Exiting Vacuum: Integrating Configuration Management into your Ecosystem

Slide 1

Slide 1 text

EXITING VACUUM INTEGRATING CONFIGURATION MANAGEMENT Sascha Bates Opscode Wednesday, October 2, 13

Slide 2

Slide 2 text

blog.brattyredhead.com Twin Cities Infracoders Meetup @sascha_d The Ship Show Podcast sascha bates Wednesday, October 2, 13

Slide 3

Slide 3 text

credentials? In love with CM since 2010 Curating developer happiness even longer Wednesday, October 2, 13

Slide 4

Slide 4 text

Wednesday, October 2, 13

Slide 5

Slide 5 text

A tool is just a tool Wednesday, October 2, 13

Slide 6

Slide 6 text

it’s what you do with it that matters Wednesday, October 2, 13

Slide 7

Slide 7 text

WHY AM I HERE? Wednesday, October 2, 13

Slide 8

Slide 8 text

I mess things up so you don’t have to Wednesday, October 2, 13

Slide 9

Slide 9 text

Wasn’t it awesome when it took 3-6 weeks to get a dev server and you got to share it with 60 other people? - nobody ever Wednesday, October 2, 13

Slide 10

Slide 10 text

This Never Happens wrong database connection string deployed to prod smtp server ﬁxed by hand and forgotten test apache server with special conﬁgs ssh keys pushed by hand Wednesday, October 2, 13

Slide 11

Slide 11 text

conﬁguration management deﬁnes and idempotently enforces system state across infrastructure components Wednesday, October 2, 13

Slide 12

Slide 12 text

freedom not bondage Wednesday, October 2, 13

Slide 13

Slide 13 text

conﬁdence Wednesday, October 2, 13

Slide 14

Slide 14 text

Conﬁguration Management is NOT a magic rainbow pixie dusted unicorn coming to save you Wednesday, October 2, 13

Slide 15

Slide 15 text

Wednesday, October 2, 13

Slide 16

Slide 16 text

where do you stand? Wednesday, October 2, 13

Slide 17

Slide 17 text

Wednesday, October 2, 13

Slide 18

Slide 18 text

if I’m really quiet Wednesday, October 2, 13

Slide 19

Slide 19 text

Wednesday, October 2, 13

Slide 20

Slide 20 text

you find yourself... in a maze of twisty little passages all alike Wednesday, October 2, 13

Slide 21

Slide 21 text

Map the Journey Infrastructure Greenﬁelding and Brownﬁelding A Balanced Ecosystem Practical CM Wednesday, October 2, 13

Slide 22

Slide 22 text

Infrastructure who cares? Wednesday, October 2, 13

Slide 23

Slide 23 text

In a perfect universe Provision Identically the brains behind your servers Wednesday, October 2, 13

Slide 24

Slide 24 text

In a perfect universe One deployment process to rule them all because deployments are complicated enough Wednesday, October 2, 13

Slide 25

Slide 25 text

In a perfect universe Repositories for all OS packages yum install tomcat trumps curl -o http://some-tomcat-url tar -xvf tomcat.gz Wednesday, October 2, 13

Slide 26

Slide 26 text

In a perfect universe Hands-off the servers! this guy again Wednesday, October 2, 13

Slide 27

Slide 27 text

Getting Started making mud pies Wednesday, October 2, 13

Slide 28

Slide 28 text

Infrastructure Crafting Server Provisioning Wednesday, October 2, 13

Slide 29

Slide 29 text

Infrastructure Crafting App Layer Configuration keep configuration data separate from code different configs in different environments deployments controlled by different teams Wednesday, October 2, 13

Slide 30

Slide 30 text

Infrastructure Crafting Dynamic Discovery Across Tiers application instances noticed by web instances noticed by load balancer conﬁgs Wednesday, October 2, 13

Slide 31

Slide 31 text

Infrastructure Crafting Workstation Automation make onboarding a fast happy process eliminate stale epic-length wiki pages Wednesday, October 2, 13

