diff --git a/lib/puppet/application/inspect.rb b/lib/puppet/application/inspect.rb index 599898a07..578588144 100644 --- a/lib/puppet/application/inspect.rb +++ b/lib/puppet/application/inspect.rb @@ -1,176 +1,179 @@ require 'puppet' require 'puppet/application' require 'puppet/file_bucket/dipper' class Puppet::Application::Inspect < Puppet::Application should_parse_config run_mode :agent option("--debug","-d") option("--verbose","-v") option("--logdest LOGDEST", "-l") do |arg| begin Puppet::Util::Log.newdestination(arg) options[:logset] = true rescue => detail $stderr.puts detail.to_s end end def help <<-HELP -SYNOPSIS +puppet-inspect(8) -- Send an inspection report ======== -Prepare and submit an inspection report to the puppet master. +SYNOPSIS +-------- + +Prepares and submits an inspection report to the puppet master. USAGE -===== - - puppet inspect +----- +puppet inspect DESCRIPTION -=========== +----------- This command uses the cached catalog from the previous run of 'puppet agent' to determine which attributes of which resources have been marked as auditable with the 'audit' metaparameter. It then examines the current state of the system, writes the state of the specified resource attributes to a report, and submits the report to the puppet master. -Puppet inspect does not run as a daemon, and must be run manually or from cron. +Puppet inspect does not run as a daemon, and must be run manually or +from cron. OPTIONS -======= +------- Any configuration setting which is valid in the configuration file is also a valid long argument, e.g. '--server=master.domain.com'. See the configuration file documentation at http://docs.puppetlabs.com/references/latest/configuration.html for the full list of acceptable settings. AUTHOR -====== +------ Puppet Labs COPYRIGHT -========= +--------- Copyright (c) 2011 Puppet Labs, LLC Licensed under the GNU General Public License version 2 HELP end def setup exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs? raise "Inspect requires reporting to be enabled. Set report=true in puppet.conf to enable reporting." unless Puppet[:report] @report = Puppet::Transaction::Report.new("inspect") Puppet::Util::Log.newdestination(@report) Puppet::Util::Log.newdestination(:console) unless options[:logset] trap(:INT) do $stderr.puts "Exiting" exit(1) end if options[:debug] Puppet::Util::Log.level = :debug elsif options[:verbose] Puppet::Util::Log.level = :info end Puppet::Transaction::Report.indirection.terminus_class = :rest Puppet::Resource::Catalog.indirection.terminus_class = :yaml end def run_command retrieval_starttime = Time.now unless catalog = Puppet::Resource::Catalog.indirection.find(Puppet[:certname]) raise "Could not find catalog for #{Puppet[:certname]}" end @report.configuration_version = catalog.version inspect_starttime = Time.now @report.add_times("config_retrieval", inspect_starttime - retrieval_starttime) if Puppet[:archive_files] dipper = Puppet::FileBucket::Dipper.new(:Server => Puppet[:archive_file_server]) end catalog.to_ral.resources.each do |ral_resource| audited_attributes = ral_resource[:audit] next unless audited_attributes status = Puppet::Resource::Status.new(ral_resource) begin audited_resource = ral_resource.to_resource rescue StandardError => detail puts detail.backtrace if Puppet[:trace] ral_resource.err "Could not inspect #{ral_resource}; skipping: #{detail}" audited_attributes.each do |name| event = ral_resource.event( :property => name, :status => "failure", :audited => true, :message => "failed to inspect #{name}" ) status.add_event(event) end else audited_attributes.each do |name| next if audited_resource[name].nil? # Skip :absent properties of :absent resources. Really, it would be nicer if the RAL returned nil for those, but it doesn't. ~JW if name == :ensure or audited_resource[:ensure] != :absent or audited_resource[name] != :absent event = ral_resource.event( :previous_value => audited_resource[name], :property => name, :status => "audit", :audited => true, :message => "inspected value is #{audited_resource[name].inspect}" ) status.add_event(event) end end end if Puppet[:archive_files] and ral_resource.type == :file and audited_attributes.include?(:content) path = ral_resource[:path] if File.readable?