4

I am wondering is whether it makes sense to have a single machine connect to multiple, distinct Puppetmaster instances.

My use case is that i have different privilege level I want to grant to server operators. We already operate a fairly (~100) wide array of Puppet clients connected to a single Puppetmaster, on which we use exported resources to configure Nagios, Munin, Backups and so on. Fairly standard stuff. But now we have another project where we setup a completely separate Puppetmaster for a client, as we didn't want to grant them access to our internal infrastructure. Yet we would like to import the exported resources on their servers into our monitoring infrastructure so that we can monitor their machines.

I guess another way to frame the question is: is it possible to run (multiple?) Puppet clients on a single machine, connected to multiple, distinct Puppetmasters?

Or would there be a way to share exported resources or data between Puppetmaster while limiting access?

(I know that Puppet can be scaled horizontally by deploying multiple Puppetmaster servers in a load balancing setup. This question is not about that.)

Improve this question

1 Answer 1

Reset to default
3

Sharing exported resources is problematic, because it requires mutual trust between the collecting master and the storing PuppetDB. For this you will need to share the Puppet CA, and this will blur the separation of the infrastructure.

You might have better luck actually introducing additional agents on the monitoring infrastructure as well. These will connect to the customer puppet master and collect only resources from there. You will then need to devise a way to generate a consistent configuration from the resources that two agents manage independently.

Improve this answer
2
  • when you say "agents", do you mean puppetd, the puppet client running as a daemon (or a cronjob, actually)? is it even possible to run multiple puppetd clients on a single server?
    – anarcat
    Commented May 13, 2015 at 16:32
  • 1
    @anarcat Yes. puppetd is a relic from 0.x and 2.x times. With version 3 or later you should only use puppet agent instead. They are the same. And yes, multiple instances can be separated, at least with recent versions. Make sure that each uses a distinct confdir and vardir setting. If this is unclear, feel free to make this a new question.
    – Felix Frank
    Commented May 14, 2015 at 13:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .