Impact Analysis with Puppet Catalog Diff
Raphaël Pinson
2/28www.camptocamp.com /
Raphaël Pinson
○ Infrastructure Developer / DevOps
○ Puppet / Terraform / Kubernetes
@raphink
3/28www.camptocamp.com /
4/28www.camptocamp.com /
5/28www.camptocamp.com /
Dev Ops
6/28www.camptocamp.com / Photo credits: Montecruz Foto, CC-BY
7/28www.camptocamp.com / Photo credits: @2016 Stefan Haehnel
8/28www.camptocamp.com /
9/28www.camptocamp.com / Photo credits: Petteri Sulonen, CC-BY
10/28www.camptocamp.com /
11/28www.camptocamp.com /
12/28www.camptocamp.com /
13/28www.camptocamp.com /
14/28www.camptocamp.com /
15/28www.camptocamp.com /
Command line call
> puppet module install camptocamp/catalog_diff
> puppet catalog diff 
          puppet5.example.com:8140/production
puppet6.example.com:8140/production 
          --use_puppetdb 
          --filter_old_env 
          --old_catalog_from_puppetdb 
          --certless 
          --show_resource_diff 
          --content_diff 
          --changed_depth 1000 
          --configtimeout 1000 
          --debug 
          --threads 50
16/28www.camptocamp.com /
17/28www.camptocamp.com /
18/28www.camptocamp.com /
Catalog Compilation Authz: classic
{
        # Allow nodes to retrieve their own catalog
        match-request: {
                path: "^/puppet/v3/catalog/([^/]+)$"
                type: regex
                method: [get, post]
        }
        allow: ["$1","catalog-diff"]
        sort-order: 500
        name: "puppetlabs catalog"
},
19/28www.camptocamp.com /
Catalog Compilation Authz: certless
{
        match-request: {
                path: "^/puppet/v4/catalog"
                type: regex
                method: [post]
        }
        allow: ["catalog-diff"]
        sort-order: 500
        name: "puppetlabs certless catalog"
},
20/28www.camptocamp.com /
21/28www.camptocamp.com /
22/28www.camptocamp.com /
23/28www.camptocamp.com /
CI/CD Integration
Branch
Merge
Request
24/28www.camptocamp.com /
GitLab CI Integration
Standardized pipelines:
https://github.com/camptocamp/puppet-gitlabci-pipelines
25/28www.camptocamp.com /
Going further
Dev.to posts:
○ https://dev.to/camptocamp-ops/diffing-puppet-environments-1fno
○ https://dev.to/camptocamp-ops/automated-puppet-impact-analysis-1
c1
GitHub projects:
○ https://github.com/camptocamp/puppet-catalog-diff
○ https://github.com/camptocamp/puppet-catalog-diff-viewer
○ https://github.com/camptocamp/puppet-gitlabci-pipelines
26/28www.camptocamp.com /
27/28www.camptocamp.com /
JOIN US !
careers.camptocamp.com
Puppet catalog Diff; Raphael Pinson

Puppet catalog Diff; Raphael Pinson