Foreman Birthday Event 2017: Foreman - Advanced use cases by Timo Goebel

1. Foreman - Advanced Use
Cases
@Foreman Birthday, Netways Nuremberg

2. Timo Goebel
mail@timogoebel.name
https://github.com/timogoebel
dm-drogerie markt / FILIADATA GmbH
Linux, Web, Puppet
Foreman Core & Plugin Maintainer

3. Default Use-Cases
• Manage the Life-Cycle of Server
• Provision
• PXE
• Puppet
• VM / Bare Metal
• Operate
• Facts
• Reports
• Demolish

4. Advanced Use Cases
• The scenario: Manage a CoreOS Container Linux Cluster with Foreman
• Setup: Simple
• Deployment and Configuration: Easy
• System Updates: Painless

5. Container Linux
• CoreOS Container Linux
• Image Based Lightweight Linux OS
• Made for (Container-) Clusters
• No Package Manager J
• No Puppet J
• Configuration via
• coreos-metadata („cloud-init“)
• Ignition

6. Aim
• Deploy a three node etcd Cluster on CoreOS
• Distributed Key-Value-Store
Host 2Host 1 Host 3
Hostgroup

7. Operatingsystem Setup

8. Hostgroup Setup
Hostgroup Parameter defines which config file to deploy:
Set up the hostgroup for the new cluster:

9. Host Provisioning
“Clone“ this Host two times, then enable Build Mode for all hosts and reboot

10. Build hosts

11. Provisioning Workflow
Example valid for on-premise systems, e.g. VMWare
1. PXE-Boot PXELinux
2. Load Kernel & Full CoreOS Image
3. Request Provisioning Template from Foreman
4. Provisioning Template writes system‘s config to disk
5. coreos-install writes CoreOS to disk, uses provisiong template
6. Signal Foreman that host is built, reboot

12. Templates (I)
Rendered PXELinux Template:
DEFAULT coreos
LABEL coreos
KERNEL boot/CoreOS-1409.6.0-x86_64-coreos_production_pxe.vmlinuz
APPEND initrd=boot/CoreOS-1409.6.0-x86_64-coreos_production_pxe_image.cpio.gz
cloud-config-url=http://foreman/unattended/provision?token=abc

13. Templates (II)
Rendered Provisioning Template (shortened, the „outer shell“):
#cloud-config
coreos:
units:
- name: coreos-bootstrap.service
runtime: no
command: start
content: |
[Unit]
Description=Install coreos to disk
[Service]
ExecStart=/bin/bash -c "/usr/bin/coreos-install -C stable -d /dev/sda
-c /home/core/cloud-config.yml
-b https://foremansp:8443/omahareleases/stable/amd64-usr
&& wget -q -O /dev/null --no-check-certificate
http://foreman:8000/unattended/built?token=abc && reboot“
write_files:
- content: |
[…]
path: /home/core/cloud-config.yml
permissions: '0600’
owner: core:core

14. Templates (III)
etcd setup Provisiong Template (rendered):
#cloud-config
etcd2:
name: timoetcd03
initial-cluster:
timoetcd01=http://172.23.1.35:2380,timoetcd02=http://172.23.1.39:2380,timoetcd03=http://172.23.
1.43:2380
initial-cluster-token: tst_timoetcd_lxsbx
initial-cluster-state: new
advertise-client-urls: http://172.23.1.43:2379
listen-client-urls: http://0.0.0.0:2379
initial-advertise-peer-urls: http://172.23.1.43:2380
listen-peer-urls: http://172.23.1.43:2380

15. Templates (IV)
etcd setup Provisiong Template (rendered):
#cloud-config
etcd2:
name: timoetcd03
initial-cluster:
timoetcd01=http://172.23.1.35:2380,timoetcd02=http://172.23.1.39:2380,timoetcd03=http://172.23.1.43:2380
initial-cluster-token: tst_timoetcd_lxsbx
initial-cluster-state: new
advertise-client-urls: http://172.23.1.43:2379
listen-client-urls: http://0.0.0.0:2379
initial-advertise-peer-urls: http://172.23.1.43:2380
listen-peer-urls: http://172.23.1.43:2380

16. Verify
ssh core@tst-timoetcd-01.lxsbx.ka.de.dm-drogeriemarkt.com
Container Linux by CoreOS stable (1409.6.0)
core@tst-timoetcd-01 ~ $ etcdctl cluster-health
member 9e8581bdc5457367 is healthy: got healthy result from
http://172.23.76.35:2379
member a1f966aae11beb97 is healthy: got healthy result from
http://172.23.76.39:2379
member b533d7354d072e18 is healthy: got healthy result from
http://172.23.76.43:2379
cluster is healthy
core@tst-timoetcd-01 ~ $

17. Painless System Updates (I)
• Meet: Foreman Omaha
• Plugin for Smart Proxy and Foreman
• Facts and Updates for CoreOS
• CoreOS Repository Mirror

18. Painless System Updates (II)
coreos:
update:
group: "<%= @host.operatingsystem.release_name %>“
server: "<%= SmartProxy.with_taxonomy_scope_override(@host.location,
@host.organization).with_features('Omaha').first.url %>/omaha/v1/update"

19. System Updates – How they should work (I)
• Fully automated updates increase security and reliability
• Great when applications are distributed
• Updates are pulled by the hosts
• Only one system can boot at once, great for clusters

20. System Updates – How they should work (II)
cluster
etcd

21. Foreman Omaha
• Install Foreman & Smart Proxy Plugins via Foreman
Installer
• Cronjob syncs CoreOS releases on Proxy
• Setup Smart Proxy in Foreman
• Setup Smart Proxy as Mirror in Foreman

22. SSH Keys
CoreOS just knows „core“ User by default

23. Whishlist
• Autoscaling
• Painless Updates for RHEL J (WIP)
• Create Images in Foreman
• cloud-init for on-premise / bare-metal systems
• 2FA / Personal Access Tokens