Puppet: How and Why Luke Kanies luke@reductivelabs.com Founder, - - PowerPoint PPT Presentation

▶
puppet how and why
SMART_READER_LITE
LIVE PREVIEW

Puppet: How and Why Luke Kanies luke@reductivelabs.com Founder, - - PowerPoint PPT Presentation

Sep 23, 2022 221 likes •1.22k views

Puppet: How and Why Luke Kanies luke@reductivelabs.com Founder, Reductive Labs Nashville, Tennessee USA Why it exists, how it works, and why it works this way Automation tools in general Not exactly modern Image from

slide-1
SLIDE 1

Luke Kanies luke@reductivelabs.com Founder, Reductive Labs Nashville, Tennessee USA

Puppet: How and Why

Why it exists, how it works, and why it works this way
slide-2
SLIDE 2
slide-3
SLIDE 3

Automation tools in general

slide-4
SLIDE 4

Not exactly modern

Image from http://flickr.com/photos/silverwood/593965547/
slide-5
SLIDE 5

In fact, they kinda suck

Image from http://flickr.com/photos/jefframone/1426716646/ Why?
slide-6
SLIDE 6

SSH

O

slide-7
SLIDE 7

Developer Sysadmin

* How many of you have written software to manage computers? * How many have published this software?
slide-8
SLIDE 8

Developer Sysadmin Three people

* How many of you have written software to manage computers? * How many have published this software?
slide-9
SLIDE 9

Somebody has to do something, and it's just incredibly pathetic that it has to be us.

  • - Jerry Garcia
slide-10
SLIDE 10 SSH Cfengine ? We needed something better
slide-11
SLIDE 11 SSH Cfengine ? A tool you can’t aord not to adopt
slide-12
SLIDE 12 Image from http://flickr.com/photos/13035641@N00/270353459/ I want Puppet to be the equivalent of bringing a gun to a knife fight. This analogy works with agriculture, metalworking, or nearly any tech., but it’s easiest with war
slide-13
SLIDE 13

But that’s still not enough

slide-14
SLIDE 14

What is a sysadmin?

Image from http://flickr.com/photos/shirleytwofeathers/2068713495/ Firefighter? Architect? Developer? Tape-changer? All of the above?
slide-15
SLIDE 15 Image from http://flickr.com/photos/kenskritters/2128853769/ I want to cause sysadmin speciation. These are house finches, reminding one of the finches Darwin observed in the Galapagos
slide-16
SLIDE 16

People are finally figuring out puppet and how it gets you to the pub by 4pm. Note that I've been at this pub since 2pm.

  • - Jorge Castro
slide-17
SLIDE 17

Either you can manage many machines with little effort

slide-18
SLIDE 18

Either you can manage many machines with little effort Or you can’t

slide-19
SLIDE 19

How do we create that tool?

slide-20
SLIDE 20

Programming SysAdmin Low-level, non- portable Assembly commands and files Abstract, portable C* Resources

An Analogy

* For small values of abstract

* The assembly programmers fought the adoption of C * Fear for your career if you’re a bit too fond of assembly * It’s not about few people, it’s about higher quality and productivity * Are there more or fewer programmers today than in the days of assembly?
slide-21
SLIDE 21

Infrastructure 2.0

This is a joke, kind of. Talk about going to Web 2.0. We’re stealing their ideas and using them to make our infrastructure better. In general, we need to steal more ideas.
slide-22
SLIDE 22

Abstraction

slide-23
SLIDE 23

Portable Resources

This:

slide-24
SLIDE 24

Portable Resources

Becomes: This:

slide-25
SLIDE 25

Portable Resources

Becomes: This:

slide-26
SLIDE 26

Portable Resources

Becomes: This:

slide-27
SLIDE 27

Portable Resources

Becomes: This:

slide-28
SLIDE 28

Portable Resources

Becomes: This:

slide-29
SLIDE 29

Resource Providers

23 package types Users in NetInfo, useradd, pw Support for Debian, Ubuntu, Red Hat, Solaris, OS X, Gentoo, SuSE, FreeBSD, and more

slide-30
SLIDE 30

Your infrastructure can use µf, too

Hang out on this slide, make the point
slide-31
SLIDE 31

Reuse

slide-32
SLIDE 32

“...we’ve just switched from CVS to SVN, and it’s awesome”

slide-33
SLIDE 33

Your Infrastructure is a program

slide-34
SLIDE 34

Same concept, different code

Debian

We’re doing the same thing with different commands on different platforms
slide-35
SLIDE 35

Same concept, different code

Debian Red Hat

We’re doing the same thing with different commands on different platforms
slide-36
SLIDE 36

Same concept, different code

Debian Red Hat

We’re doing the same thing with different commands on different platforms
slide-37
SLIDE 37

Portability and Naming

slide-38
SLIDE 38

One solution per problem

slide-39
SLIDE 39

Network Effects

slide-40
SLIDE 40

Completeness

slide-41
SLIDE 41

Relationships matter but are often implicit

slide-42
SLIDE 42

Relationships matter but are often implicit

Package

slide-43
SLIDE 43

Relationships matter but are often implicit

Package Configuration

Configuration should get modifed after package installation

slide-44
SLIDE 44

Relationships matter but are often implicit

Package Service

Service should restart when configuration changes

Configuration

Configuration should get modifed after package installation

slide-45
SLIDE 45

Relationships matter

We’ll come back to abstraction
slide-46
SLIDE 46

Classes provide Intent

This is shareable, releasable code. Classes are analogous with tags
slide-47
SLIDE 47

