SlideShare une entreprise Scribd logo
1  sur  44
Télécharger pour lire hors ligne
Puppet and the HashiStack
Bram Vogelaar
@attachmentgenie
$ whoami
• Used to be a Molecular Biologist
• Then became a Dev
• Now an Ops
• Currently Cloud Engineer @ The Factory
HashiCorp Stack/Suite
Puppet
l Open Source configuration management tool since 2005
l Desired State DSL on top of ruby
l Client – Server architecture
l Runs on pretty much any OS
l Combines node info (Facter), node config (Hiera), node model (DSL) into a catalogue that is
applies at regular intervals
https://puppet.com/open-source/#osp
Puppet Workflow
Packer
l Open Source tool to make OS images
l Supports Cloud Providers, Docker, Virtualbox, … (builders)
l Has hooks to provision the base images (provisioners)
l Create artifacts (Post-Processors)
https://www.packer.io/
HCL2
l HashiCorp Configuration Language
l Yet another config management DSL
l Desired state
l Used by multiple HashiCorp tools but also 3rd party tools
https://github.com/hashicorp/hcl
Packer
source "azure-arm" "basic-example" {
…
vm_size = "Standard_A2"
}
build {
sources = ["sources.azure-arm.basic-example"]
provisioner "shell" {
scripts = ["scripts/common/puppet_install.sh"]
}
}
$ packer build template. hcl
https://github.com/petems/puppet-install-shell
Packer & Puppet
provisioner "puppet-masterless" {
manifest_file = "site.pp"
}
provisioner "puppet-server" {
puppet_server = ”puppet.example.com"
}
Vagrant
l Open Source tool to bootstrap local vms
- Build by packer!
l Supports many vm Providers, Docker, Virtualbox, …
l Has hooks to provision the base images (provisioners), Puppet, Chef, Ansible, Bash
https://www.vagrantup.com/
Vagrantfile
Vagrant.configure("2") do |config|
config.vm.box = "base"
# config.vm.box_check_update = false
# config.vm.network "forwarded_port", guest: 80, host: 8080
# config.vm.network "private_network", ip: "192.168.33.10"
# config.vm.network "public_network"
# config.vm.synced_folder "../data", "/vagrant_data"
# config.vm.provider "virtualbox" do |vb|
# vb.gui = true
# vb.memory = "1024"
# end
# config.vm.provision "shell", inline: <<-SHELL
# apt-get update
# apt-get install -y apache2
# SHELL
end
Vagrant & Puppet
$ vagrant plugin install vagrant-puppet-install
https://github.com/petems/vagrant-puppet-install
Vagrant & Puppet
cat Vagrantfile
case node["provision_type"]
when 'masterless'
srv.vm.synced_folder "#{environment}/hieradata",
"/etc/puppetlabs/code/environments/#{environment}/hieradata"
srv.vm.provision :puppet do |puppet|
puppet.environment_path = "."
puppet.hiera_config_path = "#{environment}/hiera.yaml"
end
$ vagrant (up,halt,destroy)
Vagrant & Puppet
cat Vagrantfile
case node["provision_type"]
when 'puppet_agent'
srv.vm.provision "puppet_server" do |puppet|
puppet.options = "-t --environment #{environment}"
puppet.puppet_server = "puppetmaster.#{environment}.vagrant"
end
srv.trigger.after :destroy do |trigger|
trigger.name = "Cleaning puppet certificate"
trigger.run = {inline: "vagrant ssh puppetmaster -c 'sudo /opt/puppetlabs/bin/puppetserver ca clean --certname
#{node["hostname"]}'"}
end
$ vagrant (up,halt,destroy)
Terraform
l Open Source Automation Tool
l “cloud” oriented
l Cloud are API’s
l API’s oriented
l Terraform is an open source automation tool which can deal with any kind of CRUD api’s –
including major cloud providers
https://www.terraform.io/
The Terraform Model
l You model your infrastructure
l You make a plan
l If ok, you apply that plan
l Current state is saved for future changes
$ terraform (fmt, validate, plan, apply)
Lets magic a node
resource "azurerm_virtual_machine" "puppetmaster" {
name = "vm-${var.node_name}"
location = "${var.azure_region_name}"
resource_group_name = "${var.resource_group}"
network_interface_ids = ["${azurerm_network_interface.puppetmaster.id}"]
vm_size = "${var.vm_size}"
storage_image_reference {
id = "${var.packerimage_id}" # ← your packer image id
}
os_profile {
...
}
}
Lets magic a node
resource "azurerm_virtual_machine" "puppetmaster" {
...
os_profile {
custom_data = "${data.template_file.bootstrap_sh.rendered}"
}
}
output "private_ip" {
value = "${azurerm_network_interface.network_interface.private_ip_address}"
}
Bootstrap your Puppet Server
#!/usr/bin/env bash
apt-get install puppetserver
puppet config set --section agent environment ${environment}
systemctl start puppetserver
Move it all to a module
module "web" {
source = "../modules/azure/instance"
domain = "${var.domain}"
environment = "${var.environment}"
node_name = "web"
private_subnet = "${module.inuits_play_bootstrap.subnet_id}"
puppet_master = "${var.puppet_master}"
}
It’s a DNS problem
Consul
l Open Source Service Discovery Tool
l Build-in KV store
l Service Mesh tool
https://www.consul.io/
Consul & Puppet
class { '::consul':
config_hash => $config,
version => $version,
}
::consul::service { 'puppetmaster':
port => 8140,
}
::consul::check { 'puppetmaster_tcp':
interval => '10s',
tcp => 'localhost:8140',
notes => 'Puppetmasters listen on port 8140',
service_id => 'puppetmaster’,
}
dig @127.0.0.1 -p 8600 puppetmaster.service.consul ANY
https://forge.puppet.com/KyleAnderson/consul
Consul~Icinga(2) Exit Codes
::consul::check { 'puppetmaster':
interval => '10s',
