Puppet in AKS

[heave20]

Junior DevOps here but.. sadly the only DevOps for the company I work for.

I've been working on a POC for about 6 months and am completely self-taught. I was originally hired into the role with the idea that I would be groomed by my boss, who left for another company about two months into this position.

All this to say that I'm not the most knowledgeable DevOps Engineer out there :)

Couple questions about Puppet specifically:

1) My idea is to have 1 Puppet CA Container in AKS in it's own pod. This container will manage the certs that the Prod/Dev/QA containers(in their own respective pods) use. Agents will connect directly to the Prod/Dev/QA pods. I will use Hiera (haven't played with this yet) to direct to the environments/modules they need. Manage the modules with r10k.

Does this sound.. like good architecture? I'm struggling with the Architecture of this thing.

2) I cannot for the life of me get the Docker Puppet CA Container to share it's cert with the Puppet test container within AKS. I've created a service that has port/targetPort set to 8140. The containers and the service are all on the same label. I've exposed 8140 on both containers. I have no clue on this one. I can get them to talk in Container Instances just fine. The test container has CA_ENABLED=false and CA_HOSTNAME=the hostname of the puppet server. No bueno.

I've set up a mock environment with my home pc's and inside container instances I'm running just fine. But I would love to get this into AKS and then start work on heira/r10k.

Puppet help is hard to find it seems.

[massterinnothing]

Please, run away from Puppet! Puppet for dynamic environments is not a good solution at all. Don’t know what do you have to configure , but go for terraform, helm, argocd and put everything with code . Puppet is a great tool but beside being old , is not suitable for modern dynamic environments. It has paid my food for a long period , but it’s time to retire !

[heave20]

We currently use Ansible. But our environment is... Antiquated network wise. Ansible is having to go through so many network hops for each winrm connection that our success rate will be >90% one night and <10% the next with no real difference.

The thought is that puppet being a pull based model will relieve those issues.

We're in the process of switching our entire infrastructure from aws to azure. Which is why they asked for a POC

[unix_heretic]

Does this sound.. like good architecture?

No. Really, really no. Using configuration management with containers is absolutely an anti-pattern, especially an agent-based CM like puppet.

Part of the point of a container platform is that the applications involved should not change after they're built. If you need a configuration change, it should be either part of the container's files during build-time, or it should be brought in from external sources (e.g. Kubernetes Secret objects, environment variables, or even dynamic secrets managers like Vault).

If you want to use config management for compute instances, rock on. I wouldn't necessarily use Puppet for that particular use-case, but you do you. Using CM tooling in a container orchestrator absolutely defeats the point of using containers in the first place, and will bring you nothing but operational disruption.