A general overview of how to implement Puppet in a masterless way.

1. Masterless Puppet
(Decentralised architecture)
Jesus Nunez
nunezmontoya210@gmail.com
Sydney puppet users group March 2014

2. who is Jesus Nunez?
- Software Engineer
- Enjoys continuous process improvement
- 15+ year developing software
- Have worked for Government, Telco and Finance
industry
- Puppet enthusiast
- Currently helping to automate as much as I can…
especially my Job !!!

3. What makes up Puppet?
- Puppet DSL code
- Ruby libraries
- Execution services
=> knowledge
=> engine
=> trigger

4. Execution services in Master-node mode
for each node {
node wakes up every X time
master receives node’s signal
master compiles node’s catalog
master sends instructions to node
node applies changes and go to sleep
}

5. Execution services in Masterless mode
for each node {
remote executor sends command to node
node pulls Puppet code from git central repo
node compiles catalog
node applies changes
}

6. Distributing the knowledge
- The Puppet code will be held in each node rather than in
a Puppet Master server.
- Node local git repo will have the node’s puppet code.

7. librarian-puppet
Ruby library to manage Puppet modules.
The Puppetfile has the list of modules to pull from internal or external repos.
mod "apt",
:git => "git://github.com/puppetlabs/puppetlabs-apt.git"
mod "my_web_server",
:git => "ssh://repos.git.mycompany/infra/my_web_server.git"
:ref => “v1.0”

8. SSH remote execution
A remote executor server will trigger on one or more
target nodes:
1. Code update via librarian puppet
2. Puppet apply command

9. How do we get there?
- Puppet installed in the nodes (no need for certificate and
daemon)
- Install remote executor
- Remote executor SSH key distribution
- ENC file(s)
- Puppetfile generator
- Puppet modules with Hiera data

10. ENC file and Puppetfile generation
git_repo: ssh://repos.mycompany.com/infra
- web_server_node: &WEB_SERVER
- apache:
version: "v1.0"
...
- mysql:
version: "master"
...
- auth_node: &AUTH
- open_am...
- open_idm...
- open_dj..
- server1.mycompany.com:
type: *WEB_SERVER
- server2.mycompany.com:
type: *WEB_SERVER
- server3.mycompany.com:
type: *AUTH
Node types Nodes declaration

11. ENC file and Puppetfile generation
# server1.mycompany.com and server2.mycompany.com
mod "apache",
:git => "ssh://repos.git.mycompany/infra/apache.git",
:ref => “v1.0”
mod "mysql",
:git => "ssh://repos.git.mycompany/infra/mysql.git"
# server3.mycompany.com
mod "opean_am",
:git => "ssh://repos.git.mycompany/infra/open_am.git"
:ref => “v1.0”
mod ….

12. Putting it all together
Remote
Executor
Send
remote
command Git
Repo
Pull code
> Puppetfile generation
> Librarian-puppet install/update
> Puppet apply command

13. Multiple Environments
DEV
Remote Executor
Git repo
Nodes
TEST
Remote Executor
Git repo
Nodes
PROD
Remote Executor
Git repo
Nodes

14. Pros
- Distributed processing
- Distributed knowledge
- No single point of failure
- Less moving parts
Cons
- Reimplement remote execution and/or job scheduling
- Reimplement ENC

15. Remote Executors
- Command line
- Rundeck
- Bamboo
- Jenkins

16. questions?

17. thanks :)