(path) begin dipper.backup(path) rescue StandardError => detail Puppet.warning detail end end end @report.add_resource_status(status) end finishtime = Time.now @report.add_times("inspect", finishtime - inspect_starttime) @report.finalize_report begin Puppet::Transaction::Report.indirection.save(@report) rescue => detail puts detail.backtrace if Puppet[:trace] Puppet.err "Could not send report: #{detail}" end end end diff --git a/lib/puppet/application/kick.rb b/lib/puppet/application/kick.rb index 4cf06036f..9612a72aa 100644 --- a/lib/puppet/application/kick.rb +++ b/lib/puppet/application/kick.rb @@ -1,343 +1,353 @@ require 'puppet/application' class Puppet::Application::Kick < Puppet::Application should_not_parse_config attr_accessor :hosts, :tags, :classes option("--all","-a") option("--foreground","-f") option("--debug","-d") option("--ping","-P") option("--test") option("--host HOST") do |arg| @hosts << arg end option("--tag TAG", "-t") do |arg| @tags << arg end option("--class CLASS", "-c") do |arg| @classes << arg end option("--no-fqdn", "-n") do |arg| options[:fqdn] = false end option("--parallel PARALLEL", "-p") do |arg| begin options[:parallel] = Integer(arg) rescue $stderr.puts "Could not convert #{arg.inspect} to an integer" exit(23) end end def help <<-HELP -SYNOPSIS +puppet-kick(8) -- Remotely control puppet agent ======== + +SYNOPSIS +-------- Trigger a puppet agent run on a set of hosts. USAGE -===== - puppet kick [-a|--all] [-c|--class ] [-d|--debug] [-f|--foreground] - [-h|--help] [--host ] [--no-fqdn] [--ignoreschedules] - [-t|--tag ] [--test] [-p|--ping] [ [...]] +----- +puppet kick [-a|--all] [-c|--class ] [-d|--debug] [-f|--foreground] + [-h|--help] [--host ] [--no-fqdn] [--ignoreschedules] + [-t|--tag ] [--test] [-p|--ping] [ [...]] DESCRIPTION -=========== +----------- This script can be used to connect to a set of machines running 'puppet agent' and trigger them to run their configurations. The most common usage would be to specify a class of hosts and a set of tags, and 'puppet kick' would look up in LDAP all of the hosts matching that class, then connect to each host and trigger a run of all of the objects with the specified tags. If you are not storing your host configurations in LDAP, you can specify hosts manually. You will most likely have to run 'puppet kick' as root to get access to the SSL certificates. 'puppet kick' reads 'puppet master''s configuration file, so that it can copy things like LDAP settings. USAGE NOTES -=========== +----------- 'puppet kick' is useless unless 'puppet agent' is listening. See its documentation for more information, but the gist is that you must enable 'listen' on the 'puppet agent' daemon, either using '--listen' on the -command line or adding 'listen: true' in its config file. In addition, +command line or adding 'listen = true' in its config file. In addition, you need to set the daemons up to specifically allow connections by creating the 'namespaceauth' file, normally at '/etc/puppet/namespaceauth.conf'. This file specifies who has access to each namespace; if you create the file you must add every namespace you want any Puppet daemon to allow -- it is currently global to all Puppet daemons. -An example file looks like this:: +An example file looks like this: [fileserver] allow *.madstop.com [puppetmaster] allow *.madstop.com [puppetrunner] allow culain.madstop.com This is what you would install on your Puppet master; non-master hosts could leave off the 'fileserver' and 'puppetmaster' namespaces. OPTIONS -======= +------- Note that any configuration parameter that's valid in the configuration file is also a valid long argument. For example, 'ssldir' is a valid configuration parameter, so you can specify '--ssldir ' as an argument. See the configuration file documentation at -http://reductivelabs.com/projects/puppet/reference/configref.html for +http://docs.puppetlabs.com/references/latest/configuration.html for the full list of acceptable parameters. A commented list of all configuration options can also be generated by running puppet master with '--genconfig'. -all: Connect to all available hosts. Requires LDAP support - at this point. - -class: Specify a class of machines to which to connect. This - only works if you have LDAP configured, at the moment. +* --all: + Connect to all available hosts. Requires LDAP support at this point. -debug: Enable full debugging. +* --class: + Specify a class of machines to which to connect. This only works if + you have LDAP configured, at the moment. -foreground: Run each configuration in the foreground; that is, when - connecting to a host, do not return until the host has - finished its run. The default is false. +* --debug: + Enable full debugging. -help: Print this help message +* --foreground: + Run each configuration in the foreground; that is, when connecting to + a host, do not return until the host has finished its run. The default + is false. -host: A specific host to which to connect. This flag can be - specified more than once. +* --help: + Print this help message -ignoreschedules: Whether the client should ignore schedules when running - its configuration. This can be used to force the client - to perform work it would not normally perform so soon. - The default is false. +* --host: + A specific host to which to connect. This flag can be specified more + than once. -parallel: How parallel to make the connections. Parallelization - is provided by forking for each client to which to - connect. The default