On Sat, 2006-12-23 at 03:25 +0100, Axel Thimm wrote:
> Thanks for the puppet overview. Maybe we should create a wiki page
> with a product/feature matrix?
>
> On Fri, Dec 22, 2006 at 04:17:45PM -0800, David Lutterkort wrote:
>
> > PROS
> > ----
>
>
> > * Override mechanism for classes to allow for simple
> > one-off (or hundred-off) tweaks, e.g. to take webserver
> > class from above but use with different httpd.conf
>
> That's nice.
One thing I forgot to mention: puppet lets you also express dependencies
between config elements, so that you can say that the httpd package
should be installed/upgraded first before your custom httpd.conf is
copied from the central server. A similar mechanism also lets you say
that service X should be restarted whenever puppet needs to make a
change to file Y (useful to keep service restarts to the absolute
minimum needed)
> > * Tie-in with kickstart: provision basic system with ks (including
> > puppet client), complete config with puppet [4]
>
> That, of course, defeats lots of the security items, but there is no
> otherway. One just needs to be aware of that.
Yeah, it's not entirely watertight, but the holes that it leaves are
fairly esoteric (somebody posing as a client while you are installing
the client; somebody posing as the server while you are installing a
client), and you'll discover both breaches quickly (when the client you
are installing gets to the point where it asks the server for a cert;
the request will either fail or never show up on your server)
> What about diffing support, e.g. compare what's there and what we'd
> like it to become, kind of a dry-run session to check deviations
> between spec and reality?
Both the command-line tool and the client daemon have a 'noop' option,
that goes through the motions w/o making changes. After changes to
configs, I usually test them by running
# /usr/sbin/puppetd -v --onetime --noop
which produces output like
notice: Starting configuration run
notice: //common/lemon/autofs-server/configfile[/etc/sysconfig/autofs]/file=/etc/sysconfig/autofs/source: is {md5}6cd456ce35b212ea429e63bf892d2535, should be {md5}3ed0678eb6af27c0a264522705e79a08 (noop)
notice: //common/lemon/autofs-server/configfile[/etc/auto.homes]/file=/etc/auto.homes/owner: is build, should be root (noop)
notice: //common/lemon/users/user=build/home: is /home/build, should be /homes/build (noop)
notice: Finished configuration run in 4.56 seconds
The lines are telling me that
* /etc/sysconfig/autofs has different content from what it should
be
* /etc/auto.homes has the wrong owner
* the user 'build' has the wrong home directory
Of course, puppet would fix all these if I ran that without --noop
David
