Some experiences with Puppet

First published on
For political correctness I will use the term Chefpet for either Chef or Puppet.

At Mendix we are now managing quite a lot of servers. They are all very similar. Over the last year we've set up about 200 new servers with the same bash script. Whenever we updated the script, we pushed the changes to the existing servers using Fabric. From the start we anticipated and indeed soon ran into an issue: "This will not scale."

Everyone in the devops field, or in a startup that grows too fast, will tell you that you require a tool like Chefpet or if you are very brave CFEngine. So, this week we decided to give Puppet a try, next week we'll try Chef.

We're probably going to write up on this on the Mendix Tech Blog, but I can already tell you this:

When I first read someone comment "So, if you're in the market, good luck making your choice. I'm not making a recommendation here because, quite frankly, I wouldn't recommend either to anyone other than my worst enemy. ;-)"  on Hacker News, I thought he was joking. Now I see what he meant.

Our use case is basically this: we create a new Debian server on a IaaS provider using libcloud (Rackspace, Linode, you name it). We run some very very basic initial configuration (put the hostname in /etc/hosts, set up /etc/network/interfaces, we install Chefpet). Then we connect to the Chefpet master and from there EVERYTHING should come up automatically. The server should install the required packages, it should be firewalled, it should have a DNS entry, it should be registered with our Cloud Portal etcetera.

We basically have three common server types: appnode (runs jvm's on sun-java-jre), dbnode (runs postgres), webserver (runs nginx as a reverse proxy).

In my OO mind it makes sense to create a basenode. The other types would be subclasses of this basenode.

In this basenode we would like:

  • The resolvers (2+) we've set up in this node's datacenter.
  • A local mailserver that forwards to our own mailservers (2+) in this datacenter.
  • Some basic nagios-nrpe and munin plugins.
  • A vimrc for root, our ssh keys, tools like ack-grep, nmon, mrt, etc..
Before we can install anything we need to run apt-get update/apt-get upgrade.

To be continued.

Comments

Post a Comment

Popular posts from this blog

"Security Is Our Top Priority" is BS

First published on
A couple of years ago I was asked to give a conference talk about software security. Well, actually I wasn't really asked, my company bought a sponsorship package with a speaker slot and I replied to the internal email asking for volunteers  🤣  Anyway, while preparing my talk, I realized a couple of important points about security that have not left my mind since: Security is limitless . You can always spend more effort to make things more secure. The same goes for quality, safety, employee happiness, etc. The needs of security are opposed to the needs of a convenient user experience . Improving one typically hurts the other. Now some organizations say "Security is our #1 priority". Really? You want to make something that has no limits your number one priority? I mean security is a good thing, but this seems a bit too simple? In fact, hollow marketing claims like that can make me a bit angry. In this post I'll help you understand what to make of statements like that...
Read more

AI programming tools should be added to the Joel Test

First published on
Here's a wake-up call to all CTOs: AI programming tools are getting freaking amazing and if you don't allow your teams to use them somehow, it will bite you in the ass in a couple of years. You will be slower and you will lose your best people. The infamous Joel Test is a list from the year 2000 of 12 things all great software companies do. Since then most companies have implemented Git and CI/CD, checking of three items, so we have some space left in the 2024 update ;) I believe "Do you allow your developers to use AI assisted development environments?" is a necessary addition. I get that you don't want your source code to end up on some OpenAI / Microsoft / Github server somewhere, sure, but find a way to use your own models or learn to live with it. Note that this is often not the same as "#9 - Do you use the best tools money can buy?" as blocking AI tools is about data security, not money. So why do I think developers need AI programming tools? I...
Read more

The long long tail of AI applications

First published on
Image
Last year multiple companies asked me for advice. " We are evaluating this AI powered product, but do you think it makes sense at all? It seems a bit niche and we think ChatGPT might make this entire thing obsolete soon. " Long tail - credit to Wikipedia My answer so far has always been: "No, bare LLMs are not going to compete with this product." I think that people are failing to understand the distinction between different classes of AI companies. I see it like this: Foundational AI - creating models like GPT-4 (text), Sora (video) etc. Applied AI - using existing models to create smart applications. Note that there are also companies not focusing on AI - they will start lagging behind, let's forget about them ;) There are orders of magnitude  (!)   more companies that will deal with Applied AI than Foundational AI, and they will be very busy for decades to come. Here's why: To get the most out of LLMs, you have to ask the right questions. LLMs have acc...
Read more