Skip to content

Commit 9deb625

Browse files
reidmvreidmv
authored
Merge pull request #56 from puppetlabs/upgrade
Modernize Upgrade Plan
2 parents ab9ce56 + c2212f0 commit 9deb625

File tree

4 files changed

+152
-108
lines changed

4 files changed

+152
-108
lines changed

‎plans/upgrade.pp‎

Lines changed: 108 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
11
# @summary Upgrade an Extra Large stack from one .z to the next
22
#
33
plan peadm::upgrade (
4-
String[1] $master_host,
5-
String[1] $puppetdb_database_host,
6-
Optional[String[1]] $master_replica_host = undef,
7-
Optional[String[1]] $puppetdb_database_replica_host = undef,
4+
# Standard
5+
Peadm::SingleTargetSpec $master_host,
6+
Optional[Peadm::SingleTargetSpec] $master_replica_host = undef,
87

9-
String[1] $version,
8+
# Large
9+
Optional[TargetSpec] $compiler_hosts = undef,
10+
11+
# Extra Large
12+
Optional[Peadm::SingleTargetSpec] $puppetdb_database_host = undef,
13+
Optional[Peadm::SingleTargetSpec] $puppetdb_database_replica_host = undef,
14+
15+
String $version,
1016

1117
# This parameter exists to enable the use case of running peadm::upgrade over
1218
# the PCP transport. An orchestrator restart happens during provision
@@ -16,153 +22,147 @@
1622
Boolean $executing_on_master = false,
1723

1824
String[1] $stagingdir = '/tmp',
19-
String[1] $pe_source = "https://s3.amazonaws.com/pe-builds/released/${version}/puppet-enterprise-${version}-el-7-x86_64.tar.gz",
2025
) {
26+
# Ensure input valid for a supported architecture
27+
$arch = peadm::validate_architecture(
28+
$master_host,
29+
$master_replica_host,
30+
$puppetdb_database_host,
31+
$puppetdb_database_replica_host,
32+
$compiler_hosts,
33+
)
2134

22-
# Allow for the upgrade task to be run local to the master.
23-
$master_target = $executing_on_master ? {
24-
true => "local://${master_host}",
25-
false => $master_host,
26-
}
35+
# Convert inputs into targets.
36+
$master_target = peadm::get_targets($master_host, 1)
37+
$master_replica_target = peadm::get_targets($master_replica_host, 1)
38+
$puppetdb_database_target = peadm::get_targets($puppetdb_database_host, 1)
39+
$puppetdb_database_replica_target = peadm::get_targets($puppetdb_database_replica_host, 1)
40+
$compiler_targets = peadm::get_targets($compiler_hosts)
2741

28-
$ha_replica_target = [
29-
$master_replica_host,
30-
].peadm::flatten_compact()
42+
$all_targets = peadm::flatten_compact([
43+
$master_target,
44+
$puppetdb_database_target,
45+
$master_replica_target,
46+
$puppetdb_database_replica_target,
47+
$compiler_targets,
48+
])
3149

32-
$ha_database_target = [
33-
$puppetdb_database_replica_host,
34-
].peadm::flatten_compact()
35-
36-
# Look up which hosts are compilers in the stack
37-
# We look up groups of CMs separately since when they are upgraded is determined
38-
# by which PDB PG host they are affiliated with
39-
$compiler_cluster_master_hosts = puppetdb_query(@("PQL")).map |$node| { $node['certname'] }
40-
resources[certname] {
41-
type = "Class" and
42-
title = "Puppet_enterprise::Profile::Puppetdb" and
43-
parameters.database_host = "${puppetdb_database_host}" and
44-
!(certname = "${master_host}") }
45-
| PQL
46-
47-
$compiler_cluster_master_replica_hosts = puppetdb_query(@("PQL")).map |$node| { $node['certname'] }
48-
resources[certname] {
49-
type = "Class" and
50-
title = "Puppet_enterprise::Profile::Puppetdb" and
51-
parameters.database_host = "${puppetdb_database_replica_host}" and
52-
!(certname = "${master_replica_host}") }
53-
| PQL
54-
55-
$all_hosts = [
50+
$pe_installer_targets = peadm::flatten_compact([
5651
$master_target,
57-
$puppetdb_database_host,
58-
$master_replica_host,
59-
$puppetdb_database_replica_host,
60-
$compiler_cluster_master_hosts,
61-
$compiler_cluster_master_replica_hosts,
62-
].peadm::flatten_compact()
52+
$puppetdb_database_target,
53+
$puppetdb_database_replica_target,
54+
])
6355

