Re: [Puppet Users] Dashboard & LDAP ENC''s

Rob McBroom
Wed, 29 Jun 2011 17:06:57 -0000

On Jun 29, 2011, at 11:40 AM, Craig White wrote:

> I am still uncertain whether we will have enough servers to actually bother
with maintaining hosts in LDAP just for puppet.

Might not be worth it if it’s “just for puppet”, but once you have everything in
LDAP, there are limitless possibilities for automation. I’ll just paste
something from one of my previous messages on this list:

> … if you put details for your systems in LDAP, there’s so so much you can
automate outside of Puppet as well. Every scripting language understands LDAP,
so use your imagination.
>
> One good example is a web-based front-end to allow manger types to view the
information (as sort of an inventory tracking tool). The reason databases like
this get out of date is that keeping them current is a pain. The only way it
works is if *not* keeping it current is even *more* painful. Puppet can help
with this. If you don’t go into LDAP and add a node and classify it as a web
server, it literally won’t function as a web server. So when a human looks at
the information about a system via the web, they know it has to be correct.
>
> We also use information in LDAP to configure our monitoring system. Again,
this keeps you on your toes. If you don’t add it to LDAP, it doesn’t get
monitored. If you don’t remove it from LDAP when it’s gone, you’ll get annoyed
with alerts that it went down.
>
> And there are the daily tasks that can be sped up, like connecting (in a
loop or via cluster SSH) to all systems with certain attributes. Answering the
constant requests for “a list of all the XYZ servers with ABC”, running
`ssh-keyscan`, populating a local file for hostname completion in your shell,
etc.

And to add to that, I’ve recently started looking at Fabric which allows you
define a list of hosts in different “roles”. I can have these lists generated in
real-time based on LDAP when the command runs.

--
Rob McBroom
<http://www.skurfer.com/>