Munki Presentation

A quick intro to Munki and a talk about how it's used at OneHealth to bring DevOps-ish attitudes to the IT world.

Transcript

1. managing os x client machines with munki San Diego DevOps Meeting! April 16, 2014 1 Welcome to the meeting.
2. 2 Differences between munki and ‘configuration management’ like chef. Set it and forget it - munki sets it’s clients to a certain state, and then leaves them be, where chef runs on a regular basis to enforce things. Apple software updates can come from Apple directly, or they can come from a local cache (reposado/apple sus). Common software deployment (mostly .apps, but .pkgs are common as well).
3. 2 what is munki? Differences between munki and ‘configuration management’ like chef. Set it and forget it - munki sets it’s clients to a certain state, and then leaves them be, where chef runs on a regular basis to enforce things. Apple software updates can come from Apple directly, or they can come from a local cache (reposado/apple sus). Common software deployment (mostly .apps, but .pkgs are common as well).
4. 2 what is munki? Munki is a set of tools that can be used to manage software installs (and removals) on OS X client machines. Differences between munki and ‘configuration management’ like chef. Set it and forget it - munki sets it’s clients to a certain state, and then leaves them be, where chef runs on a regular basis to enforce things. Apple software updates can come from Apple directly, or they can come from a local cache (reposado/apple sus). Common software deployment (mostly .apps, but .pkgs are common as well).
5. 2 what is munki? Munki is a set of tools that can be used to manage software installs (and removals) on OS X client machines. It can handle the Apple package format, Adobe Enterprise Deployment "packages", and drag-and-drop disk images as installer sources. Differences between munki and ‘configuration management’ like chef. Set it and forget it - munki sets it’s clients to a certain state, and then leaves them be, where chef runs on a regular basis to enforce things. Apple software updates can come from Apple directly, or they can come from a local cache (reposado/apple sus). Common software deployment (mostly .apps, but .pkgs are common as well).
6. 2 what is munki? Munki is a set of tools that can be used to manage software installs (and removals) on OS X client machines. It can handle the Apple package format, Adobe Enterprise Deployment "packages", and drag-and-drop disk images as installer sources. It can also be configured to serve Apple Software Updates - either from Apple’s server or your own. Differences between munki and ‘configuration management’ like chef. Set it and forget it - munki sets it’s clients to a certain state, and then leaves them be, where chef runs on a regular basis to enforce things. Apple software updates can come from Apple directly, or they can come from a local cache (reposado/apple sus). Common software deployment (mostly .apps, but .pkgs are common as well).
7. 2 what is munki? Munki is a set of tools that can be used to manage software installs (and removals) on OS X client machines. It can handle the Apple package format, Adobe Enterprise Deployment "packages", and drag-and-drop disk images as installer sources. It can also be configured to serve Apple Software Updates - either from Apple’s server or your own. Differences between munki and ‘configuration management’ like chef. Set it and forget it - munki sets it’s clients to a certain state, and then leaves them be, where chef runs on a regular basis to enforce things. Apple software updates can come from Apple directly, or they can come from a local cache (reposado/apple sus). Common software deployment (mostly .apps, but .pkgs are common as well).
8. general information The basics of munki. 3
9. the tools 4
10. • munkiimport the tools This is the primary tool you will use to put packages in your munki repository 4
11. • munkiimport • manifestutil the tools This tool is used to manage your software manifests. 4
12. • munkiimport • manifestutil • makecatologs the tools After adding new packages, changing existing packages, or pretty much anything, this will update your munki software catologs. 4
13. • munkiimport • manifestutil • makecatologs • managedsoftwareupdate the tools This runs on the client to check for and install software. 4
14. • munkiimport • manifestutil • makecatologs • managedsoftwareupdate • launchd the tools The launchd item allows these things to happen on the client machine at scheduled times and without requiring admin. 4
15. managedsoftwareupdate and Managed Software Update.app! 5
16. managedsoftwareupdate and Managed Software Update.app! managedsoftwareupdate is the commandline version. It is invoked automatically by launchd, or you (the admin) can run it yourself manually.! Managed Software Update.app is the user friendly GUI version. This can be ran manually, or scheduled to run automatically (again through launchd). 5
17. managedsoftwareupdate and Managed Software Update.app! 5
18. managedsoftwareupdate and Managed Software Update.app! Managed Software Update.app does not require administrator privileges, while managedsoftwareupdate does.! ! You can control the frequency of checks. 5
19. munkiimport, manifestutil, makecatalogs 6 Demonstration of adding a package to a catalog, using manifestutil to add that to a manifest, and using makecatalogs when a change is made to a pkginfo file.
20. munkiimport, manifestutil, makecatalogs 6 Live Demo time! Demonstration of adding a package to a catalog, using manifestutil to add that to a manifest, and using makecatalogs when a change is made to a pkginfo file.
21. breakdown of the components 7
22. breakdown of the components 7 • Manifests contain lists of software of install/uninstall on particular clients.
23. breakdown of the components 7 • Manifests contain lists of software of install/uninstall on particular clients. • Catalogs contain the pkginfo for all the software in the catalog.
