Aug
10
Puppet – Resource Abstraction Layer ”; Previous Next In Puppet, Resource Abstraction Layer (RAL) can be considered as the core conceptualized model on which the whole infrastructure and Puppet setup works. In RAL, each alphabet has its own significant meaning which is defined as follows. Resource [R] A resource can be considered as all the resources which are used to model any configuration in Puppet. They are basically in-built resources which are by default present in Puppet. They can be considered as a set of resources belonging to a pre-defined resource type. They are similar to OOP concept in any other programming language wherein the object is an instance of class. In Puppet, its resource is an instance of a resource type. Abstraction [A] Abstraction can be considered as a key feature where the resources are defined independently from the target OS. In other words, while writing any manifest file the user need not worry about the target machine or the OS, which is present on that particular machine. In abstraction, resources give enough information about what needs to exist on the Puppet agent. Puppet will take care of all the functionalities or magic happening behind the scene. Regardless of the resources and OS, Puppet will take care of implementing the configuration on the target machine, wherein the user need not worry how Puppet does behind the scenes. In abstraction, Puppet separates out the resources from its implementation. This platformspecific configuration exists from providers. We can use multiple subcommands along with its providers. Layer [L] It is possible that one defines an entire machine setup and configuration in terms of collection of resources, and it can be viewed and managed via Puppet’s CLI interface. Example for User Resource Type [root@puppetmaster ~]# puppet describe user –providers user ==== Manage users. This type is mostly built to manage systemusers, so it is lacking some features useful for managing normalusers. This resource type uses the prescribed native tools for creating groups and generally uses POSIX APIs for retrieving informationabout them. It does not directly modify ”/etc/passwd” or anything. – **comment** A description of the user. Generally the user”s full name. – **ensure** The basic state that the object should be in. Valid values are ”present”, ”absent”, ”role”. – **expiry** The expiry date for this user. Must be provided in a zero-padded YYYY-MM-DD format — e.g. 2010-02-19. If you want to make sure the user account does never expire, you can pass the special value ”absent”. Valid values are ”absent”. Values can match ”/^d{4}-d{2}-d{2}$/”. Requires features manages_expiry. – **forcelocal** Forces the management of local accounts when accounts are also being managed by some other NSS Valid values are ”true”, ”false”, ”yes”, ”no”. Requires features libuser. – **gid** The user”s primary group. Can be specified numerically or by name. This attribute is not supported on Windows systems; use the ‘groups’ attribute instead. (On Windows, designating a primary group is only meaningful for domain accounts, which Puppet does not currently manage.) – **groups** The groups to which the user belongs. The primary group should not be listed, and groups should be identified by name rather than by GID. Multiple groups should be specified as an array. – **home** The home directory of the user. The directory must be created separately and is not currently checked for existence. – **ia_load_module** The name of the I&A module to use to manage this user. Requires features manages_aix_lam. – **iterations** This is the number of iterations of a chained computation of the password hash (http://en.wikipedia.org/wiki/PBKDF2). This parameter is used in OS X. This field is required for managing passwords on OS X >= 10.8. – **key_membership** Whether specified key/value pairs should be considered the **complete list** (”inclusive”) or the **minimum list** (”minimum”) of the user”s attributes. Defaults to ”minimum”. Valid values are ”inclusive”, ”minimum”. – **keys** Specify user attributes in an array of key = value pairs. Requires features manages_solaris_rbac. – **managehome** Whether to manage the home directory when managing the user. This will create the home directory when ”ensure => present”, and delete the home directory when ‘ensure => absent’. Defaults to ‘false’. Valid values are ‘true’, ‘false’, ‘yes’, ‘no’. – **membership** Whether specified groups should be considered the **complete list** (‘inclusive’) or the **minimum list** (‘minimum’) of groups to which the user belongs. Defaults to ‘minimum’. Valid values are ‘inclusive’, ‘minimum’. – **name** The user name. While naming limitations vary by operating system, it is advisable to restrict names to the lowest common denominator. – **password** The user”s password, in whatever encrypted format the local system requires. * Most modern Unix-like systems use salted SHA1 password hashes. You can use Puppet”s built-in ‘sha1’ function to generate a hash from a password. * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes. * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs [stdlib][] module contains a ‘str2saltedsha512’ function which can generate password hashes for Lion. * Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When managing passwords on these systems the salt and iterations properties need to be specified as well as the password. [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/ Be sure to enclose any value that includes a dollar sign ($) in single quotes (”) to avoid accidental variable interpolation. Requires features manages_passwords. – **password_max_age** The maximum number of days a password may be used before it must be changed. Requires features manages_password_age. – **password_min_age** The minimum number of days a password must be used before it may be changed. Requires features manages_password_age. – **profile_membership** Whether specified roles should be treated as the **complete list** (‘inclusive’) or the **minimum list** (‘minimum’) of roles of which the user is a member. Defaults to ‘minimum’. Valid values are ‘inclusive’, ‘minimum’. – **profiles** The profiles the user has. Multiple profiles should be specified as an array. Requires features manages_solaris_rbac. – **project** The name of the project associated with a user. Requires features manages_solaris_rbac. – **purge_ssh_keys** Purge ssh keys authorized for the user if