forked from linux/documentation
127 lines
4.9 KiB
Markdown
127 lines
4.9 KiB
Markdown
# Hiera
|
|
|
|
Please refer to [https://docs.puppet.com/hiera/](https://docs.puppet.com/hiera/) for a general Hiera
|
|
introduction.
|
|
|
|
Our current hierarchy has seven levels (first will be considered first
|
|
during value lookup):
|
|
|
|
- nodes (FQDN)
|
|
- subgroup (optional, ``puppet_subgroup`` attribute in sysdb)
|
|
- group (``puppet_group`` attribute in sysdb)
|
|
- Hiera environments
|
|
- Puppet server specific
|
|
- global
|
|
- common
|
|
|
|
The first four layers can be edited by the admin in the respective Hiera Git repository. The common layer (default values) and the server specific layer (differences between test and prod) are part of the Puppet code repository. Finally the global layer contains a few configurations which are managed by the Core Linux Group outside of the normal Puppet release process, eg. for license management.
|
|
|
|
The values can be stored as classical YAML values or with [encrypted yaml](https://github.com/TomPoulton/hiera-eyaml) for secrets.
|
|
|
|
The filesystem structure is as follows (the last 3 cannot be controlled by a common admin):
|
|
|
|
1. `%{::sysdb_env}/%{::group}/%{::fqdn}.yaml` or `%{::sysdb_env}/%{::group}/%{::subgroup}/%{::fqdn}.yaml`
|
|
2. `%{::sysdb_env}/%{::group}/%{::subgroup}.yaml`
|
|
3. `%{::sysdb_env}/%{::group}.yaml`
|
|
4. `%{::sysdb_env}/%{::sysdb_env}.yaml`
|
|
5. `%{::environment}/data/server_%{server_facts.servername}.yaml`
|
|
6. `/srv/puppet/data/global/global.yaml`
|
|
7. `%{::environment}/data/common.yaml`
|
|
|
|
Depending if a subgroup is defined, the node specific YAML is at a different level in the filesysystem hierarchy.
|
|
|
|
The `%{variable}` notation is hiera specific.
|
|
|
|
## Repositories
|
|
|
|
Hiera data are organized in different repositories. These repositories are located at: https://gitea.psi.ch/puppet
|
|
|
|
|
|
Each __Hiera environment__ has a dedicated hiera repository, called `data-<hiera_env>`, eg. [data-hpc](https://gitea.psi.ch/puppet/data-hpc).
|
|
The first 4 levels of the filesystem structure shown before are actually the files inside this kind of repositories.
|
|
|
|
Any change to the repo will automatically trigger a redeployment of the new version of its content on the puppet master within a few seconds from the push.
|
|
|
|
## Configuration
|
|
|
|
### Secrets
|
|
|
|
To encrypt sensitive data in your hiera configuration you need the `hiera-eyaml` tool installed on your system.
|
|
|
|
To encrypt data you have to use the public key from your Hiera (`data-*`) git repository named `eyaml_public_key.pem`
|
|
|
|
For the lower hiera layers (global, server or data) it is on the Puppet server at `/etc/puppetlabs/keys/eyaml/public_key.pkcs7.pem`.
|
|
|
|
|
|
|
|
For to encrypt a simple string do
|
|
|
|
```bash
|
|
eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem -s secret_string
|
|
```
|
|
|
|
and for a complete file
|
|
|
|
```bash
|
|
eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem -f secret_file
|
|
```
|
|
and from pipe
|
|
|
|
```bash
|
|
eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem --stdin
|
|
```
|
|
|
|
For example, to encrypt a password for a system you can do like this:
|
|
|
|
```bash
|
|
# openssl passwd -6 | eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem --stdin
|
|
Password:
|
|
Verifying - Password:
|
|
string: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQ...sfLHuai6p+Mdukw/TT1BlKA==]
|
|
|
|
OR
|
|
|
|
block: >
|
|
ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBAD
|
|
AFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEA1vyV8J3LYjfBz5zY1PIs9k9zIC
|
|
...
|
|
c+MJa+CzicugI0Ptyq/anhhfWeDeBnZza1/9OCxWqqf3wEcnhJCmxYxBEOLR
|
|
AxVw2cf3w0wGRuZ0373LHljGTsfLHuai6p+Mdukw/TT1BlKA==]
|
|
#
|
|
```
|
|
|
|
and place either the string or the block at the required place in your Hiera YAML.
|
|
|
|
|
|
Beside encrypting a complete e.g. content of a file, you can also encrypt only a single value. This can be done as follows:
|
|
|
|
```yaml
|
|
letsencrypt::eab-kid: >
|
|
ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBAD
|
|
...
|
|
|
|
letsencrypt::eab-hmac-key: >
|
|
ENC[PKCS7,MIIBygYJKoZIhvcNAQcDoIIBuzCCAbcCAQAxggEhMIIBHQIBAD
|
|
...
|
|
|
|
files::files:
|
|
/etc/letsencrypt/cli.ini:
|
|
mode: '0644'
|
|
content: |
|
|
server = https://one.digicert.com/mpki/api/v1/acme/v2/directory
|
|
# Server authentication. Due to having this, we do not need to do a DNS challenge.
|
|
eab-kid = %{lookup('lx-data::letsencrypt::eab-kid')}
|
|
eab-hmac-key = %{lookup('lx-data::letsencrypt::eab-hmac-key')}
|
|
```
|
|
|
|
`letsencrypt::eab-kid` and `letsencrypt::eab-hmac-key` are arbitrary key names, you can use any key name you want, just ensure that they are unique.
|
|
|
|
### Hiera Variable Interpolation
|
|
|
|
Within Hiera also variable interpolation might be use to include other Hiera keys or facts, etc. into the values.
|
|
For details check out the [Puppet documentation](https://www.puppet.com/docs/puppet/7/hiera_merging.html#interpolation_functions)
|
|
|
|
As such an interpolation starts with `%{`, some key or file content (especially in Apache configuration) might be interpreted as variable interpolation and result in some part of the text disappear.
|
|
Or it might simply the puppet run with `Syntax error in string` if Puppet fails to parse what it considers an interpolation.
|
|
To escape a `%` you can write `%{literal('%')}` instead.
|