script => '/usr/lib64/nagios/plugins/puppetmaster',
notes => 'Puppetmasters listen on port 8140',
service_id => 'puppetmaster',
}
Geolocation Stuff
consul_prepared_query { 'puppetmaster':
ensure => 'present',
service_name => 'puppetmaster',
service_failover_n => 1,
service_failover_dcs => [ 'failover', 'dr' ],
service_only_passing => true,
ttl => 10,
}
dig @127.0.0.1 -p 8600 puppetmaster.query.consul ANY
X509 is hard
#!/usr/bin/env bash
apt-get install puppetserver
puppet config set --section agent environment ${environment}
puppet config set --section master dns_alt_names 
puppet,puppetmaster.service.consul,puppetmaster.query.consul
puppet config set --section master autosign /etc/puppetlabs/puppet/autosign-policy.rb
systemctl start puppetserver
So what about that chicken?
#!/usr/bin/env bash
consul agent -retry-join "provider=azure 
tag_name=consul 
tenant_id=${tid} 
client_id=${cid} 
subscription_id=${sid} 
secret_access_key=${ro_key}”
cat > /etc/puppetlabs/puppet/csr_attributes.yaml << YAML
---
extension_requests:
pp_preshared_key: ${psk}
pp_role: ${role}
YAML
puppet config set --section agent environment ${environment}
puppet config set --section agent server puppet.query.consul
/opt/puppetlabs/bin/puppet agent -t
Fast Exported Resources
::consul::watch { 'detect_backend_changes':
type => 'service',
handler => '/usr/bin/runpuppet.sh',
service => 'node_exporter',
passingonly => true,
require => File['/usr/bin/runpuppet.sh'],
}
Vault
l Open Source tool to do secrets management
l Secure, store and tightly control access to tokens, passwords, certificates, encryption keys for
protecting secrets and other sensitive data using a UI, CLI, or HTTP API.
l Certificate management
l Password rotation
https://www.vaultproject.io/
Pesky Passwords
class profiles::security::vault (
Variant[Hash, Array[Hash]] $listener = {
'tcp' => {
'address' => '127.0.0.1:8200',
'cluster_address' => '127.0.0.1:8201',
},
},
Hash $storage = { 'consul' => { 'address' => '127.0.0.1:8500', 'path' => 'vault/' }},
){
class {'vault':
enable_ui => true,
listener => $listener,
storage => $storage,
}
https://forge.puppet.com/jsok/vault
Pesky Passwords
$ vault unseal
$ vault write kv/my-secret value="s3c(eT"
$ vault read kv/mysecret
Key Value
--- -----
refresh_interval 768h
mysecret s3c(eT
Vault & Hiera
cat hiera.yaml
---
version: 5
hierarchy:
- name: "Hiera-vault lookup”
lookup_key: hiera_vault
options:
confine_to_keys:
- '^sensitive_.*’
- '^password.*’
address: http://active.vault.service.consul:8200
mounts:
generic:
- secret/puppet/%{::trusted.certname}/
- secret/puppet/common/
https://github.com/petems/hiera_backend_vault
Puppet > 6
$password = Deferred('vault_lookup::lookup',["password/mysql"], 'https://active.vault.service.consul:8200',)
class { '::mysql::server':
root_password => $password,
}
Nomad
l Open Source tool to do dynamic workload scheduling
l Batch, containerized, and non-containerized applications.
l Has native Consul and Vault integrations.
https://www.nomadproject.io/
Nomad & Puppet
class { '::nomad':
config_hash = {
'client’ => { 'enabled' => true, },
'consul’ => { 'address' => '127.0.0.1:8500’, },ß
'server' => {
'enabled' => true
'bootstrap_expect' => 3,
},
'vault’ => {
'enabled’ => true,
'address’ => 'https://active.vault.service.consul:8200',
'create_from_role' => 'nomad-cluster',
'token’ => 's.krHYYcd8PRzpSBO59AE6sawO',
},
}
}
https://forge.puppet.com/modules/puppet/nomad
Waypoint
• Modern workflow to build, deploy, and release across platforms.
• Build
• Deploy
• Release
https://www.waypointproject.io/
[WIP] https://github.com/attachmentgenie/attachmentgenie-waypoint
Boundary
• Identity-based access for zero trust security
• Authenticate & authorize
• Connect
• Access
https://www.boundaryproject.io/
[WIP] https://github.com/attachmentgenie/attachmentgenie-boundary
Bolt
l Open Source tool to do task orchestration
l Aimed at fire and forget 2nd day operations
l Support tasks written in Puppet or YAML
https://puppet.com/open-source/bolt/
Bolt
# bolt-project.yaml
modulepath:
- modules
modules:
- name: puppetlabs/apt
# inventory.yaml
groups:
- name: all-of-azure
targets:
- uri: 1.2.3.4:22
name: prod
config:
transport: ssh
ssh:
user: ubuntu
Bolt
bolt project init
bolt module install
bolt command run apt action=update --targets servers
Bolt & Terraform
groups:
- name: all-of-azure
targets:
- _plugin: terraform
dir: /path/to/terraform/project
resource_type: azurerm_virtual_machine
target_mapping:
uri: public_ip
plan do_important_stuff (TargetSpec $targets){
run_task('terraform::initialize', 'dir' => '/path/to/terraform/project')
$apply_result = run_plan('terraform::apply', 'dir' => '/path/to/terraform/project', 'return_output' =>
true)
run_task('important::stuff', $targets, 'task_var' => $apply_result)
}
https://forge.puppet.com/modules/puppetlabs/terraform
Bolt & Vault
targets:
- ...
config:
ssh:
user: root
private-key:
key-data:
_plugin: vault
server_url: https://active.vault.service.consul:8200
auth:
method: token
token: xxxxx-xxxxx
path: secrets/bolt
field: private-key
https://forge.puppet.com/modules/puppetlabs/vault
Contact
bram@attachmentgenie.com
@attachmentgenie
https://www.slideshare.net/attachmentgenie
The Floor is yours…
Questions ?

Contenu connexe

Tendances

Autoscaling with hashi_corp_nomad
Autoscaling with hashi_corp_nomadAutoscaling with hashi_corp_nomad
Autoscaling with hashi_corp_nomadBram Vogelaar
 
Securing Prometheus exporters using HashiCorp Vault
Securing Prometheus exporters using HashiCorp VaultSecuring Prometheus exporters using HashiCorp Vault
Securing Prometheus exporters using HashiCorp VaultBram Vogelaar
 
Lua tech talk
Lua tech talkLua tech talk
Lua tech talkLocaweb
 
Static Typing in Vault
Static Typing in VaultStatic Typing in Vault
Static Typing in VaultGlynnForrest
 
Roll Your Own API Management Platform with nginx and Lua
Roll Your Own API Management Platform with nginx and LuaRoll Your Own API Management Platform with nginx and Lua
Roll Your Own API Management Platform with nginx and LuaJon Moore
 
Ansible fest Presentation slides
Ansible fest Presentation slidesAnsible fest Presentation slides
Ansible fest Presentation slidesAaron Carey
 
Using ngx_lua in UPYUN
Using ngx_lua in UPYUNUsing ngx_lua in UPYUN
Using ngx_lua in UPYUNCong Zhang
 
Using Node.js to Build Great Streaming Services - HTML5 Dev Conf
Using Node.js to  Build Great  Streaming Services - HTML5 Dev ConfUsing Node.js to  Build Great  Streaming Services - HTML5 Dev Conf
Using Node.js to Build Great Streaming Services - HTML5 Dev ConfTom Croucher
 
Hopping in clouds: a tale of migration from one cloud provider to another
Hopping in clouds: a tale of migration from one cloud provider to anotherHopping in clouds: a tale of migration from one cloud provider to another
Hopping in clouds: a tale of migration from one cloud provider to anotherMichele Orselli
 
Rhebok, High Performance Rack Handler / Rubykaigi 2015
Rhebok, High Performance Rack Handler / Rubykaigi 2015Rhebok, High Performance Rack Handler / Rubykaigi 2015
Rhebok, High Performance Rack Handler / Rubykaigi 2015Masahiro Nagano
 
Hashiconf EU 2019 - A Tour of Terraform 0.12
Hashiconf EU 2019 - A Tour of Terraform 0.12Hashiconf EU 2019 - A Tour of Terraform 0.12
Hashiconf EU 2019 - A Tour of Terraform 0.12Mitchell Pronschinske
 
Ansible leveraging 2.0
Ansible leveraging 2.0Ansible leveraging 2.0
Ansible leveraging 2.0bcoca
 
Hacking ansible
Hacking ansibleHacking ansible
Hacking ansiblebcoca
 
Node.js streaming csv downloads proxy
Node.js streaming csv downloads proxyNode.js streaming csv downloads proxy
Node.js streaming csv downloads proxyIsmael Celis
 
The worst Ruby codes I’ve seen in my life - RubyKaigi 2015
The worst Ruby codes I’ve seen in my life - RubyKaigi 2015The worst Ruby codes I’ve seen in my life - RubyKaigi 2015
The worst Ruby codes I’ve seen in my life - RubyKaigi 2015Fernando Hamasaki de Amorim
 
Ansible Meetup Hamburg / Quickstart
Ansible Meetup Hamburg / QuickstartAnsible Meetup Hamburg / Quickstart
Ansible Meetup Hamburg / QuickstartHenry Stamerjohann
 

Tendances (20)

Autoscaling with hashi_corp_nomad
Autoscaling with hashi_corp_nomadAutoscaling with hashi_corp_nomad
Autoscaling with hashi_corp_nomad
 
Securing Prometheus exporters using HashiCorp Vault
Securing Prometheus exporters using HashiCorp VaultSecuring Prometheus exporters using HashiCorp Vault
Securing Prometheus exporters using HashiCorp Vault
 