is 1, meaning serial execution. +* --ignoreschedules: + Whether the client should ignore schedules when running its + configuration. This can be used to force the client to perform work it + would not normally perform so soon. The default is false. -tag: Specify a tag for selecting the objects to apply. Does - not work with the --test option. +* --parallel: + How parallel to make the connections. Parallelization is provided by + forking for each client to which to connect. The default is 1, meaning + serial execution. -test: Print the hosts you would connect to but do not - actually connect. This option requires LDAP support at - this point. +* --tag: + Specify a tag for selecting the objects to apply. Does not work with + the --test option. -ping:: +* --test: + Print the hosts you would connect to but do not actually connect. This + option requires LDAP support at this point. - Do a ICMP echo against the target host. Skip hosts that don't respond to ping. +* --ping: + Do a ICMP echo against the target host. Skip hosts that don't respond + to ping. EXAMPLE -======= - sudo puppet kick -p 10 -t remotefile -t webserver host1 host2 +------- + $ sudo puppet kick -p 10 -t remotefile -t webserver host1 host2 AUTHOR -====== +------ Luke Kanies COPYRIGHT -========= +--------- Copyright (c) 2005 Puppet Labs, LLC Licensed under the GNU Public License HELP end def run_command @hosts += command_line.args options[:test] ? test : main end def test puts "Skipping execution in test mode" exit(0) end def main require 'puppet/network/client' Puppet.warning "Failed to load ruby LDAP library. LDAP functionality will not be available" unless Puppet.features.ldap? require 'puppet/util/ldap/connection' todo = @hosts.dup failures = [] # Now do the actual work go = true while go # If we don't have enough children in process and we still have hosts left to # do, then do the next host. if @children.length < options[:parallel] and ! todo.empty? host = todo.shift pid = fork do run_for_host(host) end @children[pid] = host else # Else, see if we can reap a process. begin pid = Process.wait if host = @children[pid] # Remove our host from the list of children, so the parallelization # continues working. @children.delete(pid) failures << host if $CHILD_STATUS.exitstatus != 0 print "#{host} finished with exit code #{$CHILD_STATUS.exitstatus}\n" else $stderr.puts "Could not find host for PID #{pid} with status #{$CHILD_STATUS.exitstatus}" end rescue Errno::ECHILD # There are no children left, so just exit unless there are still # children left to do. next unless todo.empty? if failures.empty? puts "Finished" exit(0) else puts "Failed: #{failures.join(", ")}" exit(3) end end end end end def run_for_host(host) if options[:ping] out = %x{ping -c 1 #{host}} unless $CHILD_STATUS == 0 $stderr.print "Could not contact #{host}\n" next end end require 'puppet/run' Puppet::Run.indirection.terminus_class = :rest port = Puppet[:puppetport] url = ["https://#{host}:#{port}", "production", "run", host].join('/') print "Triggering #{host}\n" begin run_options = { :tags => @tags, :background => ! options[:foreground], :ignoreschedules => options[:ignoreschedules] } run = Puppet::Run.indirection.save(Puppet::Run.new( run_options ), url) puts "Getting status" result = run.status puts "status is #{result}" rescue => detail puts detail.backtrace if Puppet[:trace] $stderr.puts "Host #{host} failed: #{detail}\n" exit(2) end case result when "success"; exit(0) when "running" $stderr.puts "Host #{host} is already running" exit(3) else $stderr.puts "Host #{host} returned unknown answer '#{result}'" exit(12) end end def initialize(*args) super @hosts = [] @classes = [] @tags = [] end def preinit [:INT, :TERM].each do |signal| trap(signal) do $stderr.puts "Cancelling" exit(1) end end options[:parallel] = 1 options[:verbose] = true options[:fqdn] = true options[:ignoreschedules] = false options[:foreground] = false end def setup if options[:debug] Puppet::Util::Log.level = :debug else Puppet::Util::Log.level = :info end # Now parse the config Puppet.parse_config if Puppet[:node_terminus] == "ldap" and (options[:all] or @classes) if options[:all] @hosts = Puppet::Node.indirection.search("whatever", :fqdn => options[:fqdn]).collect { |node| node.name } puts "all: #{@hosts.join(", ")}" else @hosts = [] @classes.each do |klass| list = Puppet::Node.indirection.search("whatever", :fqdn => options[:fqdn], :class => klass).collect { |node| node.name } puts "#{klass}: #{list.join(", ")}" @hosts += list end end elsif ! @classes.empty? $stderr.puts "You must be using LDAP to specify host classes" exit(24) end @children = {} # If we get a signal, then kill all of our children and get out. [:INT, :TERM].each do |signal| trap(signal) do Puppet.notice "Caught #{signal}; shutting down" @children.each do |pid, host| Process.kill("INT", pid) end waitall exit(1) end end end end