101 lines
8.5 KiB
HTML
101 lines
8.5 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
|||
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|||
|
|
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>cdist-best-practice(7)</title><link rel="stylesheet" type="text/css" href="docbook-xsl.css" /><meta name="generator" content="DocBook XSL Stylesheets V1.76.1" /></head><body><div xml:lang="en" class="article" title="cdist-best-practice(7)" lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="id278474"></a>cdist-best-practice(7)</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Nico</span> <span class="surname">Schottelius</span></h3><code class="email"><<a class="email" href="mailto:nico-cdist--@--schottelius.org">nico-cdist--@--schottelius.org</a>></code></div></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl><dt><span class="section"><a href="#_name">1. NAME</a></span></dt><dt><span class="section"><a href="#_passwordless_connections">2. PASSWORDLESS CONNECTIONS</a></span></dt><dt><span class="section"><a href="#_speeding_up_ssh_connections">3. SPEEDING UP SSH CONNECTIONS</a></span></dt><dt><span class="section"><a href="#_multi_master_or_environment_setups">4. MULTI MASTER OR ENVIRONMENT SETUPS</a></span></dt><dt><span class="section"><a href="#_seperating_work_by_groups">5. SEPERATING WORK BY GROUPS</a></span></dt><dt><span class="section"><a href="#_maintaining_multiple_configurations">6. MAINTAINING MULTIPLE CONFIGURATIONS</a></span></dt><dt><span class="section"><a href="#_multiple_developers_with_different_trust">7. MULTIPLE DEVELOPERS WITH DIFFERENT TRUST</a></span></dt><dt><span class="section"><a href="#_see_also">8. SEE ALSO</a></span></dt><dt><span class="section"><a href="#_copying">9. COPYING</a></span></dt></dl></div><div class="section" title="1. NAME"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_name"></a>1. NAME</h2></div></div></div><p>cdist-best-practice - Practices used in real environments</p></div><div class="section" title="2. PASSWORDLESS CONNECTIONS"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_passwordless_connections"></a>2. PASSWORDLESS CONNECTIONS</h2></div></div></div><p>It is recommended to run cdist with public key authentication.
|
|||
|
|
This requires a private/public key pair and the entry
|
|||
|
|
"PermitRootLogin without-password" in the sshd server.
|
|||
|
|
See sshd_config(5) and ssh-keygen(1).</p></div><div class="section" title="3. SPEEDING UP SSH CONNECTIONS"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_speeding_up_ssh_connections"></a>3. SPEEDING UP SSH CONNECTIONS</h2></div></div></div><p>When connecting to a new host, the initial delay with ssh connections
|
|||
|
|
is pretty big. You can work around this by
|
|||
|
|
"sharing of multiple sessions over a single network connection"
|
|||
|
|
(quote from ssh_config(5)). The following code is suitable for
|
|||
|
|
inclusion into your ~/.ssh/config:</p><pre class="screen">Host *
|
|||
|
|
ControlPath ~/.ssh/master-%l-%r@%h:%p
|
|||
|
|
ControlMaster auto
|
|||
|
|
ControlPersist 10</pre></div><div class="section" title="4. MULTI MASTER OR ENVIRONMENT SETUPS"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_multi_master_or_environment_setups"></a>4. MULTI MASTER OR ENVIRONMENT SETUPS</h2></div></div></div><p>If you plan to distribute cdist among servers or use different
|
|||
|
|
environments, you can do so easily with the included version
|
|||
|
|
control git. For instance if you plan to use the typical three
|
|||
|
|
environments production, integration and development, you can
|
|||
|
|
realise this with git branches:</p><pre class="screen"># Go to cdist checkout
|
|||
|
|
cd /path/to/cdist
|
|||
|
|
|
|||
|
|
# Create branches
|
|||
|
|
git branch development
|
|||
|
|
git branch integration
|
|||
|
|
git branch production
|
|||
|
|
|
|||
|
|
# Make use of a branch, for instance production
|
|||
|
|
git checkout production</pre><p>Similar if you want to have cdist checked out at multiple machines,
|
|||
|
|
you can clone it multiple times:</p><pre class="screen">machine-a % git clone git://your-git-server/cdist
|
|||
|
|
machine-b % git clone git://your-git-server/cdist</pre></div><div class="section" title="5. SEPERATING WORK BY GROUPS"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_seperating_work_by_groups"></a>5. SEPERATING WORK BY GROUPS</h2></div></div></div><p>If you are working with different groups on one cdist-configuration,
|
|||
|
|
you can delegate to other manifests and have the groups edit only
|
|||
|
|
their manifests. You can use the following snippet in
|
|||
|
|
<span class="strong"><strong>conf/manifests/init</strong></span>:</p><pre class="screen"># Include other groups
|
|||
|
|
sh -e "$__manifest/systems"
|
|||
|
|
|
|||
|
|
sh -e "$__manifest/cbrg"</pre></div><div class="section" title="6. MAINTAINING MULTIPLE CONFIGURATIONS"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_maintaining_multiple_configurations"></a>6. MAINTAINING MULTIPLE CONFIGURATIONS</h2></div></div></div><p>When you need to manage multiple sites with cdist, like company_a, company_b
|
|||
|
|
and private for instance, you can easily use git for this purpose.
