Skip to content

Commit

Permalink
docs(tofs): improve general use of language
Browse files Browse the repository at this point in the history
  • Loading branch information
@myii
myii committed Feb 27, 2019
1 parent 3fa3640 commit 5105d29
Showing 1 changed file with 27 additions and 25 deletions.
52 changes: 27 additions & 25 deletions TOFS_pattern.md
View file
Original file line number Diff line number Diff line change
@@ -1,18 +1,20 @@
# TOFS: A pattern for using Saltstack
# TOFS: A pattern for using SaltStack

Roberto Moreda <moreda@allenta.com>
29/12/2014

Modified by Daniel Dehennin <daniel.dehennin@baby-gnu.org>

All that follows is a proposal based on my experience with [Saltstack](http://www.saltstack.com/). The good thing of a piece of software like this is that you can "bend it" to suit your needs in many possible ways, and this is one of them. All the recommendations and thoughts are given "as it is" with no warranty of any type.
Updated by Imran Iqbal <https://github.com/myii>

All that follows is a proposal based on my experience with [SaltStack](http://www.saltstack.com/). The good thing of a piece of software like this is that you can "bend it" to suit your needs in many possible ways, and this is one of them. All the recommendations and thoughts are given "as it is" with no warranty of any type.

<table><tr><th>Table of Contents</th></tr><tr><td>

<!-- toc -->

- [Usage of values in pillar vs templates in file_roots](#usage-of-values-in-pillar-vs-templates-in-file_roots)
- [On reusability of Saltstack state files](#on-reusability-of-saltstack-state-files)
- [On reusability of SaltStack state files](#on-reusability-of-saltstack-state-files)
- [The Template Override and Files Switch (TOFS) pattern](#the-template-override-and-files-switch-tofs-pattern)
* [Template Override](#template-override)
* [Files Switch](#files-switch)
Expand All @@ -22,31 +24,31 @@ All that follows is a proposal based on my experience with [Saltstack](http://ww
</td></tr></table>


## Usage of values in pillar vs templates in file_roots
## Usage of values in pillar vs templates in `file_roots`

Among other functions, the _master_ (or _salt-master_) serves files to the _minions_ (or _salt-minions_). The [file_roots](http://docs.saltstack.com/en/latest/ref/file_server/file_roots.html) is the list of directories used in sequence to find a file when a minion requires it: the first match is served to the minion. Those files could be [state files](http://docs.saltstack.com/en/latest/topics/tutorials/starting_states.html) or configuration templates, among others.

Using Saltstack is a simple and effective way to implement configuration management, but even in a [non multitenant](http://en.wikipedia.org/wiki/Multitenancy) scenario, it's not a good idea to generally accessible some data (e.g. the database password in our [Zabbix](http://www.zabbix.com/) server configuration file or the private key of our [Nginx](http://nginx.org/en/) TLS certificate).
Using SaltStack is a simple and effective way to implement configuration management, but even in a [non-multitenant](http://en.wikipedia.org/wiki/Multitenancy) scenario, it is not a good idea to generally access some data (e.g. the database password in our [Zabbix](http://www.zabbix.com/) server configuration file or the private key of our [Nginx](http://nginx.org/en/) TLS certificate).

To avoid this situation we can use the [pillar mechanism](http://docs.saltstack.com/en/latest/topics/pillar/), which is designed to provide a controlled access to data from the minions based on some selection rules. As pillar data could be easily integrated in the [Jinja](http://docs.saltstack.com/en/latest/topics/tutorials/pillar.html) templates, it's a good mechanism to store values to be used in the final render of state files and templates.
To avoid this situation we can use the [pillar mechanism](http://docs.saltstack.com/en/latest/topics/pillar/), which is designed to provide controlled access to data from the minions based on some selection rules. As pillar data could be easily integrated in the [Jinja](http://docs.saltstack.com/en/latest/topics/tutorials/pillar.html) templates, it is a good mechanism to store values to be used in the final rendering of state files and templates.

