798576 - Install puppet and set up the equivalent of puppetize.sh in MDT

Status: RESOLVED WONTFIX

(Infrastructure & Operations :: RelOps: Puppet, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

This means implementing https://wiki.mozilla.org/ReleaseEngineering/PuppetAgain/Puppetization_Process in windows-land.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

misfire

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

I need dustin-test in the winbuild network to work on this.  That's becoming a bit of a challenge with DHCP and flows.  I'm back on this now.

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

From admin1b.private.releng.scl3:

Nov 16 13:31:43 admin1b dhcpd: DHCPDISCOVER from 00:50:56:bb:47:dd via 10.26.36.1: unknown network segment

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Per bug 891991, this script will also need to set the env vars FACTER_hostname and FACTER_domain to e.g., 't-w732-ix-003' and 'wintest.releng.scl3.mozilla.com', respectively.  Note that domain is *not* 'releng.ad.mozilla.com'!

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

Adding one more wrinkle, the cert files should be installed under
  C:/ProgramData/PuppetLabs/puppet/var/lib/puppet/ssl
not
  C:/ProgramData/PuppetLabs/puppet/etc/ssl

and the first run of puppet will need to include --ssldir=C:/ProgramData/PuppetLabs/puppet/var/lib/puppet/ssl

(we have to do this on OS X, as well, which is why you see --ssldir specified in puppetize.sh)

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

A little more detail: the initial install should put the following in %PROGRAMDATA%\PuppetLabs\puppet\etc\puppet.conf:

----
[main]
    logdir = $vardir/log/puppet
    rundir = $vardir/run/puppet
    ssldir = $vardir/lib/puppet/ssl
    diff = echo
    diff_args = DIFFS DISABLED - https://bugzilla.mozilla.org/show_bug.cgi?id=791102

[agent]
    classfile = $vardir/classes.txt
    localconfig = $vardir/localconfig
    certificate_revocation = false
    pluginsync = true
    plugindest = $vardir/lib/puppet/lib
----

This file will be managed by puppet after the first run, but this is required to kickstart the process, since the default paths puppet uses are all kinds of jacked up.

You'll still need to install the certs to `C:/ProgramData/PuppetLabs/puppet/var/lib/puppet/ssl`.

Comment 7

[Mark Cornmesser [:markco]]

Added the new puppet.conf file to be replaced once in the Puppet_testers_x86 gpo. 
The source file is located at: 
\\releng\SYSVOL\releng.ad.mozilla.com\files\Puppet\files\

The certs file location will need to be addressed in the puppetize.vbs or puppetize.rb.

Comment 8

[Mark Cornmesser [:markco]]

The Windows 7 x86 Tester production install task sequence is now includes a gpupdate, so that Puppet and the initial files, included our custom puppet.conf, will be present upon imaging for machines with in any OU that is linked to the puppet gpo. 

Most likely the puppetize.vbs will be ran during the same task sequence. However, if we do go with the .rb, we may need to add Ruby support with in the task sequence or run it at a later time.

Comment 9

[Dustin J. Mitchell [:dustin] (he/him)]

Puppet includes a full ruby environment, so if puppet is installed, so is ruby (it's under C:\Program Files\Puppet Labs\puppet\bin).  The advantage of puppetize.rb is that we can use the same script on Linux and Windows, rather than maintaining two scripts in different languages in parallel.

Comment 10

[Amy Rich [:arr] [:arich]]

We will not be using puppet on slaves under the new imaging and management system.