64-
# We need to make sure we aren't using PCP as this will go down during the upgrade
65-
$all_hosts.peadm::fail_on_transport('pcp')
56+
# Gather trusted facts from all systems
57+
$trusted_facts = run_task('peadm::trusted_facts', $all_targets).reduce({}) |$memo,$result| {
58+
$memo + { $result.target => $result['extensions'] }
59+
}
6660

67-
# TODO: Do we need to update the pe.conf(s) with a console password?
61+
# Determine which compilers are associated with which HA group
62+
$compiler_m1_targets = $compiler_targets.filter |$target| {
63+
$trusted_facts[$target]['pp_cluster'] == $trusted_facts[$master_target[0]]['pp_cluster']
64+
}
6865

69-
# Download the PE tarball on the nodes that need it
70-
$upload_tarball_path = "/tmp/puppet-enterprise-${version}-el-7-x86_64.tar.gz"
66+
$compiler_m2_targets = $compiler_targets.filter |$target| {
67+
$trusted_facts[$target]['pp_cluster'] == $trusted_facts[$master_replica_target[0]]['pp_cluster']
68+
}
7169

72-
$download_hosts = [
73-
$master_target,
74-
$puppetdb_database_host,
75-
$puppetdb_database_replica_host,
76-
].peadm::flatten_compact()
70+
###########################################################################
71+
# PREPARATION
72+
###########################################################################
73+
74+
# Support for running over the orchestrator transport is still TODO. For now,
75+
#fail the plan if the orchestrator is being used.
76+
$all_targets.peadm::fail_on_transport('pcp')
7777

78-
run_task('peadm::download', $download_hosts,
79-
source => $pe_source,
80-
path => $upload_tarball_path,
78+
# Download the PE tarball on the nodes that need it
79+
$platform = run_task('peadm::precheck', $master_target).first['platform']
80+
$tarball_filename = "puppet-enterprise-${version}-${platform}.tar.gz"
81+
$upload_tarball_path = "/tmp/${tarball_filename}"
82+
83+
run_plan('peadm::util::retrieve_and_upload', $pe_installer_targets,
84+
source => "https://s3.amazonaws.com/pe-builds/released/${version}/${tarball_filename}",
85+
local_path => "${stagingdir}/${tarball_filename}",
86+
upload_path => $upload_tarball_path,
8187
)
8288

83-
# Shut down Puppet on all infra hosts
84-
run_task('service', $all_hosts,
89+
# Shut down Puppet on all infra targets
90+
run_task('service', $all_targets,
8591
action => 'stop',
8692
name => 'puppet',
8793
)
8894

95+
###########################################################################
96+
# UPGRADE MASTER SIDE
97+
###########################################################################
98+
8999
# Shut down PuppetDB on CMs that use the PM's PDB PG
90-
run_task('service', $compiler_cluster_master_hosts,
100+
run_task('service', peadm::flatten_compact([
101+
$master_target,
102+
$compiler_m1_targets,
103+
]),
91104
action => 'stop',
92105
name => 'pe-puppetdb',
93106
)
94107

95-
# Shut down pe-* services on the master. Only shutting down the ones
96-
# that have failover pairs on the master replica.
97-
['pe-console-services', 'pe-nginx', 'pe-puppetserver', 'pe-puppetdb', 'pe-postgresql'].each |$service| {
98-
run_task('service', $master_target,
99-
action => 'stop',
100-
name => $service,
101-
)
102-
}
103-
104-
# TODO: Firewall up the master
105-
106-
run_task('peadm::pe_install', $master_target,
108+
run_task('peadm::pe_install', $puppetdb_database_target,
107109
tarball => $upload_tarball_path,
108110
)
109111

110-
# Upgrade the master PuppetDB PostgreSQL host. Note that installer-driven
111-
# upgrade will de-configure auth access for compilers. Re-run Puppet
112-
# immediately to fully re-enable
113-
run_task('peadm::pe_install', $puppetdb_database_host,
112+
run_task('peadm::pe_install', $master_target,
114113
tarball => $upload_tarball_path,
115114
)
116-
run_task('peadm::puppet_runonce', $puppetdb_database_host)
117115

118-
# Stop PuppetDB on the master
119-
run_task('service', $master_target,
120-
action => 'stop',
121-
name => 'pe-puppetdb',
122-
)
116+
# Installer-driven upgrade will de-configure auth access for compilers.
117+
# Re-run Puppet immediately to fully re-enable
118+
run_task('peadm::puppet_runonce', $puppetdb_database_target)
123119

124-
# TODO: Unblock 8081 between the master and the master replica
125-
126-
# Start PuppetDB on the master
127-
run_task('service', $master_target,
128-
action => 'start',
129-
name => 'pe-puppetdb',
130-
)
131-
132-
# TODO: Remove remaining firewall blocks
133120

