JavaScript is disabled on your browser. Please enable JavaScript to enjoy all the features of this site.
Rudder 4.1 - User Manual
Node management
Resources:
User manual
|
FAQ
|
Changelog
|
API reference
Version:
4.1 ESR
Download as:
epub
|
pdf
Sidebar
Prev
|
Next
Node management
Table of Contents
Node inventory
Accept new Nodes
Search Nodes
Quick search
Advanced Search
Group of Nodes
Introduction
What is Rudder?
Made for production environments
Different roles for a better accessibility
Universality
Key Features
OS independent target configuration state definition
Centralize and aggregate real configuration states
Automatic inventory
REST API
Audit trace and Change Requests
Centralized authentication (LDAP, Active Directory, plugins)
Extensibilty
Technical architecture and software dependencies
Functional architecture of Rudder
Network architecture in client/server mode
Agents
Installation
Quick installation
Requirements
Networking
Mandatory flows
Optional flows
DNS - Name resolution
JVM Security Policy
Fully supported Operating Systems
For Rudder Nodes
For Rudder Root Server
Partially supported Operating Systems
For Rudder Nodes
For Rudder Root Server
Cloud compatibility
Hardware specifications for Rudder Agent
Hardware specifications and sizing for Rudder Root Server
Memory
Disk
Install Rudder Server
Install Rudder Root server on Debian or Ubuntu
Add the Rudder packages repository
Install your Rudder Root Server
Initial configuration of your Rudder Root Server
Validate the installation
Install Rudder Root server on SLES
Configure the package manager
Add the Rudder packages repository
Install your Rudder Root Server
Initial configuration of your Rudder Root Server
Validate the installation
Install Rudder Root server on RHEL-like systems
Add the Rudder packages repository
Install your Rudder Root Server
Initial configuration of your Rudder Root Server
Validate the installation
Install Rudder Agent
Install Rudder Agent on Debian or Ubuntu
Install Rudder Agent on RHEL-like systems
For RHEL/CentOS
For Amazon Linux
For Amazon Linux 2
Install Rudder Agent on SLES
Configure and validate
Configure Rudder Agent
Validate new Node
Install Rudder Relay (optional)
On the relay
On the root server
Validation
Adding nodes to a relay server
Upgrade
Upgrade notes
Upgrade from Rudder 3.0 or older
Upgrade from Rudder 3.1, 3.2 or 4.0
Compatibility between Rudder agent 4.1 and older server versions
4.0.x servers
3.1.x and 3.2.x servers
Compatibility between Rudder server 4.1 and older agent versions
4.0.x agents
3.1.x and 3.2.x agents
3.0.x or older
Protocol for reporting
Upgrade manually installed relays (installed before 3.0)
Known issues
On Debian or Ubuntu
On RHEL or CentOS
Rudder server
Rudder agent
On SLES
Technique upgrade
Default case: your standard technique library is pristine
Special case: Techniques from standard library were modified
Web interface usage
Authentication
Presentation of Rudder Web Interface
Rudder Home
Node Management
Configuration Management
Utilities
Settings
Units supported as search parameters
Bytes and multiples
Convenience notation
Supported units
Node management
Node inventory
Accept new Nodes
Search Nodes
Quick search
Advanced Search
Group of Nodes
Configuration concepts
Techniques
Concepts
Manage the Techniques
Create new Techniques
Directives
Rules
Variables
User defined parameters
System variables
Compliance and Drift Assessment
Overview in Rudder
Compliance and drift reporting
How compliance is calculated ?
Validation workflow in Rudder
What is a Change request ?
Change request status
Change request management page
Change request detail page
How to create a Change request ?
How to validate a Change request ?
Roles
Self Validations
Change request and conflicts
Notifications:
Pending change requests
Change already proposed on Rule/Directive/Group
Policy Mode (Audit/Enforce)
How is the effective mode computed?
Technique editor
Introduction
First, what is a Technique ?
What is a Generic method?
