Getting started with MCollective has always been an adventure, you have to learn a ton of new stuff like Middleware etc. And once you get that going the docs tend to present you with a vast array of options and choices including such arcane topics like which security plugin to use while the security model chosen is entirely unique to mcollective. To get a true feeling for the horror see the official deployment guide.
This is not really a pleasant experience and probably results in many insecure or half build deployments out there – and most people just not bothering. This is of course entirely my fault, too many options with bad defaults chosen is to blame.
I saw the graph of the learning curve of Eve Online and immediately always think of mcollective ๐ Hint: mcollective is not the WoW of orchestration tools.
I am in the process of moving my machines to Puppet 4 and the old deployment methods for MCollective just did not work, everything is falling apart under the neglect the project has been experiencing. You can’t even install any plugin packages on Debian as they will nuke your entire Puppet install etc.
So I figured why not take a stab at rethinking this whole thing and see what I can do, today I’ll present the outcome of that – a new Beta distribution of MCollective tailored to the Puppet 4 AIO packaging that’s very easy to get going securely.
Overview
My main goals with these plugins were that they share as much security infrastructure with Puppet as possible. This means we get a understandable model and do not need to mess around with custom CAs and certs and so forth. Focussing on AIO Puppet means I can have sane defaults that works for everyone out of the box with very limited config. The deployment guide should be a single short page.
For a new user who has never used MCollective and now need certificates there should be no need to write a crazy ~/.mcollective file and configure a ton of SSL stuff, they should only need to do:
$ mco choria request_cert |
This will make a CSR, submit it to the PuppetCA and wait for it to be signed like Puppet Agent. Once signed they can immediately start using MCollective. No config needed. No certs to distribute. Secure by default. Works with the full AAA stack by default.
Sites may wish to have tighter than default security around what actions can be made, and deploying these policies should be trivial.
Introducing Choria
Choria is a suite of plugins developed specifically with the Puppet AIO user in mind. It rewards using Puppet as designed with defaults and can yield a near zero configuration setup. It combines with a new mcollective module used to configure AIO based MCollective.
The deployment guide for a Choria based MCollective is a single short page. The result is:
- A Security Plugin that uses the Puppet CA
- A connector for NATS
- A discovery cache that queries PuppetDB using the new PQL language
- A open source Application Orchestrator for the new Puppet Multi Node Application stuff (naming is apparently still hard)
- Puppet Agent, Package Agent, Service Agent, File Manager Agent all setup and ready to use
- SSL and TLS used everywhere, any packet that leaves a node is secure. This cannot be turned off
- A new packager that produce Puppet Modules for your agents etc and supports every OS AIO Puppet does
- The full Authentication, Authorization and Auditing stack set up out of the box, with default secure settings
- Deployment scenarios works by default, extensive support for SRV records and light weight manual configuration for those with custom needs
It’s easy to configure using the new lookup system and gives you a full, secure, usable, mcollective out of the box with minimal choices to make.
You can read how to deploy it at it’s deployment guide.
Status
This is really a Beta release at the moment, I’m looking for testers and feedback. I am particularly interested in feedback on NATS and the basic deployment model, in future I might give the current connectors a same treatment with chosen defaults etc.
The internals of the security plugin is quite interesting, it proposes a new internal message structure for MCollective which should be much easier to support in other languages and is more formalised – to be clear these messages always existed, they were just a bit adhoc.
Additionally it’s the first quality security plugin that has specific support for building a quality web stack compatible MCollective REST server that’s AAA compatible and would even allow centralised RBAC and signature authority.
