Re: [Puppet Users] Version Controlling Puppet Configs with svn

[Throwe, Jesse]

You dont rely on your SCM to define ownership.  That is explicitly defined in your puppet declaration.  This way the file can be owned by anyone (or nobody) and its placed on the server with the proper mode and ownership.

file { "/tmp/myfile":

owner => 'user',

group => 'user',

mode => '0600',

source => 'puppet:///module/mymodule/myfile',

}

On Sat, May 4, 2013 at 11:58 PM, P Cornellio <pete.c...@virginamerica.com> wrote:

Hi,

I an in the process of putting my Puppet Master configs into version control using SVN.  I'm concerned about file permission and ownership changes as a result of this.  SVN does not store permissions.  How does one safely use SVN with puppet configs?  

Cheers,

Pete

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users...@googlegroups.com.
To post to this group, send email to puppet...@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Bernardo Costa]

I suppose your concerns are about the check-outs of the svn repo on the puppet root direcctory, not about permissions and ownership inside the repo. Once you do svn co command as your user (not recommended), the new files will be created having being owned by you. It might fail if you user does not have permission tho create or modify these files inside the puppet tree source file. The best thing to do is run the svn co command as user puppet but you'll need to set its password or a sudo set of commands.

[P Cornellio]

That's correct, my concern is permissions/ownership changes inside /etc/puppet on the master after doing commits/check-outs, especially when new manifests are added on clients, outside of the master, then committed to the repo and updated onto the master.  Our master currently has mixed ownership between both root and pe-puppet user.  I will go with the approach of using the pe-puppet user on the master.

[Hyunil Shin]

Hello.

I have the same issue with you, except that I am using Git.

Can you describe your solution in more details?

As you said that /etc/puppet (in my case, /etc/puppetlabs) has mixed ownership of root, pe-puppet, how can you check-out puppet configuration from the svn server, with preserving permission and ownership?

Thank you

[Pete Cornell]

Hello--

It turns out I was overly cautious about changed ownership away from root.  As long as you ensure the group owner is the puppet group, you can have mixed ownership for user.

My solution was to use the Setgid bit on all directories where puppet manifests are located and change the directories group ownership to the puppet group.  I then place my regular user account into the puppet group and I edit puppet manifests as user, not as root.

In effect, when I edit puppet manifests they will have ownership of pete:pe-puppet. When we do commits / checkouts from SVN they keep this same group ownership and function fine in Puppet runs.

So the steps to make it work are:

On the puppet directories, change group ownership to the puppet group, set the setgid bit and set file mode of rwx for group,

e.g. as root:

# chgrp -R pe-puppet /etc/puppetlabs/puppet/modules /etc/puppetlabs/puppet/manifests

# chmod -R 2774 /etc/puppetlabs/puppet/modules /etc/puppetlabs/puppet/manifests 

Placing the setgid bit will make files keep a group ownership of pe-puppet.

Then, add your regular user account to the puppet group, e.g.

# usermod -G pe-puppet petec

Do this for all uses who will edit puppet code and  make sure that you edit puppet code and commit to Git using your regular user account, not as root.

This setup has been working fine for us.  I also setup 3 Puppet environments in this way (for dev, QA and prod) and propagate code between environments with SVN.

—

Pete

On Oct 29, 2013, at 6:50 PM, Hyunil Shin <anyone....@gmail.com> wrote:

Hello..

I have the same problem with you, except that I am using Git.

Can you describe your solution in more details?

As you said that /etc/puppet has mixed ownership of root and pe-puppet, how can you checkout puppet configuration from the svn with preserving permission and ownership?

Thank you~

On Tuesday, May 7, 2013 2:17:33 AM UTC+9, P Cornellio wrote:

[Puppet List]

To address permission issues I run a rsync server on the puppet server with a module that specifies owner and group
Jenkins ci then takes checks out svn commits and rsyncs them up.

[Hyunil Shin]

Thank you very much.

I want to know more in your method.

As result, anyway, when you do fresh checkout, the files are like 

664 petec petec site.pp

664 petec petec xxxxx

and petec is included in pe-puppet.

Am I right?

Also, I don't understand what setgid do.

Does setgid affect only execution?

I am not sure that modules and manifests need to be executed. 

You seem to manage only modules and manifests.

I try to manage all the files under /etc/puppetlabs, so I wonder if your method can be applied.

My current method is 

1. default mv /etc/puppetlabs to [another place]

2. create symbolic link 

3. git commit [another place]

4. as root, git push, pull

This way, git pull does not modify permission and ownership.

But, very dangerous when fresh checkout.

Thank you.

[Pete Cornell]

No, when I do fresh checkouts the files are
664 petec pe-puppet site.pp

and directories will be
774 petec pe-puppet xxxx

Yes, petec is a member of pe-puppet group.

Setgid, or Set Group ID, will make the directory and files created within it keep the ownership of the group you assign it instead of changing to the primary group of the user who create files in it.  It’s a good way to share files among multiple users and allow them all to read/write the same files.  Directories generally are always executable, but this method is not meant to make files within them executable as Puppet does not need that.

More of an example for this:

I want all members of group pe-puppet to be able to edit files in a directory, so I set group owner to pe-puppet:

chgrp pe-puppet mydir
 or
chown petec:pe-puppet mydir

We can use chmod to set the group id bit:
chmod g+s mydir

or, with numeric mode:
chmod 2774  mydir

After this the permissions of ‘mydir’ becomes:
drwxrwsr-- petec pe-puppet mydir

Now the special trick about this:  when I, or another user creates a file or directory under 'mydir’, it will have its group set as the group owner, ‘pe-puppet’ instead of the group of the user who creates it.  So if another user, johnc would do: mkdir mydir/newdir, it would look like:

drwxrwsr-- johnc pe-puppet newdir
 
And now both johnc and petec have rw access to newdir because we are both members of ‘pe-puppet'.  If johnc were to do the above without having the setgid bit, the above permissions would instead be:

drwxrwsr-- johnc johnc newdir

Notice also the puppet daemon is in the pe-puppet group, so this approach ensures it has unrestricted access to its files.  

I like this method as it’s fairly simple once you get the concept, and allows doing edits/commits/checkouts without becoming root. If you don’t have other users editing puppet files this method may not be necessary.

Also, yes I do manage all the puppet directories this way, both

/etc/puppetlabs/puppet

and
/opt/puppet/share/puppet/modules

—
Pete

[Hyunil Shin]

Thank you for details.

I can understand setgid.

I will try~

Thank you~

[Salient Digital]

Note that git recognizes and stores file attribute changes (whereas svn does not).