Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Doom Your Chef in 3 Easy Steps

Doom Your Chef in 3 Easy Steps

Configuration management is all the rage. It’s pretty much acknowledged that no web sites of any size can be built without automation and configuration management. In reality, there are still many web sites built precariously by hand, held together with scripts and string. Yours might be one. Maybe recently you’ve seen the light and discovered config management tools and now you're going to automate ALL THE THINGS!

Hold your horse there cowboy! Let's think about and a level of self awareness required during the early days that you may not anticipate. A lot of these questions don't actually have yes/no easy answers. My major concern is to get folks thinking about things so they don't set up a chef server and go "now what" or in six months go "oh crap"

Sascha Bates

April 26, 2013
Tweet

More Decks by Sascha Bates

Other Decks in Programming

Transcript

  1. Why should you listen?  5    years  on  a  retail

     web  ops  team  5  years  infrastructure  consulting    3  years  with  Chef Saturday, April 27, 13
  2. Why should you listen? The  ability  to  learn  from  another’s

      mistakes  is  a  sign  of  operational  maturity. -­‐me Saturday, April 27, 13
  3. ignore your infrastructure free range packages  Packages  and  repositories  are

     more  than   just  something  to  fight  about  on  the   Internet Saturday, April 27, 13
  4. ignore your infrastructure free range packages What  works  for  chickens

     and  cows  doesn’t   work  for  software Saturday, April 27, 13
  5. ignore your infrastructure free range packages Who  cares  where  I

     keep  my  packages? Saturday, April 27, 13
  6. ignore your infrastructure free range software  Ruby  (epel)  Rubygems  (rubygems.org)

     Chef  and  associated  gems  (rubygems.org) Saturday, April 27, 13
  7. ignore your infrastructure free range software  Ruby  (epel)  Rubygems  (rubygems.org)

     Chef  and  associated  gems  (rubygems.org)  Random  gems  for  projects Saturday, April 27, 13
  8. ignore your infrastructure free range software  Ruby  (epel)  Rubygems  (rubygems.org)

     Chef  and  associated  gems  (rubygems.org)  Random  gems  for  projects  Zip  packages  downloaded  from  the  internet Saturday, April 27, 13
  9. ignore your infrastructure free range software  Ruby  (epel)  Rubygems  (rubygems.org)

     Chef  and  associated  gems  (rubygems.org)  Random  gems  for  projects  Zip  packages  downloaded  from  the  internet Saturday, April 27, 13
  10. ignore your infrastructure life without package repos  Compiling  from  source

     sucks  Rabbit  droppings Saturday, April 27, 13
  11. ignore your infrastructure life without package repos  Compiling  from  source

     sucks  Rabbit  droppings  Source  bombs Saturday, April 27, 13
  12. ignore your infrastructure life without package repos  Compiling  from  source

     sucks  Rabbit  droppings  Source  bombs  Stealth  bombs Saturday, April 27, 13
  13. ignore your infrastructure life without package repos  Compiling  from  source

     sucks  Rabbit  droppings  Source  bombs  Stealth  bombs  Serial  failed  deployments Saturday, April 27, 13
  14. ignore your infrastructure honorable mentions Do  not  get  attached  to

     your  servers Get  some  virtualization Saturday, April 27, 13
  15. TEST NOTHING testing is dumb Who  cares  if  I  bring

     down  all  the  other  people   developing  on  Chef-­‐provisioned  VMs  and   servers? Saturday, April 27, 13
  16. TEST NOTHING testing is dumb  I’m  just  fixing  a  typo

       with  another  typo  It’s  just  new  functionality  with  more  logic Saturday, April 27, 13
  17. TEST NOTHING baby steps  Syntax  Testing  with  Knife  Lint  with

     Foodcritic  Vagrant:  Basic  local  testing   Saturday, April 27, 13
  18. test nothing do it again  Converge  until  it  works  Rerun

     it  from  scratch  Do  it  again Saturday, April 27, 13
  19. test nothing level up  Functional  tests  with  Minitest  Chef  Handler

    it "creates directories" do directory("/etc/").must_exist.with(:owner, "root") assert_directory "/etc", "root", "root", 0755 end Saturday, April 27, 13
  20. write scripts, not code direct script port porting  scripts  into

     Chef  is  a   recipe  for  eternal  sadness Saturday, April 27, 13
  21. bash "update_ssh" do code <<-EOH sed -i -e 's/AuthorizedKeysFile.*authorized_keys/ AuthorizedKeysFile

    \\/\\.keys\\/%u\\/ authorized_keys/g' /etc/ssh/sshd_config EOH end bash “ssh_dns” do code <<-EOH sed -i -e 's/#UseDNS.yes/UseDNS no/g' / etc/ssh/sshd_config EOH end Saturday, April 27, 13
  22. write scripts, not code code trumps scripts package "ssh" do

    action :install end service "sshd" do action [:enable, :start] end template "/etc/ssh/sshd_config" do action :create mode 0644 notifies :restart,"service[sshd]" end Saturday, April 27, 13
  23. # Cookbook Name:: keys # Recipe:: common # Author:: Sascha

    Bates keys = [] search('public_keys',"tags:common").each { |k| keys << k } search('public_keys',"tags:chef AND tags:#{node.env}").each { |k| keys << k } keys.each do |k| key_type, key_part, key_comment = k['pub_key'].split(' ') ruby_block "root_keys_#{k['id']}" do Chef::Log.debug("test condition: grep #{key_part} #{keyfile}") not_if "grep #{key_part} #{keyfile}" block do File::open(keyfile, 'a') do |f| Chef::Log.debug("Adding #{key_comment} to #{f.path}") f << k["pub_key"] << "\n" end end end end Saturday, April 27, 13
  24. write scripts, not code dsl trumps code # Cookbook Name::

    keys # Recipe:: common # Author:: Sascha Bates authkey “common_key” do action :add user “root” end Saturday, April 27, 13
  25. now what? "Almost nobody wants things to be as shitty

    as they can be...” -Jesse Robbins Saturday, April 27, 13