Live data from Hacker News

Salt: Like Puppet, Except It Doesn’t Suck

blog.smartbear.com

11–20 of 274 posts

Re: Salt: Like Puppet, Except It Doesn’t Suck

#11
post #4

Is communication to/from ZeroMQ encrypted? If not it seems like this wouldn't be a very secure way to configure or distribute files over anything other than a VPN or LAN?

It's encrypted but why do you do configuration management through anything else than LAN/VPN?

Re: Salt: Like Puppet, Except It Doesn’t Suck

#14
post #12

IMO, ansible is even better: https://github.com/ansible/ansible/ It doesn't require any deamon and does all its work over the good old unix fashion way: SSH. And it's python too.

And if you don't like Python, you usually don't have to touch it. The tasks you run on the server can be any kind of executable. They read some JSON from stdin, do their action and write some JSON to stdout. Whether that program is a Python/Perl/Ruby/LUA script or go binary doesn't matter.

Re: Salt: Like Puppet, Except It Doesn’t Suck

#15
post #12

IMO, ansible is even better: https://github.com/ansible/ansible/ It doesn't require any deamon and does all its work over the good old unix fashion way: SSH. And it's python too.

From the article:

"Chef works atop ssh, which – while the gold standard for cryptographically secure systems management – is computationally expensive to the point where most master servers fall over under the weight of 700-1500 clients. Salt’s approach was far simpler."

Does that assertion about Chef somehow don't apply to Ansible?

On the use case:

"I have this command I want to run across 1,000 servers. I want the command to run on all of those systems within a five second window. It failed on three of them, and I need to know which three."

Re: Salt: Like Puppet, Except It Doesn’t Suck

#16
post #12

IMO, ansible is even better: https://github.com/ansible/ansible/ It doesn't require any deamon and does all its work over the good old unix fashion way: SSH. And it's python too.

Agreed! The ability to both push and pull is beautiful. Push for most things, pull for deploys via git.

Re: Salt: Like Puppet, Except It Doesn’t Suck

#17
I think salt is neato, but I also find it very frustrating to use! (Possibly through no fault of salt itself - I feel like I must be missing something.)

I am generally able to SSH into a box and get things configured the way I need. However, I have huge amounts of trouble translating that into salt scripts.

Consider logrotate. Here is the only documentation I can find on the topic [1]. From this, I have no idea what to put in init.sls to make sure a given log file is being rotated correctly. It seems this would work on the cmdline, but not necessarily in a salt script.

And that's just for logrotate! My uswgi + nginx configuration - translating that into salt - I don't know where to begin.

How do I make sure things get installed in a certain order? (Answer seems to be having 10 directives, for 10 packages, each depending on another, to enforce order.)

Is there anything that more closely mirrors what I actually do when configuring the box? SSH in, set certain values, etc? I guess I could write a shell script (or use fabric) but then I seem to have lost the point of configuration management.

[1] http://docs.saltstack.com/ref/modules/all/salt.modules.logro...

Re: Salt: Like Puppet, Except It Doesn’t Suck

#18
I've used Fabric, Chef, Puppet, and Ansible, and have settled on Ansible; it's a sort of middle ground between Fabric and Chef that does more than just run commands on servers but doesn't require me to buy into a whole elaborate universe of configuration management servers and whatnots. Ansible is great.

The ZeroMQ stuff makes sense if you're pushing configurations inside a data center, but it's a dealbreaker for us having things hosted externally.

Re: Salt: Like Puppet, Except It Doesn’t Suck

#20
post #12

IMO, ansible is even better: https://github.com/ansible/ansible/ It doesn't require any deamon and does all its work over the good old unix fashion way: SSH. And it's python too.

From the article: "Chef works atop ssh, which – while the gold standard for cryptographically secure systems management – is computationally expensive to the point where most master servers fall over under the weight of 700-1500 clients. Salt’s approach was far simpler." Does that assertion about Chef somehow don't apply to Ansible? On the use case: "I have this command I want to run across 1,000 servers. I want the…

Ansible can use SSH or ZeroMQ, which is much faster.
Post reply on HN