NETWAYS Blog

Foreman’s 10th birthday – The party was a blast

by Dirk Götz | Aug 2, 2019 | Events, Foreman

Birthday Logo

I can still remember when Greg had the idea of celebrating the Foreman’s Birthday four years ago and I volunteered to organize the German one. After two editions and with Foreman being covered on the Open Source Camp last year I asked for others to run the party. And with ATIX doing a great job I asked them to team up on this. So we have grown a great community event with the annual Birthday party.

This year was different to the ones before because we had such a big support by Red Hat. The new Community Managers showed up to introduce them accompanied by Greg who had stepped down earlier this year. A group of Product managers and consultants made the last stop on their European tour. A technical writer came over to discuss the future of documentation. And with Evgeni and Ewoud we had some recurring attendees to give a talk later. ATIX also arrived with a bus full of people. Monika represented iRonin, a company doing custom development on Foreman and I hope to team up in the future, and Timo developing on Foreman for dmTech brought a colleague. So users were slightly under-represented and the prepared demos were mostly used to share knowledge and probably because of the heat instead of hacking many discussions took place. But I think everyone of the about thirty attendees made good use of the first session.

Birthday Party Demo The session ended when I brought in the cake. And thanks to our Events team the cake was as tasty as good looking. A nice touch by Ohad was to insist he can not blow off the candles alone as he could not have build Foreman without the community.

Birthday Cake Helmets

After the cake break we started with the talks and the first one was by the Community team giving us a recap of Foreman’s history, data from the community survey and other insights like a first look on the future documentation. This is really the next step to me that Red Hat is also making their Satellite documentation upstream adding a use case driven documentation to the manual which is way more technical. The second talk Quirin showcased the current state of Debian Support which will be fully functional with Errata support being added, but he already promised some usability and documentation improvements afterwards. The third speakers were Dana and Rich who showed Red Hat’s roadmap for features to add to Foreman so they will be pulled into Satellite afterwards. The roadmap will be presented in a community demo and uploaded to the community forum. Having the product managers easily available allowed the audience also to ask any question and I was excited to hear for almost all topics brought up that there is already ongoing work in the background. For example I asked about making subscription management also usable for other vendors and Rich told me he is part of a newly founded team which is evaluating exactly this.

Because of the heat we added a small ice break before starting the next talk and because of Lennart being ill Ohad entered the stage to show his work on containerizing Foreman. He explained that he started it mainly for testing but the interest showed him that expanding it to be fully functional to run Foreman and even Katello on Kubernetes could be a future way. Evgeni gave a shortened version of the talk on writing Ansible modules for Foreman and Katello he created for Froscon. It was a very technical one showing how much work is necessary to build a good base so later work is much easier. From this perspective I can really recommend this talk to all Froscon attendees. Last but not least Ewoud looked into the project’s social aspects which was a nice mixture of official history and personal moments. He also showed off the different swag the project created, ending with a t-shirt signed by as many team and community members as possible while traveling from Czech to US and back as suitable gift to Greg because “Once a foreman, always a foreman”. 😉

For dinner we had Pizza and Beer, but moved to the air-conditioned hotel bar after a short while to finish the evening. I heard people were enjoying conversation until two o’clock in the morning even when the bar closed one hour earlier. 😀

I would say the Party was a blast and I am already looking forward to next year when ATIX will be the host again. But until then there are several other Foreman related events with the Open Source Automation Day on 15. & 16.10.2019 in Munich including Workshops the day before and a Foreman hackday the day after organized by ATIX and the Open Source Camp on 07.11.2019 in Nuremberg right after OSMC by NETWAYS.

Dirk Götz

Principal Consultant

Dirk ist Red Hat Spezialist und arbeitet bei NETWAYS im Bereich Consulting für Icinga, Puppet, Ansible, Foreman und andere Systems-Management-Lösungen. Früher war er bei einem Träger der gesetzlichen Rentenversicherung als Senior Administrator beschäftigt und auch für die Ausbildung der Azubis verantwortlich wie nun bei NETWAYS.

Read more from Dirk and meet the Team

Automatisierte Updates mit Foreman Distributed Lock Manager

by Dirk Götz | Jul 12, 2019 | Foreman

Foreman Logo

Wer kennt das nicht am besten soll alle nervige, wiederkehrende Arbeit automatisiert werden, damit man mehr Zeit für spaßige, neue Projekte hat? Es gibt nach Backups wohl kein Thema, mit dem man so wenig Ruhm ernten kann, wie Updates, oder? Also ein klarer Fall für Automatisierung! Oder doch nicht weil zu viel schief gehen kann? Nun ja, diese Entscheidung kann ich euch nicht abnehmen. Aber zumindest für eine häufige Fehlerquelle kann ich eine Lösung anbieten und zwar das zeitgleiche Update eines Clusters, was dann doch wieder zum Ausfall des eigentlich hochverfügbaren Service führt.

