Entitlements through node groups

Enterprise Modules uses an entitlements manager (EM License Manager) to check what subscriptions you have on what nodes. We have multiple ways to inform the entitlements manager what nodes are allowed to use the modules. One of the easiest ways is to use the Puppet Enterprise® classifier (PE Classifier).

How does it work?

In the PE classifier, you can create specific node groups that tell the EM license manager what nodes are entitled to use the module. You can use the “pinning” functionality from PE to pin the license to a specified node.

You can also use rules to specify rules that determine what nodes are allowed to use the module.

To make this an easy process, we have created some helper classes to assist you.

Where to put the entitlement files

The best way to distribute the entitlements files to all nodes is to create a module called em_license, create a directory files, and put all of your entitlements files in there.

Let’s say, for example, that you have a default Puppet® installation and are running in a production environment. The path for all the entitlements files would be: /etc/puppetlabs/code/production/modules/em_license

How to enable license

When you are using an Enterprise Modules profiles module

When you are using any of our profile modules like ora_profile, ibm_profile or wls_profile, you don’t have to do anything anymore. The profile modules classes take care of fetching the entitlements and putting them in the right place.

When you are NOT using one of our profile modules

Before you can use our licensed modules, you have to ensure the entitlements the entitlement files are copied to all agents. It has to be done before any of the modules are applied. We have created a helper class to do this for you. Place this code somewhere “early” in your Puppet® evaluation, for example, in your your site.pp file.

include easy_type::license::activate  # Required to distribute EM entitlement files

Now every agent in your environment will activate all entitlements in /etc/puppetlabs/code/production/modules/em_license.

Customizing

By default, the easy_type::license::activate class will copy all files from the main puppet server. If you want to use a specific server, you can set a value for hiera variable easy_type::license::available::server.

If you want another directory and module name, both on the server and on the agent, you can use the variable easy_type::license::available::path.

Here is an example of setting the properties to a different value:

easy_type::license::available::server: large_server
easy_type::license::available::path: my_own_license_module

Please use the customizations with care.

Creating the base node groups

The EM license manager will look at certain specified node groups. The puppet class easy_type::license::node_groups will create all of the required base node groups for you. By default, it will create a node group for ALL of the commercial modules from Enterprise Modules. When you want to create less node groups, you can customize this by adding some hiera data. Here is an example when you are only using the ora_config, ora_install and ora_cis module:

easy_type::license::node_groups::modules:
  - ora_config
  - ora_install
  - ora_cis

It is not required to do this, but some people find having node groups for things they don’t use a nuisance.

The class easy_type::license::node_groups uses the module WhatsARanjit/node_manager to manage the node groups. So when you are using this class, be sure to add the dependency to your Puppetfile.

Adding a license group

When you get a entitlement from Enterprise Modules, it contains a license ID. This ID is needed to create the node group. Here is an example on how you can create the required node group:

node_group { 'MY-LIC-ID-2021-01-this_needs_to_b_uniq':
  ensure               => 'present',
  environment          => 'production',
  parent               => 'wls_config',
  rule                 => ['or',
  ['~',
    ['fact', 'clientcert'],
    'wls'],
  ['~',
    ['fact', 'clientcert'],
    'osb']],
}

In the name of the node group, we have the license ID MY-LIC-ID-2021-01 and the part this_needs_to_b_uniq. They must be separated by a dash (e.g. -). The parent of the node group must be the module you want the license group to work for. In this example, it is wls_config.

You can use Puppet® to create the rule sets. The example here entitles nodes where the name (e.g., clientcert) contains either wls or osb.

Checking the license

You can use the Puppet® classifier to see what nodes are entitled. You can also use this command:

$ puppet emlicense inspect

You can use this command both on the puppetserver as well as on the individual licensed nodes.