SIMP 6.4+: The ISO installation/Puppetfile workflow

Table of Contents

Background

This article describes the workflow specific to installing a fresh SIMP 6.4.0+ server from an ISO.  It builds on the decision log SIMP 6.4.0: What r10k-friendly RPM features should it include?.

Drivers:

• SIMP 6.4.0 will begin to treat the r10k/Code Manager workflow as a first-class citizen.

• Puppet modules are distributed as RPMs, signed by a known GPG key as part of SIMP's implementation of NIST 800.53, CM-7(5).

• Modern Puppet module management practices use git and r10k, a model that does not fit well with RPM-distribution.

Other considerations:

• Installation by ISO is intended to be an easy way to get started, and ensure that all files are present (including Puppet modules).

• SIMP supports installations in offline/network-isolated enclaves.

Relevant data

What the word "Environment" means

The term "environment" is heavily overloaded with respect to SIMP, Puppet, DevOps, and IT in general. 

This decision log uses the SIMP-specific terminology defined in the design article, SIMP Environments.

Proposed workflow

High-level workflow

For reference, the process has been broken down into stages A, B, and C:

A: (Admin) installs SIMP from ISO

(Admin) installs SIMP from ISO, ala the SIMP docs procedure, "ISO Installation (preferred)." 

• (A1) The OS and RPMs are installed according to the ISO's auto.cfg.

• (A2) The post-installation of each Puppet module RPM will create an associated local bare git repository, with a tagged commit for the module's current version. 

  • This is option 1 of SIMP 6.4.0: What r10k-friendly RPM features should it include?)

• (A3) The rest of the SIMP ISO installation proceeds normally.

Key 6.4.0+ differences:

• At the end of the ISO installation:

  • All puppet modules have a local bare git repo, with a tagged commit

  • There is no simp Puppet environment yet, /etc/puppetlabs/code/environments/simp

  • There is no  /var/simp/environments/simp yet

B: Admin runs simp config

Open

(Admin) logs into the newly-installed SIMP host and runs simp config.

• At an early stage (before applying with the standard action items from the questionnaire):

  • (B1) Logic determines if it needs to create the first Puppet environment directory and auto-deploy the SIMP Puppet Modules

    • This will always be "yes" after a fresh ISO install

  • (B2) (If yes:) Auto-deploy the first Puppet environment + modules

    • Details are in the "auto-deploy" section.

Key 6.4.0+ differences:

All stage B logic is new to simp config, and it replaces RPM logic in SIMP ≤ 6.3.  Specifically, it replaces the old logic between simp-environment and simp-adapter that effectively accomplished the "auto-deploy" in SIMP ≤ 6.3, but in an opinionated manner that can conflict with r10k administration. The old logic:

1. created the simp/ Puppet environment directory, and

2. auto-deployed each RPM-installed Puppet module's files into the simp Puppet environment using rsync.

By contrast, the new logic will:

1. ensure that a production environment exists under the Puppet (/etc/puppetlabs) and Secondary (/var/simp/...) environment directories, while running simp config.

   1. Note that this is now the production/ environment—with r10k workflows, it doesn't make sense to create a simp/ symlinked to production/

2. create an initial Puppetfile and Puppetfile.simp in the production Puppet environment directory

3. deploy the new Puppetfile using r10k puppetfile install 

A significant difference is that the simp config "auto-deploy" only runs once in the lifetime of the the SIMP server, whereas the SIMP ≤ 6.3 the auto-deploy executed during the %post or %posttrans  of each Puppet Module and simp-environment RPM, including upgrades.

• The initial Puppet environment in SIMP ≤ 6.3 was created upon the installation of the simp-environment RPM.

  • There is only one circumstance when SIMP 6.4+ will auto-generate a Puppet environment, and that is when simp config is run on a Puppet server without any deployed Puppet environments.

  • In practice, this means that  all later environments must be created by the administrator—never automatically.
    
    

• The Puppet module auto-deploy logic in SIMP ≤ 6.3 executed immediately upon the installation of every RPM, which happened during and after the initial SIMP ISO installation.

  • There is only one circumstance when SIMP 6.4+  will auto-deploy Puppet modules, and that is when simp config is run on a Puppet server without any deployed Puppet modules.

  • In practice, this means that all later deployments must be initiated by the administrator—never automatically.
    
    

C: Remainder of SIMP installation process

Open

After deploying the initial Puppet environment, the rest of the SIMP installation continues without any specific alterations to support the Puppetfile-based workflow.  This includes the remainder of simp config (C1), (admin-initiated) simp bootstrap, (admin-initiated) reboot, and the post-boot Puppet agent run.