Live data from Hacker News

Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

linuxjournal.com

31–40 of 75 posts

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#31

There is also Ansible [1] which is written in Python and connects to servers using SSH (combined with sudo if needed). This means you don't need to install anything on the servers you're managing, since most distributions have Python >= 2.4 included. For more details see the requirements page [2]. [1] http://ansible.cc/ [2] http://ansible.cc/docs/gettingstarted.html#requirements

Can someone who has used both chime in? I've used ansible a bit and like it, but I've never heard of Salt before.

I'm hoping for this too. Especially somebody who has used both exhaustively. At first glance the architecture of both seems to be pretty sensible, clean, minimal and good in all the ways that puppet isn't. I half heartedly picked salt based upon the following:

* More commits in github. * More pull requests in github. * Main website is ranked higher by alexa.

However, after using salt for a short while, I ran into a couple of problems (no mercurial state, no ability to specify versions when using a pip state), which ansible seemed to be able to handle.

So, I don't know... salt seems to be more popular. A bit. That's all I can tell.

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#32

Earlier quoted context omitted.

Can someone who has used both chime in? I've used ansible a bit and like it, but I've never heard of Salt before.

I'm hoping for this too. Especially somebody who has used both exhaustively. At first glance the architecture of both seems to be pretty sensible, clean, minimal and good in all the ways that puppet isn't. I half heartedly picked salt based upon the following: * More commits in github. * More pull requests in github. * Main website is ranked higher by alexa. However, after using salt for a short while, I ran into a c…

Salt does have support for Mercurial through the hg state: http://docs.saltstack.org/en/latest/ref/states/all/salt.stat...

It's also pretty easy to extend and the team who maintain Salt are really friendly and accepting of patches/pull requests.

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#33
post #10

Just when I narrowed my options down to ansible and chef… This seems to be more in line with chef/puppet, with a dedicated daemon on the client.

It's more similar to ansible than puppet. Both are python based and use zeromq. All four are declarative and AFAIK, all four have a dedicated daemon on the client.

I would rather not get into "X is better than Y", but this is not quite accurate.

I'm not saying that's a bad thing, but I see a distilled Puppet syntax there, where Ansible (http://ansible.cc) is more about modeling both resource states and ordered processes across machines.

Ansible actually uses SSH by default but there's a 0mq accelerator if you want to use it. We don't just execute individual SSH commands, modules are remote resources that model idempotent state -- but don't stay resident. The 0mq accelerator came later. There's also a pull mode, and a local mode in Ansible. Using SSH is nice because you don't have the additional PKI, and all that comes with having to maintain that. (No needs of accurate NTP and DNS either, and working with Kerberized SSH and using your OS credentials is possible). Need to do non-root things? You can do things (if you have permissions) entirely as non-root.

Furthermore, Ansible does not have a dedicated daemon on the client. It's daemonless, and consumes no resources when not running. When running with 0mq, the daemon is ephemeral, stopping after a set period of time, to not consume resources.

It also requires no bootstrapping, so if you have blank cloud images with nothing on them, or brownfield systems in the field, you can just start managing them immediately. cloud-init and so on are great for this, all cloud tools can inject keys. For this reason (no agents), it's starting to look very appealing on embedded devices and network hardware as well.

While implemented in Python you can write modules in any language. Finally, Ansible's core focus is around making multi-tier orchestration easy (somewhat of a niche case), so that leads it to look a lot different at the language/resource level. But if you have just one tier, you can use it too.

It's frequently used to deal with rolling updates involving N-tier applications with monitoring servers and load balancers all in play, though you can definitely use Ansible just for classical config management.

I think part of the reason Salt may look similar to Ansible is Salt is clearly inspired by Func, especially the minion/overlord terminology, globbing, minion-to-minion, etc, and I was one of the original authors of Func at Red Hat. We were toying around with a message bus Func at the time and decided not to do it.

So, yeah, lots of tools in this space.

In Ruby config land, there's also Sprinkle, Rexify, etc! So many options!

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#34
post #10

Just when I narrowed my options down to ansible and chef… This seems to be more in line with chef/puppet, with a dedicated daemon on the client.

It's more similar to ansible than puppet. Both are python based and use zeromq. All four are declarative and AFAIK, all four have a dedicated daemon on the client.

Ansible's ZeroMQ is an optional extra feature - out-of-the-box it works fine without a daemon on the client, as it just uses SSH.