Slide 32

Slide 32 text

Infrastructure Crafting Superior Local Testing vagrant virtualbox/ec2/vmware chef/puppet/ansible Wednesday, October 2, 13

Slide 33

Slide 33 text

Infrastructure Crafting Beef Up Your Pipeline Jenkins + Conﬁguration Management = powa bootstrap/deploy automated integration/functional testing ftw Wednesday, October 2, 13

Slide 34

Slide 34 text

Getting Started don’t do this Wednesday, October 2, 13

Slide 35

Slide 35 text

Pick a Sane Use Case don’t try to automate the world small achievable measurable impactful Wednesday, October 2, 13

Slide 36

Slide 36 text

Pick a Sane Use Case stay agile and visible demo your impactful automation show time/frustration saved Wednesday, October 2, 13

Slide 37

Slide 37 text

Keep an Open Mind “because we’ve always done it that way” is no longer acceptable Wednesday, October 2, 13

Slide 38

Slide 38 text

Refactoring Happens Wednesday, October 2, 13

Slide 39

Slide 39 text

Brownﬁelding your biggest challenge is people Wednesday, October 2, 13

Slide 40

Slide 40 text

Brownﬁelding coloring inside the lines Wednesday, October 2, 13

Slide 41

Slide 41 text

Brownﬁelding collaborating legacy apps have possessive owners be inclusive, ask questions listen when they tell you what will work mute criticism Wednesday, October 2, 13

Slide 42

Slide 42 text

A Balanced Ecosystem automation can’t live in a vacuum Wednesday, October 2, 13

Slide 43

Slide 43 text

a package manager a package repository a substitute for version control Conﬁguration Management is not Wednesday, October 2, 13

Slide 44

Slide 44 text

package repos conﬁguration management A Balanced Ecosystem Package Repos insert package repository rant here Wednesday, October 2, 13

Slide 45

Slide 45 text

conﬁguration management code is CODE put it where it belongs A Balanced Ecosystem Version Control Wednesday, October 2, 13

Slide 46

Slide 46 text

A Balanced Ecosystem Build Tools Wednesday, October 2, 13

Slide 47

Slide 47 text

A Balanced Ecosystem Virtualization Wednesday, October 2, 13

Slide 48

Slide 48 text

Practical CM testing you can write tests for CM unit testing w/rspec functional/integration testing with minitest/bats Wednesday, October 2, 13

Slide 49

Slide 49 text

Practical CM dependency resolution Librarian for both Puppet and Chef Berkshelf for Chef There could be others Wednesday, October 2, 13

Slide 50

Slide 50 text

Practical CM primitives Wednesday, October 2, 13

Slide 51

Slide 51 text

Practical CM primitives ﬁle, user, package, template, directory built-in idempotence readability operating system cross-functionality Wednesday, October 2, 13

Slide 52

Slide 52 text

Practical CM exec blocks Wednesday, October 2, 13

Slide 53

Slide 53 text

Practical CM exec vs primitives bash ‘install_my_package’ do command “yum -y install my_package” end NEVER DO THIS Wednesday, October 2, 13

Slide 54

Slide 54 text

Practical CM exec vs primitives ALWAYS DO THIS package 'apache' do action :install end Wednesday, October 2, 13

Slide 55

Slide 55 text

bash "install_tomcat6" do tomcat_version_name = "apache-tomcat-#{node.tomcat.version}" tomcat_version_name_tgz = "#{tomcat_version_name}.tar.gz" user "root" code <<-EOH curl --proxy https://aproxy.com:8080/ --user user:pass https://myartifactoryurl.com/artifactory/ext-release-local/ apache-tomcat/apache-tomcat/#{node.tomcat.version}/ #{tomcat_version_name_tgz} -o /tmp/#{tomcat_version_name_tgz} tar -zxf /tmp/#{tomcat_version_name_tgz} -C /tmp rm /tmp/#{tomcat_version_name_tgz} mv /tmp/#{tomcat_version_name} #{node.tomcat.install_path} chown -R #{node.tomcat.run_user}:#{node.tomcat.run_group} #{node.tomcat.install_path} chmod -R 755 #{node.tomcat.install_path} rm -rf #{node.tomcat.install_path}/webapps/ROOT EOH end Wednesday, October 2, 13

