How to generate the pre populated information in metadata.rb in chef

You can configure the values in my knife.rb:

cookbookcopyright “Rajesh Kumar”
cookbooklicense “apachev2”
cookbook_email “rajesh@scmgalaxy.com”

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post How to generate the pre populated information in metadata.rb in chef? appeared first on scmGalaxy.

Error while uploading the cookbooks….

> knife cookbook upload cookbooks_test
ERROR: Could not find cookbook cookbooks_test in your cookbook path, skipping it
ERROR: Failed to upload 1 cookbook.

Solution:

You can pass path of the cookbooks via commend line using…

knife cookbook upload cookbooks_test -o /path/to/cookbook

Also, you can set the path in .chef/knife.rb. If .chef/knife.rb is missing, you can following commands…

knife configure --initial

But if you install the startter kit from manage.chef.io, you just need to replace all the files including .knife.rb

if you cookbooks files many places then you can set your .knife.rb like as below;

cookbook_path [ '.', '..', './cookbooks', '~/git/chef' ]

If you are still getting this error, make sure the metadata.rb has same name which you using to upload the cookbooks.
Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Error: Could not find cookbook cookbooks_test in your cookbook path, sk appeared first on scmGalaxy.

FATAL: Chef::Exceptions::ChildConvergeError: Chef run process exited unsuccessfully

> knife bootstrap uvo1t75faaktzc532w6.vm.cld.sr -x root -P Br356YS0iy --sudo

Doing old-style registration with the validation key at /Users/rajesh.kumar/chef-repo/.chef/scmgalaxy-validator.pem...
Delete your validation key in order to use your user credentials instead

Connecting to uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr
> Existing Chef installation detected
uvo1t75faaktzc532w6.vm.cld.sr Starting first Chef Client run...
uvo1t75faaktzc532w6.vm.cld.sr [2015-08-20T12:01:37-04:00] WARN:
uvo1t75faaktzc532w6.vm.cld.sr * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
uvo1t75faaktzc532w6.vm.cld.sr SSL validation of HTTPS requests is disabled. HTTPS connections are still
uvo1t75faaktzc532w6.vm.cld.sr encrypted, but chef is not able to detect forged replies or man in the middle
uvo1t75faaktzc532w6.vm.cld.sr attacks.
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr To fix this issue add an entry like this to your configuration file:
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr # Verify all HTTPS connections (recommended)
uvo1t75faaktzc532w6.vm.cld.sr ssl_verify_mode :verify_peer
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr # OR, Verify only connections to chef-server
uvo1t75faaktzc532w6.vm.cld.sr verify_api_cert true
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr To check your SSL configuration, or troubleshoot errors, you can use the
uvo1t75faaktzc532w6.vm.cld.sr `knife ssl check` command like so:
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr knife ssl check -c /etc/chef/client.rb
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Starting Chef Client, version 11.16.2
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr ================================================================================
uvo1t75faaktzc532w6.vm.cld.sr Chef encountered an error attempting to load the node data for "C2445575914.domain"
uvo1t75faaktzc532w6.vm.cld.sr ================================================================================
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Authentication Error:
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Failed to authenticate to the chef server (http 401).
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Server Response:
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Failed to authenticate as 'C2445575914.domain'. Ensure that your node_name and client key are correct.
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Relevant Config Settings:
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr chef_server_url " api.opscode.com/organizations/scmgalaxy "
uvo1t75faaktzc532w6.vm.cld.sr node_name "C2445575914.domain"
uvo1t75faaktzc532w6.vm.cld.sr client_key "/etc/chef/client.pem"
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr If these settings are correct, your client_key may be invalid, or
uvo1t75faaktzc532w6.vm.cld.sr you may have a chef user with the same client name as this node.
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr [2015-08-20T12:01:41-04:00] FATAL: Stacktrace dumped to /var/chef/cache/chef-stacktrace.out
uvo1t75faaktzc532w6.vm.cld.sr Chef Client failed. 0 resources updated in 3.598799916 seconds
uvo1t75faaktzc532w6.vm.cld.sr [2015-08-20T12:01:41-04:00] ERROR: 401 "Unauthorized"
uvo1t75faaktzc532w6.vm.cld.sr [2015-08-20T12:01:41-04:00] FATAL: Chef::Exceptions::ChildConvergeError: Chef run process exited unsuccessfully (exit code 1)

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

rajeshkumar replied the topic: FATAL: Chef::Exceptions::ChildConvergeError: Chef run process exited u

I just login to the nodes and deleted all files under /etc/chef/ and rerun the commands and worked like charm.

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Fatal: Chef::Exceptions::ChildConvergeError: Chef run process exited unsuccessfully appeared first on scmGalaxy.

Issues –

knife bootstrap uvo1t75faaktzc532w6.vm.cld.sr -x root -P Br356YS0iy --sudo --node-name firefox
Doing old-style registration with the validation key at /Users/rajesh.kumar/.chef/scmgalaxy-validator.pem...
Delete your validation key in order to use your user credentials instead

Connecting to uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr
> Existing Chef installation detected
uvo1t75faaktzc532w6.vm.cld.sr Starting first Chef Client run...
uvo1t75faaktzc532w6.vm.cld.sr [2015-08-20T12:10:17-04:00] WARN:
uvo1t75faaktzc532w6.vm.cld.sr * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
uvo1t75faaktzc532w6.vm.cld.sr SSL validation of HTTPS requests is disabled. HTTPS connections are still
uvo1t75faaktzc532w6.vm.cld.sr encrypted, but chef is not able to detect forged replies or man in the middle
uvo1t75faaktzc532w6.vm.cld.sr attacks.
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr To fix this issue add an entry like this to your configuration file:
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr # Verify all HTTPS connections (recommended)
uvo1t75faaktzc532w6.vm.cld.sr ssl_verify_mode :verify_peer
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr # OR, Verify only connections to chef-server
uvo1t75faaktzc532w6.vm.cld.sr verify_api_cert true
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr To check your SSL configuration, or troubleshoot errors, you can use the
uvo1t75faaktzc532w6.vm.cld.sr `knife ssl check` command like so:
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr knife ssl check -c /etc/chef/client.rb
uvo1t75faaktzc532w6.vm.cld.sr ```
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Starting Chef Client, version 11.16.2
uvo1t75faaktzc532w6.vm.cld.sr Creating a new client identity for firefox using the validator key.
uvo1t75faaktzc532w6.vm.cld.sr resolving cookbooks for run list: []
uvo1t75faaktzc532w6.vm.cld.sr Synchronizing Cookbooks:
uvo1t75faaktzc532w6.vm.cld.sr Compiling Cookbooks...
uvo1t75faaktzc532w6.vm.cld.sr [2015-08-20T12:10:21-04:00] WARN: Node firefox has an empty run list.
uvo1t75faaktzc532w6.vm.cld.sr Converging 0 resources
uvo1t75faaktzc532w6.vm.cld.sr
uvo1t75faaktzc532w6.vm.cld.sr Running handlers:
uvo1t75faaktzc532w6.vm.cld.sr Running handlers complete
uvo1t75faaktzc532w6.vm.cld.sr Chef Client finished, 0/0 resources updated in 4.732276995 seconds
MAMSIT1026467:.chef rajesh.kumar$ knife bootstrap {{uvo1t75faaktzc532w6.vm.cld.sr}} --ssh-user {{root}} --ssh-password '{{Br356YS0iy}}' --sudo --use-sudo-password --node-name firefox1
Doing old-style registration with the validation key at /Users/rajesh.kumar/.chef/scmgalaxy-validator.pem...
Delete your validation key in order to use your user credentials instead

Connecting to {{uvo1t75faaktzc532w6.vm.cld.sr}}
ERROR: Network Error: getaddrinfo: nodename nor servname provided, or not known
Check your knife configuration and network settings

Solution –

I am not able to find the problem with the above commands but following commands is working perfectly....
knife bootstrap uvo1t75faaktzc532w6.vm.cld.sr -x root -P Br356YS0iy --sudo --node-name firefox

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Error: Network Error: getaddrinfo: nodename nor servname provided, or appeared first on scmGalaxy.

Error

knife node edit firefox
ERROR: You must set your EDITOR environment variable or configure your editor via knife.rb

Solution:

export EDITOR=$(which vi)
To persist this, add it to ~/.bashrc or ~/.bash_profile.
or
knife[:editor] = "vi" in knife.rb

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post You must set your EDITOR environment variable or configure your editor appeared first on scmGalaxy.

