Add cloud-config-puppet hook.

3 files changed, 122 insertions, 0 deletions

diff --git a/cloudinit/CloudConfig.py b/cloudinit/CloudConfig.py
index f4a6ef37..fbca1c0e 100644
--- a/cloudinit/CloudConfig.py
+++ b/cloudinit/CloudConfig.py
@@ -19,6 +19,8 @@ import yaml
 import re
 import cloudinit
 import cloudinit.util as util
+import pwd
+import socket
 import subprocess
 import os
 import glob
@@ -40,6 +42,7 @@ class CloudConfig():
         self.add_handler('disable-ec2-metadata',
             self.h_disable_ec2_metadata, "always")
         self.add_handler('config-mounts')
+        self.add_handler('config-puppet')
 
     def get_config_obj(self,cfgfile):
         f=file(cfgfile)
@@ -181,6 +184,62 @@ class CloudConfig():
 
         send_ssh_keys_to_console()
 
+    def h_config_puppet(self,name,args):
+        # Check if there is a puppet key in the configuration
+        if self.cfg.has_key('puppet'):
+            puppet_cfg = self.cfg['puppet']
+            # Start by installing the puppet package ...
+            e=os.environ.copy()
+            e['DEBIAN_FRONTEND']='noninteractive'
+            # Make sure that the apt database is updated since it's not run by
+            # default
+            # Note: we should have a helper to check if apt-get update 
+            # has already been run on this instance to speed the boot time.
+            subprocess.check_call(['apt-get', 'update'], env=e)
+            subprocess.check_call(['apt-get', 'install', '--assume-yes',
+                                   'puppet'], env=e)
+            # ... and then update the puppet configuration
+            if puppet_cfg.has_key('conf'):
+                # Add all sections from the conf object to puppet.conf
+                puppet_conf_fh = open('/etc/puppet/puppet.conf', 'a')
+                for cfg_name, cfg in puppet_cfg['conf'].iteritems():
+                    # ca_cert configuration is a special case
+                    # Dump the puppetmaster ca certificate in the correct place
+                    if cfg_name == 'ca_cert':
+                        # Puppet ssl sub-directory isn't created yet
+                        # Create it with the proper permissions and ownership
+                        os.makedirs('/var/lib/puppet/ssl')
+                        os.chmod('/var/lib/puppet/ssl', 0771)
+                        os.chown('/var/lib/puppet/ssl',
+                                 pwd.getpwnam('puppet').pw_uid, 0)
+                        os.makedirs('/var/lib/puppet/ssl/certs/')
+                        os.chown('/var/lib/puppet/ssl/certs/',
+                                 pwd.getpwnam('puppet').pw_uid, 0)
+                        ca_fh = open('/var/lib/puppet/ssl/certs/ca.pem', 'w')
+                        ca_fh.write(cfg)
+                        ca_fh.close()
+                        os.chown('/var/lib/puppet/ssl/certs/ca.pem',
+                                 pwd.getpwnam('puppet').pw_uid, 0)
+                    else:
+                        puppet_conf_fh.write("\n[%s]\n" % (cfg_name))
+                        for o, v in cfg.iteritems():
+                            if o == 'certname':
+                                # Expand %f as the fqdn
+                                v = v.replace("%f", socket.getfqdn())
+                                # Expand %i as the instance id
+                                v = v.replace("%i",
+                                      self.cloud.datasource.get_instance_id())
+                                # certname needs to be downcase
+                                v = v.lower()
+                            puppet_conf_fh.write("%s=\"%s\"\n" % (o, v))
+                puppet_conf_fh.close()
+            # Set puppet default file to automatically start
+            subprocess.check_call(['sed', '-i',
+                                   '-e', 's/^START=.*/START=yes/',
+                                   '/etc/default/puppet'])
+            # Start puppetd
+            subprocess.check_call(['service', 'puppet', 'start'])
+
     def h_ec2_ebs_mounts(self,name,args):
         print "Warning, not doing anything for config %s" % name
 
