/badge.svg){kind=icon}
Puppetboard is a web interface to PuppetDB aiming to replace the reporting functionality of Puppet Enterprise console (previously: Puppet Dashboard) for the open source Puppet.
Puppetboard is packaged and available on PyPI.
There is a Puppet module originally written by Spencer Krum and currently maintained by Voxpupuli that takes care of installing the Puppetboard for you.
To see how to get it working with RedHat/Centos 7 check out these docs.
We provide an official Docker image in the GitHub Container Registry.
You must provide a secret key! Generate one for example by running ruby -e "require 'securerandom'; puts SecureRandom.hex(32)".
You can run the app on your PuppetDB host with this command:
docker run -it \
-e PUPPETDB_HOST=localhost \
-e PUPPETDB_PORT=8080 \
-e SECRET_KEY=XXXXXXXX \
--net=host \
ghcr.io/voxpupuli/puppetboard
Optionally you can set PUPPETBOARD_URL_PREFIX env variable to a value like /puppetboard to run the app under a URL prefix.
You can use the following Puppet Code to have Puppetboard managed by Puppet:
include docker
docker::image { 'ghcr.io/voxpupuli/puppetboard': }
docker::run { 'puppetboard':
image => 'ghcr.io/voxpupuli/puppetboard',
env => [
'PUPPETDB_HOST=127.0.0.1',
'PUPPETDB_PORT=8080',
'PUPPETBOARD_PORT=8088',
'SECRET_KEY=XXXXXXXX',
],
net => 'host',
}
If you want to have all features enabled, you must use SSL talking to PuppetDB:
file { '/etc/puppetboard':
ensure => directory,
}
file { '/etc/puppetboard/key.pem':
ensure => file,
mode => '0644',
source => "/etc/puppetlabs/puppet/ssl/private_keys/${facts['networking']['fqdn']}.pem",
}
file { '/etc/puppetboard/cert.pem':
ensure => file,
mode => '0644',
source => "/etc/puppetlabs/puppet/ssl/certs/${facts['networking']['fqdn']}.pem",
}
include docker
docker::image { 'ghcr.io/voxpupuli/puppetboard': }
docker::run { 'puppetboard':
image => 'ghcr.io/voxpupuli/puppetboard',
volumes => ['/etc/puppetboard:/etc/puppetboard:ro'],
env => [
'PUPPETDB_HOST=puppet', # this must be the certname or DNS_ALT_NAME of the PuppetDB host
'PUPPETDB_PORT=8081',
'PUPPETBOARD_PORT=8080',
'ENABLE_CATALOG=true',
'PUPPETDB_SSL_VERIFY=false',
'PUPPETDB_KEY=/etc/puppetboard/key.pem',
'PUPPETDB_CERT=/etc/puppetboard/cert.pem',
'SECRET_KEY=XXXXXXXX',
'DEFAULT_ENVIRONMENT=*',
],
net => 'host',
}
Within an air gapped environment you want to load all content from your local puppetboard web service.
Add: 'OFFLINE_MODE=true', to the env parameter list of the docker::run Puppet type.
We also provide the Dockerfile, so you can build the image yourself:
docker build -t puppetboard .
Actively maintained packages:
You can also install the package from PyPI and configure a WSGI-capable application server to serve it.
We recommend using virtualenv to provide a separate environment for the app.
virtualenv -p python3 venv
. venv/bin/activate
pip install puppetboard
Please see an article about more deployment setups here.
The default value of usecacheonfailure = true configuration setting for Puppet agents causes Puppet runs to always succeed,
event if there are catalog compilation failures f.e. because of a syntax error in your code. This is because in such
cases with this setting Puppet will just use a cached working catalog and report the run to PuppetDB as successful.
(Although with an error visible in the Puppet run log.)
Therefore, to show the nodes with a catalog compilation as failed in Puppetboard you need to set
usecacheonfailure = false in your nodes' puppet.conf.
Of course you need to configure your Puppet Server to store the Puppet run reports in PuppetDB. If you haven't done that already please follow the PuppetDB documentation about this.
If you run Puppetboard on a different host than PuppetDB then you may want to configure the certificate allow-list for which certificates are allowed to access data from PuppetDB. Please read more about this feature in the PuppetDB documentation here.
Puppetboard will look for a file pointed at by the PUPPETBOARD_SETTINGS environment variable.
The file has to be identical to
default_settings.py
but should only override the settings you need changed.
If you run PuppetDB and Puppetboard on the same machine the default settings provided will be enough to get you started and you won't need a custom settings file.
