PSICK: Classify and manage with style

This is the PSICK (Puppet Systems Infrastructure Construction Kit) module, a module than alone accomplishes a good slice of what you need to do with Puppet.

Example42's psick Puppet module provides the following features, all of which are optional:

• Classification - Manage Puppet classification in a smart, staged, Hiera driven way.
• A set of base profiles for common systems management needs on: Linux, MacOS and Windows.
• Integration with the companion psick_profile module to manage multiple more or less common applications

The module is designed to:

• Permit quick, safe and easy integration in any Puppet setup
• Allow cherry picking of the desired functionalities and profiles
• Be entirely Hiera driven: In practice a DSL to configure infrastructures

It can be used together with the PSICK control-repo or as a strandalone module, just classify it on your nodes:

include psick

By default, this doesn't do anything at all, but is enough to let you manage everything via Hiera, in the psick namespace.

In the following examples we will use Hiera YAML files, but any backend can be used: psick is a normal, even if somehow unusual, Puppet module, with classes (a lot of them) whose params can be set as Hiera data, defines, templates, files, fuctions, custom data types etc.

Check the default PSICK hiera data module for various real world usage examples.

Classification

Psick can manage the whole classification of the nodes of an infrastructure. It can work side by side and External Node Classifier, or it can totally replace it.

When used for classification, you just need to include the psick class on all your nodes (typically in manifests/site.pp) and then configure it via Hiera, considering that:

• Different Hiera keys are available to manage the classes to include for different OSes at different stages of the classification
• Psick has 4 classification stages, by default they require the previous one to be completed: First run (optional, executed only once), pre, main and profile.
• Each Hiera key used to classify, has as value an hash of key values, where keys are strings used as placeholders, and values are the names of classes to include.

Example of Hiera data to classifiy Linux and Windows nodes:

# First run mode must be enabled and each class to include there explicitely defined:
psick::enable_firstrun: true
psick::firstrun::linux_classes:
  hostname: psick::hostname
  packages: psick::aws::sdk
psick::firstrun::windows_classes:
  hostname: psick::hostname
  packages: psick::aws::sdk

# Pre and base classes, both on Linux and Windows
psick::pre::linux_classes:
  puppet: puppet
  dns: psick::dns::resolver
  hostname: psick::hostname
  hosts: psick::hosts::resource
  repo: psick::repo
psick::base::linux_classes:
  sudo: psick::sudo
  time: psick::time
  sysctl: psick::sysctl
  update: psick::update
  ssh: psick::openssh::tp
  mail: psick_profile::postfix
  mail: psick::users::ad

psick::pre::windows_classes:
  hosts: psick::hosts::resource
psick::base::windows_classes:
  features: psick::windows::features
  registry: psick::windows::registry
  services: psick::windows::services
  time: psick::time
  users: psick::users::ad

# Profiles for specific roles (ie: webserver)
psick::profiles::linux_classes:
  webserver: apache
psick::profiles::windows_classes:
  webserver: psick_profile::iis

Psick base profiles

Psick provides ready to use profiles for many common OS configurations: users management, time, openssh, keys, cronjobs, sysctl, different languages setups (php, ruby, python...), motd, hosts file, common packages, proxy...

Refer to the specific documentation for more details. Here is some example Hiera data to manage uan user with admin powers, the dns resolver and some limits, according to the profile used:

# User al creation with ssh_authorized_keys:
psick::users::users_hash:
  al:
    ensure: present
    comment: 'Al'
    groups:
      - users
      - wheel
    ssh_authorized_keys:
      - 'ssh-rsa AAAAB3NzaC...'
# Passwordless sudopowers for user al
psick::sudo::directives:
  al:
    content: 'al ALL=(ALL) NOPASSWD:ALL'

# Example to manage resolver
psick::dns::resolver::nameservers:
  - 8.8.8.8
  - 1.1.1.1

# Sample Limits
psick::limits::limits_hash:
  '*/nofile':
    soft: 2048
    hard: 4096

psick_profile and applications profiles

For some very common applications and languages, there are dedicated profile classes and defines, in the psick and the psick_profile modules. Here's a list from psick:

• psick::aws - Manage AWS client tools and infrastructures setup
• psick::bolt - Manage Bolt installation and user
• psick::git - Git installation and configuration
• psick::php - Manage php and modules

Check the psick_profile module for more details.