Lua tech talk
Lua tech talkLua tech talk
Lua tech talk
 
Static Typing in Vault
Static Typing in VaultStatic Typing in Vault
Static Typing in Vault
 
Roll Your Own API Management Platform with nginx and Lua
Roll Your Own API Management Platform with nginx and LuaRoll Your Own API Management Platform with nginx and Lua
Roll Your Own API Management Platform with nginx and Lua
 
Ansible fest Presentation slides
Ansible fest Presentation slidesAnsible fest Presentation slides
Ansible fest Presentation slides
 
Using ngx_lua in UPYUN
Using ngx_lua in UPYUNUsing ngx_lua in UPYUN
Using ngx_lua in UPYUN
 
Using Node.js to Build Great Streaming Services - HTML5 Dev Conf
Using Node.js to  Build Great  Streaming Services - HTML5 Dev ConfUsing Node.js to  Build Great  Streaming Services - HTML5 Dev Conf
Using Node.js to Build Great Streaming Services - HTML5 Dev Conf
 
Hopping in clouds: a tale of migration from one cloud provider to another
Hopping in clouds: a tale of migration from one cloud provider to anotherHopping in clouds: a tale of migration from one cloud provider to another
Hopping in clouds: a tale of migration from one cloud provider to another
 
dotCloud and go
dotCloud and godotCloud and go
dotCloud and go
 
Rhebok, High Performance Rack Handler / Rubykaigi 2015
Rhebok, High Performance Rack Handler / Rubykaigi 2015Rhebok, High Performance Rack Handler / Rubykaigi 2015
Rhebok, High Performance Rack Handler / Rubykaigi 2015
 
Ubic
UbicUbic
Ubic
 
Hashiconf EU 2019 - A Tour of Terraform 0.12
Hashiconf EU 2019 - A Tour of Terraform 0.12Hashiconf EU 2019 - A Tour of Terraform 0.12
Hashiconf EU 2019 - A Tour of Terraform 0.12
 
Ansible leveraging 2.0
Ansible leveraging 2.0Ansible leveraging 2.0
Ansible leveraging 2.0
 
Hacking ansible
Hacking ansibleHacking ansible
Hacking ansible
 
Node.js streaming csv downloads proxy
Node.js streaming csv downloads proxyNode.js streaming csv downloads proxy
Node.js streaming csv downloads proxy
 
The worst Ruby codes I’ve seen in my life - RubyKaigi 2015
The worst Ruby codes I’ve seen in my life - RubyKaigi 2015The worst Ruby codes I’ve seen in my life - RubyKaigi 2015
The worst Ruby codes I’ve seen in my life - RubyKaigi 2015
 
Beyond Phoenix
Beyond PhoenixBeyond Phoenix
Beyond Phoenix
 
Nginx-lua
Nginx-luaNginx-lua
Nginx-lua
 
Ansible Meetup Hamburg / Quickstart
Ansible Meetup Hamburg / QuickstartAnsible Meetup Hamburg / Quickstart
Ansible Meetup Hamburg / Quickstart
 

Similaire à Puppet and the HashiStack

Puppet for Java developers - JavaZone NO 2012
Puppet for Java developers - JavaZone NO 2012Puppet for Java developers - JavaZone NO 2012
Puppet for Java developers - JavaZone NO 2012Carlos Sanchez
 
Puppet Troubleshooting
Puppet TroubleshootingPuppet Troubleshooting
Puppet TroubleshootingPuppet
 
Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013
Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013
Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013Carlos Sanchez
 
Continuous Delivery: The Next Frontier
Continuous Delivery: The Next FrontierContinuous Delivery: The Next Frontier
Continuous Delivery: The Next FrontierCarlos Sanchez
 
Puppet Camp Seattle 2014: Puppet: Cloud Infrastructure as Code
Puppet Camp Seattle 2014: Puppet: Cloud Infrastructure as CodePuppet Camp Seattle 2014: Puppet: Cloud Infrastructure as Code
Puppet Camp Seattle 2014: Puppet: Cloud Infrastructure as CodePuppet
 
Stanford Hackathon - Puppet Modules
Stanford Hackathon - Puppet ModulesStanford Hackathon - Puppet Modules
Stanford Hackathon - Puppet ModulesPuppet
 
Puppet: Eclipsecon ALM 2013
Puppet: Eclipsecon ALM 2013Puppet: Eclipsecon ALM 2013
Puppet: Eclipsecon ALM 2013grim_radical
 
Docker deploy
Docker deployDocker deploy
Docker deployEric Ahn
 
Writing and Publishing Puppet Modules - PuppetConf 2014
Writing and Publishing Puppet Modules - PuppetConf 2014Writing and Publishing Puppet Modules - PuppetConf 2014
Writing and Publishing Puppet Modules - PuppetConf 2014Puppet
 
20090514 Introducing Puppet To Sasag
20090514 Introducing Puppet To Sasag20090514 Introducing Puppet To Sasag
20090514 Introducing Puppet To Sasaggarrett honeycutt
 
Does your configuration code smell?
Does your configuration code smell?Does your configuration code smell?
Does your configuration code smell?Tushar Sharma
 