Assuming your webserver and PuppetDB machine are not identical you will at least have to change the following settings:
PUPPETDB_HOSTPUPPETDB_PORTBy default PuppetDB requires SSL to be used when a non-local client wants to connect. Therefore you'll also have to supply the following settings:
PUPPETDB_SSL_VERIFY = TruePUPPETDB_KEY = /path/to/private/keyfile.pemPUPPETDB_CERT = /path/to/public/keyfile.crtWhen using the Puppetboard Docker image, you may also pass Puppetboard it's certificate contents via these environment variables, either as a multiline string or pre-base64 encoded. This can be useful where the certificate is stored in a secrets store i.e. AWS SSM Parameter Store.
PUPPETDB_CERT="-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----"
PUPPETDB_CERT=LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQouLi4KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
For information about how to generate the correct keys please refer to the
pypuppetdb documentation. Alternatively it is possible
to explicitly specify the protocol to be used setting the PUPPETDB_PROTO variable.
Other settings that might be interesting, in no particular order:
SECRET_KEY: set this to a long string, the same for each application replica, and keep it secret. Refer to
Flask documentation, section
"How to generate good secret keys" for more info. Cannot be an empty string, which is the default.FAVORITE_ENVS: an ordered list of Puppet environment names that will be shown immediately after "All Environments"
and before other environments (which are sorted by name) in the dropdown for choosing the environment shown
in the top-right of the UI. Environments listed here that do not really exist in your deployment are silently ignored.SHOW_ERROR_AS: friendly or raw. The former makes Puppet run errors in Report and Failures views shown
in a modified, (arguably) more user-friendly form. The latter shows them as they are.
Defaults to friendly.CODE_PREFIX_TO_REMOVE: what code path that should be shortened in "Friendly errors" to "…" for readability.
A regexp. Defaults to /etc/puppetlabs/code/environments(/.*?/modules)?.PUPPETDB_TIMEOUT: Defaults to 20 seconds, but you might need to increase this value. It depends on how big the
results are when querying PuppetDB. This behaviour will change in a future release when pagination will be introduced.UNRESPONSIVE_HOURS: The amount of hours since the last check-in after which a node is considered unresponsive.LOGLEVEL: A string representing the loglevel. It defaults to 'info' but can be changed to 'warning' or
'critical' for less verbose logging or 'debug' for more information.ENABLE_QUERY: Defaults to True causing a Query tab to show up in the web interface allowing users to write
and execute arbitrary queries against a set of endpoints in PuppetDB. Change this to False to disable this.
See ENABLED_QUERY_ENDPOINTS to fine-tune which endpoints are allowed.ENABLED_QUERY_ENDPOINTS: If ENABLE_QUERY is True, allow to fine tune the endpoints of PuppetDB APIs that
can be queried. It must be a list of strings of PuppetDB endpoints for which the query is enabled.
See the QUERY_ENDPOINTS constant in the puppetboard.app module for a list of the available endpoints.GRAPH_TYPE: Specify the type of graph to display. Default is
pie, other good option is donut. Other choices can be found here:
C3.js documentationGRAPH_FACTS: A list of fact names to tell PuppetBoard to generate a pie-chart on the fact page. With some fact
values being unique per node, like ipaddress, uuid, and serial number, as well as structured facts it was no longer
feasible to generate a graph for everything.INVENTORY_FACTS: A list of tuples that serve as the column header and the fact name to search for to create
the inventory page. If a fact is not found for a node then undef is printed.INVENTORY_FACT_TEMPLATES: A mapping between fact name and jinja template to customize displayENABLE_CATALOG: If set to True allows the user to view a node's latest catalog. This includes all managed
resources, their file-system locations and their relationships, if available. Defaults to False.REFRESH_RATE: Defaults to 30 the number of seconds to wait until the index page is automatically refreshed.DEFAULT_ENVIRONMENT: Defaults to 'production', as the name suggests, load all information filtered by this
environment value.REPORTS_COUNT: Defaults to 10 the limit of the number of reports to load on the node or any reports page.OFFLINE_MODE: If set to True load static assets (jquery, semantic-ui, etc) from the local web server instead
of a CDN. Defaults to False.DAILY_REPORTS_CHART_ENABLED: Enable the use of daily chart graphs when looking at dashboard and node view.DAILY_REPORTS_CHART_DAYS: Number of days to show history for on the daily report graphs.DISPLAYED_METRICS: Metrics to show when displaying node summary. Example: 'resources.total', 'events.noop'.TABLE_COUNT_SELECTOR: Configure the dropdown to limit number of hosts to show per page.LITTLE_TABLE_COUNT: Default number of reports to show when when looking at a node.NORMAL_TABLE_COUNT: Default number of nodes to show when displaying reports and catalog nodes.LOCALISE_TIMESTAMP: If set to True then timestamps are shown using your browser's timezone. Otherwise UTC is used. Defaults to True.WITH_EVENT_NUMBERS: If set to True then Overview and Nodes list shows exact number of changed resources
in the last report. Otherwise shows only 'some' string if there are resources with given status. Setting this
to False gives performance benefits, especially in big Puppet environments (more than few hundreds of nodes).
