After you set up a Razor environment, you're ready to install Razor.
Install Razor
At a minimum, to install Razor, you must install the Razor server. You may also install the client to make interacting the the server easier, and enable authentication security to control permissions.
export RAZOR_HOSTNAME=<server name>
export HTTP_PORT=8150
export HTTPS_PORT=8151
The installation tasks on this page use $<RAZOR_HOSTNAME>
, $<HTTP_PORT>
, and $<HTTPS_PORT>
to represent these variables.
Install the Razor server
Installing Razor involves classifying a node with the pe_razor
module.
When Puppet Enterprise applies this classification, the software downloads automatically and installs a Razor server and a PostgreSQL database. The download can take several minutes.
Because the Razor software is stored online, you need an internet connection to install it.
- In the console, create a classification node group for the Razor server.
- Click the Razor server node group, click Configuration, then in the Add new class field, enter
pe_razor
and click Add class. - Commit changes.
- On the Razor server, run Puppet:
puppet agent -t
Install the Razor server while you're offline
Install Razor using your own remote directory containing a Puppet Enterprise tarball and the Razor microkernel.
Copy the Razor microkernel and the Puppet Enterprise tarball appropriate for your installation to your own FTP site or to the Razor server.
If you save the files locally, when you specify directory paths, use three forward slashes (file:///
). If you save the files on the
Razor server, use two forward slashes (file://
).
[root@razor ~]# tree /tmp/razor_files/
/tmp/razor_files/
├── 2017.2.3/
│ └── puppet-enterprise-2017.2.3-el-7-x86_64.tar.gz
└── microkernel-008.tar
Change the default Razor port
The default ports for Razor are port 8150 for HTTP communication between the server and nodes, and port 8151 for HTTPS, used for accessing the public API. You can optionally change the default ports if they’re occupied by another service, out of range, or blocked by a firewall.
- In the console, select the Classification, then click the node group that contains the pe_razor module.
- On the Configuration tab, under pe_razor in the Parameters box, select whether you want to change server_http_port or server_https_port.
- In the Value field, enter the port number to use, click Add parameter, and then commit changes.
Parameters for the pe_razor
class
Parameters for the pe_razor class enable customization of your Razor installation. You can review configuration settings that are currently being used by Razor with the razor config
command.
pe_razor
class has these parameters: Parameter | Default | Description |
---|---|---|
api_config_blacklist | [‘facts.blacklist’, ‘database_url’] | Properties that Razor hides from query results. You can add additional properties to protect sensitive data. |
auth_config | /etc/puppetlabs/razor-server/shiro.ini | Path to the authentication configuration file. |
auth_enabled | false | true to enable authentication for requests to /api endpoints, or false . |
broker_path | /etc/puppetlabs/razor-server/brokers:brokers | Colon-separated list of directories containing broker types. |
checkin_interval | 15 | Interval, in seconds, at which the microkernel checks in with the Razor server. |
database_url | jdbc:postgresql:razor?user=razor&password=$dbpassword | URL for the Razor server. |
dbpassword | razor | Password to the Razor database. |
facts_blacklist | [‘domain’, ‘filesystems’, ‘fqdn’, ‘hostname’, ‘id’, ‘/kernel.*/’, ‘memoryfree’, ‘memorysize’, ‘memorytotal’, ‘/operatingsystem.*/’, ‘osfamily’, ‘path’, ‘ps’, ‘rubysitedir’, ‘rubyversion’, ‘selinux’, ‘sshdsakey’, ‘/sshfp_[dr]sa/’, ‘sshrsakey’, ‘/swap.*/’, ‘timezone’, ‘/uptime.*/’] | Facts that Razor ignores. Each entry may be a string or a regexp enclosed in /../ where any fact that matches the regexp is dropped. |
facts_match_on | [] | Array of values used to match nodes from within the microkernel to nodes in the Razor database. By default, this parameter excludes /^macaddress.*/ (regex), serialnumber , and uuid , which are already used. |
hook_execution_path | /opt/puppetlabs/puppet/bin | Colon-separated list of paths that Razor searches in order when running hooks, prior to using the default execution path. |
hook_path | /etc/puppetlabs/razor-server/hooks:hooks | Colon-separated list of directories containing hook types. |
match_nodes_on | [‘mac’] | Array of values used to match nodes when a node PXE boots. Values can include mac , serial , asset , oruuid . |
microkernel_debug_level | quiet | Sets the logging level for the microkernel. Valid values are quiet or debug . |
microkernel_extension_zip | /etc/puppetlabs/razor-server/mk-extension.zip | Zip file that specifies custom facts or other code that is unpacked by the microkernel prior to checkin. |
microkernel_kernel_args | " | Additional command-line arguments that are supplied to the microkernel during boot. |
microkernel_url | https://pm.puppetlabs.com/puppet-enterprise-razor-microkernel-$ | Location of the Razor microkernel used to install Razor offline. |
pe_tarball_base_url | https://pm.puppetlabs.com/puppet-enterprise | Location of the Puppet Enterprise tarball used to install Razor offline. |
protect_new_nodes | false | true to make new machines ineligible for provisioning, or false . |
repo_store_root | /opt/puppetlabs/server/data/razor-server/repo | Directory where repository contents are downloaded and served. |
secure_api | true | true to require HTTPS/SSL communication with /api endpoints. |
server_http_port | 8150 | Port that nodes use to communicate with the server over HTTP. Only URLs starting with /svc need to be available on this port. |
server_https_port | 8151 | Port that the client uses to communicate with the server’s public API over HTTPS. Only URLs starting with /api need to be available on this port. |
task_path | /etc/puppetlabs/razor-server/tasks:tasks | Colon-separated list of directories containing tasks. |
Verify the Razor server
Use a test command to verify that the Razor server is correctly installed. The output JSON file test.out
contains a list of available Razor commands.
wget https://$<RAZOR_HOSTNAME>:$<HTTPS_PORT>/api -O test.out
Install the Razor client
The Razor client is installed as a Ruby gem, pe-razor-client
. The process for installing the client differs by platform.
pe-razor-client
, alongside the open source Razor client, razor-client
. If you already have razor-client
installed, or are not sure if you do, run gem uninstall razor-client
before installing the Puppet Enterprise client.Install the Razor client on *nix systems
Make interacting with the Razor server from *nix systems easier by installing the Razor client.
Install the Razor client on Windows systems
Make interacting with the Razor server from Windows systems easier by installing the Razor client.
Enable authentication security
Enable authentication security to control what tasks users can perform. For example, you might limit certain users to read permissions to avoid accidental overwrite of nodes.
Two methods are required to secure your Razor server:
Authentication security using Shiro – disabled by default
Protocol security using HTTPS and TLS/SSL – enabled by default if you’re using Puppet Enterprise and you install Razor on a managed node
Permissions for Razor
These are the available permissions for Razor.
razor <COMMAND_NAME> --help
to view required permissions for each command.Task | Permission |
---|---|
Query all collections | query:* |
Query the node collection | query:nodes |
Query a specific node | query:nodes:<NODE_NAME> |
Run all commands | commands:* |
Create policies | commands:create-policy:* |
Create policies starting with a specific name | commands:create-policy:<NAME>* |
Verify Razor versions
Verify your installation by checking the version of the Razor server and client. This information can also be useful for troubleshooting.
razor --version
or razor -v