There are a variety of approaches on usage of pillar and templates seen in [saltstack-formulas](https://github.com/saltstack-formulas) repositories. [Some](https://github.com/saltstack-formulas/nginx-formula/pull/18) [developments](https://github.com/saltstack-formulas/php-formula/pull/14) stress the initial purpose of pillar data into an storage for most of possible variables for a determined system configuration. This, in my opinion, shifting too much load from the original template files approach. Adding up some [non-trivial Jinja](https://github.com/spsoit/nginx-formula/blob/81de880fe0276dd9488ffa15bc78944c0fc2b919/nginx/ng/files/nginx.conf) code as essential part of composing the state file definitely makes Saltstack state files (hence formulas) more difficult to read. The extreme of this approach is that we could end up with a new render mechanism, implemented in Jinja, storing everything needed in pillar data to compose configurations. Additionally, we are establishing a strong dependency with the Jinja renderer.
There are a variety of approaches on the usage of pillar and templates as seen in the [saltstack-formulas](https://github.com/saltstack-formulas)' repositories. [Some](https://github.com/saltstack-formulas/nginx-formula/pull/18) [developments](https://github.com/saltstack-formulas/php-formula/pull/14) stress the initial purpose of pillar data into a storage for most of the possible variables for a determined system configuration. This, in my opinion, is shifting too much load from the original template files approach. Adding up some [non-trivial Jinja](https://github.com/spsoit/nginx-formula/blob/81de880fe0276dd9488ffa15bc78944c0fc2b919/nginx/ng/files/nginx.conf) code as essential part of composing the state file definitely makes SaltStack state files (hence formulas) more difficult to read. The extreme of this approach is that we could end up with a new render mechanism, implemented in Jinja, storing everything needed in pillar data to compose configurations. Additionally, we are establishing a strong dependency with the Jinja renderer.

Opposed to the _put in file\_roots the code and in pillar the data_ approach, there's the _pillar as a store for a set of key-values_ approach. A full-blown configuration file abstracted in pillar and jinja is complicated to develop, understand and maintain. I think it's better a simpler approach keeping a configuration file templated using just a basic (non-extensive but extensible) set of pillar values.
In opposition to the _put the code in file\_roots and the data in pillars_ approach, there is the _pillar as a store for a set of key-values_ approach. A full-blown configuration file abstracted in pillar and jinja is complicated to develop, understand and maintain. I think a better and simpler approach is to keep a configuration file templated using just a basic (non-extensive but extensible) set of pillar values.


## On reusability of Saltstack state files
## On the reusability of SaltStack state files

There's a brilliant initiative of the Saltstack community called [salt-formulas](https://github.com/saltstack-formulas). The goal is to provide state files, pillar examples and configuration templates ready to be used for provisioning. I'm a contributor or two small ones: [zabbix-formula](https://github.com/saltstack-formulas/zabbix-formula) and [varnish-formula](https://github.com/saltstack-formulas/varnish-formula).
There is a brilliant initiative of the SaltStack community called [salt-formulas](https://github.com/saltstack-formulas). Their goal is to provide state files, pillar examples and configuration templates ready to be used for provisioning. I am a contributor for two small ones: [zabbix-formula](https://github.com/saltstack-formulas/zabbix-formula) and [varnish-formula](https://github.com/saltstack-formulas/varnish-formula).

The [design guidelines](http://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html) for formulas are clear in many aspects and it's a recommended reading for anyone willing to write state files, even non-formulaic ones.
The [design guidelines](http://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html) for formulas are clear in many aspects and it is a recommended reading for anyone willing to write state files, even non-formulaic ones.

In the next section I'm going to describe my proposal to extend even further the reusability of formulas, suggesting some patterns of usage.
In the next section, I am going to describe my proposal to extend further the reusability of formulas, suggesting some patterns of usage.


## The Template Override and Files Switch (TOFS) pattern

I understand a formula as a **complete, independent set of Saltstack state and configuration template files sufficient to configure a system**. A system could be something as simple as a ntp server or some other much more complex service that requires many state and configuration template files.
I understand a formula as a **complete, independent set of SaltStack state and configuration template files sufficient to configure a system**. A system could be something as simple as an NTP server or some other much more complex service that requires many state and configuration template files.

The customization of a formula should be done mainly by providing pillar data used later to render either the state or the configuration template files.

Expand Down Expand Up @@ -88,7 +90,7 @@ file_roots:
}, merge=salt['pillar.get']('ntp:lookup')) %}
```

In `init.sls` we have the minimal states required to have NTP configured. In many cases `init.sls` is almost equivalent to a `apt-get install` or a `yum install` of the package.
In `init.sls` we have the minimal states required to have NTP configured. In many cases `init.sls` is almost equivalent to an `apt-get install` or a `yum install` of the package.