When i bootstrap windows node, i get following error..

knife bootstrap windows winrm uvo1eak9a5geec05f7z.vm.cld.sr --winrm-user administrator --winrm-password 'Rx4m7W4PQu' --node-name firefox_win --run-list 'recipe[snc_firefox]'

Waiting for remote response before bootstrap./opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
../opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/session.rb:48: warning: epoll is not supported on this platform
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/em-winrm-0.7.0/lib/em-winrm/server.rb:45: warning: epoll is not supported on this platform
ERROR: No response received from remote node after 1.98 minutes, giving up.
ERROR: WinRM::WinRMAuthorizationError: WinRM::WinRMAuthorizationError

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Waiting for remote response before bootstrap in windows appeared first on scmGalaxy.

Project 1 – Write a cookbook which can add your bash script in crontab on your nodes.

Project 2 – Perforce the following workflow of chef configuration management tools?

— create a new cookbook and add a recipe to it
— upload your cookbook to the Chef server
— configure your node’s run list
— run chef-client to trigger the configuration process on your target node

Project 3 – Write a cookbook with external cookbook_files in Chef?

Project 4 – Write a cookbook which can Set Chef Cookbook Dependencies in metadata file and use it?

Project 5 – Write a cookbook add jenkins slave nodes in jenkins master server using Chef cookbook?

Project 6 – Write a cookbook to configure nginx with chef solo on vagrant?

Project 7 – Write a cookbook to Setting up a MySQL database with a user with Vagrant and chef-solo?

Project 8 – Write a cookbook to track changes made to systems via knife in chef?

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Configuration management chef tools projects to test your skills? appeared first on scmGalaxy.

How do we configure WLS and Oracle DB using docker/chef/puppet

The post Configure WLS with Oracle DB appeared first on scmGalaxy.

Problem
AWT is not properly configured on this server. Perhaps you need to run your container with “-Djava.awt.headless=true”? See also: wiki.jenkins-ci.org/display/JENKINS/Jenk…awt.headless+problem

Mixlib::ShellOut::ShellCommandFailed
Expected process to exit with [0], but received '2'
---- Begin output of /opt/opscode/embedded/bin/chpst -u opscode -U opscode /opt/opscode/embedded/bin/rabbitmqctl wait /var/opt/opscode/rabbitmq/db/rabbit@localhost.pid

[2016-08-31T22:10:34-04:00] FATAL:
BOOT007: The secrets file (/etc/opscode/private-chef-secrets.json) is present
but the file /etc/opscode/pivotal.pem is missing.

Ensure that private-chef-secrets.json is copied into /etc/opscode from the
first Chef Server node that you brought online, then run
‘chef-server-ctl reconfigure’ again.
FIX1:

your code here

To fix it, I deleted /etc/opscode/private-chef-secrets.json and run again chef-server-ctl reconfigure

FIX2:

cp /opt/opscode/embedded/service/omnibus-ctl/spec/fixtures/pivotal.pem /etc/opscode/

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post AWT is not properly configured on this server appeared first on scmGalaxy.

Error executing action `run` on resource ‘execute[/opt/opscode/embedded/bin/chpst -u opscode -U opscode /opt/opscode/embedded/bin/rabbitmqctl wait /var/opt/opscode/rabbitmq/db/rabbit@localhost.pid]’

Fix 1
So obviously RabbitMq is running, on port 5672, which can be verified through
> netstat -ltnp
tcp 0 0 127.0.0.1:5672 0.0.0.0:* LISTEN 1111/beam.smp

Fix 2
> /etc/init.d/rabbitmq-server stop

Fix 3:
Check your /etc/hosts file. That is not defined well.

Reference
discourse.chef.io/t/chef-server-missing-…and-pivotal-pem/7756
serverfault.com/questions/663310/chef-se…-fails-with-rabbitmq
discourse.chef.io/t/chef-12-server-dead-…nfigure-bombs/7435/7

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Error executing action `run` on resource ‘execute[/opt/opscode/embedded/bin/chps appeared first on scmGalaxy.

Error
ERROR: Failed to authenticate to api.chef.io/organizations/ravitestorg as ravidaur with key /root/chefrepo/.chef/ravidaur.pem
Response: Failed to authenticate as ravidaur. Synchronize the clock on your host.

docs.chef.io/errors.html

Solution

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Error: Failed to authenticate to https://api.chef.io/organizations appeared first on scmGalaxy.

Problem

[root@sv-chef-server mychefrepo]# sudo knife node list
ERROR: SSL Validation failure connecting to host: 10.0.0.134 - SSL_connect returned=1 errno=0 state=error: certificate verify failed
ERROR: Could not establish a secure connection to the server.
Use `knife ssl check` to troubleshoot your SSL configuration.
If your Chef Server uses a self-signed certificate, you can use
`knife ssl fetch` to make knife trust the server's certificates.

Original Exception: OpenSSL::SSL::SSLError: SSL Error connecting to https://10.0.0.134/organizations/mysvhcl/nodes - SSL_connect returned=1 errno=0 state=error: certificate verify failed

Solution

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Error: SSL Validation failure connecting to host appeared first on scmGalaxy.

Source – http://hub.scalr.com/blog/top-questions-on-server-configuration-management-tools-chef-puppet-and-ansible-2

As a quick recap, configuration management tools enable companies to standardize and automate their infrastructure. Through standardization, you can build systems that are platform independent (i.e. instead of relying on AMIs or provider specific toolsets). These tools also make it easy reproduce servers for scaling or testing, and recover from disaster quickly by defining a proper application state. For example, if servers are not in that defined state when each server is checked, they are restored to their proper state. In addition, this standardization makes it easy to onboard new developers.

While the language across configuration management tools is different, the concepts are the same. At the fundamental level in each configuration tool, a resource represents a part of the system and its desired state, such as a package that should be installed, a service that should be running, or a file that should be generated.

In Chef, a recipe is a collection of resources that describes a particular configuration or policy. These collections are called playbooks in Ansible, and manifests in Puppet. These collections describe everything that is required to configure part of a system. Collections install and configure software components, manage files, deploy applications, and execute other recipes. We go into more detail in our blog post here.

Here are the top questions we got from the community:

How is the concept of master/agent configuration better (or not) than agentless, when it comes to infrastructure as code?

Chef and Puppet are master/agent configuration systems, while Ansible is an agentless system. The historic argument is that the agent-based installation process is difficult –  you have to set up the master, and then set up the agents on your nodes so that they know about the master. If you’ve got servers with diverse linux distros, on different versions of Windows, etc., installation can get tricky. Though, because they’re logging every few minutes, agent-based systems are powerful for advanced monitoring. At the end of the day this really is based on personal preference and what company requires. If your infrastructure is beefy and heavily standardized, installation on nodes isn’t complicated so use agent-based systems. If you have servers that run Python, try agentless.

Are these configuration management systems like MicroSoft System Center Configuration Manager (SCCM) but used for local and cloud?

This is like MS SCCM, but open-source and paid for per node. For those who haven’t used it, MicroSoft System Center Configuration Manager (SCCM) is used for infrastructure provisioning, monitoring, and automating workflow processes (usually sysadmin stuff). SCCM is a powerhouse in the enterprise space. While it can manage end clients on non-Windows servers, the server console portion of SCCM must be hosted and run on a Windows server machine. The reason other orchestration/configuration systems win here is that you pay on a per-node basis and you’re not totally tied into Windows Server’s licensing agreements. In other words, open-source vs proprietary. And with Chef/Puppet/Ansible the thinking is more in resources as opposed to SCCM, which is more in files and terminal commands.

An attendee commented on using SCCM:

 “We really like Ansible because of the none-agent requirement. For Windows patching we utilize System Center Configuration Manager, and even though System Center can provide patching to Linux we have run into issues with SCCM agent staying healthy and running on our Linux systems. We have also run into when the SCCM admins have made changes it broke SCCM agent on a majority of our Linux servers. Our Linux patching process has been highly manual up to this point but we are seeking to automate this to free up staff time to be better directed at other support tasks, which is why were are reviewing several solutions. The non-agent aspect is highly desirable in our situation because of past experience with SCCM agent. I just wanted to provide that feedback so others that have not experienced agent issues with other deployment solutions may want to keep that in mind.”

If we have to pick a tool dependent on whether we deploy on cloud or on-premise – which of these tools would be a better choice?

We would recommend looking into network access requirements for each tool. If you have an agent that checks in periodically with a central master management piece, that is likely to work better then SSH which requires direct path / path through lots of proxies. 

One attendee mentioned in the comments: “[In regards to] SSH vs Agent – Agent is more secure where SSH not an option.”

What happened to cfengine? This tool used to be mentioned alongside Chef and Puppet. 
Version 3 of cfengine is a complete revamp, but it compared to other configuration management tools the brand and community outreach isn’t strong, and does little the others don’t do better.

How does StackStorm compare to the other orchestrators being reviewed?
StackStorm labels itself more of an automation platform, or a DevOps workflow tool that handles provisioning and configuring servers but also leans on automatic and event driven services that plugs into Jenkins and other CI/CD workflows.

From one attendee that had used all three: “For us, getting the Server engineers to adopt Chef has been very difficult. It grew organically on the Dev side of the house. Ansible appears to be something that guys without Dev skills could pick up more easily. Just [my] perception.”

Can I run tasks in parallel with Ansible rather than running it serially (say 50 servers being updated with a patch)?

The default method is to run each task across all servers in parallel, meaning that it will run the first task (e.g. installing Git) on all servers in a group, and once all servers respond with a success, failure, or unchanged response, Ansible will move to the next task on all servers. It doesn’t run on a server, wait, move on to the next, it will run on all servers at once over SSH. If you want to deploy updates in batches, you can run a percentage of servers in a group (e.g. 50%, by listing it in the playbook as serial: 50%).

An attendee made this comment as we mentioned Ansible:

“I have attended a presentation from RedHat regarding Ansible that states [that Ansible scales well]. They have large scale hosting companies that on the fly spin up servers and perform patching for their servers via Ansible. The one mentioned had over 50,000 servers and it seemed to handle the volume / scale fine. I of course don’t know everything about Puppet or Chef or Salt, but one thing I find really nice about Ansible is the ability to perform rolling updates / tasks. So if you say had 1000 servers you can say you want to run 10% or 100 at a time and keep it rolling until all 1000 are done. It can be stated by percentage or defined number…I am sure I sound a bit biased but one of the main reasons Ansible is high on our list right now is the fact that it is agentless and does not really consume resources.”

With Ansible, how can we handle the security implications about allowing passwordless ssh to a root account on all systems? What mechanisms are there for access control and auditing?

There are definitely security implications if you are going to allow passwordless ssh. So it’s on the company to ensure that security groups or NSGs are well defined. We should also mention that the passwordless ssh is only enabled on the machine you are running Ansible commands and playbooks from, so if anything consider that workstation to be your weak point. Make sure SSH access is only permissible through your IP. As an alternative solution to connecting via SSH, if you use docker, Ansible allows you to deploy playbooks directly into Docker containers using the local Docker client. All you need is a user inside that container.

Does ansible run single-threaded or is it addressing multiple servers in a group asynchronously?
Ansible runs on each host in parallel. This means that it attempts to run your tasks on all servers defined at the top of the playbook before moving on to the next task.

One user said in regards to all three tools: “Ansible seems better for “orchestration” and Puppet/Chef are really good for “Configuration Management”.  Ansible can be used to stop applications and databases and then run Puppet and then start applications and databases.”

Lastly, we got a surprise question from the audience on Jenkins, a CI/CD pipeline tool that can be used in conjunction with tools like Chef to completely automate the infrastructure behind your applications.

What is the alternative of Jenkins?
While we recommend Jenkins, If you’re a Ruby shop, Capistrano is geared towards your deployments. If you live in the AWS world, you can try using the CodeCommit/CodeDeploy/CodePipeline toolset. If you’re looking for a provider agnostic solution, CircleCI is great. If your workflows revolve around Atlassian, try Bamboo. 

If you are unsure of what CI/CD pipeline tool to use, or how they work, we will be hosting a webinar on Jenkins as part of our on-going series on infrastructure-as-code.

The post Top Questions on Server Configuration Management Tools Chef, Puppet, and Ansible appeared first on scmGalaxy.

My main experience is with ClearCase. I have read various descriptive comparisons between ClearCase and other available Software Management Version tools. Which tool has your company implemented? What were the key features helped you select this tool over another one?

Configuration Management Tools Discussion

The post Configuration Management Tools Discussion appeared first on scmGalaxy.