Bevor ich aber nun zu der von mir vorgeschlagen Lösung komme, will ich kurz erklären wo die Inspiration hierfür herkommt, denn Foreman DLM (Distributed Lock Manager) wurde stark vom Updatemechanismus von CoreOS inspiriert. Hierbei bilden CoreOS-Systeme einen Cluster und über eine Policy wird eingestellt wie viele gleichzeitig ein Update durchführen dürfen. Sobald nun ein neues Update verfügbar ist, beginnt ein System mit dem Download und schreibt in einen zentralen Speicher ein Lock. Dieses Lock wird dann nach erfolgreichem Update wieder freigegeben. Sollte allerdings ein weitere System ein Lock anfordern um sich upzudaten und die maximalen gleichzeitigen Locks werden bereits von anderen Systemen gehalten, wird kein Update zu dem Zeitpunkt durchgeführt sondern später erneut angefragt. So wird sichergestellt, dass die Container-Plattform immer mit genug Ressourcen läuft. CoreOS hat dazu dann noch weitere Mechnismen wie einen einfachen Rollback auf den Stand vor dem Update und verschiedene Channel zum Testen der Software, welche so einfach nicht auf Linux zur Verfügung stehen. Aber einen Locking-Mechanismus zur Verfügung zu stellen sollte machbar sein, dachte sich dmTech. Dass die Wahl auf die Entwicklung als ein Foreman-Plugin fiel lässt sich leicht erklären, denn dieser dient dort als das zentrale Tool für die Administration.

Wie sieht nun die Lösung aus? Mit der Installation des Plugins bekommt Foreman einen neuen API-Endpunkt über den Locks geprüft, bezogen und auch wieder freigegeben werden können. Zur Authentifizierung werden die Puppet-Zertifikate (oder im Fall von Katello die des Subscription-Managers) genutzt, die verschiedenen HTTP-Methoden stehen für eine Abfrage (GET), Beziehen (PUT) oder Freigaben (DELETE) des Lock und die Antwort besteht aus einem HTTP-Status-Code und einem JSON-Body. Der Status-Code 200 OK für erfolgreiche Aktionen und 412 Precondition Failed wenn Beziehen und Freigeben des Locks nicht möglich ist sowie der Body können dann im eigenen Update-Skript ausgewertet werden. Ein einfaches Beispiel findet sich hierbei direkt im Quelltext-Repository. Ein etwas umfangreicheres Skript bzw. quasi ein Framework wurde von einem Nutzer in Python entwickelt und ebenfalls frei zur Verfügung gestellt.
read more…

Dirk Götz

Principal Consultant

Read more from Dirk and meet the Team

Verwaltung von SUSE Linux Paketen mit Katello

by Dirk Götz | Mar 1, 2019 | Foreman

Katello erweitert Foreman um Content-Management oder da es mir primär um Linux-Pakete geht bevorzuge ich den Ausdruck Software-Management. Über Lifecycle-Environments und Content-Views werden hier Snapshots der Repositories erstellt und den verschiedenen Stages nacheinander präsentiert, damit in Produktion auch tatsächlich die Updates landen, die auch vorher getestet wurden. Doch darüber habe ich bereits vor einer Weile geschrieben. Seitdem hat sich zwar einiges weiterentwickelt, insbesondere ist die Unterstützung für Debian dazugekommen. Aber darüber möchte ich berichten wenn auch noch der Support für Errata-Management für Debian soweit ist.

Stattdessen möchte ich auf die Unterstützung für SUSE eingehen. Diese wurde von ATIX entwickelt und als Foreman-Plugin “ForemanSccManager” veröffentlicht. Wer die “Red Hat”-Unterstützung von Katello kennt, wird die Funktionalität recht schnell wieder erkennen. Das Plugin fügt einen neuen Menüpunkt hinzu, der es erlaubt Accounts für den Zugriff auf das SUSE Customer Center anzugeben und die damit verknüpften Softwareprodukte einfach zur Synchronisation auszuwählen. Dies finde ich besonders hilfreich, da SUSE zur Authentifizierung nicht nur mit Benutzer und Passwort sondern auch einem Token in der URL arbeitet, welches das manuelle Handling hier leider erschwert.

