Making Infrastructure S'mores With Chef (ThatConference edition)

When defining the configuration of a system, different domain experts in your organization can bring their own skills and knowledge to mix together to create a delightful recipe for success. In this talk, I will demonstrate how to mix together the graham cracker of a sysadmin, the chocolate of an app dev, and the marshmallow of security to create a delicious treat that meets all the requirements for each discipline. With the use of Test Driven Infrastructure and a Delivery Pipeline, you'll learn how each "chef" can add their portion of the camping delight, but still keep from dropping marshmallows into the campfire.

Talk given at ThatConference on 8/11/2015

Transcript

1. MAKING INFRASTRUCTURE S'MORES WITH CHEF
2. WHOAMI
3. WHAT IS CHEF? ▸ Define reusable resources and infrastructure state as code ▸ Manages deployment and on-going automation ▸ Community content available for all common automation tasks
5. DOMAIN EXPERTS ▸ Systems are complicated today ▸ Nobody can know everything about the stack ▸ Let your domain experts contribute their portion directly
6. ANYONE CAN DO ANYTHING?
7. OLD WAY COMMUNICATE VIA TICKETS
8. NEW WAY COMMUNICATE VIA CODE
9. CONFIGURATION DRIFT
10. DON'T DO THINGS BY HAND Every time someone logs onto a system by hand, they jeopardize everyone's understanding of the system — Mark Burgess
11. PEOPLE MAKE MISTAKES THIS DOESN'T SCALE
12. INFRASTRUCTURE AS CODE Enable the reconstruction of the business from nothing but a source code repository, an application data backup, and [compute] resources — Jesse Robins
13. VERSIONED MODULARIZED TESTED
14. EXECUTABLE DOCUMENTATION
15. HOW DO I MAKE SURE NOBODY MESSES STUFF UP?
16. TESTING IS ESSENTIAL
17. COMMUNICATE THROUGH CODE (REDUX)
18. WHAT HAPPENS WHEN YOU HAVE ONE GROUP WRITING ALL THE AUTOMATION?
22. HOW DO WE SOLVE THIS?
23. USE A PIPELINE
24. ENCOURAGE LOCAL TESTING WITH FOODCRITIC
25. EXAMPLE FOODCRITIC CUSTOM RULE rule 'COMP001', 'Do not allow recipes to mount disk volumes' do tags %w{recipe compliance} recipe do |ast| mountres = find_resources(ast, :type => 'mount').find_all do |cmd| cmd end execres = find_resources(ast, :type => 'execute').find_all do |cmd| cmd_str = (resource_attribute(cmd, 'command') || resource_name(cmd)).to_s cmd_str.include?('mount') end mountres.concat(execres).map{|cmd| match(cmd)} end end
26. ERROR OUTPUT FROM FOODCRITIC $ foodcritic –I /afs/getchef.com/foodcritic-rules/rules.rb . COMP001: Do not allow recipes to mount disk volumes: ./recipes/default.rb:20 COMP001: Do not allow recipes to mount disk volumes: ./recipes/default.rb:26
27. CHEF AUDIT MODE AS THE FINAL TEST
28. EXAMPLE OF AN AUDIT COOKBOOK control '6.9 Ensure FTP Server is not enabled' do it 'is not running the vsftpd service' do expect(service('vsftpd')).to_not be_running expect(service('vsftpd')).to_not be_enabled end it 'is not listening on port 21' do expect(port(21)).to_not be_listening end end
29. SECURITY AND COMPLIANCE SHOULD BE FIRST-CLASS CITIZENS
30. TRUST, BUT VERIFY
31. SEPARATION OF CONCERNS IS A THINGS
32. AKA "MY TESTS ARE FAILING, SO I'LL REMOVE THEM"
33. DEMO TIME
34. TO REVIEW ▸ Trust (but verify) your domain experts ▸ Share the cooking ▸ Foodcritic is your friend ▸ Use your production audit cookbooks in your pipeline ▸ Did I mention test?
35. QUESTIONS?
36. RESOURCES ▸ Sidney Dekker - Field Guide to Human Error ▸ foodcritic.io ▸ learn.chef.io ▸ http://jtimberman.housepub.org/blog/2015/04/03/chef-audit- mode-introduction/
37. MOAR RESOURCES ▸ twitter.com/mattstratton ▸ speakerdeck.com/mattstratton ▸ github.com/mattstratton/infrastruture-smores ▸ github.com/mattstratton/speaking ▸ arresteddevops.com