Puppet as a tool

slide-48
SLIDE 48

Centralized Management

puppetd in the cloud Puppetmasterd puppetd OS X puppetd Linux Code
slide-49
SLIDE 49

Each host gets a Resource Catalog

slide-50
SLIDE 50

Node Classification

slide-51
SLIDE 51

Node Classification

slide-52
SLIDE 52

Node Classification

slide-53
SLIDE 53

SSH Resources

We’ll come back to abstraction
slide-54
SLIDE 54

So You’ve Got a Resource Catalog

slide-55
SLIDE 55

The Configuration Process

* You can change the runinterval * You can trigger runs through puppetrun, SIGUSR1, or puppetd --test
slide-56
SLIDE 56

The Configuration Process

  • 1. Retrieve resource catalog from central

server

* You can change the runinterval * You can trigger runs through puppetrun, SIGUSR1, or puppetd --test
slide-57
SLIDE 57

The Configuration Process

  • 1. Retrieve resource catalog from central

server

  • 2. Determine resource order
* You can change the runinterval * You can trigger runs through puppetrun, SIGUSR1, or puppetd --test
slide-58
SLIDE 58

The Configuration Process

  • 1. Retrieve resource catalog from central

server

  • 2. Determine resource order
  • 3. Check each resource in turn, fixing if

necessary

* You can change the runinterval * You can trigger runs through puppetrun, SIGUSR1, or puppetd --test
slide-59
SLIDE 59

The Configuration Process

  • 1. Retrieve resource catalog from central

server

  • 2. Determine resource order
  • 3. Check each resource in turn, fixing if

necessary

  • 4. Rinse and repeat, every 30 minutes
* You can change the runinterval * You can trigger runs through puppetrun, SIGUSR1, or puppetd --test
slide-60
SLIDE 60

Transactions (for each resource)

slide-61
SLIDE 61

Transactions (for each resource)

  • 1. Retrieve current state (e.g., by querying dpkg

db or doing a stat)

slide-62
SLIDE 62

Transactions (for each resource)

  • 1. Retrieve current state (e.g., by querying dpkg

db or doing a stat)

  • 2. Compare to desired state
slide-63
SLIDE 63

Transactions (for each resource)

  • 1. Retrieve current state (e.g., by querying dpkg

db or doing a stat)

  • 2. Compare to desired state
  • 3. Fix, if necessary (or just log)
slide-64
SLIDE 64

Configurations are idempotent

Idempotency is what allows us to manage a machine through its whole lifecycle
slide-65
SLIDE 65

Configurations are idempotent

Idempotency is what allows us to manage a machine through its whole lifecycle
slide-66
SLIDE 66

Idempotency allows management through the lifecycle

slide-67
SLIDE 67

Resource sorting is done via dependencies

In this context, I sometimes call the Resource Catalog the ‘Resource Graph’

slide-68
SLIDE 68

A Simple Transaction

slide-69
SLIDE 69

A Simple Transaction

slide-70
SLIDE 70

A Simple Transaction

slide-71
SLIDE 71

Client Reporting

slide-72
SLIDE 72
slide-73
SLIDE 73
slide-74
SLIDE 74
slide-75
SLIDE 75

Who’s using Puppet?

“...at Google we're currently using Puppet to manage close to 6,000 Macs, and it's likely our deployment will expand dramatically beyond that....”

Testimonials . . .at Google we're currently using it to manage close to 6,000 Macs, and it's likely our deployment will expand dramatically beyond that. . . Nigel Kersten MacOps
slide-76
SLIDE 76

Puppet vs. Capistrano

slide-77
SLIDE 77

Puppet vs. Cfengine

slide-78
SLIDE 78

It scales like HTTPS

And you don’t even need to centralize it.
slide-79
SLIDE 79

All communication is via XMLRPC over HTTPS

And moving to REST

  • ver HTTPS
slide-80
SLIDE 80

Uses SSL, and provides a Certificate Authority

* Every connection is encrypted, and the only connection that isn’t authenticated is the one that asks for a signed cert * Client certs * Autosign, manual sign, manual certificate generation * You don’t even have to use it
slide-81
SLIDE 81

Logs go to syslog (by default)

slide-82
SLIDE 82
slide-83
SLIDE 83
slide-84
SLIDE 84
slide-85
SLIDE 85

Written in Ruby

  • 1 to 1 test code to real code (and pretty good

coverage)

  • Plugins are nearly always drop-in (resource

types, providers, reports, etc.)

slide-86
SLIDE 86

Language and Library

C was a language and a library, Puppet is a framework and a tool
slide-87
SLIDE 87

An api

* Discovery * Replace webmin in 20 mins * etc.
slide-88
SLIDE 88

ralsh - a thin API wrapper

This uses the same model as the rest of puppet -- it chooses the appropriate provider for the local system. You can edit resources, and it even works over the network.
slide-89
SLIDE 89

Virtualization

Image from http://flickr.com/photos/pingnews/132543603/
slide-90
SLIDE 90 This is all I do
slide-91
SLIDE 91

Bad product, hungry Luke

slide-92
SLIDE 92

Full time since March 2005

slide-93
SLIDE 93

Support, Consulting, Training, and more

slide-94
SLIDE 94

Other Software

slide-95
SLIDE 95

An Irony

Puppet exposes Your Next Big Problem

slide-96
SLIDE 96

Puppet is plumbing

We’re producing software to take more advantage of it. We’re beginning to build a Puppet ecosystem.
slide-97
SLIDE 97

In the Future

  • Discovery
  • Node Classification
  • Probably much more :)
slide-98
SLIDE 98

Questions?