forked from linux/documentation
how to add a new sysdb env
This commit is contained in:
buchel_k committed
1 parent
b7fc3d809c
commit
5a8d65a46a
1 file changed
+39
-39
@@ -4,21 +4,13 @@
|
||||
|
||||
Deploying a new environment requires the following:
|
||||
1. Configuring the environment in **bob**
|
||||
2. Configuring the environment in GIT (`https://git.psi.ch/linux-infra/hiera`)
|
||||
- Environment format: `data-<environment_name>`
|
||||
- And change permissions accordingly
|
||||
- Configure the necessary webhooks for the Puppet and Sysdb server
|
||||
2. Configuring the environment `data-<environment_name>` in GIT (https://gitea.psi.ch/puppet)
|
||||
3. Configuring the environment in Puppet (e.g. `puppet01.psi.ch`)
|
||||
|
||||
## Configuring the environment in sysdb
|
||||
|
||||
Bob allows to create a new environment in `sysdb` by using the `bob env` option.
|
||||
You must have permissions to do that.
|
||||
|
||||
|
||||
You must belong to the `sysdb-admins` group that is actually
|
||||
configured on the local `/etc/group` file. A migration to Active
|
||||
Directory should be done for that group.
|
||||
Only members of the `unx-lx_eng` group have permissions to do so.
|
||||
|
||||
To list current defined environments run
|
||||
|
||||
@@ -48,56 +40,64 @@ An example
|
||||
|
||||
You must belong to the `unx-puppet_adm` Active Directory group in order to be able to create new projects.
|
||||
|
||||
In order to create a new environment in **GIT**, you should access and login in the following link: https://git.psi.ch/linux-infra/hiera/.
|
||||
In order to create a new environment in **GIT**, you should access and login in the following link: https://gitea.psi.ch/puppet/.
|
||||
Here you can see the different environments.
|
||||
|
||||
The steps to create and configure a new **GIT** project are:
|
||||
|
||||
1. Create a new project (environment) in the `hiera` group. It can be done here: https://git.psi.ch/projects/new?namespace_id=1738
|
||||
1. Create a new repository (environment). It can be done here: https://gitea.psi.ch/repo/create?org=6
|
||||
|
||||
- Click `[Create blank project]`
|
||||
- Define `[Project name]`, which *must* have the format `data-<environment_name>` where `<environment_name>` is the one defined in **Bob**
|
||||
- Specify `[Visibility Level]`: Should be `Internal` or `Private`
|
||||
- Remove the tick `[Initialize repository with a README]`.
|
||||
- Define `Repository name`, which *must* have the format `data-<environment_name>` where `<environment_name>` is the one defined in **Bob**
|
||||
- `Visibility`: set checkbox `Make repository private`
|
||||
- `Default Branch`: set it to `master`
|
||||
|
||||
2. Configure project permissions as follows:
|
||||
|
||||
- `[data-<environment_name]->[Settings]->[Repository]`, or directly: https://git.psi.ch/linux-infra/hiera/data-(environment_name)/-/settings/repository
|
||||
- Enable already registered deploy key: `[Deploy Keys]` -> `[Privately accessible deploy keys]` -> select `root@puppet01'` -> click on `'Enable'`
|
||||
- `[data-<environment_name]->[Manage]->[Members]`, or directly: https://git.psi.ch/linux-infra/hiera/data-(environment_name)/project_members
|
||||
- Setup specific permissions for specific users or groups. In example:
|
||||
- Set project `Maintainer`:
|
||||
- `[Select members to invite]` (`caubet_m`) + `[Choose a role permission]` (`Maintainer`) + `[Add to project]`
|
||||
- Set other roles:
|
||||
- `[Select members to invite]` (`dorigo_a`) + `[Choose a role permission]` (`Developer`) + `[Add to project]`
|
||||
- `[data-<environment_name]->[Settings]->[Webhooks]`, or directly: https://git.psi.ch/linux-infra/hiera/data-(environment_name)/-/hooks
|
||||
- Add WebHooks as follows:
|
||||
- `[URL]`: http://puppet01.psi.ch/events/dataupdate
|
||||
- `[URL]`: http://sysdb.psi.ch/events/dataupdate
|
||||
- (Checked) `[Push events]`. Uncheck the rest.
|
||||
- `[SSL verification]` -> (uncheck) `[Enable SSL verification]`
|
||||
- Confirm information from above, and click on `[Add webhook]` to add the new WebHook.
