jessereynolds

Puppet Node Purging via API

When you're decomissioning a machine that has been managed by Puppet you may want to programatically clean up the node. There are two parts to this:

• revoking and deleting the certificate of the node in Puppet's CA
• deactivating the node in PuppetDB

The following should work for Puppet 4.x and Puppet DB 4.x (including Puppet Enterprise 2016.4.x, 2017.1.x, 2017.2.x).

I've used certificate based auth, and the examples are being run from the puppet master so make use of existing certificates for authentication. When run remotely the cacert, certificate and corresponding private key for authentication will need to be present.

ptarjan

Scaling your API with rate limiters

The following are examples of the four types rate limiters discussed in the accompanying blog post. In the examples below I've used pseudocode-like Ruby, so if you're unfamiliar with Ruby you should be able to easily translate this approach to other languages. Complete examples in Ruby are also provided later in this gist.

In most cases you'll want all these examples to be classes, but I've used simple functions here to keep the code samples brief.

Request rate limiter

This uses a basic token bucket algorithm and relies on the fact that Redis scripts execute atomically. No other operations can run between fetching the count and writing the new count.

Fornoth

#Python Script Setup

To get the python script running, run either pip install flask or pip install -r requirements.txt if you used git clone to clone the gist

#libspotify_embedded_shared.so notes

##Using the library (still in progress) There's a compile.sh that compiles a program that calls SpInit(), but doesn't get any farther because it needs more than just the API version number (which is 4)

##Spotify appkey

DavidWittman

#!/usr/bin/expect -f

# This script secures SuperMicro IPMI implementations which are vulnerable
# to viewing the IPMI password in plaintext on port 49152. It does this by
# using the shell available in some SuperMicro BMCs to drop traffic to port
# 49152 in iptables. 
#
# See http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/
# for more details on the vulnerability.
#

roidrage

• The Challenger Launch Decision: http://amzn.to/1fEZykf
• Friendly Fire: http://amzn.to/17MZDcz
• The Black Swan - The Impact of the Highly Improbable: http://amzn.to/19CvJvW
• The Field Guide to Understanding Human Error: http://amzn.to/19IxbP4
• Power of Habit: http://amzn.to/13TDI2U

bf4

  gem 'lograge' # more readable logs
    gem 'logstash-event' # for logstash json format
  gem 'mono_logger' # threadsafe logging

rodjek

check_puppet_run_health

A Nagios check that connects to PuppetDB and determines the Puppet agent run health on a host.

Requires

• PuppetDB
• A puppetmaster configured to send reports to PuppetDB

States

rockymadden

This chassis houses up to 8 processing nodes. Each node is roughly equivilent to 30 elastic compute units. You can scale as needed by building and slotting more nodes into the chassis. Candidates for these nodes includes: app servers of any kind, ssl termination/reverse proxies, cache servers, distributed/concurrent processing, cron jobs, etc.

Barebone:

• 1x Supermicro 5038ML-H8TRF(http://www.supermicro.com/products/system/3U/5038/SYS-5038ML-H8TRF.cfm) $3750

---

Per node (up to 8):

mrflip

Next Steps

• Measure time spend on index, flush, refresh, merge, query, etc. (TD - done)
• Take hot threads snapshots under read+write, read-only, write-only (TD - done)
• Adjust refresh time to 10s (from 1s) and see how load changes (TD)
• Measure time of a rolling restart doing disable_flush and disable_recovery (TD)
• Specify routing on query -- make it choose same node for each shard each time (MD)
• GC new generation size (TD)
• Warmers

• measure before/after of client query time with and without warmers (MD)

wofeiwo

// Copyright 2012 Junqing Tan <[email protected]> and The Go Authors
// Use of this source code is governed by a BSD-style
// Part of source code is from Go fcgi package

// Fix bug: Can't recive more than 1 record untill FCGI_END_REQUEST 2012-09-15
// By: wofeiwo

package fcgiclient

import (