Developers, Sysadmins, and everyone else: Why you should be using Serverspec

Sarah Kowalik and Jesse Reynolds
Jan 13 2015, LCA 2015, Auckland
A talk as part of the Miniconf: Developer, Testing, Release and Continuous Integration Automation http://linux.conf.au/schedule/30206/view_talk?day=tuesday

Transcript

1. #lca2015 Developers, Sysadmins, and everyone else: Why you should be using Serverspec Sarah Kowalik & Jesse Reynolds R&D @ Bulletproof
2. #lca2015
3. #lca2015 What is Serverspec?
4. #lca2015 File "/var/log/flapjack/flapjack.log" should be file should be mode 644 should be owned by "flapjack" (FAILED - 1) 1) File "/var/log/flapjack/flapjack.log" should be owned by "flapjack" On host `127.0.0.1' Failure/Error: it { should be_owned_by 'flapjack' } expected `File "/var/log/flapjack/ flapjack.log".owned_by?("flapjack")` to return true, got false sudo -p 'Password: ' /bin/sh -c stat\ -c\ \%U\ / var/log/flapjack/flapjack.log\ \|\ grep\ --\ \\ \^flapjack\\\$
5. #lca2015 Why Serverspec?
6. #lca2015 Automate your QA
7. #lca2015 Validate your expectations
8. #lca2015 Fail early
9. #lca2015 Validate your output
10. #lca2015 Works on my machine (and yours)
11. #lca2015 Build confidence
12. #lca2015 So, how might you use Serverspec?
13. #lca2015 As a Developer…
14. #lca2015 Package installation describe package(’flapjack') do it { should be_installed } it { should be_enabled } end
15. #lca2015 Command Execution describe command(‘flapjack receiver httpbroker —help’) do its(:exit_status) { should eq 0 } its(:stdout) { should match /port/ } its(:stderr) { should match /interval/ } end
16. #lca2015 Running processes describe process("flapjack") do it { should be_running } its(:args) { should match /server start/ } end
17. #lca2015 File presence, perms describe file('/var/log/flapjack/flapjack.log') do it { should be_file } it { should be_mode 644 } end
18. #lca2015 File ownership describe file('/var/log/flapjack/flapjack.log') do it { should be_owned_by 'flapjack' } it { should be_grouped_into 'flapjack' } end
19. #lca2015 File hash describe file('/etc/services') do its(:sha256sum) { should eq ‘a861c…’ } end
20. #lca2015 Listening on a port describe port(3080) do it { should be_listening } end
21. #lca2015 As a Sysadmin…
22. #lca2015 After running puppet on a server
23. #lca2015 File contents describe file('/etc/ssh/sshd_config') do its(:content) { should match /Port 22/ } end
24. #lca2015 Users & Groups describe user('flapjack') do it { should exist } it { should belong_to_group 'flapjack' } it { should have_home_directory ‘/opt/flapjack’ } it { should have_login_shell '/bin/bash' } end
25. #lca2015 Mounted directories describe file('/') do it { should be_mounted.with( :type => 'ext4' )} it { should be_mounted.with( :options => { :rw => true } )} end
26. #lca2015 PHP Configuration describe 'PHP config parameters' do context php_config('session.cache_expire') do its(:value) { should eq 180 } end end
27. #lca2015 Making network changes
28. #lca2015 Iptables describe iptables do it { should have_rule('-P INPUT ACCEPT')} end
29. #lca2015 Host Reachability describe host('target.example.jp') do it { should be_reachable } it { should be_reachable.with( :port => 22, :proto => 'tcp' )} end
30. #lca2015 In the Windows world…
31. #lca2015 File versioning describe file('C:\\Windows\\System32\ \wuapi.dll') do it { should be_version('7.6.7600.256') } end
32. #lca2015 IIS Application Pool describe iis_app_pool('Default App Pool') do it { should exist } it { should have_dotnet_version('2.0') } end
33. #lca2015 IIS Website describe iis_website('Default Website') do it { should be_enabled } it { should be_running } it { should be_in_app_pool('Default App Pool') } it { should have_physical_path('C:\\inetpub\\www') } end
34. #lca2015 Windows Registry Key describe windows_registry_key('HKEY_USERS \S-1-5-21\Test MyKey') do it { should have_property_value('qword value', :type_qword, 'adff32') } it { should have_property_value('binary value', :type_binary, 'dfa0f066') } end
35. #lca2015 Recap
36. #lca2015
37. #lca2015 build package stop publish package Flapjack automated package testing Fail Pass
38. #lca2015 Serverspec deals with both RHEL and Debian families os[:family] # RedHat, Ubuntu, Debian and so on os[:release] # OS release version os[:arch] # i386 or x86_64 describe service('flapjack'), :if => os[:family] == 'ubuntu' do it { should be_enabled } end
40. #lca2015 Questions?
41. #lca2015
42. #lca2015
43. #lca2015 Thank you! http://serverspec.org https://github.com/flapjack/omnibus-flapjack/tree/ master/spec/serverspec http://rspec.info/ http://flapjack.io http://bulletproof.net Liked the talk? Let @SarahKowalik & @jessereynolds know!