|
|||
|
|
Including a possible common base that is reused accross the different sites:</p><pre class="screen"># create branches
|
|||
|
|
git branch company_a company_b common private
|
|||
|
|
|
|||
|
|
# make stuff for company a
|
|||
|
|
git checkout company_a
|
|||
|
|
# work, commit, etc.
|
|||
|
|
|
|||
|
|
# make stuff for company b
|
|||
|
|
git checkout company_b
|
|||
|
|
# work, commit, etc.
|
|||
|
|
|
|||
|
|
# make stuff relevant for all sites
|
|||
|
|
git checkout common
|
|||
|
|
# work, commit, etc.
|
|||
|
|
|
|||
|
|
# change to private and include latest common stuff
|
|||
|
|
git checkout private
|
|||
|
|
git merge common</pre><p>The following <span class="strong"><strong>.git/config</strong></span> is taken from a a real world scenario:</p><pre class="screen"># Track upstream, merge from time to time
|
|||
|
|
[remote "upstream"]
|
|||
|
|
url = git://git.schottelius.org/cdist
|
|||
|
|
fetch = +refs/heads/*:refs/remotes/upstream/*
|
|||
|
|
|
|||
|
|
# Same as upstream, but works when being offline
|
|||
|
|
[remote "local"]
|
|||
|
|
fetch = +refs/heads/*:refs/remotes/local/*
|
|||
|
|
url = /home/users/nico/p/cdist
|
|||
|
|
|
|||
|
|
# Remote containing various ETH internal branches
|
|||
|
|
[remote "eth"]
|
|||
|
|
url = sans.ethz.ch:/home/services/sans/git/cdist-eth
|
|||
|
|
fetch = +refs/heads/*:refs/remotes/eth/*
|
|||
|
|
|
|||
|
|
# Public remote that contains my private changes to cdist upstream
|
|||
|
|
[remote "nico"]
|
|||
|
|
url = git.schottelius.org:/home/services/git/cdist-nico
|
|||
|
|
fetch = +refs/heads/*:refs/remotes/nico/*
|
|||
|
|
|
|||
|
|
# The "nico" branch will be synced with the remote nico, branch master
|
|||
|
|
[branch "nico"]
|
|||
|
|
remote = nico
|
|||
|
|
merge = refs/heads/master
|
|||
|
|
|
|||
|
|
# ETH stable contains rock solid configurations used in various places
|
|||
|
|
[branch "eth-stable"]
|
|||
|
|
remote = eth
|
|||
|
|
merge = refs/heads/stable</pre><p>Have a look at git-remote(1) to adjust the remote configuration, which allows</p></div><div class="section" title="7. MULTIPLE DEVELOPERS WITH DIFFERENT TRUST"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_multiple_developers_with_different_trust"></a>7. MULTIPLE DEVELOPERS WITH DIFFERENT TRUST</h2></div></div></div><p>If you are working in an environment that requires different people to
|
|||
|
|
work on the same configuration, but having different privileges, you can
|
|||
|
|
implement this scenario with a gateway host and sudo:</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
|
|||
|
|
Create a dedicated user (for instance <span class="strong"><strong>cdist</strong></span>)
|
|||
|
|
</li><li class="listitem">
|
|||
|
|
Setup the ssh-pubkey for this user that has the right to configure all hosts
|
|||
|
|
</li><li class="listitem">
|
|||
|
|
Create a wrapper to update the cdist configuration in ~cdist/cdist
|
|||
|
|
</li><li class="listitem">
|
|||
|
|
Allow every developer to execute this script via sudo as the user cdist
|
|||
|
|
</li><li class="listitem">
|
|||
|
|
Allow run of cdist as user cdist on specific hosts on a per user/group base
|
|||
|
|
</li><li class="listitem">
|
|||
|
|
f.i. nico ALL=(ALL) NOPASSWD: /home/cdist/bin/cdist config hostabc
|
|||
|
|
</li></ul></div><p>For more details consult sudoers(5)</p></div><div class="section" title="8. SEE ALSO"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_see_also"></a>8. SEE ALSO</h2></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
|
|||
|
|
cdist(1)
|
|||
|
|
</li><li class="listitem">
|
|||
|
|
cdist-tutorial(7)
|
|||
|
|
</li></ul></div></div><div class="section" title="9. COPYING"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="_copying"></a>9. COPYING</h2></div></div></div><p>Copyright (C) 2011-2012 Nico Schottelius. Free use of this software is
|
|||
|
|
granted under the terms of the GNU General Public License version 3 (GPLv3).</p></div></div></body></html>
|