Harmonious Development: Via Vagrant and Puppet
Harmonious Development: Via Vagrant and PuppetHarmonious Development: Via Vagrant and Puppet
Harmonious Development: Via Vagrant and PuppetAchieve Internet
 

Similaire à Puppet and the HashiStack (20)

Puppet @ Seat
Puppet @ SeatPuppet @ Seat
Puppet @ Seat
 
Puppet
PuppetPuppet
Puppet
 
Puppet for Java developers - JavaZone NO 2012
Puppet for Java developers - JavaZone NO 2012Puppet for Java developers - JavaZone NO 2012
Puppet for Java developers - JavaZone NO 2012
 
Puppet Troubleshooting
Puppet TroubleshootingPuppet Troubleshooting
Puppet Troubleshooting
 
Troubleshooting Puppet
Troubleshooting PuppetTroubleshooting Puppet
Troubleshooting Puppet
 
Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013
Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013
Continuous Delivery with Maven, Puppet and Tomcat - ApacheCon NA 2013
 
EC2
EC2EC2
EC2
 
Continuous Delivery: The Next Frontier
Continuous Delivery: The Next FrontierContinuous Delivery: The Next Frontier
Continuous Delivery: The Next Frontier
 
Puppet Camp Seattle 2014: Puppet: Cloud Infrastructure as Code
Puppet Camp Seattle 2014: Puppet: Cloud Infrastructure as CodePuppet Camp Seattle 2014: Puppet: Cloud Infrastructure as Code
Puppet Camp Seattle 2014: Puppet: Cloud Infrastructure as Code
 
Stanford Hackathon - Puppet Modules
Stanford Hackathon - Puppet ModulesStanford Hackathon - Puppet Modules
Stanford Hackathon - Puppet Modules
 
Puppet: Eclipsecon ALM 2013
Puppet: Eclipsecon ALM 2013Puppet: Eclipsecon ALM 2013
Puppet: Eclipsecon ALM 2013
 
Puppet
PuppetPuppet
Puppet
 
Docker deploy
Docker deployDocker deploy
Docker deploy
 
Writing and Publishing Puppet Modules - PuppetConf 2014
Writing and Publishing Puppet Modules - PuppetConf 2014Writing and Publishing Puppet Modules - PuppetConf 2014
Writing and Publishing Puppet Modules - PuppetConf 2014
 
infra-as-code
infra-as-codeinfra-as-code
infra-as-code
 
20090514 Introducing Puppet To Sasag
20090514 Introducing Puppet To Sasag20090514 Introducing Puppet To Sasag
20090514 Introducing Puppet To Sasag
 
Test driven infrastructure
Test driven infrastructureTest driven infrastructure
Test driven infrastructure
 
Does your configuration code smell?
Does your configuration code smell?Does your configuration code smell?
Does your configuration code smell?
 
Vagrant for real
Vagrant for realVagrant for real
Vagrant for real
 
Harmonious Development: Via Vagrant and Puppet
Harmonious Development: Via Vagrant and PuppetHarmonious Development: Via Vagrant and Puppet
Harmonious Development: Via Vagrant and Puppet
 

Plus de Bram Vogelaar

Cost reconciliation in a post CMDB world
Cost reconciliation in a post CMDB worldCost reconciliation in a post CMDB world
Cost reconciliation in a post CMDB worldBram Vogelaar
 
Self scaling Multi cloud nomad workloads
Self scaling Multi cloud nomad workloadsSelf scaling Multi cloud nomad workloads
Self scaling Multi cloud nomad workloadsBram Vogelaar
 
Scraping metrics for fun and profit
Scraping metrics for fun and profitScraping metrics for fun and profit
Scraping metrics for fun and profitBram Vogelaar
 
10 things i learned building nomad-packs
10 things i learned building nomad-packs10 things i learned building nomad-packs
10 things i learned building nomad-packsBram Vogelaar
 
10 things I learned building Nomad packs
10 things I learned building Nomad packs10 things I learned building Nomad packs
10 things I learned building Nomad packsBram Vogelaar
 
Easy Cloud Native Transformation with Nomad
Easy Cloud Native Transformation with NomadEasy Cloud Native Transformation with Nomad
Easy Cloud Native Transformation with NomadBram Vogelaar
 
Observability; a gentle introduction
Observability; a gentle introductionObservability; a gentle introduction
Observability; a gentle introductionBram Vogelaar
 
Running Trusted Payload with Nomad and Waypoint
Running Trusted Payload with Nomad and WaypointRunning Trusted Payload with Nomad and Waypoint
Running Trusted Payload with Nomad and WaypointBram Vogelaar
 
Easy Cloud Native Transformation using HashiCorp Nomad
Easy Cloud Native Transformation using HashiCorp NomadEasy Cloud Native Transformation using HashiCorp Nomad
Easy Cloud Native Transformation using HashiCorp NomadBram Vogelaar
 
CICD using jenkins and Nomad
CICD using jenkins and NomadCICD using jenkins and Nomad
CICD using jenkins and NomadBram Vogelaar
 
Running trusted payloads with Nomad and Waypoint
Running trusted payloads with Nomad and WaypointRunning trusted payloads with Nomad and Waypoint
Running trusted payloads with Nomad and WaypointBram Vogelaar
 
Gamification of Chaos Testing
Gamification of Chaos TestingGamification of Chaos Testing
Gamification of Chaos TestingBram Vogelaar
 
