Node Classification and Role-Based Access Control Quick Start Guide
A newer version is available; see the version menu above for details.
The Puppet Enterprise (PE) console enables you to manage nodes groups and users. You can create node groups and then assign classes to nodes through those node groups. You can connect with an external directory, such as Active Directory or OpenLDAP, and import users and groups, rather than creating and maintaining users and groups in multiple locations. You can also create user roles, and assign users to those roles. Roles are granted permissions, such as permission to act on node groups. When you assign roles to users or user groups, you are granting users permissions in a more organized way.
In this exercise, you’ll create a new node group, apply rules to the group to define the nodes it will include, and add classes to the group. You’ll also create a new user role and give the role view permissions on your node group. Finally, you’ll create a new local user, and assign a user role to that user. This exercise doesn’t cover connecting with an OpenLDAP or Active Directory. For more information about that, see Working with Role-Based Access Control.
Note: Users and user groups are not currently deletable. And roles are deletable by API, not in the console. Therefore, we recommend that you try out these steps on a virtual machine.
It also assumes you’ve installed a *nix module. Finally, you must have admin permissions to complete these steps, which include assigning a user to a role.
Create a New Node Group
- In the PE console, click Nodes > Classification.
- In the Node group name field, type web_app_servers.
- Leave All Nodes as the parent to the new node group, and production as the environment.
- Click Add group. The web_app_servers group is added to the list of node groups.
Add Nodes to the New Node Group
To add nodes to a node group, you create rules that define which nodes should be included in the group.
- On the Classification page, click the web_app_servers node group to open it.
- On the Rules tab, in the Fact field, type or select osfamily.
From the Operator drop-down list, select is, and in the Value field, type RedHat.
As you type in the rule, the number in the Node matches column changes to indicate how many nodes this rule will affect.
- Click Add rule, and then click the commit button.
Add Classes to the Node Group
Now that you’ve created a node group, you’ll add classes to give the matching nodes purpose.
- On your web_app_servers page, click the Classes tab.
- In the Add new class field, on *nix, select
- Click Add class.
- In the Parameter box, click Parameter name and choose the parameter you’d like to edit. For this example, we will use
logroot. In the Value field, enter
Note: The grey text that appears as values for some parameters is the default value, which can be either a literal value or a Puppet variable. You can restore this value by selecting Discard changes after you have added the parameter.
- Click Add parameter, and then click the commit button.
You can check these changes by clicking Nodes > Inventory, then clicking one of the nodes from your node group. In the Classification page, you’ll see the
apache class with the Source group
Create a New User Role
Add a user role so you can manage permissions for groups of users at once.
- In the console, click Access control and then click User Roles.
- For Name, type Web developers, and then for Description, type a description for the Web developers role, such as web developers.
- Click Add role.
Create a New User and Add the User to Your New Role
These steps demonstrate how to create a new local user. See Adding LDAP Users to PE for information about adding existing users from your directory service.
- On the Access control page, click Users.
- In the Full name field, type in a user name.
- In the Login field, type the user’s login information.
Click Add local user.
Note: When you create new local users, you need to send them a login token. Do this by clicking the new user’s name in the User list and then on the upper-right of the user’s page, click Generate password reset. A message opens with a link that you must copy and send to the new user.
- Click User Roles and then click Web developers.
- On the Member users tab, on the User name list, select the new user you created, and then click Add user and click the commit button.
Enable a User to Log in
When you create new local users, you need to send them a password reset token so that they can log in for the first time.
- Click the new local user in the Users list. The new user’s page opens.
- On the upper-right of the page, click Generate password reset. A Password reset link message box opens.
- Copy the link provided in the message and send it to the new user. Then you can close the message.
Give Your New Role Access to the Node Group You Created
- From the Web developer role page, click the Permissions tab.
- In the Type box, select Node groups.
- In the Permission box, select View.
- In the Object box, select web-app_servers.
- Click Add permission, and then click the commit button.
Now, you have given members of the
Web developersrole permission to view the
Next: Writing Modules (*nix)