And

1. Cloud Infrastructure
as Code
Andrew Parker
Puppet Labs
@aparker42

2. In 1889

5. Tickets please

6. Eureka !

7. Herman's Invention

8. Herman, grows a Mustache

9. The Tabulating Machine

10. Automation makes IT better!

22. Puppet
A language and infrastructure

23. Puppet Resources
• Describes the desired configuration state of
individual elements of the system being
managed
user { 'henrik': # A user named 'henrik'
ensure => present, # should exist
shell => '/bin/bash' # with this shell
}

24. Puppet Resources
package{ 'apache2': # A packaged named 'apache2'
ensure => present # should be installed
}

25. Puppet Language
• The Puppet Language has constructs to
– compose sets of resources into classes
– define order of operations on resources
– define custom resources

26. Common Pattern; Package, File,
Service
class webserver {
package{ 'apache2':
ensure => present
}
file { '/etc/apache2/apache2.conf':
content => template('apache2/apache2.erb'),
require => Package['apache2']
}
service { 'apache2':
ensure => running,
subscribe => File['/etc/apache2/apache2.conf']
}
}

27. Presto – a Web Server
• Now we can build a webserver with this:
node kermit.example.com {
include webserver
}

28. Infra == Code == Text

29. Infra == Code == Text

30. Infra == Code == Text

32. Cloud Infrastructure
(as Code)

33. Turtles All The Way Down

34. Turtles All The Way Down
Cloud

35. Google Compute Engine
• Express infrastructure as
– VM Instances
– Networks
– Firewalls
– Disks

36. Build your own?
puppet module install puppetlabs-gce_compute

37. A Disk
gce_disk { 'mydisk':
ensure => present,
size_gb => '2'
}

38. A Network
gce_network { 'mynetwork':
ensure => present,
gateway => '10.0.1.1',
range => '10.0.1.0/24'
}

39. An Instance
gce_instance { 'myinstance':
ensure => present,
zone => 'us-central1-a',
machine => 'n1-standard-1',
image => "${images}/ubuntu-12-04-v20120621"
}

40. New Pattern; Network, Firewall,
(Disk), Instance
class app_stack {
gce_network { 'appnet':
ensure => present,
range => '10.0.1.0/24'
} ->
gce_firewall { 'webhttp':
ensure => present,
allow => 'tcp:80',
network => 'appnet'
} ->
gce_instance { 'server1':
ensure => present,
network => 'appnet'
}
}

41. Turtles All The Way Down
Application
Cloud

42. Modules & Classes
gce_instance { 'myinstance':
ensure => present,
. . .
modules => [ 'puppetlabs-mysql',
'martasd/mediawiki',
. . .
],
enc_classes => {
mediawiki => {server_name => "$gce_external_ip"}
}
}

43. Turtles All The Way Down
Puppet
Cloud

44. Setting up a master
gce_instance { 'pe-master':
ensure => present,
. . .
startupscript => ‘puppet-enterprise.sh’,
metadata => {
‘pe_role’ => ‘master’, ‘pe_version’ => ‘3.6.1’ }
}
gce_instance { ‘agent-1’:
ensure => present,
. . .
startupscript => ‘puppet-enterprise.sh’,
metadata => {
‘pe_role’ => ‘agent’, ‘pe_version’ => ‘3.6.1’,
‘pe_master’ => ‘pe-master’ }
}

45. Turtles All The Way Down
Application
Puppet
Cloud

46. Security 90s Style
Master
Agent
Agent

47. Autosign
# Whether (and how) to autosign certificate requests.
# This setting
# is only relevant on a puppet master acting as a
# certificate authority (CA).
#
# Valid values are true (autosigns all certificate
# requests; not recommended),
# false (disables autosigning certificates), or the
# absolute path to a file.
[master]
autosign = true

48. Autosign
# Whether (and how) to autosign certificate requests.
# This setting
# is only relevant on a puppet master acting as a
# certificate authority (CA).
#
# Valid values are true (autosigns all certificate
# requests; not recommended),
# false (disables autosigning certificates), or the
# absolute path to a file.
[master]
autosign = $confdir/autosign.conf

49. Autosign
# Whether (and how) to autosign certificate requests.
# This setting
# is only relevant on a puppet master acting as a
# certificate authority (CA).
#
# Valid values are true (autosigns all certificate
# requests; not recommended),
# false (disables autosigning certificates), or the
# absolute path to a file.
[master]
autosign = $confdir/my_autosign
trusted_node_data = true
[agent]
csr_attributes = $confdir/csr_attributes.yaml

50. Autosign
# Produce attributes for the csr based on instance
metadata
MD="http://metadata/computeMetadata/v1/instance"
INSTANCE=$(curl -fs -H "Metadata-Flavor: Google"
$MD/zone)
NAME=$(curl -fs -H "Metadata-Flavor: Google"
$MD/attributes/puppet_instancename)
UUID=$(curl -fs -H "Metadata-Flavor: Google" $MD/id)
cat > $PUPPET_DIR/csr_attributes.yaml <<END

51. Autosign
# Produce attributes for the csr based on instance
metadata
MD="http://metadata/computeMetadata/v1/instance"
INSTANCE=$(curl -fs -H "Metadata-Flavor: Google"
$MD/zone)
NAME=$(curl -fs -H "Metadata-Flavor: Google"
$MD/attributes/puppet_instancename)
UUID=$(curl -fs -H "Metadata-Flavor: Google" $MD/id)
cat > $PUPPET_DIR/csr_attributes.yaml <<END

52. Trust your data
Master Agent
CSR
Certificate
Facts/Certificate
Catalog

53. Why do this?
• How fast can you change?
• How frequent?
• At what cost?
• What is your level of automation?

54. So what became of Herman Hollerith?

56. So what became of Herman Hollerith?

57. So what became of Herman Hollerith?

58. Questions ?

59. Puppetize!