Puppet Agent

Puppet is a software that allows network administrators to automate repetitive tasks. NVIDIA Onyx includes a built-in agent for the open-source “Puppet” configuration change management system. The Puppet agent enables configuring switches in accordance with the standard “puppet-netdev-stdlib” type library and with the “Mellanox-netdev-stdlib-mlnxos” and “Mellanox-netdev-ospf-stdlib” type libraries provided to the Puppet community.For more information, please refer to the CLI commands, to the NetDev documentation and to Puppet modules GitHub page.

To set the puppet server:

1. Define the Puppet server (the name has to be a DNS and not IP).

   Copy

   Copied!

               
   
               
   switch (config) # puppet-agent master-hostname <please_type_your_hostname_DNS_here>
           

2. Enable the Puppet agent.

   Copy

   Copied!

               
   
               
   switch (config) # puppet-agent enable
           

3. (Optional) Verify there are no errors in the Puppet agent log.

   Copy

   Copied!

               
   
               
   switch (config) # show puppet-agent log continuous
           

Using CLI Commands

1. Verify the certificate request.

   Copy

   Copied!

               
   
               
   # puppet cert list 
   "<switch>" 
   (F4:B4:20:3B:2B:11:76:37:14:34:D0:D1:03:ED:3D:B5)
           

2. Sign the certificate request if the cert_name parameter (e.g. switch1.domain) is in the list.

   Copy

   Copied!

               
   
               
   # puppet cert sign <full_domain_name>
           

3. Verify the request is removed from the Puppet certification list.

   Copy

   Copied!

               
   
               
   # puppet cert list
           

Accepting Certificate Requests in Puppet Server Console

Go to the “nodes requests” page (the button is at the top right), and wait for a certificate request for the switch and then accept it.

For those types which have to be installed at the Puppet server prior to the first Puppet configuration run (before configuring resources on the switch), netdev-stdlib types and a package of providers is provided.

To install those modules, run the following commands in the Puppet server:

            

            
# puppet module install netdevops-netdev_stdlib
# puppet module install mellanox-netdev_ospf_stdlib
# puppet module install mellanox-netdev_stdlib_mlnxos
        

For more information please refer to the Network Automation Tools page community page.

1. Assign configuration classes to a node.
   Configuration files can be written and changed in the puppet server machine in the directory “/etc/puppetlabs/puppet/manifests/” (or “/etc/puppet/manifests” in case of an open source puppet server).
   The file “/etc/puppetlabs/puppet/manifests/site.pp” is the main file for Puppet-classes-to-nodes association. To associate a configuration to a Puppet agent node, just append association lines as below:

   Copy

   Copied!

               
   
               
   import "netdev_vlan_example"
   import "netdev_l2_vlan_example"
   import "netdev_lag_example"
   node 'switch-6375dc.mtr.labs.mlnx'{
    
     netdev_device { $hostname: }
    
     include vlan_example # Asserts a class vlan_example in one of the files
     include l2_interface_example
    include lag_example
    
   }
           

   Warning

   If you have a puppet console, you may assign classes of configuration in the following way:

   •Add the relevant classes (using the console add class button on the “nodes” page).

   •Assign the classes to the relevant nodes/groups in the puppet server console (in the console node/group page -> edit -> Classes).

2. Update VLAN.
   Manifest example (located in “/etc/puppetlabs/puppet/manifests/netdev_vlan_example.pp”).

   Copy

   Copied!

               
   
               
   class vlan_example{
    
     $vlans = {
      'Vlan244' => {vlan_id => 244, ensure => present},
      'Vlan245' => {vlan_id => 245, ensure => present},
     }
    
     create_resources( netdev_vlan, $vlans )
   }
           

3. Update Layer 2 Interface.
   Manifest example (located in “/etc/puppetlabs/puppet/manifests/netdev_l2_interface_example.pp”).

   Copy

   Copied!

               
   
               
   class vlans_ensure_example{
    
     $vlans = {
      'Vlan347' => {vlan_id => 347, ensure => present},
      'Vlan348' => {vlan_id => 348, ensure => present},
      'Vlan349' => {vlan_id => 349, ensure => present},
     }
    
     create_resources( netdev_vlan, $vlans )
   }
    
   class l2_interface_example{
    
     include vlans_ensure_example #class to Ensure VLANs before assigning
    
     $l2_interfaces = {
       'ethernet 1/3' => {ensure => absent, vlan_tagging => disable}, #default
       'ethernet 1/4' => {ensure => present, vlan_tagging => enable, 
   tagged_vlans => [Vlan348,Vlan347], untagged_vlan => Vlan349} #hybrid
     }
    
     create_resources( netdev_l2_interface, $l2_interfaces )
   }
           

4. Update LAG.
   Manifest example (located in “/etc/puppetlabs/puppet/manifests/netdev_lag_example.pp”).

   Copy

   Copied!

               
   
               
   class lag_example{
    
     $lags = {
     'port-channel 101' => {ensure => present, 
   links => ['ethernet 1/12', 'ethernet 1/13'], lacp => active},
     'port-channel 102' => {ensure => present, 
   links => ['ethernet 1/6','ethernet 1/5'], lacp => disabled},
     }
    
     create_resources( netdev_lag, $lags )
   }
           

   Warning

   You may add classes to ensure that all assigned links are with the same layer 1 and layer 2 configurations (similarly to the way we did in update l2_interface section with vlans_ensure_example class).