Technique Editor
Utility
Interface
Create your first Technique
1. General information
2. Add and configure generic methods
3. Save and apply your technique
Configuration policies
How to
Enforce a line is present in a file only once
Share files between nodes
Security considerations
Data confidentiality
Private data
Common data
Node-Server communication security
File copy
Inventory
Usecases
Dynamic groups by operating system
Library of preventive policies
Standardizing configurations
Using Rudder as an Audit tool
Using Audit mode to validate a policy before applying it
Basic administration
Archives
Archive usecases
Changes testing
Changes qualification
Concepts
Archiving
Importing configuration
Deploy a preconfigured instance
Event Logs
Policy Server
Configure allowed networks
Clear caches
Reload dynamic groups
Plugins
Install a plugin
Basic administration of Rudder services
Restart the agent of the node
Restart the root rudder service
Restart everything
Restart only one component
REST API
Default setup
Rudder Authentication
Apache access rules
User for REST actions
Status
Promises regeneration
Dynamic groups regeneration
Technique library reload
Archives manipulation
Archiving:
Listing:
Restoring a given archive:
Restoring the latest available archive (from a previously archived action, and so from a Git tag):
Restoring the latest available commit (use Git HEAD):
Downloading a ZIP archive
User management
Configuration of the users using a XML file
Generality
Passwords
Configuring an LDAP authentication provider for Rudder
LDAP is only for authentication
Enable LDAP authentication
Authorization management
Pre-defined roles
Custom roles
Going further
Advanced Node management
Node management
Reinitialize policies for a Node
Completely reinitialize a Node
Change the agent run schedule
Installation of the Rudder Agent
Static files
Generated files
Services
Configuration
Rudder Agent interactive
Processing new inventories on the server
Verify the inventory has been received by the Rudder Root Server
Process incoming inventories
Validate new Nodes
Prepare policies for the Node
Agent execution frequency on nodes
Checking configuration (CFEngine)
Inventory (FusionInventory)
Advanced configuration
Policy generation
Update policies button
Regenerate all policies button
Technique creation
Recommended solution: Technique Editor
Using the Technique Editor
Logs
Understanding how Technique Editor works
Directory layout
Sharing ncf code with nodes
From ncf Technique Editor to Rudder Techniques and back
Hooks
Create Technique manually
Prerequisite
Define your objective
Initialize your new Technique
Node properties
Using properties
Local override
Merging properties
Under the hood
Node properties expansion in directives
Feature availability
Usage
Providing a default value
Forcing expansion on the node
JavaScript evaluation in Directives
Feature availability
Usage
Rudder utility library
Standard hash methods
UNIX password-compatible hash methods
Status and future support
Server Event Hooks
Generalities about hooks
node-post-acceptance
When/What ?
Parameters
node-post-deletion
When/What ?
Parameters
node-pre-deletion
When/What ?
Parameters
policy-generation-finished
When/What ?
Parameters
policy-generation-node-finished
When/What ?
Parameters
policy-generation-node-ready
When/What ?
Parameters
policy-generation-started
When/What ?
Parameters
New directives default naming scheme
Advanced administration
Database maintenance
Automatic PostgreSQL table maintenance
PostgreSQL database vacuum
LDAP database reindexing
Migration, backups and restores
Backup
Restore
Migration
Performance tuning
Reports retention
Apache web server
Jetty
Java "Out Of Memory Error"
Configure RAM allocated to Jetty
Optimize PostgreSQL server
Suggested values on an high end server
Suggested values on a low end server
CFEngine
Rsyslog
Maximum number of TCP sessions in rsyslog
Maximum number of file descriptors
Network backlog
Conntrack table
Password management
Configuration of the postgres database password
Configuration of the OpenLDAP manager password
Configuration of the WebDAV access password
Password upgrade
Use a database on a separate server
On the database server
On the root server
Multiserver Rudder
Preliminary steps
Install rudder-relay-top
Install rudder-db
Install rudder-ldap
Install rudder-web
Mirroring Rudder repositories
Monitoring
Monitoring Rudder itself
Monitoring a Node
Monitoring a Server
Monitoring your configuration management
Monitor compliance
Monitor events
Use Rudder inventory in other tools
Export to a spreadsheet
Rundeck and Ansible
Directives ordering
Policy generation and Directive merge
Sorting Directives based on the same Technique
Special use case: overriding generic_variable_definition
Sorting Policies
Example
Troubleshooting and common issues
Rudder extension and integration with third party software
Extending Rudder with plugins
Rudder Plugin
Extending API: rudder-plugin-itop
Adding information to node details: rudder-plugin-external-node-information
Providing new authentication methods
Providing a full new feature: rudder-plugin-datasources
Building your own plugins
Rudder integration in your infrastructure
Existing third party integration
Rundeck