Slide 56

Slide 56 text

wtf was that?! Wednesday, October 2, 13

Slide 57

Slide 57 text

package 'tomcat7' do action :install end Wednesday, October 2, 13

Slide 58

Slide 58 text

Practical CM template primitive templates allow you to write flat files with varied configs across different environments Wednesday, October 2, 13

Slide 59

Slide 59 text

<% @sudoers_users.each do |user| -%> <%= user %> ALL=(ALL) <%= "NOPASSWD:" if @passwordless %>ALL <% end -%> # Members of the sysadmin group may gain root privileges %sysadmin ALL=(ALL) <%= "NOPASSWD:" if @passwordless %>ALL Wednesday, October 2, 13

Slide 60

Slide 60 text

bash "update_ssh" do code <<-EOH sed -i -e 's/ AuthorizedKeysFile.*authorized_keys/ AuthorizedKeysFile \\/\\.keys\\/%u\\/ authorized_keys/g' /etc/ssh/sshd_config EOH end bash “ssh_dns” do code <<-EOH sed -i -e 's/#UseDNS.yes/UseDNS no/g' /etc/ssh/sshd_config EOH end Wednesday, October 2, 13

Slide 61

Slide 61 text

primitives trump execs package "ssh" do action :install end service "sshd" do action [:enable, :start] end template "/etc/ssh/sshd_config" do action :create mode 0644 notifies :restart,"service[sshd]" end Wednesday, October 2, 13

Slide 62

Slide 62 text

Practical CM extending and abstracting CM tools are easy to extend understand repeatable patterns abstract them into libraries, resources, custom types keep front line code readable Wednesday, October 2, 13

Slide 63

Slide 63 text

# Cookbook Name:: keys # Recipe:: common # Author:: Sascha Bates keys = [] search('public_keys',"tags:common").each { |k| keys << k } search('public_keys',"tags:chef AND tags:#{node.env}").each { | k| keys << k } keys.each do |k| key_type, key_part, key_comment = k['pub_key'].split(' ') ruby_block "root_keys_#{k['id']}" do Chef::Log.debug("test condition: grep #{key_part} #{keyfile}") not_if "grep #{key_part} #{keyfile}" block do File::open(keyfile, 'a') do |f| Chef::Log.debug("Adding #{key_comment} to #{f.path}") f << k["pub_key"] << "\n" end end Wednesday, October 2, 13

Slide 64

Slide 64 text

dsl trumps code # Cookbook Name:: keys # Recipe:: common # Author:: Sascha Bates authkey “common_key” do action :add user “root” end Wednesday, October 2, 13

Slide 65

Slide 65 text

If you don’t remember anything else start small, stay visible, communicate craft a holistic ecosystem use the tool wisely and well Wednesday, October 2, 13

Slide 66

Slide 66 text

bonus slide # -*- mode: ruby -*- # vi: set ft=ruby Vagrant.configure("2") do |config| config.vm.hostname = "goto-example" config.vm.box = "opscode_centos-6.4_provisionerless" config.vm.network :private_network, ip: "33.33.33.10" config.vm.network "forwarded_port", guest: 8080, host: 8080, auto_correct: true config.omnibus.chef_version = :latest config.ssh.max_tries = 40 config.ssh.timeout = 120 config.berkshelf.enabled = true config.vm.provision :chef_solo do |chef| chef.log_level = :debug chef.run_list = [ "recipe[goto::default]" ] end end Wednesday, October 2, 13