Main variables and common parameters

The main psick class has some parameters which are used as defaults in all the psick and psick profile classes or can contain data (in Hashes of key-values) used by all the other psick profiless

You can use them as general switches or data sources which apply to psick and psick_profile classes.

Check for more details on the Main Parameters, here they are wit the default values:

# General psick switches
psick::manage: true
psick::auto_prereq: true
psick::noop_manage: false
psick::noop_value: false
psick::force_ordering: true

# Available data general enpoints
psick::settings: {}
psick::servers: {}
psick::tp: {}
psick::firewall: {}
psick::monitor: {}

Additional documentation

Check this list of blog posts about psick module:

• Psick module version 1 coming soon! - Accouncing version 1 of Psick, with info on backwards incompatible changes.
• Psick profiles. Part 1 - Overview - Overview of the base and the application profiles (at the times they were in the deprecate tp_profile module, replaced by psick_profile module in Psick 1.0)
• Psick profiles. Part 2 - Setting proxy server and hostname - How to manage proxy and hostname with psick classes (still up to date info)
• Psick profiles. Part 3 - Managing OpenSSH - Managing ssh, configs and keys with psick (up to date).
• Psick profiles. Part 4 - Managing users - Managing users with psick (up to date).
• Psick profiles. Part 5 - Managing /etc/hosts and DNS - Alternative ways to manage hosts and dns with psick (up to date).
• Introducing PSICK - The Infrastructure Puppet module - The first announcement of the psick module. Still valid info, except the old info on tp profiles

Changelog

Release 1.1.1

• A few more puppet 8 fixes
• Actions updates

Release 1.1.0

• More updates for full Puppet 8 compatibility
• Added psick::puppet::facter profile to manage facter.conf
• pdk update
• Make psick::tools::create_dir windows compatible
• Several lints and fixes
• Define psick::git::clone to clone and sync a git repo
• psick::ruby::rbenv has no more a default ruby version

Release 1.0.4

• Updated psick::timezone to support more recent Debian derivatives
• Replaced legacy facts in preparation for Puppet 8
• Codacy lint fixes

Release 1.0.3

• Class psick::openssh::hostkeys
• Fixed lint errors

Release 1.0.2

• Basic Devuan support
• Removed deprecated cli_enable param in tp::test defines
• Added psick::netstat task
• Added exclude_unchanged_resources params to psick::puppet::pe_agent

Release 1.0.1

• Fixed psick::network class
• Added psick::nodejs class

Releae 1.0.0

• Release 1, backwards incompatible. Read migration notes before upgrading.
• Docs update
• pdk update
• Lint cleanups and code improvements
• Added GitHub and CD4PE pipelines
• Updated psick profile generation script
• Improved psick::puppet::pe_client_tools psick::puppet::pe_agent and psick::puppet::pe_server
• Fixed psick::limits
• Added psick::network (based on example42-network)
• Added psick::rclocal (based on example42-rclocal)
• Added psick::systemd (based on voxpupuli-systemd)
• Added psick::kmod
• Added psick::admin (based/renamed on example42 psick::ansible voxpupuli-systemd)
• Moved most app profiles to psick_profile module:
• psick::icinga2 moved to psick_profile::icinga2
• psick::icingaweb2 moved to psick_profile::icingaweb2
• psick::monitor::sar moved to psick_profile::sar
• psick::monitor::ganglia moved to psick_profile::ganglia
• psick::monitor::newrelic moved to psick_profile::newrelic
• psick::monitor::nrpe moved to psick_profile::nrpe
• psick::monitor::snmpd moved to psick_profile::snmpd
• psick::virtualbox moved to psick_profile::virtualbox
• psick::jenkinns moved to psick_profile::jenkinns
• psick::backup::duply moved to psick_profile::duply
• psick::backup::legato moved to psick_profile::legato
• psick::ci:octocatalog moved to psick_profile::octocatalog
• psick::foreman moved to psick_profile::foreman
• psick::grafana moved to psick_profile::grafana
• psick::inluxdb moved to psick_profile::influxdb
• psick::keepalived moved to psick_profile::keepalived
• psick::mongo moved to psick_profile::mongo
• psick::prometheus moved to psick_profile::prometheus
• psick::rundeck moved to psick_profile::rundeck
• psick::sensu moved to psick_profile::sensu
• psick::vagrant moved to psick_profile::vagrant
• psick::gitlab moved to psick_profile::gitlab
• psick::mariadb moved to psick_profile::mariadb
• psick::mysql moved to psick_profile::mysql
• psick::docker moved to psick_profile::docker
• psick::apache moved to psick_profile::apache
• psick::iis moved to psick_profile::iis
• psick::puppetserver moved to psick_profile::puppetserver
• psick::puppetdb moved to psick_profile::puppetdb
• psick::mail::postfix moved to psick_profile::postfix

