D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] SSH key management

 

On 15/08/13 20:48, Simon Waters wrote:
> On 15 Aug 2013, at 18:42, Mark Evans <mpe@xxxxxxxxxxxxxxxxxxxxxx> wrote:
>> I tend to use this or the "If Mark was thinking he backed up the
>> /etc/ssh first" method.
> Good idea, but things are more dynamic in the new work environment because we do a 
> lot of testing, experimental builds, and things are getting more dynamic. My 
> colleague will create a new server just to check out an alleged bug or oddity in 
> an OS, rather than mess with existing systems.
>
> We need to get better at this as well. It was taking 2 hours to build a 3 server 
> test environment with all software and services installed and configured. We are 
> now using snapshots to reduce that. But we need to get smarter since we have no 
> template capability in the snapshots, and it would be desirable to build them from 
> clean OS each time as it is easier to apply patches and keep clean that way, and 
> proves we still can do it as well - thus proving our build scripts are valid.


What virtualization system(s) are you using, and why on earth do you not
have multiple VMs already set up *as templates* ready for immediate
cloning to a new instance? The only limits I have on deploying new
instances is the SAN keeping up as I spawn multiple clones
simultaneously. I also don't see why it's desirable to build from a
clean OS each time either, apart from proving you are capable and your
build scripts work, as you said (fair enough). But it's a massive waste
of time. Build, script, template and drop the master image into your
repo once and once only. Work incrementally on your masters as required:
WSUS/Puppet/Chef/etc to redo from scratch what you know already works
is... let's just say wasteful.

Please don't construe this as being critical* - after all, I know
nothing of your working environment, in-house rules, guidelines and so
on: there are no doubt perfectly sensible reasons for any restrictions
you have to deal with, often with a PHB attached. But when it's taking 2
hours to build a 3 server test rig, you're doing something very, very
wrong. My lowly i7 workstation can spin up 3 new VMs and deploy them in
mere minutes, the 64 core Supermicro server in the garage can do it in
under a minute and the big bucks hardware my employers typically own can
do it almost as fast as I type. Admin overhead post-cloning is taken
care of via Puppet normally, another blisteringly quick operation. Worst
case scenario means ssh-ing in and pulling the relevant scripts from
version control (either sh or powershell, depending on OS flavour), or
sometimes in the case of a completely new system, actually writing them.

I'm only so efficient because I'm so lazy. I automate everything in
sight and reuse stuff constantly because every second I redo some task
I've previously completed is time I could be drinking beer instead :]

Regards


* No really: I know you're not an idiot and am curious as to what kind
of admin barriers you're bumping up against

-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq