cdist - Configuration management
cdist [-h] [-V]
cdist banner
cdist config [-h] [-d] [-V] [-c CDIST_HOME] [-i MANIFEST] [-p] [-s] host [host …]
cdist is the frontend executable to the cdist configuration management.
-cdist supports different as explained below. The options to the main
-program are:
-
--h, --help
-
-
- Show the help screen
-
-
--V, --version
-
-
- Show version and exit
-
Displays the cdist banner.
Configure a system
-
--h, --help
-
-
- Show the help screen
-
-
--c CDIST_HOME, --cdist-home CDIST_HOME
-
-
- Instead of using the parent of the bin directory as cdist home,
- use the specified directory
-
-
--d, --debug
-
-
- Enable debug output
-
-
--i MANIFEST, --initial-manifest MANIFEST
-
-
- Path to a cdist manifest or - to read from stdin
-
-
--p, --parallel
-
-
- Operate on multiple hosts in parallel
-
-
--s, --sequential
-
-
- Operate on multiple hosts sequentially
-
# Configure ikq05.ethz.ch with debug enabled
-cdist config -d ikq05.ethz.ch
-
-# Configure hosts in parallel and use a different home directory
-cdist config -c ~/p/cdist-nutzung \
- -p ikq02.ethz.ch ikq03.ethz.ch ikq04.ethz.ch
-
-# Display banner
-cdist banner
-
-# Show help
-cdist --help
-
-# Show Version
-cdist --version
-
-cdist(7)
-
-
-cdist-type-emulator(1)
-
-
-cdist-reference(7)
-
Copyright (C) 2011-2012 Nico Schottelius. Free use of this software is
-granted under the terms of the GNU General Public License version 3 (GPLv3).
cdist-best-practice - Practices used in real environments
2. PASSWORDLESS CONNECTIONS
It is recommended to run cdist with public key authentication.
-This requires a private/public key pair and the entry
-"PermitRootLogin without-password" in the sshd server.
-See sshd_config(5) and ssh-keygen(1).
3. SPEEDING UP SSH CONNECTIONS
When connecting to a new host, the initial delay with ssh connections
-is pretty big. You can work around this by
-"sharing of multiple sessions over a single network connection"
-(quote from ssh_config(5)). The following code is suitable for
-inclusion into your ~/.ssh/config:
Host *
- ControlPath ~/.ssh/master-%l-%r@%h:%p
- ControlMaster auto
- ControlPersist 10
4. MULTI MASTER OR ENVIRONMENT SETUPS
If you plan to distribute cdist among servers or use different
-environments, you can do so easily with the included version
-control git. For instance if you plan to use the typical three
-environments production, integration and development, you can
-realise this with git branches:
# Go to cdist checkout
-cd /path/to/cdist
-
-# Create branches
-git branch development
-git branch integration
-git branch production
-
-# Make use of a branch, for instance production
-git checkout production
Similar if you want to have cdist checked out at multiple machines,
-you can clone it multiple times:
machine-a % git clone git://your-git-server/cdist
-machine-b % git clone git://your-git-server/cdist
5. SEPERATING WORK BY GROUPS
If you are working with different groups on one cdist-configuration,
-you can delegate to other manifests and have the groups edit only
-their manifests. You can use the following snippet in
-conf/manifests/init:
# Include other groups
-sh -e "$__manifest/systems"
-
-sh -e "$__manifest/cbrg"
6. MAINTAINING MULTIPLE CONFIGURATIONS
When you need to manage multiple sites with cdist, like company_a, company_b
-and private for instance, you can easily use git for this purpose.
-Including a possible common base that is reused accross the different sites:
# create branches
-git branch company_a company_b common private
-
-# make stuff for company a
-git checkout company_a
-# work, commit, etc.
-
-# make stuff for company b
-git checkout company_b
-# work, commit, etc.
-
-# make stuff relevant for all sites
-git checkout common
-# work, commit, etc.
-
-# change to private and include latest common stuff
-git checkout private
-git merge common
The following .git/config is taken from a a real world scenario:
# Track upstream, merge from time to time
-[remote "upstream"]
- url = git://git.schottelius.org/cdist
- fetch = +refs/heads/*:refs/remotes/upstream/*
-
-# Same as upstream, but works when being offline
-[remote "local"]
- fetch = +refs/heads/*:refs/remotes/local/*
- url = /home/users/nico/p/cdist
-
-# Remote containing various ETH internal branches
-[remote "eth"]
- url = sans.ethz.ch:/home/services/sans/git/cdist-eth
- fetch = +refs/heads/*:refs/remotes/eth/*
-
-# Public remote that contains my private changes to cdist upstream
-[remote "nico"]
- url = git.schottelius.org:/home/services/git/cdist-nico
- fetch = +refs/heads/*:refs/remotes/nico/*
-
-# The "nico" branch will be synced with the remote nico, branch master
-[branch "nico"]
- remote = nico
- merge = refs/heads/master
-
-# ETH stable contains rock solid configurations used in various places
-[branch "eth-stable"]
- remote = eth
- merge = refs/heads/stable
Have a look at git-remote(1) to adjust the remote configuration, which allows
7. MULTIPLE DEVELOPERS WITH DIFFERENT TRUST
If you are working in an environment that requires different people to
-work on the same configuration, but having different privileges, you can
-implement this scenario with a gateway host and sudo:
-
-Create a dedicated user (for instance cdist)
-
-
-Setup the ssh-pubkey for this user that has the right to configure all hosts
-
-
-Create a wrapper to update the cdist configuration in ~cdist/cdist
-
-
-Allow every developer to execute this script via sudo as the user cdist
-
-
-Allow run of cdist as user cdist on specific hosts on a per user/group base
-
-
-f.i. nico ALL=(ALL) NOPASSWD: /home/cdist/bin/cdist config hostabc
-
For more details consult sudoers(5)
-
-cdist(1)
-
-
-cdist-tutorial(7)
-
Copyright (C) 2011-2012 Nico Schottelius. Free use of this software is
-granted under the terms of the GNU General Public License version 3 (GPLv3).