24. breakdown of the components 7 • Manifests contain lists of software of install/uninstall on particular clients. • Catalogs contain the pkginfo for all the software in the catalog. • pkginfo contains parameters for the installation/ removal of software.
25. install/uninstall types 8 explain the three main types - optional installs, managed installs, managed uninstalls.
26. install/uninstall types • optional_installs 8 explain the three main types - optional installs, managed installs, managed uninstalls.
27. install/uninstall types • optional_installs • managed_installs 8 explain the three main types - optional installs, managed installs, managed uninstalls.
28. install/uninstall types • optional_installs • managed_installs • managed_uninstalls 8 explain the three main types - optional installs, managed installs, managed uninstalls.
29. other types 9 apple software updates (pkginfo type and regular) update_for requires
30. other types • apple software updates 9 apple software updates (pkginfo type and regular) update_for requires
31. other types • apple software updates • update_for 9 apple software updates (pkginfo type and regular) update_for requires
32. other types • apple software updates • update_for • requires 9 apple software updates (pkginfo type and regular) update_for requires
33. client configuration 10 munkitools can be broken down into 4 sections (and installed seperately) -munkitools_admin (admin tools, not required for client), munkitools_core, munkitools_app, munkitools_launchd (restart required, not often updated) ! Configure manually via `defaults write` or deploy via a package.
34. client configuration • Install munkitools 10 munkitools can be broken down into 4 sections (and installed seperately) -munkitools_admin (admin tools, not required for client), munkitools_core, munkitools_app, munkitools_launchd (restart required, not often updated) ! Configure manually via `defaults write` or deploy via a package.
35. client configuration • Install munkitools • Configure managedinstalls.plist 10 munkitools can be broken down into 4 sections (and installed seperately) -munkitools_admin (admin tools, not required for client), munkitools_core, munkitools_app, munkitools_launchd (restart required, not often updated) ! Configure manually via `defaults write` or deploy via a package.
36. This is where you configure the client.! There are only two required values-! ClientIdentifier and SoftwareRepoURL managedinstalls.plist 11 /Library/Preferences/ManagedInstalls.plist ClientIdentifier - tells munki what manifest to use SoftwareRepoURL - tells munki client where the server is! Serve apple updates from a local cache!
37. managedinstalls.plist There are other values you can configure.! SoftwareUpdateServerURL and InstallAppleSoftwareUpdates if you want to serve apple updates are the most common. 11 /Library/Preferences/ManagedInstalls.plist ClientIdentifier - tells munki what manifest to use SoftwareRepoURL - tells munki client where the server is! Serve apple updates from a local cache!
38. 12 bootstrap You can also bootstrap with munki.! Just add:! /Users/Shared/.com.googlecode.munki.checkandinstallatstartup Bootstrapping will automatically run munki for you until there are no more managed_installs left.
39. onehealth 13 This can be ‘new out of box’ or ‘new to the next user’ machines. Out of box machines do not necessarily need to be erased!
40. onehealth So how does this work at OneHealth? 13 This can be ‘new out of box’ or ‘new to the next user’ machines. Out of box machines do not necessarily need to be erased!
41. onehealth So how does this work at OneHealth? The workflow is pretty simple. 13 This can be ‘new out of box’ or ‘new to the next user’ machines. Out of box machines do not necessarily need to be erased!
42. onehealth With existing machines - munki + munkibootstrap packages are installed (ARD, manually, ssh, etc).! Managed installs are automatically in effect, optional installs are in ‘self-service’. 13 This can be ‘new out of box’ or ‘new to the next user’ machines. Out of box machines do not necessarily need to be erased!
43. onehealth New machines - AutoDMG built (‘never booted’) image with an admin user and munki + munkibootstrap preinstalled. This image is deployed (ASR, DeployStudio, NetBoot) and the machine is automatically bootstrapped. 13 This can be ‘new out of box’ or ‘new to the next user’ machines. Out of box machines do not necessarily need to be erased!
44. automation 14 But who wants to deal with checking for updated applications, then using munkiimport to import them, etc? Let’s automate that! AutoPkg + Jenkins for automation!
45. automation Just having munki is already a huge step forward from manually installing packages/updates on each client. 14 But who wants to deal with checking for updated applications, then using munkiimport to import them, etc? Let’s automate that! AutoPkg + Jenkins for automation!
46. automation Just having munki is already a huge step forward from manually installing packages/updates on each client.! But why settle with that? 14 But who wants to deal with checking for updated applications, then using munkiimport to import them, etc? Let’s automate that! AutoPkg + Jenkins for automation!
47. automation 14 Enter AutoPkg! But who wants to deal with checking for updated applications, then using munkiimport to import them, etc? Let’s automate that! AutoPkg + Jenkins for automation!
48. automation 14 Enter AutoPkg! Also enter Jenkins! But who wants to deal with checking for updated applications, then using munkiimport to import them, etc? Let’s automate that! AutoPkg + Jenkins for automation!
49. apple updates Reposado + Margarita 15 Gives me branches to control what updates are approved, munki makes it so my users don’t have to have admin. ! Reposado is a cli tool, margarita is a graphical web frontend.