134121
# Wait until orchestrator service is healthy to proceed
135122
run_task('peadm::orchestrator_healthcheck', $master_target)
136123

137-
# Upgrade the compiler group A hosts
138-
run_task('peadm::agent_upgrade', $compiler_cluster_master_hosts,
139-
server => $master_host,
124+
# Upgrade the compiler group A targets
125+
run_task('peadm::agent_upgrade', $compiler_m1_targets,
126+
server => $master_target.peadm::target_name(),
140127
)
141128

142-
# Shut down PuppetDB on CMs that use the PMR's PDB PG
143-
run_task('service', $compiler_cluster_master_replica_hosts,
129+
###########################################################################
130+
# UPGRADE REPLICA SIDE
131+
###########################################################################
132+
133+
# Shut down PuppetDB on compilers that use the repica's PDB PG
134+
run_task('service', peadm::flatten_compact([
135+
$master_replica_target,
136+
$compiler_m2_targets,
137+
]),
144138
action => 'stop',
145139
name => 'pe-puppetdb',
146140
)
147141

148-
# Run the upgrade.sh script on the master replica host
149-
run_task('peadm::agent_upgrade', $ha_replica_target,
150-
server => $master_host,
142+
run_task('peadm::pe_install', $puppetdb_database_replica_target,
143+
tarball => $upload_tarball_path,
151144
)
152145

153-
# Upgrade the master replica's PuppetDB PostgreSQL host
154-
run_task('peadm::pe_install', $ha_database_target,
155-
tarball => $upload_tarball_path,
146+
# Installer-driven upgrade will de-configure auth access for compilers.
147+
# Re-run Puppet immediately to fully re-enable
148+
run_task('peadm::puppet_runonce', $puppetdb_database_replica_target)
149+
150+
# Run the upgrade.sh script on the master replica target
151+
run_task('peadm::agent_upgrade', $master_replica_target,
152+
server => $master_target.peadm::target_name(),
156153
)
157-
run_task('peadm::puppet_runonce', $ha_database_target)
158154

159-
# Upgrade the compiler group B hosts
160-
run_task('peadm::agent_upgrade', $compiler_cluster_master_replica_hosts,
161-
server => $master_host,
155+
# Upgrade the compiler group B targets
156+
run_task('peadm::agent_upgrade', $compiler_m2_targets,
157+
server => $master_target.peadm::target_name(),
162158
)
163159

164-
# Ensure Puppet running on all infrastructure hosts
165-
run_task('service', $all_hosts,
160+
###########################################################################
161+
# FINALIZE UPGRADE
162+
###########################################################################
163+
164+
# Ensure Puppet running on all infrastructure targets
165+
run_task('service', $all_targets,
166166
action => 'start',
167167
name => 'puppet',
168168
)

‎tasks/agent_upgrade.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
#!/bin/bash
22

3+
export USER=$(id -un)
4+
export HOME=$(getent passwd "$USER" | cut -d : -f 6)
5+
export PATH="/opt/puppetlabs/bin:${PATH}"
6+
37
set -e
48

59
curl -k "https://${PT_server}:8140/packages/current/upgrade.bash" | bash

‎tasks/trusted_facts.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"description": "Return the Puppet agent's trusted facts",
3+
"parameters": { },
4+
"input_method": "stdin",
5+
"implementations": [
6+
{"name": "trusted_facts.rb"}
7+
]
8+
}

‎tasks/trusted_facts.rb‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/opt/puppetlabs/puppet/bin/ruby
2+
3+
require 'openssl'
4+
require 'puppet'
5+
require 'puppet/ssl/oids'
6+
require 'json'
7+
8+
Puppet.initialize_settings
9+
ssldir = Puppet.settings[:ssldir]
10+
certname = Puppet.settings[:certname]
11+
12+
oids = Puppet::SSL::Oids::PUPPET_OIDS.reduce({}) do |memo,oid|
13+
memo.merge(oid[0] => oid[1])
14+
end
15+
16+
raw = File.read("#{ssldir}/certs/#{certname}.pem")
17+
18+
cert = OpenSSL::X509::Certificate.new(raw)
19+
20+
extensions = cert.extensions.reduce({}) do |memo,ext|
21+
case oids[ext.oid]
22+
when nil
23+
memo.merge(ext.oid => ext.value[2..-1])
24+
else
25+
memo.merge(ext.oid => ext.value[2..-1],
26+
oids[ext.oid] => ext.value[2..-1])
27+
end
28+
end
29+
30+
result = {'extensions' => extensions}
31+
32+
puts result.to_json

0 commit comments

Comments
 (0)