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#35
Didn't Salt build upon Func? And didn't the author of Func go on to write Ansible? My experience between Salt, Rundeck, Ansible, and Fabric was that Salt/Rundeck were too heavyweight and that between Ansible and Fabric, Ansible mopped the floor with Fabric. Just my $.02.

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#36

There is also Ansible [1] which is written in Python and connects to servers using SSH (combined with sudo if needed). This means you don't need to install anything on the servers you're managing, since most distributions have Python >= 2.4 included. For more details see the requirements page [2]. [1] http://ansible.cc/ [2] http://ansible.cc/docs/gettingstarted.html#requirements

Can someone who has used both chime in? I've used ansible a bit and like it, but I've never heard of Salt before.

We're using salt and while it's incredible buggy still it's the most impressive system we've used so far. It's faster than anything else because it does not go through the process of signing in through ssh and creating a unix session.

That might sound like a boring detail but it opens up many possibilities by doing things like asking all machines for their system time and then doing something with it.

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#37

Earlier quoted context omitted.

Can someone who has used both chime in? I've used ansible a bit and like it, but I've never heard of Salt before.

I'm hoping for this too. Especially somebody who has used both exhaustively. At first glance the architecture of both seems to be pretty sensible, clean, minimal and good in all the ways that puppet isn't. I half heartedly picked salt based upon the following: * More commits in github. * More pull requests in github. * Main website is ranked higher by alexa. However, after using salt for a short while, I ran into a c…

Ansible is moving at a pretty good clip too.

We do strongly encourage squash commits so I wouldn't go by counts alone, but pick what tool you like to use most and that best fits your needs, and your style, and what you want to do with it.

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#38
post #35

Didn't Salt build upon Func? And didn't the author of Func go on to write Ansible? My experience between Salt, Rundeck, Ansible, and Fabric was that Salt/Rundeck were too heavyweight and that between Ansible and Fabric, Ansible mopped the floor with Fabric. Just my $.02.

Yeah, I was one of the Func authors. That minion/overlord terminology, globbing, delegation, minion-to-minion, etc, are ideas clearly from there. I think mCollective was the first to take our Func-on-AMQP ideas and implement them, actually, though Salt was probably the first to try to stick a CM layer on the top of a Func-based-system, like I was planning but hadn't got around to ("Remote Rocket Surgery" was the placeholder codename for that on top of Func).

As far as Func->Ansible goes, Seth Vidal (another one of the original authors) also does a lot of commits and wrote our yum module -- and is now using it for Fedora Infrastructure.

I wouldn't really recommend anyone look at Func anymore -- it's fading just a little bit (taken over by Steve Salesvan, also ex Red Hat), but it's still in use at places like Tumblr, which is a pretty large setup. Still, it was fun to do. We sort of did multiprocessing before multiprocessing.py :)

Adoption is going pretty well at the moment and it has been fun to watch. Several setups in the couple thousand of node ranges, lots around Big Data applications.

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#39
post #23
post #6

Salt starts off with negative marks because they decided to type the letters A-E-S in their codebase: https://github.com/saltstack/salt/blob/develop/salt/crypt.py... Specifically, they appear to be doing AES-CBC with HMAC-SHA256. There's nothing obviously wrong with it (randomized IVs from os.urandom, both authentication and encryption and with distinct keys...) but I would hope the standard for cryptography is highe…

http://docs.saltstack.org/en/latest/topics/index.html """ Salt takes advantage of a number of technologies and techniques. The networking layer is built with the excellent ZeroMQ networking library, so the Salt daemon includes a viable and transparent AMQ broker. Salt uses public keys for authentication with the master daemon, then uses faster AES encryption for payload communication; authentication and encryption ar…

That explains the feature set, but it doesn't quite explain why it doesn't use TLS; TLS also starts with public key cryptosystems and then generates signing and symmetric encryption keys, oftentimes using precisely the same base algorithms (AES-256 and HMAC-SHA256).

(Also, msgpack seems completely orthogonal to this issue.)

Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ

#40

There is also Ansible [1] which is written in Python and connects to servers using SSH (combined with sudo if needed). This means you don't need to install anything on the servers you're managing, since most distributions have Python >= 2.4 included. For more details see the requirements page [2]. [1] http://ansible.cc/ [2] http://ansible.cc/docs/gettingstarted.html#requirements

I love Ansible. After having used puppet and chef at the company I work for, everyone was thrilled about how easy and boiler-plate free Ansible is.

Chef is great for bigger architectures, but if your goal is to provision a limited set of servers and document it's configuration in a readable format, Ansible is truly fantastic.

Post reply on HN