd}"
- ${cmd}
+ sudo -u $git_user ${cmd}
fi
# git clean to remove any untracked
@@ -95,7 +96,7 @@
echo "Running git clean to clean any untracked files."
cmd="git clean -dffx -e /private/"
echo "${cmd}"
- ${cmd}
+ sudo -u $git_user ${cmd}
echo "HEAD is now $(git rev-parse HEAD)."
cd -
diff --git a/manifests/puppetmaster.pp b/manifests/puppetmaster.pp
index 7ceab0c..ab1615e 100644
--- a/manifests/puppetmaster.pp
+++ b/manifests/puppetmaster.pp
@@ -62,6 +62,37 @@
}
}
+ # Service user to handle the post-merge hook on sockpuppet
+ class gitpuppet {
+ user { 'gitpuppet':
+ ensure => present,
+ gid => 'gitpuppet',
+ shell => '/bin/false',
+ home => '/home/gitpuppet',
+ managehome => true,
+ system => true,
+ }
+ file { [ "/home/gitpuppet", "/home/gitpuppet/.ssh" ]:
+ ensure => directory,
+ owner => gitpuppet,
+ group => gitpuppet,
+ mode => 0700,
+ require => User['gitpuppet'];
+ }
+ file {
+ "/home/gitpuppet/.ssh/gitpuppet.key":
+ owner => gitpuppet,
+ group => gitpuppet,
+ mode => 0400,
+ source =>
'puppet:///private/ssh/gitpuppet/gitpuppet.key';
+ "/home/gitpuppet/.ssh/authorized_keys":
+ owner => gitpuppet,
+ group => gitpuppet,
+ mode => 0400,
+ source =>
'pupppet:///files/puppet/git/gitpuppet_authorized_keys';
+ }
+ }
+
# Class: puppetmaster::config
#
# This class handles the master part of /etc/puppet.conf. Do not
include directly.
@@ -100,11 +131,23 @@
group => root;
"$puppetmaster::gitdir/operations/puppet/.git/hooks/post-merge":
require => Git::Clone["operations/puppet"],
+ owner => 'gitpuppet',
source =>
"puppet:///files/puppet/git/puppet/post-merge",
mode => 0550;
"$puppetmaster::gitdir/operations/puppet/.git/hooks/pre-commit":
require => Git::Clone["operations/puppet"],
+ owner => 'gitpuppet',
source =>
"puppet:///files/puppet/git/puppet/pre-commit",
+ mode => 0550;
+
"$puppetmaster::gitdir/operations/puppet/.git/hooks/pre-merge":
+ require => Git::Clone["operations/puppet"],
+ owner => 'gitpuppet',
+ source =>
"puppet:///files/puppet/git/puppet/pre-merge",
+ mode => 0550;
+
"$puppetmaster::gitdir/operations/puppet/.git/hooks/pre-rebase":
+ require => Git::Clone["operations/puppet"],
+ owner => 'gitpuppet',
+ source =>
"puppet:///files/puppet/git/puppet/pre-rebase",
mode => 0550;
"$puppetmaster::gitdir/operations/software/.git/hooks/pre-commit":
require => Git::Clone["operations/software"],
@@ -123,16 +166,25 @@
}
if ! $is_labs_puppet_master {
+ # Set up private repo.
+ # Note that puppet does not actually clone the repo --
puppetizing that
+ # turns out to be a big, insecure mess. On a new
puppetmaster you will
+ # will need to do a clone of
$puppetmaster::gitdir/operations/puppet/private
+ # by hand and with a forwarded key.
file {
"$puppetmaster::gitdir/operations/private":
ensure => directory,
- owner => root,
+ owner => gitpuppet,
group => puppet,
mode => 0750;
-
"$puppetmaster::gitdir/operations/private/.git/hooks/post-merge":
source =>
"puppet:///files/puppet/git/private/post-merge",
+ owner => gitpuppet,
mode => 0550;
+
"$puppetmaster::gitdir/operations/puppet/private":
+ ensure => link,
+ owner => gitpuppet,
+ target =>
"${gitdir}/operations/private";
}
}
@@ -140,13 +192,42 @@
"operations/puppet":
require =>
File["$puppetmaster::gitdir/operations"],
directory =>
"$puppetmaster::gitdir/operations/puppet",
+ owner => 'gitpuppet',
branch => "production",
origin =>
"https://gerrit.wikimedia.org/r/p/operations/puppet";;
"operations/software":
require =>
File["$puppetmaster::gitdir/operations"],
+ owner => 'gitpuppet',
directory =>
"$puppetmaster::gitdir/operations/software",
origin =>
"https://gerrit.wikimedia.org/r/p/operations/software";;
}
+
+ # These symlinks will allow us to use /etc/puppet for the
puppetmaster to run out of.
+ file { '/etc/puppet/templates':
+ ensure => link,
+ target => "${gitdir}/operations/puppet/templates",
+ force => true,
+ }
+ file { '/etc/puppet/files':
+ ensure => link,
+ target => "${gitdir}/operations/puppet/files",
+ force => true,
+ }
+ file { '/etc/puppet/manifests':
+ ensure => link,
+ target => "${gitdir}/operations/puppet/manifests",
+ force => true,
+ }
+ file { '/etc/puppet/modules':
+ ensure => link,
+ target => "${gitdir}/operations/puppet/modules",
+ force => true,
+ }
+ file { '/etc/puppet/private':
+ ensure => link,
+ target => "${gitdir}/operations/puppet/private",
+ force => true,
+ }
}
# Class: puppetmaster::passenger
diff --git a/manifests/site.pp b/manifests/site.pp
index 3848b81..44c5082 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -2607,12 +2607,6 @@
'dbpassword' =>
$passwords::puppet::database::puppet_production_db_pass,
'dbserver' => "db9.pmtpa.wmnet",
'dbconnections' => "256",
- 'filesdir' => "/var/lib/git/operations/puppet/files",
- 'privatefilesdir' => "/var/lib/git/operations/private/files",
- 'manifestdir' => "/var/lib/git/operations/puppet/manifests",
- 'modulepath' => "/var/lib/git/operations/puppet/modules",
- 'templatedir' => "/var/lib/git/operations/puppet/templates",
- 'softwaredir' => "/var/lib/git/operations/software"
}
}
}
--
To view, visit https://gerrit.wikimedia.org/r/75263
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I1a90164b9664eb4d5a553d4e312aed6930cb89a8
Gerrit-PatchSet: 11
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Lcarr <[email protected]>
Gerrit-Reviewer: Ottomata <[email protected]>
Gerrit-Reviewer: Ryan Lane <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