Defaults to True.ENABLE_CLASS: If set to True allows the user to view the number of resource events (number of changed resources in the last report) grouped by class.
The resource events are grouped by their status ('failure', 'success', 'noop').CLASS_EVENTS_STATUS_COLUMNS: A mapping between the status of the resource events and the name of the columns of the table to display.CACHE_TYPE: Specifies which type of caching object to use when SCHEDULER_ENABLED is set to True.
The cache is used for the classes view (ENABLE_CLASS is set to True) which requires parsing the events of all the latest reports to group them by Puppet class.
If the last report is present in the cache, we do not parse the events, which avoids unnecessary processing.
If you configure more than one worker, you must use a shared backend (e.g. MemcachedCache) to allow the sharing of the cache between the processes.
Indeed, the SimpleCache type does not allow sharing the cache between processes, it uses the process memory to store the cache.
Defaults to SimpleCache.CACHE_DEFAULT_TIMEOUT: Cache lifetime in second. Defaults to 3600.SCHEDULER_ENABLED: If set to True then a scheduler instance is created in order to execute scheduled jobs. Defaults to False.SCHEDULER_JOBS: List of the scheduled jobs to trigger within a worker.
A job can for example be used to compute a result to be cached. This is the case for the classes view which uses a job to pre-compute at regular intervals the results to be displayed.
Each scheduled job must contain the following fields: id, func, trigger, seconds.SCHEDULER_LOCK_BIND_PORT: Specifies an available port that allows a single worker to listen on it.
This allows to configure scheduled jobs in a single worker. Defaults to 49100.For questions or bug reports you can file an issue.
Puppetboard relies on the pypuppetdb library to fetch data from PuppetDB and is built with the help of the Flask microframework.
If you wish to hack on Puppetboard you should fork/clone the Github repository and then install the requirements through:
pip install --upgrade wheel setuptools
python setup.py develop
pip install --upgrade -r requirements-test.txt
mypy --install-types --non-interactive puppetboard/ test/
You're advised to do this inside a virtualenv specifically created to work on Puppetboard as to not pollute your global Python installation.
You can run the tests with:
pytest --cov=. --cov-report=xml --strict-markers --mypy puppetboard test
pylint --errors-only puppetboard test
You can run the app it in development mode by simply executing:
flask run
You can specify listening host and port with environment variables or command line otions:
export FLASK_RUN_HOST=0.0.0.0
export FLASK_RUN_PORT=8000
flask run
or
flask run --host '0.0.0.0' --port '8000'
Use PUPPETBOARD_SETTINGS to change the different settings or patch default_settings.py directly.
Take care not to include your local changes on that file when submitting patches for Puppetboard.
Place a settings.py file inside the base directory of the git repository that will be used, if the environment
variable is not set.
We welcome contributions to this project. However, there are a few ground rules contributors should be aware of.
This project is licensed under the Apache v2.0 License. As such, your contributions, once accepted, are automatically covered by this license.
Write decent commit messages. Don't use swear words and refrain from uninformative commit messages as 'fixed typo'.
The preferred format of a commit message:
docs/quickstart: Fixed a typo in the Nodes section.
If needed, elaborate further on this commit. Feel free to write a
complete blog post here if that helps us understand what this is
all about.
Fixes #4 and resolves #2.
If you'd like a more elaborate guide on how to write and format your commit messages have a look at this post by Tim Pope.
please see: RELEASE.md
The app code is licensed under the Apache License, Version 2.0.
The favicon has been created based on the icon created by Jonathan Coutiño under the Attribution 3.0 Unported (CC BY 3.0) license, downloaded from the Noun Project.
All notable changes to this project will be documented in this file.
Merged pull requests:
Implemented enhancements:
Merged pull requests:
Implemented enhancements:
Fixed bugs:
Closed issues:
Merged pull requests:
SECRET_KEY can't be empty #979 (kenyon)Merged pull requests:
SECRET_KEY value to a random string by default. This has caused issues in deployments with more than one app replica or when the app was restarted. Please set this to your own long, random string, the same for each application replica. Implements #721.None (default for full node view). PR #908, fixes #907.Thanks to the following contributors of this release:
Big thanks to Louis Charreau who contributed the above feature!
