FOREMAN AND PUPPET @ UNIVERSITY OF BONN OLIVER FREYERMUTH, PETER WIENEMANN PHYSICS INSTITUTE @ U BONN ● The Physics Institute at the University of Bonn has – ~240 members – ~1500 registered devices in IPAM – Biggest particle accelerator run by a German university (164.4 m circumference) with two „large“ experiments (O(50) collaborators) ● IT group of Physics Institute – 2 „full time“ persons with teaching duties – 1 technician – 5 part-time persons (~0.2 FTE each) – Plan to merge with IT group of Nuclear/Hadron Physics Institute (HISKP) O. Freyermuth and P. Wienemann: Foreman and Puppet @ University of Bonn 2 MORE NUMBERS ● Run approximately 400 centrally managed Linux nodes at Physics Institute – Desktops (Ubuntu 18.04) → ~150 nodes – HPC/HTC cluster nodes (SL6/CentOS 7) → ~150 nodes – Servers → ~100 nodes with ~40 different services ● O(1000) self-managed (sometimes ~unmanaged) devices (laptops, lab PCs, printers, cameras, oscilloscopes, H.323 devices, TVs, tablets, PDUs, ...) ● Use central university computing centre offerings for standard services like mail system, web content management system, IPAM, ticket system, network services, OwnCloud with Onlyoffice, etc. O. Freyermuth and P. Wienemann: Foreman and Puppet @ University of Bonn 3 HISTORY ● Using Puppet since ~2009 – Completely self-written manifests, no modules, poor maintainability – Only used for desktops and HPC/HTC cluster nodes ● Refactored everything in ~2014: Switch to „roles and profiles“ paradigm – Started using publicly available third-party modules – Still self-written PXE/kickstart/preseed machinery ● Started Foreman tests in 2015 Migration of production systems to Foreman started in 2017 – Full puppetization of all nodes/services – Discarded self-written deployment machinery → replaced by Foreman tools O. Freyermuth and P. Wienemann: Foreman and Puppet @ University of Bonn 4 LAYOUT Network A Network B Foreman Proxy Foreman Proxy (Puppet Master, TFTP) (Puppet Master, TFTP) Network C Network D Foreman Server (Puppet-Master, CA) Foreman Proxy Foreman Proxy (Puppet Master, TFTP) (Puppet Master, TFTP) Git Repository O. Freyermuth and P. Wienemann: Foreman and Puppet @ University of Bonn 5 PRESENT WORKFLOW ● Most of the presently used 86 Puppet modules are third-party code. Forked on Github and collected on https://github.com/unibonn. Patches always sent upstream. ● Discarded „roles“ → Foreman hostgroups/config groups ● „profiles“ kept on private, on premise git hosting platform – Contains site/host specific configuration, augmented by parameters (see below) ● Module management done with r10k, synced to all Puppet masters ● Foreman Puppet class filter: Only „profiles“ visible (to avoid clutter) ● No hiera → Foreman global and smart class parameters ● No mcollective O. Freyermuth and P. Wienemann: Foreman and Puppet @ University of Bonn 6 QUESTIONS ● What is your Puppet module design „philosophy“? ● How do you manage Puppet code? ● How do you handle parameters? ● Which Foreman plugins do you use/do you consider useful? O. Freyermuth and P. Wienemann: Foreman and Puppet @ University of Bonn 7 Thanks for your attention! Oliver Freyermuth: [email protected] Peter Wienemann: [email protected].