Gamification of Chaos Testing
Gamification of Chaos TestingGamification of Chaos Testing
Gamification of Chaos TestingBram Vogelaar
 
Devops its not about the tooling
Devops its not about the toolingDevops its not about the tooling
Devops its not about the toolingBram Vogelaar
 
High Available Drupal
High Available DrupalHigh Available Drupal
High Available DrupalBram Vogelaar
 
Over engineering your personal website
Over engineering your personal websiteOver engineering your personal website
Over engineering your personal websiteBram Vogelaar
 
Puppet and the HashiCorp Suite
Puppet and the HashiCorp SuitePuppet and the HashiCorp Suite
Puppet and the HashiCorp SuiteBram Vogelaar
 
testing for people who hate testing
testing for people who hate testingtesting for people who hate testing
testing for people who hate testingBram Vogelaar
 
Terraform for fun and profit
Terraform for fun and profitTerraform for fun and profit
Terraform for fun and profitBram Vogelaar
 

Plus de Bram Vogelaar (20)

Cost reconciliation in a post CMDB world
Cost reconciliation in a post CMDB worldCost reconciliation in a post CMDB world
Cost reconciliation in a post CMDB world
 
Self scaling Multi cloud nomad workloads
Self scaling Multi cloud nomad workloadsSelf scaling Multi cloud nomad workloads
Self scaling Multi cloud nomad workloads
 
Scraping metrics for fun and profit
Scraping metrics for fun and profitScraping metrics for fun and profit
Scraping metrics for fun and profit
 
10 things i learned building nomad-packs
10 things i learned building nomad-packs10 things i learned building nomad-packs
10 things i learned building nomad-packs
 
10 things I learned building Nomad packs
10 things I learned building Nomad packs10 things I learned building Nomad packs
10 things I learned building Nomad packs
 
Easy Cloud Native Transformation with Nomad
Easy Cloud Native Transformation with NomadEasy Cloud Native Transformation with Nomad
Easy Cloud Native Transformation with Nomad
 
Uncomplicated Nomad
Uncomplicated NomadUncomplicated Nomad
Uncomplicated Nomad
 
Observability; a gentle introduction
Observability; a gentle introductionObservability; a gentle introduction
Observability; a gentle introduction
 
Running Trusted Payload with Nomad and Waypoint
Running Trusted Payload with Nomad and WaypointRunning Trusted Payload with Nomad and Waypoint
Running Trusted Payload with Nomad and Waypoint
 
Easy Cloud Native Transformation using HashiCorp Nomad
Easy Cloud Native Transformation using HashiCorp NomadEasy Cloud Native Transformation using HashiCorp Nomad
Easy Cloud Native Transformation using HashiCorp Nomad
 
CICD using jenkins and Nomad
CICD using jenkins and NomadCICD using jenkins and Nomad
CICD using jenkins and Nomad
 
Running trusted payloads with Nomad and Waypoint
Running trusted payloads with Nomad and WaypointRunning trusted payloads with Nomad and Waypoint
Running trusted payloads with Nomad and Waypoint
 
Gamification of Chaos Testing
Gamification of Chaos TestingGamification of Chaos Testing
Gamification of Chaos Testing
 
Gamification of Chaos Testing
Gamification of Chaos TestingGamification of Chaos Testing
Gamification of Chaos Testing
 
Devops its not about the tooling
Devops its not about the toolingDevops its not about the tooling
Devops its not about the tooling
 
High Available Drupal
High Available DrupalHigh Available Drupal
High Available Drupal
 
Over engineering your personal website
Over engineering your personal websiteOver engineering your personal website
Over engineering your personal website
 
Puppet and the HashiCorp Suite
Puppet and the HashiCorp SuitePuppet and the HashiCorp Suite
Puppet and the HashiCorp Suite
 
testing for people who hate testing
testing for people who hate testingtesting for people who hate testing
testing for people who hate testing
 
Terraform for fun and profit
Terraform for fun and profitTerraform for fun and profit
Terraform for fun and profit
 

Dernier

Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxKatpro Technologies
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsJoaquim Jorge
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?Antenna Manufacturer Coco
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsEnterprise Knowledge
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEarley Information Science
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessPixlogix Infotech
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 

Dernier (20)

Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI Solutions
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 

