Adding Nodes Automatically in OpsWorks for Puppet Enterprise
Important
The AWS OpsWorks for Puppet Enterprise service reached end of life on March 31, 2024 and has been disabled for both new and existing customers. We strongly recommend customers migrate
their workloads to other solutions as soon as possible. If you have questions about migration, reach out to the AWS Support Team on AWS re:Post
This topic describes how to add Amazon Elastic Compute Cloud (Amazon EC2) nodes to your OpsWorks for Puppet Enterprise server
automatically. In Add Nodes for the Puppet Master to Manage, you learned
how to use the associate-node
command to add one node at a time to your Puppet
Enterprise server. The code in this topic shows how to add nodes automatically using the
unattended method. The recommended method of unattended (or automatic) association of new nodes
is to configure the Amazon EC2 user data. By default, an OpsWorks for Puppet Enterprise server already has puppet-agent
For information about how to disassociate a node, see Disassociate a Node from an OpsWorks for Puppet Enterprise Server in this guide,
and disassociate-node
in the OpsWorks for Puppet Enterprise API documentation.
Step 1: Create an IAM Role to Use as Your Instance Profile
Create an AWS Identity and Access Management (IAM) role to use as your EC2 instance profile, and attach the
following policy to the IAM role. This policy allows the opsworks-cm
API to
communicate with the EC2 instance during node registration. For more information about
instance profiles, see Using Instance Profiles in the Amazon EC2 documentation. For information about how to
create an IAM role, see Creating an IAM Role in the Console in the Amazon EC2 documentation.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "opsworks-cm:AssociateNode", "opsworks-cm:DescribeNodeAssociationStatus", "opsworks-cm:DescribeServers", "ec2:DescribeTags" ], "Resource": "*", "Effect": "Allow" } ] }
AWS OpsWorks provides an AWS CloudFormation template that you can use to create the IAM role with the
preceding policy statement. The following AWS CLI command creates the instance profile role for
you by using this template. You can omit the --region
parameter if you want to
create the new AWS CloudFormation stack in your default region.
aws cloudformation --region
region ID
create-stack --stack-namemyPuppetinstanceprofile
--template-url https://s3.amazonaws.com/opsworks-cm-us-east-1-prod-default-assets/misc/owpe/opsworks-cm-nodes-roles.yaml --capabilities CAPABILITY_IAM
Step 2: Create Instances by Using an Unattended Association Script
To create EC2 instances, you can copy the user data script that is included in the Starter Kit to the userdata
section of EC2
instance instructions, Amazon EC2 Auto Scaling group launch configurations, or an AWS CloudFormation template. The script
is supported only for EC2 instances running Ubuntu and Amazon Linux operating systems. For
more information about adding scripts to user data, see Running Commands on
Your Linux Instance at Launch in the Amazon EC2 documentation. The easiest way to create
a new node is to use the Amazon EC2
instance launch wizard. This walkthrough uses the Apache web server example module
setup described in Getting Started with OpsWorks for Puppet Enterprise.
-
The user data script in the Starter Kit runs the
opsworks-cm
APIassociate-node
command to associate a new node with your Puppet master. In this release, it also installs the current version of the AWS CLI on the node for you, in case it is not already running the most up-to-date version. Save this script to a convenient location asuserdata.sh
.By default, the name of the new registered node is the instance ID.
-
Follow the procedure in Launching an Instance in the EC2 documentation, with modifications here. In the EC2 instance launch wizard, choose an Amazon Linux AMI.
-
On the Configure Instance Details page, select myPuppetinstanceprofile, the role you created in Step 1: Create an IAM Role to Use as Your Instance Profile, as your IAM role.
-
In the Advanced Details area, upload the
userdata.sh
script that you created in Step 1. -
No changes are needed on the Add Storage page. Go on to Add Tags.
By applying tags to your EC2 instance, you can customize the behavior of
userdata.sh
. For this example, apply the roleapache_webserver
to your node by adding the following tag:pp_role
, with the valueapache_webserver
.Setting the
pp_role
value on the node sets data values that are permanently stored in the node's agent certificate, enabling trusted classification of the node. For more information, see Extension requests (permanent certificate data)in the Puppet platform documentation. -
On the Configure Security Group page, choose Add Rule, and then choose the type HTTP to open port 8080 for the Apache web server in this example.
-
Choose Review and Launch, and then choose Launch. When your new node starts, it applies the Apache configuration of the sample module you set up in Set Up the Starter Kit Apache Example.
-
When you open the webpage linked to the public DNS of your new node, you should see a website that is hosted by your Puppet-managed Apache web server.