Ethernet and Port-Channel

Interface Capabilities

VLAN Capabilities

Layer 2 Ethernet Interface Capabilities

LAG Capabilities

Layer 3 Interface Capabilities

OSPF Interface Capabilities

OSPF Area Capabilities

Router OSPF Capabilities

SNMP, LLDP, IP Routing, and Spanning Tree Capabilities

Fetched Image Capabilities

Installed Image Capabilities

This section presents common issues that may prevent the switch from connecting to the puppet server.

Switch and Server Clocks are not Synchronized

This can be fixed by using NTP to synchronize the clocks at the switch (using the command “ntp”) and at the server (e.g. using ”ntpdate”).

Outdated or Invalid SSL Certificates Either on the Switch or the Server

This can be fixed on the switch using the CLI command “puppet-agent clear-certificates” (requires “puppet-agent restart” to take effect).

On the server it can be fixed by running “puppet cert clean <switch_fqdn>” (FQDN is the Fully Qualified Domain Name which consists of a hostname and a domain suffix).

Communications Issue

Make sure it is possible to ping the puppet server hostname from the switch (using the command “ping”).

If the hostname is not reachable (e.g. no DNS server) it can be statically added to the switch local hosts lookup (using the command “ip host”).

Make sure that port 8140 is open (using the command “tracepath {<hostname> | <ip>}/8140”).

puppet-agent

switch (config) # puppet-agent
switch (config puppet-agent) # 

puppet-agent enable

switch (config) # puppet-agent vrf mgmt enable

master-hostname

switch (config puppet-agent) # master-hostname my_puppet_server_hostname

enable

switch (config puppet-agent) # enable

run-interval

switch (config puppet-agent) # run-interval 40m

restart

switch (config puppet-agent) # restart

show puppet-agent

switch (config)  # show puppet-agent 
Puppet agent          : enabled
VRF name:             : mgmt
Puppet master hostname: puppet
Run interval          : 30m

show puppet-agent log

switch (config puppet-agent) # show puppet-agent log

Mon Nov 04 11:52:42 +0000 2013 Puppet (notice): Starting Puppet client version 3.2.3
Mon Nov 04 11:52:44 +0000 2013 Puppet (warning): Unable to fetch my node definition, but the agent run will continue:
Mon Nov 04 11:52:44 +0000 2013 Puppet (warning): Could not intern from pson: source '"#<Puppet::Node:0x7f' not in PSON!
Mon Nov 04 11:53:21 +0000 2013 /Netdev_vlan[Vlan104]/ensure (notice): created
Mon Nov 04 11:53:22 +0000 2013 /Netdev_vlan[Vlan101]/ensure (notice): created
Mon Nov 04 11:53:23 +0000 2013 /Netdev_vlan[Vlan102]/ensure (notice): created
Mon Nov 04 11:53:24 +0000 2013 /Netdev_vlan[Vlan103]/ensure (notice): created
Mon Nov 04 11:53:40 +0000 2013 /Netdev_l2_interface[ethernet 1/6]/untagged_vlan (notice): untagged_vlan changed 'default' to 'Vlan103'
Mon Nov 04 11:53:43 +0000 2013 /Netdev_l2_interface[ethernet 1/7]/untagged_vlan (notice): untagged_vlan changed 'default' to 'Vlan103'
Mon Nov 04 11:53:48 +0000 2013 /Netdev_vlan[Vlan100]/ensure (notice): created
Mon Nov 04 11:53:48 +0000 2013 /Netdev_l2_interface[ethernet 1/5]/vlan_tagging (notice): vlan_tagging changed 'enable' to 'disable'
Mon Nov 04 11:53:48 +0000 2013 /Netdev_l2_interface[ethernet 1/5]/tagged_vlans (notice): tagged_vlans changed '[]' to '[Vlan100,Vlan101,Vlan102]'
Mon Nov 04 11:53:51 +0000 2013 /Netdev_l2_interface[ethernet 1/1]/tagged_vlans (notice): tagged_vlans changed '[]' to '[Vlan101,Vlan104]'
Mon Nov 04 11:53:51 +0000 2013 /Netdev_l2_interface[ethernet 1/1]/untagged_vlan (notice): untagged_vlan changed 'default' to 'Vlan100'
Mon Nov 04 11:53:54 +0000 2013 /Netdev_l2_interface[ethernet 1/3]/tagged_vlans (notice): tagged_vlans changed '[]' to '[Vlan101,Vlan104]'
Mon Nov 04 11:53:54 +0000 2013 /Netdev_l2_interface[ethernet 1/3]/untagged_vlan (notice): untagged_vlan changed 'default' to 'Vlan100'
Mon Nov 04 11:53:58 +0000 2013 /Netdev_l2_interface[ethernet 1/4]/vlan_tagging (notice): vlan_tagging changed 'enable' to 'disable'
Mon Nov 04 11:53:58 +0000 2013 /Netdev_l2_interface[ethernet 1/4]/tagged_vlans (notice): tagged_vlans changed '[]' to '[Vlan100,Vlan101,Vlan102]'
Mon Nov 04 11:54:03 +0000 2013 /Netdev_l2_interface[ethernet 1/2]/tagged_vlans (notice): tagged_vlans changed '[]' to '[Vlan101,Vlan104]'
Mon Nov 04 11:54:03 +0000 2013 /Netdev_l2_interface[ethernet 1/2]/untagged_vlan (notice): untagged_vlan changed 'default' to 'Vlan100'
Mon Nov 04 11:54:06 +0000 2013 Puppet (notice): Finished catalog run in 47.90 seconds