Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Salt: Like Puppet, Except It Doesn’t Suck

blog.smartbear.com

Post reply on HN
Print view View original

21–30 of 274 posts

Re: Salt: Like Puppet, Except It Doesn’t Suck

#21

Post by Goladus »

cowmix wrote: post #9

For years I have been trying to spread the gosspel of bcfg2 because, while not perfect, I thought was a more complete system over Puppet or Chef. Bcfg2, however has some big warts of its own AND it never really caught on. In the past few months I've been slowing converting to SaltStack and it really is everything I ever dreamed of for a CM system. Fast, easy, real-time. Lovin' it.

If bcfg2 was a complete system, it never caught on because the documentation was entirely missing. Every time I looked at it, I blocked on actually getting anything done because I couldn't find an equivalent to these reference manuals:

http://docs.puppetlabs.com/references/latest/type.html

http://docs.opscode.com/resource.html

https://cfengine.com/archive/manuals/cf-manuals/cf2-Referenc...

Re: Salt: Like Puppet, Except It Doesn’t Suck

#22

Post by dbarlett »

lobo_tuerto wrote: post #15
susi22 wrote: post #12

IMO, ansible is even better: https://github.com/ansible/ansible/ It doesn't require any deamon and does all its work over the good old unix fashion way: SSH. And it's python too.

From the article: "Chef works atop ssh, which – while the gold standard for cryptographically secure systems management – is computationally expensive to the point where most master servers fall over under the weight of 700-1500 clients. Salt’s approach was far simpler." Does that assertion about Chef somehow don't apply to Ansible? On the use case: "I have this command I want to run across 1,000 servers. I want the…

Two solutions: pull-mode playbooks [1] and fireball mode [2] (temporary ØMQ daemon).

[1] http://www.ansibleworks.com/docs/playbooks2.html#pull-mode-p...

[2] http://www.ansibleworks.com/docs/playbooks2.html#fireball-mo...

Re: Salt: Like Puppet, Except It Doesn’t Suck

#23

Post by DASD »

gaadd33 wrote: post #4

Is communication to/from ZeroMQ encrypted? If not it seems like this wouldn't be a very secure way to configure or distribute files over anything other than a VPN or LAN?

They use AES and RSA but their implementation has had vulnerabilities.

http://docs.saltstack.com/topics/releases/0.15.1.html

https://github.com/saltstack/salt/commit/5dd304276ba5745ec21...

Here's a good article( http://missingm.co/2013/06/ansible-and-salt-a-detailed-compa...) with a comparison to Ansible that others are also mentioning here. Ansible uses KeyCzar which which seems more sane than rolling your own crypto as many readers here on HN know.

Re: Salt: Like Puppet, Except It Doesn’t Suck

#24

Post by susi22 »

lobo_tuerto wrote: post #15
susi22 wrote: post #12

IMO, ansible is even better: https://github.com/ansible/ansible/ It doesn't require any deamon and does all its work over the good old unix fashion way: SSH. And it's python too.

From the article: "Chef works atop ssh, which – while the gold standard for cryptographically secure systems management – is computationally expensive to the point where most master servers fall over under the weight of 700-1500 clients. Salt’s approach was far simpler." Does that assertion about Chef somehow don't apply to Ansible? On the use case: "I have this command I want to run across 1,000 servers. I want the…

Well, ansible by default runs with paramiko which is a python implementation of SSH protocol. It will also keep connections open for multiple commands. It also has a pull mode and it also has a fireball mode which uses 0mq:

http://jpmens.net/2012/10/01/dramatically-speeding-up-ansibl...

However, you're not forced to use this. In the beginning, you can just seed your CentOS or debian with a Kickstarter or seed file and then run your inital thing with ansible simply over ssh (using all the goodies, ssh-agent, password less ssh etc..).

One huge plus for ansible is also that it used yaml which is rather simple. I've been following both project for >1 year and it seems that recently ansible has picked up a lot and will probably make the "race" (IMO).

Re: Salt: Like Puppet, Except It Doesn’t Suck

#25

Post by INTPenis »

susi22 wrote: post #12

IMO, ansible is even better: https://github.com/ansible/ansible/ It doesn't require any deamon and does all its work over the good old unix fashion way: SSH. And it's python too.

I came from building a large puppet environment to loving ansible. I much prefer push method in daily operations.

Re: Salt: Like Puppet, Except It Doesn’t Suck

#28

Post by etherael »

tptacek wrote: post #18

I've used Fabric, Chef, Puppet, and Ansible, and have settled on Ansible; it's a sort of middle ground between Fabric and Chef that does more than just run commands on servers but doesn't require me to buy into a whole elaborate universe of configuration management servers and whatnots. Ansible is great. The ZeroMQ stuff makes sense if you're pushing configurations inside a data center, but it's a dealbreaker for us…

Ansible can do the zeromq stuff anyway, that's what fireball is for.

Re: Salt: Like Puppet, Except It Doesn’t Suck

#29

Post by pilif »

susi22 wrote: post #26
cultureulterior wrote: post #19

Personally, I don't think puppet sucks

The problem is most dev-ops and sysadmins don't know ruby and that's a HUGE disadvantage. In the end configuration management will often by done by sysadmins.

I'm only managing 24 machines with puppet, so nothing fancy, but I managed to do all of the stuff I needed without writing a single line of Ruby code.

That was handy for me too as while I'm somewhat familiar with Ruby, I'm no expert at all. I can read Ruby no problem and I can write ruby that's not-quite-idiomatic and I'm terribly slow at it.

Post reply on HN