Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes for Python 3 and documentation for Python 3 on RHEL 7 #272

Merged
merged 2 commits into from
Mar 20, 2020
Merged

Fixes for Python 3 and documentation for Python 3 on RHEL 7 #272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d94fdfe
Fixing wsgi.py for python 3. Added documentation on running Puppetboa…
nmaludy Mar 20, 2020
b27a2c3
Added table of repos needed for the python3 packages
nmaludy Mar 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 123 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,74 @@ class { 'puppetboard::apache::vhost':
}
```

### RedHat/CentOS 7 with Python 3

If you want to use the latest version of Puppet Board you'll need to run Python 3.6+.

By default RHEL 7 has Python 2.7 installed, so you'll need to install a Python 3 and
the compatible version of `mod_wsgi` (the `mod_wsgi` module must be compiled to support
the specific version of Python you're running).


``` puppet
$mod_wsgi_package_name = 'rh-python36-mod_wsgi'

package { ['python3', 'python3-pip', 'python3-devel', 'python36-virtualenv']:
ensure => present,
}

# configure apache
class { 'apache':
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it would be awesome to have this in an acceptance test <3

purge_configs => false,
mpm_module => 'prefork',
default_vhost => false,
default_mods => false,
}

# configure mod_wsgi for python3
class { 'apache::mod::wsgi':
mod_path => 'modules/mod_rh-python36-wsgi.so',
package_name => $mod_wsgi_package_name,
wsgi_socket_prefix => '/var/run/wsgi',
}

# create symlinks from the isolated Red Hat directory into the
# standard Apache paths so that it can pick up the module and config
file { '/etc/httpd/conf.modules.d/10-rh-python36-wsgi.conf':
ensure => 'link',
target => '/opt/rh/httpd24/root/etc/httpd/conf.modules.d/10-rh-python36-wsgi.conf',
require => Package[$mod_wsgi_package_name],
}
file { '/usr/lib64/httpd/modules/mod_rh-python36-wsgi.so':
ensure => 'link',
target => '/opt/rh/httpd24/root/usr/lib64/httpd/modules/mod_rh-python36-wsgi.so ',
require => Package[$mod_wsgi_package_name],
}

class { 'puppetboard':
# use python3 when setting up the virtualenv for puppetboard
virtualenv_python => '3',
# specify other parameters here
}
```

**NOTE** Below are the Yum repos needed for the various packages above.
On CentOS you'll need to package `centos-release-scl-rh` or manage
the SCL repos with the [bodgit/scl](https://github.com/bodgit/puppet-scl) module.

| OS | package | repo |
|----------|------------------------|-------------------------------|
| RHEL 7 | `python3` | `rhel-7-server-rpms` |
| RHEL 7 | `python3-pip` | `rhel-7-server-rpms` |
| RHEL 7 | `python3-devel` | `rhel-7-server-optional-rpms` |
| RHEL 7 | `python36-virtualenv` | `EPEL` |
| RHEL 7 | `rh-python36-mod_wsgi` | `rhel-server-rhscl-7-rpms` |
| CentOS 7 | `python3` | `base/7` |
| CentOS 7 | `python3-pip` | `base/7` |
| CentOS 7 | `python3-devel` | `base/7` |
| CentOS 7 | `python36-virtualenv` | `EPEL` |
| CentOS 7 | `rh-python36-mod_wsgi` | `centos-sclo-rh` |

### Using SSL to the PuppetDB host


Expand Down Expand Up @@ -328,6 +396,61 @@ class { 'puppetboard':
}
```

### Using SSL to PuppetDB >= 6.9.1

As of PuppetDB `6.9.1` the `/metrics/v2` API is only accessible on the loopback/localhost
interface of the PuppetDB server. This requires you to run `puppetboard` locally on
that host and configure `puppetdb_host` to `127.0.0.1`:

``` puppet

$ssl_dir = $::settings::ssldir
$puppetboard_certname = $::certname
class { 'puppetboard':
groups => 'puppet',
manage_virtualenv => true,
puppetdb_host => '127.0.0.1',
puppetdb_port => 8081,
puppetdb_key => "${ssl_dir}/private_keys/${puppetboard_certname}.pem",
puppetdb_ssl_verify => "${ssl_dir}/certs/ca.pem",
puppetdb_cert => "${ssl_dir}/certs/${puppetboard_certname}.pem",
}
```

**NOTE** In order for SSL to verify properly in this setup, you'll need your
Puppet SSL certificate to have an IP Subject Alternative Name setup
for `127.0.0.1`, otherwise the certificate verification will fail.
You can set this up in your `puppet.conf` with the `dns_alt_names`
configuration option, documented [here](https://puppet.com/docs/puppet/latest/configuration.html#dnsaltnames).

``` ini
[main]
dns_alt_names = puppetdb,puppetdb.domain.tld,puppetboard,puppetboard.domain.tld,IP:127.0.0.1
```

**NOTE** If you need to regenerate your existing cert to add DNS Alt Names
follow the documentation [here](https://puppet.com/docs/puppet/latest/ssl_regenerate_certificates.html#regenerate_agent_certs_and_add_dns_alt_names):

``` shell
# remove the existing agent certs
puppetserver ca clean --certname <CERTNAME_OF_YOUR_PUPPETDB>
puppet ssl clean

# stop our services
puppet resource service puppetserver ensure=stopped
puppet resource service puppetdb ensure=stopped

# regenerate our cert
puppetserver ca generate --certname <CERTNAME> --subject-alt-names puppetdb,puppetdb.domain.tld,puppetboard,puppetboard.domain.tld,IP:127.0.0.1 --ca-client
# copy the cert into the PuppetDB directory
cp /etc/puppetlabs/puppet/ssl/certs/<CERTNAME>.pem /etc/puppetlabs/puppetdb/ssl/public.pem
cp /etc/puppetlabs/puppet/ssl/private_keys/<CERTNAME>.pem /etc/puppetlabs/puppetdb/ssl/private.pem

# restart our services
puppet resource service puppetdb ensure=running
puppet resource service puppetserver ensure=running
```

## Development

This module is maintained by [Vox Pupuli](https://voxpupuli.org/). Voxpupuli
Expand Down
2 changes: 1 addition & 1 deletion templates/wsgi.py.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import sys

os.environ['PUPPETBOARD_SETTINGS'] = '<%= @basedir %>/puppetboard/settings.py'
activate_this = '<%= @basedir %>/virtenv-puppetboard/bin/activate_this.py'
execfile(activate_this, dict(__file__=activate_this))
exec(compile(open(activate_this).read(), activate_this, 'exec'), dict(__file__=activate_this))

me = os.path.dirname(os.path.abspath(__file__))
# Add us to the PYTHONPATH/sys.path if we're not on it
Expand Down