Release 0.8.0

• Standardised manage, noop_manage and noop_value on all classes
• Removed local tp profiles (replaced by separated tp_profiles module)
• Added psick::limits class
• Added psick::mounts class
• Added option to manage gitlab configs via in line settings
• Cleaned up deprecations in logs
• Removed deprecated auto_conf param

Release 0.7.0

• Deprecated local tp profiles. Preparing transition to tp_profile module
• Added psick::icinga2 profile, features full
• Added psick::icingaweb2 profile, features full
• Added psick::java:install_tarball define
• Added psick::selinux class
• Added psick::remediate profile to install Puppet Remediate
• Added psick::ensure2* functions
• Added psick::hosts::puppetdb profile.
• psick::php::fpm profile
• Improved psick::packages
• Fixed mariadb and mysql defines
• Puppetserver 6 has new ca commands - @tuxmea.
• Updated hiera.yaml with globs to split per profile hiera data

Release 0.6.2

• Updated psick::puppet::foss_master to Puppet 6
• Updated psick::puppetserver to Puppet 6
• Added psick::jenkins::jcasc clsss
• Updated .travis.yml

Release 0.6.1

• Improved openssh defines
• Added extra_packages_list to psick::git
• Added extra options to default apache vhost template
• Added update_hostname option to psick::hostname
• Less default vagrant plugins
• psick::virtualbox updated

Release 0.6.0

• Added no_noop parameter to tp profiles
• Changed current no_noop params to not override server side noop_mode
• Added psick::chruby profile
• Use correct puppet agent parameter for server - @tuxmea.

Release 0.5.8

• Global renaming auto_prerequisites to auto_prereq #61
• Added force_ordering param to psick #55
• Docs, test and addons to psick::puppet::gems and psick::rbenv #50 #47

Release 0.5.7

• psick::rbenv profile
• Improved r10k setup

Release 0.5.6

• psick::gitlab::ci profile
• Puppet profiles from example42 puppet module
• More works on jenkins and Jenkinsfile
• psick::puppet::postrun_command management
• Added no_noop parameter to tp and other profiles
• Added psick::schedule profile
• Added psick::lvm profile
• Added defines to manage services scripts

Release 0.5.5

• Improved psick::jenkins and psick::jenkins::plugin
• Reorganised docs
• Added psick::reboot profile
• Improved psick::nfs profiles
• Regenerated tp profiles

Release 0.5.4

• Refactored psick::jenkins profile (psick::ci::jenkins removed)
• Allow alternative pdk templates for mass generation of tp profiles
• Reduced number of redundant tests on tp profiles
• Added ansible and sysdig tp profiles

Release 0.5.3

• Complete psick::bolt profile and better tasks @alvagante

Release 0.5.2

• Added sample Puppet tasks and psick::bolt @alvagante

Release 0.5.1

• Improvements and fixes @alvagante

Release 0.5.0

• Added lamp classes and defines (apache, php, mariadb, mysql) @alvagante
• Refactored tp profiles @alvagante
• Refactored users and packages profiles @alvagante
• Added ansible and docker profiles and defines @alvagante

Release 0.4.0

• Refined and adapted structure to a single standalone module @alvagante
• Imported defines from Psick 0.3.0 control-repo tools module @alvagante
• Generate first set of tp profiles with working specs and implementation @alvagante

Release 0.3.0

• Sync from Psick 0.3.0 control-repo profile module @alvagante