```
## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/init.sls
Expand All @@ -106,7 +108,7 @@ Enable and start NTP:
- pkg: Install NTP package
```

In `conf.sls` we have the configuration states. In most cases that is just managing configuration file templates and making them be watched by the service.
In `conf.sls` we have the configuration states. In most cases, that is just managing configuration file templates and making them to be watched by the service.

```
## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/conf.sls
Expand All @@ -126,7 +128,7 @@ Configure NTP:
- pkg: Install NTP package
```

Under `files/default` there's an structure that mimics the one in the minion in order to avoid clashes and confusion on where to put the needed templates. There you can find a mostly standard template for configuration file.
Under `files/default`, there is a structure that mimics the one in the minion in order to avoid clashes and confusion on where to put the needed templates. There you can find a mostly standard template for the configuration file.

```
## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/files/default/etc/ntp.conf.jinja
Expand Down Expand Up @@ -155,9 +157,9 @@ restrict 127.0.0.1
restrict ::1
```

With all this, it's easy to install and configure a simple NTP server just running `salt-call state.sls ntp.conf`: the package will be installed, the service will be running and the configuration should be correct for most of cases, even without pillar data.
With all this, it is easy to install and configure a simple NTP server by just running `salt-call state.sls ntp.conf`: the package will be installed, the service will be running and the configuration should be correct for most of cases, even without pillar data.

Alternatively you can define a highstate in `/srv/saltstack/salt/top.sls` and run `salt-call state.highstate`.
Alternatively, you can define a highstate in `/srv/saltstack/salt/top.sls` and run `salt-call state.highstate`.

```
## /srv/saltstack/salt/top.sls
Expand All @@ -166,7 +168,7 @@ base:
- ntp.conf
```

**Customizing the formula just with pillar data** we have the option to define the NTP servers.
**Customizing the formula just with pillar data**, we have the option to define the NTP servers.

```
## /srv/saltstack/pillar/top.sls
Expand All @@ -189,7 +191,7 @@ ntp:

### Template Override

If the customization based on pillar data is not enough, we can override the template creating a new one in `/srv/saltstack/salt/ntp/files/default/etc/ntp.conf.jinja`
If the customization based on pillar data is not enough, we can override the template by creating a new one in `/srv/saltstack/salt/ntp/files/default/etc/ntp.conf.jinja`

```
## /srv/saltstack/salt/ntp/files/default/etc/ntp.conf.jinja
Expand All @@ -209,11 +211,11 @@ This way we are locally **overriding the template files** offered by the formula

### Files Switch

To bring some order into the set of template files included in a formula, as we commented, we suggest have a similar structure to a normal final file system under `files/default`.
To bring some order into the set of template files included in a formula, as we commented, we suggest having a similar structure to a normal final file system under `files/default`.

We can make coexist different templates for different minions, classified by any [grain](http://docs.saltstack.com/en/latest/topics/targeting/grains.html) value, just creating new directories under `files`. This mechanism is based in **using values of some grains as a switch for the directories under `files/`**.
We can make different templates coexist for different minions, classified by any [grain](http://docs.saltstack.com/en/latest/topics/targeting/grains.html) value, by simply creating new directories under `files`. This mechanism is based on **using values of some grains as a switch for the directories under `files/`**.

If we decide that we want `os_family` as switch, then we could provide with the formula template variants for `RedHat` and `Debian` families.
If we decide that we want `os_family` as switch, then we could provide the formula template variants for both the `RedHat` and `Debian` families.

```
/srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/files/
Expand All @@ -228,7 +230,7 @@ If we decide that we want `os_family` as switch, then we could provide with the
ntp.conf.jinja
```

To make this work we need a `conf.sls` state file that takes a list of possible files as configuration template.
To make this work we need a `conf.sls` state file that takes a list of possible files as the configuration template.

```
## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/conf.sls
Expand Down Expand Up @@ -284,7 +286,7 @@ Configure NTP:
- pkg: Install NTP package
```

We can simplify the `conf.sls` with a new `files_switch` macro to use in `source` parameter for the `file.managed` function.
We can simplify the `conf.sls` with the new `files_switch` macro to use in the `source` parameter for the `file.managed` state.

```
## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/conf.sls
Expand Down

0 comments on commit 5105d29

Please sign in to comment.