Puppet and the HashiStack

  • 1. Puppet and the HashiStack Bram Vogelaar @attachmentgenie
  • 2. $ whoami • Used to be a Molecular Biologist • Then became a Dev • Now an Ops • Currently Cloud Engineer @ The Factory
  • 4. Puppet l Open Source configuration management tool since 2005 l Desired State DSL on top of ruby l Client – Server architecture l Runs on pretty much any OS l Combines node info (Facter), node config (Hiera), node model (DSL) into a catalogue that is applies at regular intervals https://puppet.com/open-source/#osp
  • 6. Packer l Open Source tool to make OS images l Supports Cloud Providers, Docker, Virtualbox, … (builders) l Has hooks to provision the base images (provisioners) l Create artifacts (Post-Processors) https://www.packer.io/
  • 7. HCL2 l HashiCorp Configuration Language l Yet another config management DSL l Desired state l Used by multiple HashiCorp tools but also 3rd party tools https://github.com/hashicorp/hcl
  • 8. Packer source "azure-arm" "basic-example" { … vm_size = "Standard_A2" } build { sources = ["sources.azure-arm.basic-example"] provisioner "shell" { scripts = ["scripts/common/puppet_install.sh"] } } $ packer build template. hcl https://github.com/petems/puppet-install-shell
  • 9. Packer & Puppet provisioner "puppet-masterless" { manifest_file = "site.pp" } provisioner "puppet-server" { puppet_server = ”puppet.example.com" }
  • 10. Vagrant l Open Source tool to bootstrap local vms - Build by packer! l Supports many vm Providers, Docker, Virtualbox, … l Has hooks to provision the base images (provisioners), Puppet, Chef, Ansible, Bash https://www.vagrantup.com/
  • 11. Vagrantfile Vagrant.configure("2") do |config| config.vm.box = "base" # config.vm.box_check_update = false # config.vm.network "forwarded_port", guest: 80, host: 8080 # config.vm.network "private_network", ip: "192.168.33.10" # config.vm.network "public_network" # config.vm.synced_folder "../data", "/vagrant_data" # config.vm.provider "virtualbox" do |vb| # vb.gui = true # vb.memory = "1024" # end # config.vm.provision "shell", inline: <<-SHELL # apt-get update # apt-get install -y apache2 # SHELL end
  • 12. Vagrant & Puppet $ vagrant plugin install vagrant-puppet-install https://github.com/petems/vagrant-puppet-install
  • 13. Vagrant & Puppet cat Vagrantfile case node["provision_type"] when 'masterless' srv.vm.synced_folder "#{environment}/hieradata", "/etc/puppetlabs/code/environments/#{environment}/hieradata" srv.vm.provision :puppet do |puppet| puppet.environment_path = "." puppet.hiera_config_path = "#{environment}/hiera.yaml" end $ vagrant (up,halt,destroy)
  • 14. Vagrant & Puppet cat Vagrantfile case node["provision_type"] when 'puppet_agent' srv.vm.provision "puppet_server" do |puppet| puppet.options = "-t --environment #{environment}" puppet.puppet_server = "puppetmaster.#{environment}.vagrant" end srv.trigger.after :destroy do |trigger| trigger.name = "Cleaning puppet certificate" trigger.run = {inline: "vagrant ssh puppetmaster -c 'sudo /opt/puppetlabs/bin/puppetserver ca clean --certname #{node["hostname"]}'"} end $ vagrant (up,halt,destroy)
  • 15. Terraform l Open Source Automation Tool l “cloud” oriented l Cloud are API’s l API’s oriented l Terraform is an open source automation tool which can deal with any kind of CRUD api’s – including major cloud providers https://www.terraform.io/
  • 16. The Terraform Model l You model your infrastructure l You make a plan l If ok, you apply that plan l Current state is saved for future changes $ terraform (fmt, validate, plan, apply)
  • 17. Lets magic a node resource "azurerm_virtual_machine" "puppetmaster" { name = "vm-${var.node_name}" location = "${var.azure_region_name}" resource_group_name = "${var.resource_group}" network_interface_ids = ["${azurerm_network_interface.puppetmaster.id}"] vm_size = "${var.vm_size}" storage_image_reference { id = "${var.packerimage_id}" # ← your packer image id } os_profile { ... } }
  • 18. Lets magic a node resource "azurerm_virtual_machine" "puppetmaster" { ... os_profile { custom_data = "${data.template_file.bootstrap_sh.rendered}" } } output "private_ip" { value = "${azurerm_network_interface.network_interface.private_ip_address}" }
  • 19. Bootstrap your Puppet Server #!/usr/bin/env bash apt-get install puppetserver puppet config set --section agent environment ${environment} systemctl start puppetserver
  • 20. Move it all to a module module "web" { source = "../modules/azure/instance" domain = "${var.domain}" environment = "${var.environment}" node_name = "web" private_subnet = "${module.inuits_play_bootstrap.subnet_id}" puppet_master = "${var.puppet_master}" }
  • 21. It’s a DNS problem
  • 22. Consul l Open Source Service Discovery Tool l Build-in KV store l Service Mesh tool https://www.consul.io/
  • 23. Consul & Puppet class { '::consul': config_hash => $config, version => $version, } ::consul::service { 'puppetmaster': port => 8140, } ::consul::check { 'puppetmaster_tcp': interval => '10s', tcp => 'localhost:8140', notes => 'Puppetmasters listen on port 8140', service_id => 'puppetmaster’, } dig @127.0.0.1 -p 8600 puppetmaster.service.consul ANY https://forge.puppet.com/KyleAnderson/consul