50. Software Update branches (test, release, etc). apple updates 15 No admin required! Gives me branches to control what updates are approved, munki makes it so my users don’t have to have admin. ! Reposado is a cli tool, margarita is a graphical web frontend.
51. from the user perspective 16 MSU.app - Checks for managed_installs/uninstalls then lets user select optional_installs/uninstalls. ! Everything without a password. ! If a package requires a restart, munki will prompt the user and take care of it.
52. from the user perspective Managed Software Update.app - automatic or user initiated. 16 MSU.app - Checks for managed_installs/uninstalls then lets user select optional_installs/uninstalls. ! Everything without a password. ! If a package requires a restart, munki will prompt the user and take care of it.
53. from the user perspective Managed Software Update.app - automatic or user initiated. No admin prompt. No need to contact IT Support. 16 MSU.app - Checks for managed_installs/uninstalls then lets user select optional_installs/uninstalls. ! Everything without a password. ! If a package requires a restart, munki will prompt the user and take care of it.
54. from the user perspective Managed Software Update.app - automatic or user initiated. No admin prompt. No need to contact IT Support. Munki will restart the computer if needed. 16 MSU.app - Checks for managed_installs/uninstalls then lets user select optional_installs/uninstalls. ! Everything without a password. ! If a package requires a restart, munki will prompt the user and take care of it.
55. from admin perspective 17 There’s not much to do at this point. Approve packages that get added by autopkg, add new software as needed. ! MunkiReport! Show them.
56. from admin perspective Approve new versions of apps brought in by AutoPkg/Jenkins. 17 There’s not much to do at this point. Approve packages that get added by autopkg, add new software as needed. ! MunkiReport! Show them.
57. from admin perspective Approve new versions of apps brought in by AutoPkg/Jenkins. Do nothing. 17 There’s not much to do at this point. Approve packages that get added by autopkg, add new software as needed. ! MunkiReport! Show them.
58. from admin perspective Approve new versions of apps brought in by AutoPkg/Jenkins.! Do nothing.! Occasionally add new software to munki. 17 There’s not much to do at this point. Approve packages that get added by autopkg, add new software as needed. ! MunkiReport! Show them.
59. from admin perspective 17 MunkiReport-php! Runs a series of pre- and postflight scripts and sends them to a server. There’s not much to do at this point. Approve packages that get added by autopkg, add new software as needed. ! MunkiReport! Show them.
60. tl;dr Here’s the step-by-step version of our workflow 18 User specific info includes hostname and user account (non-admin). Even these aren’t done totally manually - osx admin/user script for things that haven’t been put in munki yet. Also. CreateUserpkg for user creation.
61. tl;dr Here’s the step-by-step version of our workflow 1. Take new machine out of box. 18 User specific info includes hostname and user account (non-admin). Even these aren’t done totally manually - osx admin/user script for things that haven’t been put in munki yet. Also. CreateUserpkg for user creation.
62. tl;dr Here’s the step-by-step version of our workflow 1. Take new machine out of box. 2. Bootstrap it with munki, or install thin image with munki configured. 18 User specific info includes hostname and user account (non-admin). Even these aren’t done totally manually - osx admin/user script for things that haven’t been put in munki yet. Also. CreateUserpkg for user creation.
63. tl;dr Here’s the step-by-step version of our workflow 1. Take new machine out of box. 2. Bootstrap it with munki, or install thin image with munki configured. 3. Go do something else while munki runs (30 minutes tops). 18 User specific info includes hostname and user account (non-admin). Even these aren’t done totally manually - osx admin/user script for things that haven’t been put in munki yet. Also. CreateUserpkg for user creation.
64. tl;dr Here’s the step-by-step version of our workflow 1. Take new machine out of box. 2. Bootstrap it with munki, or install thin image with munki configured. 3. Go do something else while munki runs (30 minutes tops). 4. Configure user specific info (This bit can be automated using DeployStudio. For now, we do it by hand.) 18 User specific info includes hostname and user account (non-admin). Even these aren’t done totally manually - osx admin/user script for things that haven’t been put in munki yet. Also. CreateUserpkg for user creation.
65. tl;dr Here’s the step-by-step version of our workflow 1. Take new machine out of box. 2. Bootstrap it with munki, or install thin image with munki configured. 3. Go do something else while munki runs (30 minutes tops). 4. Configure user specific info (This bit can be automated using DeployStudio. For now, we do it by hand.) 5. Give the machine to its new user. 18 User specific info includes hostname and user account (non-admin). Even these aren’t done totally manually - osx admin/user script for things that haven’t been put in munki yet. Also. CreateUserpkg for user creation.
66. links • Autopkg - https://github.com/autopkg/autopkg! • AutoDMG - https://github.com/MagerValp/AutoDMG! • Munki - https://code.google.com/p/munki/! • MunkiReport-php - https://github.com/munkireport/ munkireport-php! • Jenkins - http://jenkins-ci.org/! • Me - http://drpebcak.svbtle.com/ 19 Additional Resources - https://github.com/MagerValp/CreateUserPkg https://github.com/grahamgilbert/Crypt-Server https://github.com/wdas/reposado https://github.com/jessepeterson/margarita