puppetlabs / puppet-vro-starter_content

vRealize Automation Plug-in Starter Content Pack for vRA 7.4 and Puppet plug-in for vRealize 3.2

Introduction

This repository provides "batteries-included" starter Puppet content for the Puppet plug-in for vRealize Automation 3.2. It shows you how Puppet code is organized to make self-service provisioning easy and can create 5 different machine types out of the box:

• Linux base server
• Linux MySQL server
• Linux web server
• Windows base server
• Windows web server

With vRA 7.3 & 7.4 and the Puppet plug-in for vRealize Automation 3.x, building Puppet Enterprise blueprints is easier than ever with PE components now built directly into the vRA Enterprise GUI. While creating blueprints, you simply drag and drop the Puppet component onto the blueprint and fill in a couple of text boxes. No need to jump back and forth from vRA to vRO to get set up. Even better, Puppet role classes are now read dynamically from your Puppet Server, so you need only pick from the list instead of typing classes out manually.

Getting started

Here's your high-level plan to get started with vRA 7.3 & 7.4 Enterprise to take advantage of the new GUI Puppet components:

• Create a Puppet Enterprise master and follow the instructions at the bottom of this page to install the starter content.
• Remove any previous Puppet plug-ins and install the Puppet plug-in for vRealize Automation 3.1 into vRO.
• Follow the vRA 7.3 docs to add a Puppet endpoint (points to your master), and create your Puppet Enterprise blueprints using code from this repo that is now on your PE master.
  • Puppet endpoint - username: vro-plugin-user
  • Puppet endpoint - password: puppetlabs
  • Puppet endpoint - use sudo: true
  • Puppet component on blueprints - shared secret (cert autosigning): S3cr3tP@ssw0rd!

Note: if you are using vRealize 6.x or 7.0 through 7.2, then use the "iaas_eventbroker" branch of this repo.

vRA 7.3 Puppet docs:

• Create a Puppet Endpoint
• Creating Puppet Enabled vSphere Blueprints
• Add a Puppet Component to a vSphere Blueprint
• vRealize Automation 7.3 Release Notes

Please see the Puppet plug-in for vRealize documentation for more detailed information.

Install Starter Content on your PE Master

Installation with git

git clone https://github.com/puppetlabs/puppet-vro-starter_content.git
cd puppet-vro-starter_content
sudo bash scripts/vra_nc_setup.sh
sudo /opt/puppetlabs/bin/puppet agent -t

Installation with curl

curl -sSL https://github.com/puppetlabs/puppet-vro-starter_content/archive/production.tar.gz | tar -zx
cd puppet-vro-starter_content-production
sudo bash scripts/vra_nc_setup.sh
sudo /opt/puppetlabs/bin/puppet agent -t

Special thanks for creation and testing of this starter content go to Abir Majumdar, Tommy Speigner, Erik Dasher, Kai Pak, Tyler Pace, Garrett Guillotte, Colin Brock, Justin May, Bryan Jen, Lindsey Smith, Jeremy Adams and the whole Puppet TSE team.

puppet-vro-starter_content's Issues

Ubuntu 18.04 and Puppet Enterprise 2019.1.1 Issues

Describe the Bug

Error:

Info: Retrieving locales
Info: Loading facts
Info: Caching catalog for puppet.home.lab
Info: Applying configuration version '1565636919'
Error: Could not prefetch rbac_role provider 'ruby': SSL_connect returned=1 errno=0 state=error: sslv3 alert handshake failure
Error: Failed to apply catalog: SSL_connect returned=1 errno=0 state=error: sslv3 alert handshake failure

Expected Behavior

Notice: Applied catalog in 25.74 seconds

Steps to Reproduce

Steps to reproduce the behavior:

wget -O - https://downloads.puppetlabs.com/puppet-gpg-signing-key.pub | gpg --import
curl -JLO https://pm.puppet.com/cgi-bin/download.cgi?dist=ubuntu&rel=18.04&arch=amd64&ver=latest
tar -xzvf puppet-enterprise-2019.1.1-ubuntu-18.04-amd64.tar.gz
cd puppet-enterprise-2019.1.1-ubuntu-18.04-amd64/
sudo ./puppet-enterprise-installer

Option 1

Follow the link to set the password

sudo puppet agent -t
sudo puppet agent -t
sudo apt-get install python
git clone https://github.com/puppetlabs/puppet-vro-starter_content.git
cd puppet-vro-starter_content
sudo bash scripts/vra_nc_setup.sh
sudo puppet agent -t

Environment

• Version Puppet 6.4.3 or Puppet Enterprise 2019.1.1
• Platform Ubuntu 18.04

Additional Context

This is a fresh install

Module with Docs instead of Control Repo

Our plugin referencing a control-repo full of forked modules is an anti-pattern to what we teach puppet users. Users could potentially adopt this control repo or parts of it, and end up paying across the rest of their infrastructure in technical debt.

Can we work on transitioning this into a module that sets our master to be compatible with the Plugin (manages sudoers, autosign, etc), and documentation on linking a vRO implementation with a master that has the module included?