  • 24. Consul~Icinga(2) Exit Codes ::consul::check { 'puppetmaster': interval => '10s', script => '/usr/lib64/nagios/plugins/puppetmaster', notes => 'Puppetmasters listen on port 8140', service_id => 'puppetmaster', }
  • 25. Geolocation Stuff consul_prepared_query { 'puppetmaster': ensure => 'present', service_name => 'puppetmaster', service_failover_n => 1, service_failover_dcs => [ 'failover', 'dr' ], service_only_passing => true, ttl => 10, } dig @127.0.0.1 -p 8600 puppetmaster.query.consul ANY
  • 26. X509 is hard #!/usr/bin/env bash apt-get install puppetserver puppet config set --section agent environment ${environment} puppet config set --section master dns_alt_names puppet,puppetmaster.service.consul,puppetmaster.query.consul puppet config set --section master autosign /etc/puppetlabs/puppet/autosign-policy.rb systemctl start puppetserver
  • 27. So what about that chicken? #!/usr/bin/env bash consul agent -retry-join "provider=azure tag_name=consul tenant_id=${tid} client_id=${cid} subscription_id=${sid} secret_access_key=${ro_key}” cat > /etc/puppetlabs/puppet/csr_attributes.yaml << YAML --- extension_requests: pp_preshared_key: ${psk} pp_role: ${role} YAML puppet config set --section agent environment ${environment} puppet config set --section agent server puppet.query.consul /opt/puppetlabs/bin/puppet agent -t
  • 28. Fast Exported Resources ::consul::watch { 'detect_backend_changes': type => 'service', handler => '/usr/bin/runpuppet.sh', service => 'node_exporter', passingonly => true, require => File['/usr/bin/runpuppet.sh'], }
  • 29. Vault l Open Source tool to do secrets management l Secure, store and tightly control access to tokens, passwords, certificates, encryption keys for protecting secrets and other sensitive data using a UI, CLI, or HTTP API. l Certificate management l Password rotation https://www.vaultproject.io/
  • 30. Pesky Passwords class profiles::security::vault ( Variant[Hash, Array[Hash]] $listener = { 'tcp' => { 'address' => '127.0.0.1:8200', 'cluster_address' => '127.0.0.1:8201', }, }, Hash $storage = { 'consul' => { 'address' => '127.0.0.1:8500', 'path' => 'vault/' }}, ){ class {'vault': enable_ui => true, listener => $listener, storage => $storage, } https://forge.puppet.com/jsok/vault
  • 31. Pesky Passwords $ vault unseal $ vault write kv/my-secret value="s3c(eT" $ vault read kv/mysecret Key Value --- ----- refresh_interval 768h mysecret s3c(eT
  • 32. Vault & Hiera cat hiera.yaml --- version: 5 hierarchy: - name: "Hiera-vault lookup” lookup_key: hiera_vault options: confine_to_keys: - '^sensitive_.*’ - '^password.*’ address: http://active.vault.service.consul:8200 mounts: generic: - secret/puppet/%{::trusted.certname}/ - secret/puppet/common/ https://github.com/petems/hiera_backend_vault
  • 33. Puppet > 6 $password = Deferred('vault_lookup::lookup',["password/mysql"], 'https://active.vault.service.consul:8200',) class { '::mysql::server': root_password => $password, }
  • 34. Nomad l Open Source tool to do dynamic workload scheduling l Batch, containerized, and non-containerized applications. l Has native Consul and Vault integrations. https://www.nomadproject.io/
  • 35. Nomad & Puppet class { '::nomad': config_hash = { 'client’ => { 'enabled' => true, }, 'consul’ => { 'address' => '127.0.0.1:8500’, },ß 'server' => { 'enabled' => true 'bootstrap_expect' => 3, }, 'vault’ => { 'enabled’ => true, 'address’ => 'https://active.vault.service.consul:8200', 'create_from_role' => 'nomad-cluster', 'token’ => 's.krHYYcd8PRzpSBO59AE6sawO', }, } } https://forge.puppet.com/modules/puppet/nomad
  • 36. Waypoint • Modern workflow to build, deploy, and release across platforms. • Build • Deploy • Release https://www.waypointproject.io/ [WIP] https://github.com/attachmentgenie/attachmentgenie-waypoint
  • 37. Boundary • Identity-based access for zero trust security • Authenticate & authorize • Connect • Access https://www.boundaryproject.io/ [WIP] https://github.com/attachmentgenie/attachmentgenie-boundary
  • 38. Bolt l Open Source tool to do task orchestration l Aimed at fire and forget 2nd day operations l Support tasks written in Puppet or YAML https://puppet.com/open-source/bolt/
  • 39. Bolt # bolt-project.yaml modulepath: - modules modules: - name: puppetlabs/apt # inventory.yaml groups: - name: all-of-azure targets: - uri: 1.2.3.4:22 name: prod config: transport: ssh ssh: user: ubuntu
  • 40. Bolt bolt project init bolt module install bolt command run apt action=update --targets servers
  • 41. Bolt & Terraform groups: - name: all-of-azure targets: - _plugin: terraform dir: /path/to/terraform/project resource_type: azurerm_virtual_machine target_mapping: uri: public_ip plan do_important_stuff (TargetSpec $targets){ run_task('terraform::initialize', 'dir' => '/path/to/terraform/project') $apply_result = run_plan('terraform::apply', 'dir' => '/path/to/terraform/project', 'return_output' => true) run_task('important::stuff', $targets, 'task_var' => $apply_result) } https://forge.puppet.com/modules/puppetlabs/terraform
  • 42. Bolt & Vault targets: - ... config: ssh: user: root private-key: key-data: _plugin: vault server_url: https://active.vault.service.consul:8200 auth: method: token token: xxxxx-xxxxx path: secrets/bolt field: private-key https://forge.puppet.com/modules/puppetlabs/vault
  • 44. The Floor is yours… Questions ?