Presentation Lfoppiano Pycon
0 likes616 views
Func is a Python-based tool that provides a unified way to manage and control large networks of machines through a centralized controller node. It uses a module-based architecture where core functionality is implemented in reusable modules. Some key modules allow restarting services, running commands, updating systems, and more across multiple remote machines defined by glob patterns or groups. The system aims to provide a more secure, automated, and scalable alternative to manual SSH/Telnet access.
![Func: quick start
Two components: certmaster (51235/tcp) and minion
(51234/tcp)
Status or the art: 1 Certmaster, N minions (Proxy module
will be available after Google SoC)
Certmaster needs to sign minions by certificate
generation (automatically performed using autosign):
certmasterca tool.
Minion needs only to know who is certmaster
[root@a~]# certmaster-ca --list
[root@a~]# certmaster-ca --sign hostname.domain.x
[root@a~]# certmaster-ca --clear hostname.domain.x](https://image.slidesharecdn.com/presentationlfoppianopycon-091115143143-phpapp01/85/Presentation-Lfoppiano-Pycon-8-320.jpg)
![Func: starting
Open a shell on certmaster host
Python API
>>> from func.overlord import client
>>> client1 = client.Client(“*.lan”)
>>> client1.service.restart(“httpd”)
>>> client1.command.run(“df h”)
CLI
[root@a~]# func “*.com” call service restart “httpd”
[root@a~]# func “*.lan” call command run “df h”](https://image.slidesharecdn.com/presentationlfoppianopycon-091115143143-phpapp01/85/Presentation-Lfoppiano-Pycon-9-320.jpg)
![Globbing
Python API
>>> from func.overlord import client
>>> glob1 = client.Client(“customer*; office.example.lan”)
>>> glob1.yumcmd.update();
CLI
[root@a~]# func “*.example.org;*.lan” run yumcmd update
[root@a~]# func “web*.domain.it;virt*” run](https://image.slidesharecdn.com/presentationlfoppianopycon-091115143143-phpapp01/85/Presentation-Lfoppiano-Pycon-13-320.jpg)
![Grouping
[root@a~]# cat /etc/func/groups
[webservers]
host = office.example.lan, customer01.example.com
[jbossas]
host = *.example.lan
Python API & CLI Example
>>> from func.overlord import client
>>> client.Client(@webservers).service.restart(“httpd”);
[root@a~]# func “@webservers” run service restart “httpd”](https://image.slidesharecdn.com/presentationlfoppianopycon-091115143143-phpapp01/85/Presentation-Lfoppiano-Pycon-14-320.jpg)
Presentation Lfoppiano Pycon
- 1. FUNC Fedora Unified Network Controller Luca Foppiano <lfoppiano@byte-code.com>
- 2. Summary The big picture Solutions Features What about future? Related projects
- 3. The big picture “turn off all testing virtual machines” “restart all crashed web services” “update all machines with operation suffix in the name (eg. web*.example.*, customer*, etc)”
- 4. Solutions? Manual solution SSH or Telnet (as your risk) Func (https://fedorahosted.org/func)
- 5. Manual solution Obsolete Expensive Impossible on world distributed network High risk Need to trust unskilled people
- 6. SSH Secure Bash powered Problems with multihop Requires manual “public key” exchange Security issues (one machine has the control of whole networks without any filter)
- 7. Func Provides Python APIs (and/or CLI command) to manage huge number of machines Fedora Unified Network Controller A Red Hat and Fedora Project Written in Python Secure (https based connection) Modulebased architecture Easy to expand by writing new modules Security model guarantee by ACLs Web interface based on TurboGear (FuncWeb)
- 8. Func: quick start Two components: certmaster (51235/tcp) and minion (51234/tcp) Status or the art: 1 Certmaster, N minions (Proxy module will be available after Google SoC) Certmaster needs to sign minions by certificate generation (automatically performed using autosign): certmasterca tool. Minion needs only to know who is certmaster [root@a~]# certmaster-ca --list [root@a~]# certmaster-ca --sign hostname.domain.x [root@a~]# certmaster-ca --clear hostname.domain.x
- 9. Func: starting Open a shell on certmaster host Python API >>> from func.overlord import client >>> client1 = client.Client(“*.lan”) >>> client1.service.restart(“httpd”) >>> client1.command.run(“df h”) CLI [root@a~]# func “*.com” call service restart “httpd” [root@a~]# func “*.lan” call command run “df h”
- 10. What about modules? Func based on modules architecture A module support new stuff 20 modules (libVirt, jboss, info, process, command, iptables, nagios, etc) Writing a new module is simple. When you write a module, it works on both CLI and PyScripting, no modification on func are needed.
- 11. How to write new module funccreatemodule By hand import func_module class NewModule(func_module.FuncModule): version = “1.0” api_version = “0.1” description = “new module” def __init__(self): pass def anAction(self, arg1, arg2): pass
- 12. Advanced features Async mode Only on python API (implementation is coming ;) ) Useful on long time required commands (eg. Yum update) Multiplexer: possibility to launch more than one process Globbing Grouping
- 13. Globbing Python API >>> from func.overlord import client >>> glob1 = client.Client(“customer*; office.example.lan”) >>> glob1.yumcmd.update(); CLI [root@a~]# func “*.example.org;*.lan” run yumcmd update [root@a~]# func “web*.domain.it;virt*” run
- 14. Grouping [root@a~]# cat /etc/func/groups [webservers] host = office.example.lan, customer01.example.com [jbossas] host = *.example.lan Python API & CLI Example >>> from func.overlord import client >>> client.Client(@webservers).service.restart(“httpd”); [root@a~]# func “@webservers” run service restart “httpd”
- 15. Future ideas Modules module Google Summer of Code: Proxy module Systemconfig* module User/groups manipulation Package on other distributions (Debian, Suse, Ubuntu, etc.)
- 16. Related projects Symbolic (http://www.opensymbolic.org) Puppet (http://reductivelabs.com/trac/puppet) Puppetteam (http://projects.bytecode.com/trac/puppetteam) Cobbler (http://cobbler.et.redhat.com/)