Rapid testing Setups for Puppet – Felix Frank, MPeX.net GmbH

2. Creating rapid Puppet
test environments
and running from source

3. Felix Frank
MPeX.net GmbH
@felis_rex
ffrank.github.io

4. This session

5. Learn one simple technique
to make Puppet do what
you want for a while.

6. Puppet
A quick rehash

10. Software - behaving
erratically since 1947

11. We usually need
to find the cause

12. Strategy

13. research safely
in a lab environment

14. ...allows arbitrary repetition

15. ...liberally strip down your code

16. ...eliminate problem through iteration

17. ...generate minimal reproduction

18. Lab environment
approaches

19. create a VM and set up Puppet

20. clone the original machine

21. have a Vagrant
or Docker file ready
etc.

22. All these are valid
but possibly
too expensive

23. Agent setups are
simple enough
but masters are no fun

24. What with
the whole
SSL dance

25. Proposal

26. Just run Puppet as a non-root user

28. Just kidding!
Here's how it works

29. All Puppet data and configs
can live in ~/.puppet/

30. ...allowing shenanigans galore

31. Let's see it
in action

32. Do these in .SHrc
GEM_HOME=~/gems
PATH=$PATH:$GEM_HOME/bin

33. Then just
> gem install puppet
--version 3.7.5

34. How does it work?
A quick overview
of Puppet's configuration.

35. $HOME is used courtesy
of sensible default configs.

36. Take a look
> puppet master --configprint manifest
/home/puppy/.puppet/manifests/site.pp

37. Find settings
> puppet master --configprint all
| grep 'puppet.conf'
config = /home/puppy/.puppet/puppet.conf
config_file_name = puppet.conf

38. Get an overview
> puppet master --configprint all | less

39. ...and go a little crazy
> puppet master --confdir /tmp
--configprint manifest
/tmp/manifests/site.pp

40. Cascading settings

41. There are two trees
of path settings
with roots
→ confdir
→ vardir

42. All other paths
are derived, e.g.
statefile = $statedir/state.yaml
= $vardir/state/state.yaml

43. Both confdir and vardir
are in ~/.puppet per default.
...execpt you are root or puppet

44. Speaking
of defaults

45. The examples represent
version 3.x behavior.
Puppet 4 has similar
but different defaults.

46. Don't try this
with 2.x

47. What this
all means

48. With these tools any user
can run a complete
(WEBrick) master with CA.

49. The agent is limited.
→ file as per permissions
→ cron only for your jobs
→ package works only with
gems and similar
etc.

50. All this holds true
for puppet apply as well.

51. A word on security

53. Will this
enable
spoofing?

54. Not really.

55. → Master port is unprivileged.
→ But user cannot get
a signed master cert.
Only new agents are vulnerable

56. Make sure your master
always keeps its port.

57. ...or pre-share the CA cert.

58. ...orAlways
pre-share
the CA cert.

59. Use the source

60. With Ruby applications
this is not quite intuitive.

61. Just calling
> ~/puppet-3.4.2/bin/puppet
agent --test
will likely not do what you want.

62. Ever looked at bin/puppet?

63. #!/usr/bin/env ruby
begin
require 'puppet/util/command_line'
Puppet::Util::CommandLine.new.execute
rescue LoadError => e
$stderr.puts e.message
exit(1)
end

64. Puppet relies on require logic.
Straight forward approach:
Manipulate Ruby's LIBRARY_PATH

65. > ruby -e 'puts $:'
/usr/lib/ruby/vendor_ruby
/usr/lib/ruby/1.9.1
...

66. > export RUBYLIB=~/puppet-3.4.2/lib
> ruby -e 'puts $:'
/home/puppy/puppet-3.4.2/lib
/usr/lib/ruby/vendor_ruby
/usr/lib/ruby/1.9.1
...

67. This is rather fragile
and cumbersome.

68. In fact, Gems can mess up
the library look-up and
cause unpredictable results.

69. Bundler

70. Arguably the best way
to manage installed
gems and versions.

73. Synopsis:
> cd path/to/git-clone
> bundle install
> bundle exec ...
e.g.
> bundle exec puppet master

74. But Why

75. Running from source:
not only for hackers

76. Aside from idle tinkering
it allows contributing
by triaging bugs
and finding reproductions

77. In summary

78. We can run
arbitrary manifests
and module sets
from ~/.puppet

79. This works with
> puppet master
> puppet agent
> puppet apply

80. Try arbitrary versions
of Puppet using git
and bundler

82. A word on my behalf

83. Read.

85. A word on your behalf

86. Diversity.

87. Let's not be a bunch
of white dudes forever.

88. Thanks for listening!
Images
http://wallpaperscraft.com/download/line_background_brush_colorful_bright_60114/1366x768
http://www.funnyjunk.com/funny_pictures/4162539/Mayonnaise+low/
http://imgfave.com/view/3573521
http://web.mit.edu/mtg/www/2005/FAL/Photos.html
https://flic.kr/p/auyoK1
http://novemberart.deviantart.com/art/Scientist-Cat-293594656
http://www.angelfire.com/wv/otieandtanya/puppetry.html
http://www.shopage.fr/?q=Fin
http://www.hlg.co.nz/building.php
http://bashish.sourceforge.net/old/screenshots.html
http://www.melablog.it/post/14719/apple-e-i-531-certiicati-ssl-diginotar-rubati
http://www.hisbuildingblocks.com/2010_04_01_archive.html
http://www.hollywoodisburning.com/2012/08/the-new-basis-of-power/
http://odesk.ro/hackers-hack-online-anti-hacking-session/
http://www.neebu.net/~khuon/gallery/misc/linux_nylug_booth