Wenn jemand ein paar Screenshots sehen möchte, möchte ich ihn auf die Orcharhino-Dokumentation (einem Produkt auf Basis von Katello) verweisen, denn das Plugin befindet sich schon eine Weile bei ATIX und ihren Orcharhino-Kunden im Praxis-Einsatz. Wer also auf SUSE angewiesen ist und noch eine Lösung für das Softwaremanagement sucht, kann mit Katello und dem ForemanSccManager auf eine modernere Plattform als Spacewalk oder den darauf basierenden SUSE-Manager setzen. Wer bereits auf Katello setzt und SUSE nutzt, dem kann ich nur empfehlen seinen Workflow auf das Plugin umzustellen.

Dirk Götz

Principal Consultant

Read more from Dirk and meet the Team

OSMC 2018 – Day 2

by Dirk Götz | Nov 7, 2018 | Icinga

The evening event was again great food, drinks and conversation and while it ended in the early morning for some people, rooms were full of attendees again for the first talk. It was a hard choice between probably great talks but in the end I had chosen Rodrigue Chakode with “Make IT monitoring ready for cloud-native systems“. Being a long-term contributor to several Open Source Monitoring he used his experience to develop Realopinsight as a tool bringing existing monitoring tools together and extending them for monitoring cloud-native application platforms. In his live demo he showed the webinterface and Icinga 2, Zabbix and Kubernetes integration including aggregation of the severity for a specific service across the different solutions.
OSMC 2018
“Scoring a Technical Cyber Defense Exercise with Nagios and Selenium” by Mauno Pihelgas was a quite uncommon case study. Locked Shields is the biggest Cyber Defense exercise involving 22 teams defending systems provided by vendors against hundreds of attacks. Mauno is responsible for the availability scoring system which gives the defending teams bonus points for availability of the systems, but of course it makes also available for attacks which if successful will cause loss of points. The data collected by Nagios and Selenium are then forwarded to Kafka and Elasticsearch to provide abuse control and overall scoring. To give you some numbers over the 2 days of the exercise about 34 million checks are executed and logged.
Susanne Greiner’s talk “Mit KI zu mehr Automatisierung bei der Fehleranalyse” was on using Artificial Intelligence for automatic failure analyses. Her talk started from anomaly detection and forecasting, went through user experience and ended with machine learning and deep learning. It is always great to see what experts can do with data, so running anomaly detection and forecasting on the data, adding labels for user experience and feeding them to the AI can increase troubleshooting capabilities. And better troubleshooting will result in better availability and user experience of course what perhaps is the main goal of all IT.
At the evening event there was again some gambling and after lunch the guys how managed to win the most chips won some real prices.
OSMC 2018 Gambling Winners
While some still enjoyed the event massage, Carsten Köbke started the afternoon sessions with the best talk title “Katzeninhalt mit ein wenig Einhornmagie” (Cat content with a little bit of unicorn magic). Being the author of the Icinga Web 2 module for Grafana and several themes for Icinga Web 2 he demonstrated and explained his work to the audience. It is very nice to see performance data with annotations extracted from the Icinga database nicely presented in Grafana. The themes part of the talk was based on the idea of every one can do this and monitoring can be fun.
Thomas and Daniel teamed up to focus on log management and help people on choosing their tool wisely in their talk “Fokus Log-Management: Wähle dein Werkzeug weise“. They compared the Elastic stack and Graylog with each other in multiple categories, showing up advantages and disadvantages and which tool fits best for which user group.
“Eliminating Alerts or ‘Operation Forest’” by Rihards Olups was a great talk on how he tried reducing alerts to get a better acceptance and handling of the remaining alerts, getting problems solved instead of ignored. The ‘Operation forest’ mentioned in the talk’s title is his synonym for there infrastructure and alerts are trash he does not like in his forest, because trash attracts trash, like alerts attract alerts because if the numbers grows they tend to be ignored and more problems will get critical causing more alerts. It is not a problem of the tool used for monitoring and alerting but he had not only nice hints on changing culture but also technical ones like focusing on one monitoring solution, knowing and using all features or making problems more recognizable like putting them into the message of the day. For those having the same problems in their environment he wrote a shitlist you can check the problems you have and the number of checked items will indicate how shitty your environment is, I recommend having a look at this list.
Last but not least Nicolai Buchwitz talked about the “Visualization of your distributed infrastructure” and with his Map module for Icinga Web 2 he is providing a very powerful tool to visualize it. All the new features you get from the latest 1.1.0 release make it even more useful and the outlook on future extensions looks promising. Nicolai concluded with a nice live demo showing all this functionality.
So it was again a great conference, thanks to all speakers, attendees and sponsors for making this possible. I wish everyone not staying for the hackathon or Open Source camp “Save travels”. Slides, videos and pictures will be online in the near future. I hope to see you on next year’s OSMC on November, 4th – 7th!

