Configura)on Management

Transcription

1 Configura)on Management How to automate yourself into be2er projects Presented by: Randy Herban

2 About me HPC for over 10 years Receiving end of config mgmt Systems Administrator Became a champion Manager of Systems Team IntegraJon to other tools

3 Goals This talk will Explain why you should use configurajon management Give you tools to convince peers Show benefit to management This talk won t. Teach about a specific tool Dictate a specific design However Will use puppet examples from our site

4 What is Configura)on Management Tool to implement changes Install required libraries Setup Apache (package + configs) Add IPv6 address Enforce configurajons on machines /var/www/html must be world- readable Apache must be running Telnet must *not* be running Next iterajon of shell scripts in your home dir

5 Why bother? AutomaJon necessary for large- scale systems You can t scale Gets way too complex Anything manual is VERBOTEN* Automate the mundane; Get to the interesjng * Just a guideline; Break as necessary, then add to config mgmt

6 Version Control Requirement for programmers Built- in documentajon Group edits Peer review ( hooks) Version control

7 Version Control - Sysadmins We can use it too! Built- in documentajon Change desc & reason; requestor / Jcket number Group edits Compliments Change Management Peer review hooks Know who/when/what was changed Version control Back out broken commits

8 Configura)on Management Centralized control of your systems ALL of your systems ConfiguraJon enforcement First Jme and every Jme it runs Consistency Base config just works: ldap, ntp, dns, nfs, ipmi, netgroup, syslog, sudoers Rapid deployment Bare metal - > Network boot - > Automated installer - > ConfigMgmt- > Usable Scale

9 Examples Puppet, Chef, CFEngine, Salt, Ansible xcat, Rocks, Bright CompuJng Image based (golden master) Homegrown

10 Our Comparison Ansible Chef CFEngine Puppet Salt Scalability Medium High High High Open Source Yes Yes Yes Enterprise Support Yes Yes Yes Online DocumentaJon Yes Yes Yes Yes Yes Ease of Deployment Easy Hard Medium Easy Learning Curve Low High Medium Low CLI Yes Yes Yes Yes Yes Web Interface Yes Yes Yes Yes Yes AddiJonal Modules Yes Yes Yes Yes WriJng new modules Yes Yes Yes Yes Yes

11 GeBng Started - From a technical perspec)ve Pick a simple, common config: resolv.conf, ntp.conf, nsswitch.conf Test and Implement No one should nojce! /etc/shells

12 svn/puppet - manifests - site.pp - modules - shells - manifests - init.pp - config.pp - install.pp - files - shells (actual config file) - apache - ganglia

13 puppet/modules/shells/manifests/init.pp # =Class: shells # This module manages /etc/shells. The top level class should be #instanjated with no parameters, and will instanjate subclasses as #appropriate. # ==Parameters: none # ==Packages Installed: Package[ksh, zsh, tcsh] # ==Files Modified: File[/etc/shells] # ==Classes Called: Class[shells::install, shells::config] # ==Dependencies: none class shells { class { ['shells::install', 'shells::config']:

14 puppet/modules/shells/manifests/config.pp class shells::config { file { "/etc/shells": owner => 'root', group => 'root', mode => 0444, source => "puppet:///modules/shells/shells", require => Class["shells::install"], file { "/usr/local/bin/bash": ensure => link, target => "/bin/bash",

15 puppet/modules/shells/manifests/install.pp class shells::install { package { [ 'ksh', 'tcsh', 'zsh' ]: ensure => latest, package { 'bash': ensure => latest, nojfy => Exec['update_ldconfig_bash'], exec { 'update_ldconfig_bash': command => '/sbin/ldconfig', cwd => '/tmp',

16 Next steps ConJnue unjl your base config is ready Momentum!

17 puppet/manifests/site.pp class base_rcac { class { "autofs": class { "cron": class { "cups": class { "ipmi": class { "issue": class { "kernel": class { "shells":

18 Next steps Service specific configs User frontends, compute nodes, web, database Modules change over Jme Add features you need now, not everything Leave it extensible for future Apache Now: Serve up a docroot Later: SSL, Rewrites, alternate docroots Machine specific configs Host X needs specific package

19 puppet/manifests/site.pp continued node test.rcac.purdue.edu' { include base_rcac class { "apache": class { "apache::ssl": class { "apache::cas": node /^carter- [a- f]\d+\.rcac\.purdue\.edu/ { include cluster_rcac class { "hp_bios": class { "ganglia":

20 GeBng Started Poli)cally From a colleague s perspec)ve Work is front- loaded, early work is costly As more is added, deployments get MUCH easier Offer to help colleagues port Get a friend Is it in puppet yet? Transparency Bundle with installer

21 GeBng Started Poli)cally From a manager s perspec)ve How does it benefit the company Consistency? Security? DocumentaJon? NOPE Gezng more done! Fine to go slow Show conjnual results New deploys are 12% faster Security vulnerability patched quicker and are guaranteed Peer review caught 2 typos that could have led to outages

22 Things to watch out for ShooJng yourself in the foot MUCH easier Some machines get out of sync PerfecJonism will hurt you

23 puppet/modules/apache/manifests/init.pp class apache( $auth_domain = 'rcac') { class { 'apache::params': auth_domain => $auth_domain class { ['apache::install', 'apache::config', 'apache::service']: puppet/modules/apache/manifests/ssl.pp class apache::ssl { class { ["apache::ssl::params", "apache::ssl::config"]: require => Class["apache", "ssl"],