Thanks to René Hernandez 2nd who contributed to this release!
bytes instead of str. (#741).bytes instead of str. (#741).Thanks to the contributor of this release, Shawn Toffel!
LOCALISE_TIMESTAMP = False and document how it works. (#461)Very big thanks to Melchior NOGUES who did most of the development for this release!
(4.0.4 was a partially incorrect release. Please use 4.0.5 instead.)
Thanks to Stephen Ryan who contributed to this release!
Thanks to Marcel Deglau who contributed to this release!
This is mostly a maintenance release.
The major version is bumped because of:
There might be some performance improvements thanks to the upgrade of the core dependencies - Flask, Jinja2, Werkzeug etc.
Additional improvements:
Thanks to the following contributors of this release: @ArthurWuTW, @jcpunk, @carlosduelo.
Thanks to the following contributors of this release: @vilhelmprytz, @ldumont, @allan-reynolds.
Thanks to the following contributors of this release: @Rewerson, @vchepkov.
✨ Thanks to the following contributors of this release: @djluo, @GermanG, @jgrammen-agilitypr, @SeanHood, @tuxmea, @qhess34! 🌟
Thanks to @smortex and @sebastianrakel for their contributions!
>=2.4.0.rc1 because
we need it for Python 3.9 supportThis is a bugfix and maintenance release. The major version is bumped because of the Python 3.5 support drop.
Features:
Bugfixes:
Other:
in reports (#576)
v2 on PuppetDB >= 5.3.11 and < 6.0.0 (#558)dailyreport.js that caused it not to render when served under a non-default virtual host (#557)Metrics listing page. This change now supports the changes in PuppetDB >= 6.9.1 (https://puppet.com/security/cve/CVE-2020-7943/)v1 and v2 endpoints
depending on the version of the server. Any PuppetDB >= 6.9.1 will be queried with
the v2 endpoint automatically (because v1 is disabled from here forward). Any
PuppetDB <= 6.9.0 will use v1.>=2.1.0 because changes were needed in this library to support the metrics v2 fixes.urllib.>=1.2.0 to >=2.0.0* Updating the pypuppetdb requirement to >= 0.2.1, using information
available in PuppetDB 3.2 and higher
* latest_report_hash and latest_report_status fields from the Nodes endpoint, this effectively deprecates the report_latest() function* code_id from the Catalogs endpoint (current unused) * Adding a automatic refresh on the overview page to reload the page every X number of seconds, defaults to 30. This is configurable with the configuration option REFRESH_RATE * Fixing the table alignment in the catalog_compare() page by switching to fixed tables from basic tables. * Using colors similar to Puppet Dashboard and Foreman for the status counts sections
templates/_macros.html status_counts that shows node/report status information, like what is avaiable on the index and nodes pages, available to the reports pages and tables also.limit_reports from utils.py because this helper function has been replaced by the limit PuppetDB paging function.Known Issues
dev.py.setup.py. The license shouldn't be longer than 200 characters. We were including the full license tripping up tools like bdist_rpm.This release introduces a few big changes. The most obvious one is the revamped Overview page which has received significant love. Most of the work was done by Julius Härtl. The Nodes tab has been given a slight face-lift too.
Other changes:
PUPPETDB_SSL is gone and replaced by PUPPETDB_SSL_VERIFY which now defaults to True. This only affects connections to PuppetDB that happen over SSL.PUPPETDB_CERT and PUPPETDB_KEY are provided.UNRESPONSIVE_HOURS has been added which denotes the amount of hours after which Puppetboard will display the node as unreported if it hasn't checked in. We default to 2 hours.Puppetboard is now neatly packaged up and available on PyPI. This should significantly help reduce the convoluted installation instructions people had to follow.
Updated installation instructions have been added on how to install from PyPI and how to configure your HTTPD.
In this release we've introduced a few new things. First of all we now require pypuppetdb version 0.0.4 or later which includes support for the v3 API introduced with PuppetDB 1.5.
Because of changes in PuppetDB 1.5 and therefor in pypuppetdb users of the v2 API, regardless of the PuppetDB version, will no longer be able to view reports or events.
In light of this the following settings have been removed:
PUPPETDB_EXPERIMENTALTwo new settings have been added:
PUPPETDB_API: an integer, defaulting to 3, representing the API version we want to use.ENABLE_QUERY: a boolean, defaulting to True, on wether or not to be able to use the Query tab.We've also added a few new features:
Initial release.
* This Changelog was automatically generated by github_changelog_generator
FAQs
Web frontend for PuppetDB
We found that puppetboard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.
Security News
Research
Socket researchers found a malicious Maven package impersonating the legitimate ‘XZ for Java’ library, introducing a backdoor for remote code execution.