<HTML><HEAD>
<STYLE id=eMClientCss>BLOCKQUOTE.cite {
PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
BLOCKQUOTE.cite2 {
PADDING-TOP: 0px; PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; MARGIN-TOP: 3px; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
.plain PRE {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
.plain TT {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
#5f544974d3334bfa916e36cc35293a7a {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain PRE {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain TT {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
BODY {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
</STYLE>
</HEAD>
<BODY>
<DIV>1. Flatten includes -- 6+ layers of include are a bit much. Move all default items currently buried in base and template up to a top scope "default" node, and inherit that.</DIV>
<DIV> </DIV>
<DIV>example:<BR> <BR> site.pp -> server -> template -> base -> iptables</DIV>
<DIV> </DIV>
<DIV>some nodes pull in from base, some from template.</DIV>
<DIV> </DIV>
<DIV>I propose the following:</DIV>
<DIV> </DIV>
<UL>
<LI>move base to a top level node, all sub includes in base should be evaluated, and moved to the node level unless they absolutely need to be includes.</LI>
<LI><SPAN id=5f544974d3334bfa916e36cc35293a7a>move exim to a top level 'server' node, and inherit base</SPAN></LI>
<LI>inherit 'server' node for all boxes that use 'server' or template now, base node for all other nodes.</LI></UL>
<DIV> </DIV>
<DIV>2. Remove hardcoding -- openstack_project is only usable for ... o.o. Any hardcoded items should be variables, with a hiera lookup and a default as their default value.<BR></DIV>
<DIV> ie $puppetmaster = hiera('puppetmaster', 'ci-puppetmaster.openstack.org') -- then you can set puppetmaster: 'puppethostname' in hiera, in the node that calls the puppetmaster manifest, or default to o.o</DIV>
<DIV> </DIV>
<DIV>3. Redesign hiera.yaml to include a second data directory for 'public' data. Start taking advantage of hiera's ability to load different data based on hierachy.</DIV>
<DIV> </DIV>
<DIV>See <A href="https://review.openstack.org/#/c/71739/">https://review.openstack.org/#/c/71739/</A> for the open review that addresses this.</DIV>
<DIV> </DIV>
<DIV>4. move package installs into hiera. <SPAN id=db1cf7f7bf644595bc08af059440bbe9>It depends on task #3 to split out the hiera data, so that a given host will load a common.yaml, a private yaml, and then a host specific yaml.</SPAN></DIV>
<DIV>* just pushed to upstream review: <A href="https://review.openstack.org/#/c/71630/">https://review.openstack.org/#/c/71630/</A></DIV>
<DIV> </DIV>
<DIV>This would be a fairly large change, but could be approached in sections. It would allow you to specify the following in a common.yaml:</DIV>
<DIV> </DIV>
<DIV><SPAN id=f7e3133f38254e28b25ecb1dd7a1d5a9>packages::versioned<BR></SPAN> gear:<BR> ensure: 'present'<BR> provider: 'pip'<BR> deep_merge:<BR> ensure: 'latest'<BR> provider: 'gem'</DIV>
<DIV> unzip:</DIV>
<DIV> ensure: '6.0-4ubuntu2'</DIV>
<DIV> </DIV>
<DIV>And have the following in something like puppetmaster.yaml</DIV>
<DIV> </DIV>
<DIV><SPAN id=f81b3b33bf9b49f9b6b339dbec82ee2f>packages::versioned<BR></SPAN> puppetmaster:</DIV>
<DIV> ensure: '2.7.25-1puppetlabs1'</DIV>
<DIV> </DIV>
<DIV>When loading package lists, this module deduplicates, which removes the issue of 'package already defined' on future code blocks.</DIV>
<DIV> </DIV>
<DIV>5. move user management into hiera. This works best when used with task #3, as you can then specify "public" users, and "custom" (private) users. This would also make it easier to handle adding users on specific servers.</DIV>
<DIV> </DIV>
<DIV>Should support having no password (which means the account can not authenticate with a password)<BR>Support adding/updating/removing ssh keys<BR>Supports adding/updating/removing accounts and groups.</DIV>
<DIV> </DIV>
<DIV>users::hiera::_users:<BR> testuser:<BR> ensure: present<BR> password: nobodyknows<BR> managehome: true<BR> ssh_authorized_keys:<BR> public_key_1:<BR> ensure: present<BR> key: AAAAB3NzaC1yc2EAAAABJQAAAQBzosfmzVV2hxckSV3kwwcYE9RFfDsV+/Zu2PlZrcpP97SHNh/+AwXfaTy8p5qyRFqeO+WYtabzW$<BR> type: ssh-rsa<BR>users::hiera::_groups:<BR> group1:<BR> ensure: present<BR> gid: 401</DIV>
<DIV><BR>6. continued refactoring of all modules until:</DIV>
<UL>
<LI>they can be used in any environment</LI>
<LI>they can be used in puppet 2.7 or 3.x interchangeably</LI>
<LI>they don't implicitly include more than is required.</LI></UL>
<DIV> </DIV>
<DIV>Please note, these items are wide, sweeping changes, and as such I'm expecting we would want to tackle them in small, safe steps (ie get the framework in place and inert, then test changes on sandboxed machines, then gradually roll out to production).</DIV>
<DIV> </DIV>
<DIV>For this reason we may even want to consider a new module to house these items, to completely isolate them and remove risk.</DIV>
<DIV> </DIV>
<DIV>That's my pitch, thanks for reading this far.</DIV>
<DIV> </DIV>
<DIV> </DIV></BODY></HTML>