PostgreSQL administration using Puppet. Miguel Di Ciurcio Filho

Transcription

1 PostgreSQL administration using Puppet Miguel Di Ciurcio Filho 1/25

2 What is Puppet? Puppet Architecture Managing PostgreSQL Installation Databases Roles and Grants Configuration Agenda 2/25

3 What is Puppet? Automation platform that defines and enforces the state of your infrastructure. Open Source since 2005 Used by projects and organizations like Debian, Wikipedia, Google, Mozilla, PayPal, GitHub, LHC and many others Frees SysAdmins from writing one off, fragile scripts and other manual tasks. Ensures consistency across your infrastructure. Puppet uses a declarative language for modeling your configuration, meaning you tell Puppet what results you want, rather than how to get there. 3/25

4 Declarative Modeling Language Model the desired state, Puppet figure out how to enforce it. Imperative Shell Code Comparison if [ 0 -ne $(getent passwd elmo > /dev/null)$? ] then useradd elmo --gid sysadmin -n fi Declarative Puppet C user { 'elmo': ensure => presen gid => 'sysadm } GID=`getent passwd elmo awk -F: '{print $4}'` GROUP=`getent group $GID awk -F: '{print $1}'` if [ "$GROUP"!= "$GID" ] && [ "$GROUP"!= "sysadmin" ] then usermod --gid $GROUP $USER fi if [ "`getent group sysadmin awk -F: '{print $1}'`" == "" ] then groupadd sysadmin fi group { 'sysadmin': ensure => presen } 4/25

5 How Puppet Works 5/25

6 Data Flow How Puppet manages data flow from Individual Nodes 6/25

7 Puppet enforces resources in an idempotent way. Idempotency It is our job as developers to teach Puppet how to do this for resource types we develop so that our users don't have to. # First Puppet Run notice: /Group[sysadmin]/ensure: created notice: /User[elmo]/ensure: created notice: Finished catalog run in 0.08 seconds # Second Puppet Run notice: Finished catalog run in 0.03 seconds Idempotence: The property of certain operations in mathematics or computer science in that they can be applied multiple times without further changing the result beyond the initial application. Notes: Idempotent able to be applied multiple times with the same outcome. Puppet resources are idempotent, since they describe a desired final state rather than a series of steps to follow. Source: Puppet Docs 7/25

8 Describe the desired state. Let Puppet maintain it. State Model 8/25

9 Puppet Resources Resources are building blocks. They can be combined to make larger components. Together they can model the expected state of your system. 9/25

10 Puppet Demo 10/25

11 Demo summary Modules: directories that contain your configuration. Encapsulates all of the components related to a given configuration in a single directory hierarchy that enables the following: Auto loading of classes File serving for templates and files Easy sharing with others Facts: key/value pairs generated by facterabout a given node. Classes: collection of resources that are managed together as a single unit. 11/25

12 Why use Puppet to manage a relational database? Avoid clumsy scripts. Guarantee consistency of configuration over time. Better visibility of current state. Easy integration with any source control management tool. 12/25

13 The puppetlabs/postgresql module Manages packages and services on several operating systems (server and client). Red Hat, Ubuntu, Debian, Scientific, CentOS, OracleLinux, SUSE Enterprise (!). Supports basic management of databases, users and permissions. Manages the firewall on some distros. postgresql 13/25

14 puppetlabs/postgresql classes and resources postgresql::server postgresql::server::db postgresql::server::pg_hba_rule postgresql::server::role postgresql::server::database_grant postgresql::server::table_grant postgresql::server::config_entry 14/25

15 The class postgresql::server class { 'postgresql::server': manage_firewall => true, postgres_password => 'TPSrep0rt!', } Manages the installation and configuration of the server. Supports various parameters. Installs packages and enforces a restrictive configuration by default. Runs initdbif necessary. 15/25

16 The resource postgresql::server::db postgresql::server::db {'test1': user => 'test1', password => postgresql_password('test1', 'changeme!'), } Convenient resource to create databases. Creates an user and assign the necessary permissions in one go. 16/25

17 The resource postgresql::server::pg_hba_rule postgresql::server::pg_hba_rule { 'allowapptoaccessdatabase': type => 'host', database => 'app', user => 'app', address => ' /24', auth_method => 'md5', } Allows you to create an access rule for pg_hba.conf. 17/25

18 The resource postgresql::server::role postgresql::server::role { 'dba': superuser => true, password_hash => postgresql_password('dba', 'dba'), } Creates roles in PostgreSQL. Suports various parameters like: createdb, createrole, replicationand others. 18/25

19 The resource postgresql::server:: database_grant postgresql::server::database_grant { 'marmot_elvis': privilege => 'ALL', db => 'db01', role => 'elvis', } Manages grant based access privileges for databases. 19/25

20 The resource postgresql::server::table_grant postgresql::server::table_grant { 'table1ofdb01': privilege => 'ALL', table => 'table1', db => 'db01', role => 'elvis', } Manages grant based access privileges for tables. 20/25

21 The resource postgresql::server::config_entry postgresql::server::config_entry { 'check_function_bodies': value => 'off', } postgresql::server::config_entry { 'work_mem': value => '10MB', } Can be used to modify the postgresql.confconfiguration file. 21/25

22 Puppet + PostgreSQL Demo 22/25

23 About Puppet Labs Developer of IT automation software for system administrators 3,000+ Community members 50,000+ Nodes managed in the largest deployments Support for Red Hat, CentOS, Ubuntu, Debian, SUSE, Solaris, AIX, Mac OS X, Windows, etc. 23/25

24 Infraestructure administration and operation. Authorized Puppet Labs Partner since 2012 Puppet Open Source and Enterprise consulting. Offers all official training courses in Brazil: Puppet Fundamentals Puppet Practitioner Puppet Architect About Instruct 24/25

25 Next Steps & Questions Brazillian Community: br.org Instruct: Puppet training in Brazil Learn more! Download Puppet Enterprise manage 10 nodes for free puppet enterprise Learning Puppet Tutorials Download the Learning Puppet VM learning puppet VM.html Puppet Docs /25