Ansible
iTop
Integrate Rudder thanks to its APIs
Rudder Plugins
Node properties data sources
First set: data source description
Second set: query configuration
Third set: query triggers
Node external reports
Documents naming convention
Plugin configuration
Configuration file location
Configuration file format
Reference
Inventory workflow, from nodes to Root server
Processing inventories on node
Processing inventories on relays
Processing inventories on root server
Queue of inventories waiting to be parsed
Rudder Server data workflow
Configuration files for Rudder Server
Rudder Agent workflow
Request data from Rudder Server
Launch processes
Identify Rudder Root Server
Inventory
Syslog
Apply Directives
Configuration files for a Node
Packages organization
Packages
Software dependencies and third party components
Building the Rudder Agent
Get source
Build a dpkg package
Build an rpm package
Build an agent locally
Generic methods
Command
command_execution
command_execution_result
Condition
condition_from_command
Example
condition_from_expression
Example
condition_from_expression_persistent
Example
Directory
directory_absent
directory_check_exists
directory_create
Environment
environment_variable_present
File
file_check_FIFO_pipe
file_check_block_device
file_check_character_device
file_check_exists
file_check_hardlink
file_check_regular
file_check_socket
file_check_symlink
file_check_symlinkto
file_copy_from_local_source
file_copy_from_local_source_recursion
file_copy_from_local_source_with_check
Examples
file_copy_from_remote_source
file_copy_from_remote_source_recursion
file_create
file_create_symlink
file_create_symlink_enforce
file_create_symlink_force
file_download
file_enforce_content
file_ensure_block_in_section
file_ensure_block_present
file_ensure_key_value
file_ensure_key_value_option
file_ensure_key_value_parameter_in_list
Example
file_ensure_key_value_parameter_not_in_list
Example
file_ensure_key_value_present_in_ini_section
file_ensure_keys_values
Usage
Example
file_ensure_line_present_in_ini_section
file_ensure_line_present_in_xml_tag
file_ensure_lines_absent
file_ensure_lines_present
file_from_string_mustache
file_from_template
file_from_template_jinja2
Setup
Syntax
file_from_template_mustache
Syntax
file_from_template_type
Usage
Template types
Example
file_remove
file_replace_lines
Syntax
Example
file_template_expand
Group
group_absent
group_present
Http
http_request_check_status_headers
http_request_content_headers
Log
log_rudder
Logger
logger_rudder
Package
package_absent
package_check_installed
package_install
package_install_version
package_install_version_cmp
package_install_version_cmp_update
package_present
package_remove
package_state
Setup
Package parameters
Package providers
Examples
package_state_options
package_verify
package_verify_version
Permissions
permissions
permissions_dirs
permissions_dirs_recurse
permissions_recurse
permissions_type_recursion
Schedule
schedule_simple
Example
schedule_simple_catchup
schedule_simple_nodups
schedule_simple_stateless
Service
service_action
Parameters
Implementation
Examples
service_check_disabled_at_boot
service_check_running
service_check_running_ps
service_check_started_at_boot
service_ensure_disabled_at_boot
service_ensure_running
service_ensure_running_path
service_ensure_started_at_boot
service_ensure_stopped
service_reload
service_restart
service_restart_if
service_start
service_stop
Sharedfile
sharedfile_from_node
sharedfile_to_node
Parameters
target_uuid
Example:
User
user_absent
user_create
Variable
variable_dict
variable_dict_from_file
variable_dict_merge
Usage
variable_dict_merge_tolerant
variable_iterator
variable_iterator_from_file
variable_string
variable_string_default
variable_string_from_command
variable_string_from_file
variable_string_from_math_expression
Usage
Supported mathematical expressions
Formatting options
Examples
Man pages
rudder(8)
NAME
SYNOPSIS
DESCRIPTION
OPTIONS
COMMANDS
agent
remote
server
AUTHOR
RESOURCES
COPYING
Technique reference
Files organisation
metadata.xml and CFEngine templates (*.st)
Version number formating
General Rules
Details of the metadata.xml file
The <SECTION> tag
Variables definitions in the <SECTION> tags
Available types for an INPUT variable
The <FILES> tag
Examples
Multivalued sections
Unique variable across several instance
Password handling
Known limitations
Can’t put a multivalued section in a multivalued section
Can’t have several multivalued sections that are components with keys
Can’t have several sections that are components with keys in multivalued Techniques.
Reports reference
Concepts
Report format
Valid report types
Syntax of the Techniques
Generalities
Variable remplacement
Single-valued variable remplacement
Remplacement of variable with one or more values
Remplacement of variable with one or more value, and writing an index all along
Conditionnal writing of a section
Best Practices for Techniques
Naming convention
Raising classes
Writing convention
Technique naming guidelines
In the Technique
In the metadata.xml
Files convention
Maintenance
Testing
Package format
File description
Rudder relay API
Remote Run
Description
Security
Usage
Shared Files
Description
Security
Usage
Appendix: Glossary
License