|
||||
- `data-<environment_name` -> `Settings` -> `Collaborators`, or directly: https://gitea.psi.ch/puppet/data-(environment_name)/settings/collaboration
|
||||
- if the team does not yet exists, map it from the AD group as documented in chapter "Mapping AD Groups to Teams" in our [Gitea Production Documentation](gitea-dmz)
|
||||
- Enable already registered deploy key: `Settings` -> `Deploy Keys` -> `Add Deploy Key` with
|
||||
- `Title`: `plidata`
|
||||
- `Content`: `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTmrqGEcE+Uv88WvnROZ7hcsFeZhAClV3nV66Mq+GVc0COEICFcVYcc73BvqHN6Vgii9yE2ZIKR7fqw2Hf0JIVoBzatzxTJJwXWYKsj8Z9gJbMKy8Axgz6alorLAybRz5DZAjND46/vh8/6E0c1YOytd5d30t92d7Wa4YO6dJqrdRaXK/Li54gdDjnHgbP0McafsnuxcBI4utPD/30+o9V6RcBG7qPdHYEviX3JGYOHsbRWs36VhpOjnxpqVouNECXYTaPtAMMWlgE/bm9mLflVH3UIDn6Ufv2bxcMKd4rJwDzjWqcb047iYhfIiB6ciCrJJ4hYnywVaFnNiA0iNcf/SvQjpkZjgejGhz72IJk4A2j+nb2RIL75NxXHgOZRlQ+JO/D53Keb9jINY4NWDRm85MP2gtuy7xNxoSPylhM0JaDtkUI0uUGshACMS9yMtKPxhQUPJmxIMbm2gKSkrBPIdlHg42O81mbFYR9B/XSW8GjsKZBAaCtQMlh0Zxr5Hc=`
|
||||
- for the runner configuration check out the new Hiera data repo and add `.gitea/workflows/hiera_update.yaml` from [another one](https://gitea.psi.ch/puppet/data-lx/raw/branch/master/.gitea/workflows/hiera_update.yaml).
|
||||
|
||||
|
||||
### Test new environment in GIT
|
||||
|
||||
In order to test that environment was successfully created
|
||||
|
||||
git clone git@git.psi.ch:linux-infra/hiera/data-<environment_name>.git
|
||||
git clone git@gitea.psi.ch:puppet/data-<environment_name>.git
|
||||
|
||||
An example
|
||||
|
||||
caubet_m@caubet-laptop:~/GIT$ git clone git@git.psi.ch:linux-infra/hiera/data-meg.git
|
||||
Cloning into 'data-meg'...
|
||||
X11 forwarding request failed
|
||||
$ git clone git@gitea.psi.ch:puppet/data-ems.git
|
||||
Cloning into 'data-ems'...
|
||||
warning: You appear to have cloned an empty repository.
|
||||
|
||||
## Configuring the environment in Puppet server
|
||||
|
||||
In [bootstrap](https://git.psi.ch/linux-infra/bootstrap) add the new repo to `instcode/puppet/puppet_server/manifests/data.pp` and run the bootstrap for the Puppet server. Note that before this can be rolled out `master` branch needs to exist on `git.psi.ch`.
|
||||
## Configuring the Environment in Puppet Server and Sysdb Server
|
||||
|
||||
## Configuring the environment in Sysdb Server
|
||||
In [bootstrap](https://gitea.psi.ch/lx/bootstrap)
|
||||
|
||||
In [bootstrap](https://git.psi.ch/linux-infra/bootstrap) add the new repo to the suitable inventory file (eg. `ansible/inventory.yaml` for production) and run the playbook for the Sysdb server. Note that before this can be rolled out `master` branch needs to exist on `git.psi.ch`.
|
||||
- add the new environment to the `sysdb_environments` list in [`ansible/group_vars/prod.yaml`](https://gitea.psi.ch/lx/bootstrap/src/branch/prod/ansible/group_vars/prod.yaml).
|
||||
|
||||
- To prepare the `eyaml` key go into the directory `ansible/roles/hiera_checkout/files/srv/puppet` and run
|
||||
```
|
||||
SYSDB_ENV=...
|
||||
eyaml createkeys
|
||||
mv keys/private_key.pkcs7.pem keys/${SYSDB_ENV}_private_key.pkcs7.pem
|
||||
ansible-vault encrypt --vault-pass-file ../../../../../vault-pass keys/${SYSDB_ENV}_private_key.pkcs7.pem
|
||||
```
|
||||
and move `keys/public_key.pkcs7.pem` as `eyaml_public_key.pem` into the `data-<environment_name>` checkout and add, commit and push everything changed on both repos.
|
||||
|
||||
- For Puppet server run in `ansible` to deploy:
|
||||
```
|
||||
ansible-playbook -i inventory.yaml --vault-pass-file ./vault-pass prepare_puppet_server.yaml
|
||||
```
|
||||
|
||||
- For Sysdb server run in `ansible` to deploy:
|
||||
```
|
||||
ansible-playbook -i inventory.yaml --vault-pass-file ./vault-pass install_sysdb.yaml
|
||||
```
|
||||
|
||||
|
||||
## Test new environment in Puppet
|
||||
|
||||
Reference in new issue
Block a user