diff --git a/doc/examples/cloud-config-puppet.txt b/doc/examples/cloud-config-puppet.txt
new file mode 100644
index 00000000..258418a4
--- /dev/null
+++ b/doc/examples/cloud-config-puppet.txt
@@ -0,0 +1,51 @@
+#cloud-config
+#
+# This is an example file to automatically setup and run puppetd
+# when the instance boots for the first time.
+# Make sure that this file is valid yaml before starting instances.
+# It should be passed as user-data when starting the instance.
+puppet:
+ # Every key present in the conf object will be added to puppet.conf:
+ # [name]
+ # subkey=value
+ #
+ # For example the configuration below will have the following section
+ # added to puppet.conf:
+ # [puppetd]
+ # server=puppetmaster.example.org
+ # certname=i-0123456.ip-X-Y-Z.cloud.internal
+ #
+ # The puppmaster ca certificate will be available in 
+ # /var/lib/puppet/ssl/certs/ca.pem
+ conf:
+   puppetd:
+     server: "puppetmaster.example.org"
+     # certname supports substitutions at runtime:
+     #   %i: instanceid 
+     #       Example: i-0123456
+     #   %f: fqdn of the machine
+     #       Example: ip-X-Y-Z.cloud.internal
+     #
+     # NB: the certname will automatically be lowercased as required by puppet
+     certname: "%i.%f"
+   # ca_cert is a special case. It won't be added to puppet.conf.
+   # It holds the puppetmaster certificate in pem format. 
+   # It should be a multi-line string (using the | yaml notation for 
+   # multi-line strings).
+   # The puppetmaster certificate is located in 
+   # /var/lib/puppet/ssl/ca/ca_crt.pem on the puppetmaster host.
+   #
+   ca_cert: |
+     -----BEGIN CERTIFICATE-----
+     MIICCTCCAXKgAwIBAgIBATANBgkqhkiG9w0BAQUFADANMQswCQYDVQQDDAJjYTAe
+     Fw0xMDAyMTUxNzI5MjFaFw0xNTAyMTQxNzI5MjFaMA0xCzAJBgNVBAMMAmNhMIGf
+     MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCu7Q40sm47/E1Pf+r8AYb/V/FWGPgc
+     b014OmNoX7dgCxTDvps/h8Vw555PdAFsW5+QhsGr31IJNI3kSYprFQcYf7A8tNWu
+     1MASW2CfaEiOEi9F1R3R4Qlz4ix+iNoHiUDTjazw/tZwEdxaQXQVLwgTGRwVa+aA
+     qbutJKi93MILLwIDAQABo3kwdzA4BglghkgBhvhCAQ0EKxYpUHVwcGV0IFJ1Ynkv
+     T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwDwYDVR0TAQH/BAUwAwEB/zAd
+     BgNVHQ4EFgQUu4+jHB+GYE5Vxo+ol1OAhevspjAwCwYDVR0PBAQDAgEGMA0GCSqG
+     SIb3DQEBBQUAA4GBAH/rxlUIjwNb3n7TXJcDJ6MMHUlwjr03BDJXKb34Ulndkpaf
+     +GAlzPXWa7bO908M9I8RnPfvtKnteLbvgTK+h+zX1XCty+S2EQWk29i2AdoqOTxb
+     hppiGMp0tT5Havu4aceCXiy2crVcudj3NFciy8X66SoECemW9UYDCb9T5D0d
+     -----END CERTIFICATE-----
diff --git a/upstart/cloud-config-puppet.conf b/upstart/cloud-config-puppet.conf
new file mode 100644
index 00000000..83786118
--- /dev/null
+++ b/upstart/cloud-config-puppet.conf
@@ -0,0 +1,12 @@
+# Setup puppetd
+
+description "Setup puppetd"
+
+# Make sure puppet is started after repositories have been setup.
+# This can be useful if the puppet package should be pulled from
+# a different repository.
+start on started cloud-apt-update-upgrade
+console output
+task
+
+exec cloud-init-cfg config-puppet