Jonathan Clarke

Implementing a tool to automate IT infrastructure management has many undeniable benefits. But that doesn't mean there aren't some drawbacks too (usually outweighed by the benefits) that we should be considering, and working to reduce or remove.

Implementing a tool like this in a team usually has a pretty significant impact: new processes, new language(s) to learn, new way of doing pretty much everything on your infrastructure. These tools are complex, so a minority of the team tends to become experts in it, and tries to lead the others. Resistance to change is common and understandable, but unfortunately, this can end up with some of the team members being left behind by the sudden and massive changes to their work. This is clearly not a Good Thing, and certainly not showing very good inclusiveness towards everyone. It is also making some configuration management projects fail, which is definitely a Bad Thing for those of us trying to implement them.

How to improve this situation is a topic dear to me. This has always been the focus of the Rudder and ncf open source projects I work on - making our technologies more accessible, easier to adopt and simpler to understand. Some key points we have focused on include: - Avoiding the necessity to write code (user interfaces of course, but that can be combined with other users writing code) - Separating roles so that experts can implement the how and others can focus on the what - Minimising the amount of effort required (sane and non-surprising default values, auto-configuration where possible, ...)

This talk will explain some of these concepts, and show how we have achieved considerable success using the ""ncf builder"" web interface that can be used to write configuration management policy without writing any code (see http://www.ncf.io).

After 4 years of "experience in the trenches" providing enterprise configuration management solutions based on CFEngine 3, it became clear that our customers wanted CFEngine's speed, small footprint, and features but were having a hard time with the language and tooling, and needed an easier way.

The goal of ncf is to abstract the knowledge of "how" to achieve tasks in CFEngine, and expose these capabilities for non-expert users. Thus, you can express your intent in a very succinct and expressive manner, integrating simply with CFEngine and its power, while keeping everything "under the hood" tunable.

ncf promotes DRY-ness and sharing knowledge. It is built from the ground-up to be easy to learn, flexible and extensible. The framework is written in pure CFEngine language, introducing a well-structured design built on multiple decoupled layers with clearly-defined interfaces and roles.

In our presentation we will introduce ncf and explain how ncf can be used to solve real-world examples, explain our design choices, the architectural approach taken, and demo the new magic at our finger tips to build CFEngine solutions that are extensible and easier to work with.

Designing, applying and keeping track of security-oriented rules for your IT infrastructure can be time-consuming, costly and approximate job. Whether you're in charge of defining the policy, implementing it or checking for discrepencies, you'll be aware that all of this takes time, often out-of-hours time, that there is a lot of room for error and usually a considerable gap between ideals and reality - just how big a gap may or may not be shared with everyone involved.

This talk will show how Rudder, an open source stack for automating configuration and auditing, can be used to ease and improve on several of these issues. Topics covered will include deploying identical settings everywhere, saving time for multiple changes, near real-time auditing of actual settings, gaining global overview to help analyze vulnerability impacts, and improved reactivity. I will include real-life examples and feedback from several companies where this has been put into action, including benefits (of course) and shortcomings (because there are always some).

The aim of this session is to discuss methods and the approach of automation applied to this field, while demonstrating and giving feedback on some of the possibilities offered by Rudder. I hope to avoid being side-tracked into talking about detailed security recommendations, sticking to simple best practices for the sake of examples, thus focusing on the approach.

Rudder is a new open source tool in the configuration management domain. Its aim is not to reinvent the technical wheel, but to provide a new way to drive our infrastructure.

Specifically aimed at drift assessment, it addresses automation, ongoing verification and repairs, centralizing information and knowledge about your infrastructure, compliance reporting... thus helping to keep drift from nominal behavior low. Built upon a standard CFEngine architecture (and other open source components). This talk will show how Rudder's approach enables everyone in the IT department to benefit from the advantages of configuration management, without necessarily needing to learn a complex tool, or even get their hands dirty. We'll describe and demonstrate how this is possible, and dive into the technical architecture that makes it work. In a nutshell, clearly separated tasks permit technical experts to create configuration templates for the tools they know best, thus letting non-experts leverage this power via a modern web interface, such as: architects or security officers who implement policy, junior sysadmins who use and reuse such policies to setup services, and pretty much anyone who digs into real-time compliance reports and error logs.

Other people: Nicolas Charles