Automated configuration management (with puppet...)

[j4m3s]

I'm thinking about how to contribute the Hendy Irawan's jboss AS7 puppet module - specifically how to implement the JBoss CLI integration.

For anyone not familiar with puppet, it's a centralised open-source server build and config management tool that maintains consistent configuration for all apps on all servers across the estate.  It makes server builds and config changes/ patches a breeze - but there isn't yet a module for JBoss AS7, which is a big gap for those of use who use it at the centre of the architecture. 

The key to the ongoing config management is that Puppet must be able to check (hourly, daily, weekly, whenever) what the configuration of an application is, and apply changes to close any deviations from the catalog.  We could simply push-out a standard standalone.xml to all hosts - but that would remove any host-specific settings like hostname, mod_cluster node configs etc. 

It feels like a case where the CLI should be used.  Indeed adding new configuration elements is a breeze (./jboss_cli.sh --file xyz) - but identifying whether the change actually needs to be applied is a lot more tricky.  And assuming we can tell whether the change needs to be applied, it's not straightforward to just apply a script as a new server might need "add" commands, where existing ones could need a "remove" first.

I'm loathed to say it but I'm starting to think we may be heading towards an XPath query/ edit of the standalone.xml config file to target specific sections of the file in a query-set fashion.

Has anyone solved this problem already, and integrated jboss config management with puppet?  Or even an alternative to puppet that we could learn from or even switch to?

Thank you

James

[ctomc]

Hi,

i am not familiar with Puppet beyond knowing what it is...

can you give more precise description what od you want to do, and current api's are not supporting that for you?

just for info, one cli is just getting better at if/else scripts https://github.com/jbossas/jboss-as/pull/2571

What kind of API is current puppet integration using? REST/JSON? or something else? and how is it written? as you can access every information trought scripting...

--

tomaz

[j4m3s]

Thanks for the reply Tomaz. 

The CLI would be the ideal option - puppet is written in Ruby but it's very straightforward to write shell scripts, so could connect to the CLI and run commands from files etc.  Using the CLI would also protect the config file to some extent.

Forgive me if this is obvious stuff to some, but:

Puppet really has three main functions (it will for us anyway):

a) building servers

b) applying updates/ changes to servers

c) ensuring all servers are configured the same way, by correcting any deviations that occur on servers.

You could acheive a) by writing a pile of shell scripts and jboss CLI scripts to configure a server.  It's a bit brittle, but it can work (with some manual intervention).

You could acheive b) by writing another set of shell scripts for each update, and applying them to each server.  All changes would also need to be applied in sequence to the output of a) for any new builds. 

I'm not sure how you acheive c).  You rely on a) and b) working flawlessly and then you prevent anyone from changing anything.

The beauty of puppet is that it describes the desired state of the server, and applies whatever changes are necessary for that particular server to get it to this desired state.  Importantly, it does so in a fashion that is quite surgical - it won't blat a new config file over the top of an old one (unless you want it to) - it allows you to change parts of a file, so you could have a server running one app, with its config, a separate server running another app, with its config, and a server running both - with their configs side-by-side.

As you'd expect, the key is for puppet to be able to understand the desired state, the current state, and correct the differences. 

For JBoss this could be:  Ensure all serverXs have a particular security domain configured.  If it's not there already, easy - just run an "add" script through the CLI.  But what if it IS there already, but just needs another login module option adding?  Running the same script as the "add" would fail because the security domain already exists. 

The problem can probably be split into three separate challenges:  

1) How do you describe the desired Jboss config state in a logical way

2) How do you retrieve the current state and calculate the changes that must be applied in order to get the config to match the desired state

3) how do you convert those changes into a format that can be run through the CLI.

Support for if-else in the CLI may well help for step 2 and 3, if we can figure out a way of applying it generically to the output from step 1.

Puppet integrates with a tool called Augeas which may help (it has modules for lots of other standard config files) - and it's even red-hat related from what I can tell.  However it seems to operate directly on the config files, so I'm not sure it's really the way to go.

[mark_us]

Hi James,

I am also looking for a solution to manage jboss with puppet over cli.

Have you found a good solution? How did you go to use cli with puppet?

Best Erhards

Markus

[herwix]

Hey,

I'm looking for a similar solution and what I found seems to fit the bill perfectly... didn't have an indepth look yet but gonna do it next week.

Puppi by example42 and their jboss plugin! Hope this helps you

http://www.example42.com/?q=Puppi_A_Puppet_module_for_Deployment_Automation

https://github.com/example42/puppet-jboss

Cheers, Alex

[bserdar]

JCliff is a project we are currently developing and using to manage our JBoss servers. It is not a puppet module, but allows one to write puppet modules to configure JBoss AS7/EAP6 using the command line client. The idea is to lay down configuration file fragments using the CLI language, and have JCliff apply those changes.

https://github.com/bserdar/jcliff

[mark_us]

Very interesting project, I'm going to look at this

Many thanks, Alexander!

[mark_us]

Hi Burak,

JCliff is also a very interesting project.

Another thing:

Does anyone have experience with a CLI Deployment Archiv?

https://community.jboss.org/wiki/CLIDeploymentArchive

It is very interesting to deploy the configuration with the application artifacts (Puppet could deploy the CLI artifact).

What do you think?

[bserdar]

I don't think CLI deployment archive would be very useful if you're using something like puppet. At least in our case,  we deploy multiple apps, and they share certain configuration elemens. So we use puppet to lay down Jcliff configuration files, as well as the applications themselves, and run Jcliff to keep the server config up to date, and deploy the applications.