Dirk Götz

Principal Consultant

Read more from Dirk and meet the Team

OSMC 2018 – Day 1

by Dirk Götz | Nov 6, 2018 | Icinga

It is always the same, Winter is coming and it brings people to Nuremberg for OSMC. Our Open Source Monitoring conference still grows every year and after giving three parallel tracks a try last year, we changed format again to include also shorter talks and having always three tracks. It also gets more international and topics get more diverse, covering all different monitoring solutions with speakers (and attendees) from all over the worlds. Like every year also the 13th conference started with a day of workshops enabling the interested ones to get hands on Prometheus, Ansible, Graylog and practical example on using the Puppet modules for Icinga 2. Also this year two days of great talks will be followed by a day of hacking and the second issue of the Open Source Camp takes place, this time focusing on Puppet.
OSMC 2018
And another tradition is Bernd starting the conference with a warm welcome before the first talk. Afterwards Michael Medin talked about his journey in monitoring and being a speaker at OSMC for the eleventh time in “10 years of OSMC: Why does my monitoring still look the same?“. It was a very entertaining talk comparing general innovation with the one happening in monitoring. He was showing up that monitoring solutions changed to reflect the change in culture but still stayed the same mechanism and explained all the problems we probably know like finding the correct metrics and interpreting them resulting from this.
Second talk I attended was “Scaling Icinga2 with many heterogeneous projects – and still preserving configurability” by Max Rosin. He started with the technical debt to solve and requirements to fulfill when migrating from Icinga 1 to Icinga 2 like check latency or 100% automation of the configuration. Their high-available production environment had no outage since going live in January, because the infrastructure design and testing updates and configuration changes in a staging setup, what is pretty awesome. The scripting framework they created for the migration will be released on Github. But this was not all they coded to customize their environment, they added some very helpful extensions for the operations team to Icinga Web 2, which will be available on Github somewhere in the future after separating company specific and upstream ready parts.
For the third session I had chosen Matthias Gallinger with “Netzwerkmonitoring mit Prometheus” (Network monitoring with Prometheus). In his case study he showed the migration from Cacti to Prometheus and Grafana done at a international company based in Switzerland. The most important part is here the SNMP Exporter for Prometheus including a generator for its configuration. All required is part of their labs edition of Open Monitoring Distribution (OMD).
After the lunch Serhat Can started with “Building a healthy on-call culture“. He provided and explained his list of rules which should create such a culture: Be transparent – Share responsibilities – Be prepared – Build resilient and sustainable systems – Create actionable alerts – Learn from your experiences. To sum up he tells everyone to care about the on-call people resulting in a good on-call service and user experience which will prevent a loss of users and money.
The Director of UX at Grafana Labs David Kaltschmidt gave an update on whats new and upcoming in Grafana focusing on the logging feature in “Logging is coming to Grafana“. The new menu entry Explore allows to easily querying Prometheus metrics including functions – just one click away – for rate calculation or average and it works the same for logging entries as a new type of datasource. This feature should be very useful in a Kubernetes environment to do some distributed tracing. If you are interested in this feature it should be available as beta in December.
“Distributed Tracing FAQ” was also the title of Gianluca Arbezzano‘s talk. I can really recommend his talk for the good explanation on why and how to trace requests through more and more complex, distributed services of nowadays. If you are more interested in tool links, he recommends Opentracing as library, Zipkin as frontend and of course InfluxDB as backend.
This year Bernd’s talk about the “Current State of Icinga” was crowded and interesting as always. I skip the organizational things like interest in the project is growing according to website views, customers talking about their usage, partners, camps and meetups all over the world. From the technical aspects Icinga 2 had a release bringing more stabilization, improved Syntax Highlighting and as new feature Namespacing. The coming Director release brings support for multiple instances helping with staging, health checks and a configuration basket allowing to easily export and import configuration. A new Icinga Web 2 module X509 helps managing your certificate infrastructure, available next week on github. The one for VMware vSphere (sponsored by dmTECH) is already released and was shown in a demo by Tom who developed it. Icinga DB will replace IDO as a backend moving volatile data to Redis and data to be keeped will be stored to MySQL or PostgreSQL and there will also be a new Monitoring Module for Icinga Web 2 to make use of it, all available hopefully in two weeks.
This year’s OSMC provided something special as the last talk of the first day with an authors’ panel including Marianne Spiller (Smart Home mit openHAB 2), Jan Piet Mens (Alternative DNS Servers – Choice and deployment, and optional SQL/LDAP back-ends), Thomas Widhalm and Lennart Betz (Icinga 2 – Ein praktischer Einstieg ins Monitoring) moderated by Bernd and answering questions from the audience.
If you want to get more details or pictures have a look at Twitter. There will also be a post by Julia giving a more personal view on the conference from interviewing some attendees and one of me covering the talks of the second day, but now I am heading for the evening event.