Links to vra documentations are wrong

The links to the vmware documentation in the README.md are wrong. Probably vmware rearranged their documentation, so they're pointing not to the content they should.

vRO plugin - vRA 7.4 - properties issues

Hi there, this may or may not be the right place for this, so i apologize if it's not. Have deployed the Puppet plugin for vRO/vRA, in a new environment, and for the most part it's working. Quick note, I'm using vRA 7.4 and the latest vRO version as well. I'm also using PE version 2017.3.5.

The plug-in itself appears to be working fine, however the data look ups don't seem to be working properly. Specifically, when creating a new blueprint for a traditional linux VM, the Puppet module works fine until i'm trying to select the Puppet role. Specifically, selecting the puppet master and environment appears to work just fine, it dynamically populates the environments, but when i go to select the role, the roles do not appear.

I've ensured that the vro plugin user should have appropriate permissions, even assigning that user to the administrator role to test. Any thoughts? I'm finding absolutely no errors or events in vRO that help me troubleshoot the puppet code in vRO. Also don't see any errors on the Puppet side either.

In this case I am trying to use the starter role that was created, role::linux_webserver

Problem using vro-plugin-user with sudo. Cannot display environment/role list.

I'm not sure if it's a problem of my puppet enterprise installation or it's general but the /etc/puppetlabs/code directory in my installation have those permissions:
drwxr-x--- 3 pe-puppet pe-puppet 4096 Jun 5 10:08 code
vro/vra plugin is trying to do a ls /etc/puppetlabs/code/environment and it fail with this error on the orchestrator:

2017-06-05 14:20:34.075+0200 [http-nio-127.0.0.1-8280-exec-8] ERROR {} [BaseController] Error invoking REST [unknown]
ch.dunes.util.DunesServerException: Action 'getEnvironments' in module 'com.puppet.o11n.plugin.puppet' failed : Failed to get list of environments from master. exitCode=2 error=ls: cannot access /etc/puppetlabs/code/environments/: Permission denied
 (unnamed script#31)
	at com.vmware.o11n.service.impl.ScriptModuleRuntimeServiceImpl.executeServerAction(ScriptModuleRuntimeServiceImpl.java:58)
	at com.vmware.o11n.service.impl.ScriptModuleRuntimeServiceImpl.executeServerActionPriviliged(ScriptModuleRuntimeServiceImpl.java:94)
	at sun.reflect.GeneratedMethodAccessor722.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:207)
	at com.sun.proxy.$Proxy315.executeServerActionPriviliged(Unknown Source)
	at com.vmware.o11n.service.factory.VcoFactoryFacade.executeServerActionPriviliged(VcoFactoryFacade.java:2491)
	at sun.reflect.GeneratedMethodAccessor714.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at com.vmware.o11n.service.security.AccessRightsInterceptor.invoke(AccessRightsInterceptor.java:98)
	at com.vmware.o11n.service.security.AccessRightsInterceptor.invoke(AccessRightsInterceptor.java:89)
	at com.vmware.o11n.service.factory.LocalVSOFactoryInvocationHandler.invokeOperation(LocalVSOFactoryInvocationHandler.java:199)
	at com.vmware.o11n.service.factory.LocalVSOFactoryInvocationHandler.doInvoke(LocalVSOFactoryInvocationHandler.java:255)
	at com.vmware.o11n.service.factory.LocalVSOFactoryInvocationHandler.invoke(LocalVSOFactoryInvocationHandler.java:128)
	at com.sun.proxy.$Proxy361.executeServerActionPriviliged(Unknown Source)
	at ch.dunes.model.client.VSOFactoryClient.executeServerActionPriviliged(VSOFactoryClient.java:2829)
	at com.vmware.o11n.web.action.ActionController.doExecuteAction(ActionController.java:478)
	at com.vmware.o11n.web.action.ActionController.executeActionByName(ActionController.java:404)
	at sun.reflect.GeneratedMethodAccessor713.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:116)
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963)
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897)
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at com.vmware.o11n.web.Slf4jRequestLoggingFilter.doFilterInternal(Slf4jRequestLoggingFilter.java:50)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at com.vmware.o11n.web.SlashAppendingFilter.doFilterInternal(SlashAppendingFilter.java:25)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at com.vmware.o11n.json.DefaultJsonVersionHeaderFilter.doFilter(DefaultJsonVersionHeaderFilter.java:95)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at com.vmware.o11n.web.cluster.RestActiveNodeFilter.doFilter(RestActiveNodeFilter.java:63)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317)
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at com.vmware.o11n.web.auth.http.TokenAuthenticationFilter.doFilter(TokenAuthenticationFilter.java:97)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:157)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:595)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
	at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:677)
	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.lang.Thread.run(Thread.java:748)

The user is created by default without any group (so it get only a default group equal to username).
I've added the vro-plugin-user to pe-puppet group and it works (or it should run the various ls command with sudo too and sudo needs to be configured).

implement ssh settings for master