Puppet and containers: A multi-tenancy deployment
summary
CERN runs 40,000 nodes served by a shared pool of ~200 Puppet Servers, so a single compromised repo or master can push malicious catalogs cluster‑wide. The team prototypes a containerized catalog master that compiles catalogs in ephemeral containers behind an nginx proxy, sees stable ~40s compile times dominated by JVM/Ruby warm‑up, then moves to a Kubernetes per‑team namespace design with autoscaling, Foreman/PuppetDB/GitLab integration, Vault for secrets and central logging via Wendy; Kubernetes removes warm‑up but increases orchestration and ACL work and is still under test.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:39Config management at CERNIT
- 2:02Growing out of control
- 3:24How does the attack work?
- 5:43A peek under the hood
- 8:07Measuring the performance
- 8:37Where the time is going?
- 10:09Advantages and drawbacks
- 13:16Managing our deployment
- 14:06Summing up
related talks
29mA Multi-Cluster, Multi-Cloud Infrastructure with GitOps at CERN
42mPuppet Control-Repo to the Next Level
43mContinuously Integrating Puppet
47mContainerizing your Security Operations Center
44mQuick Prototyping with LXC and Puppet
36mBuilding a CI/CD driven infrastructure for managing Kubernetes clusters
44mContain yourselves
32mKubernetes Namespaces Unleashed: Unlocking the Full Potential of You...