Migrating from Puppet Enterprise to OpenVox and Foreman

# Puppet Enterprise -><br/> OpenVox & Foreman

???

---
## $ whoami
<img src="bastelfreak2.jpg" alt="drawing" style="float: right;width: 400px;"/>

* Tim 'bastelfreak' Meusel

* Puppet Contributor since 2012

* Merging stuff on [Vox Pupuli](https://voxpupuli.org/) (Puppet Community) since 2015

* Vox Pupuli Project Management Committee member

* Senior IT Automation Consultant at [betadots](https://betadots.de/)

* Foreman Contributor since 2014

<a href='https://betadots.de' alt='company website betadots'><img src="logo-1181x1181.png" alt="drawing" style="position: fixed; bottom: 12px; left: 20px; width: 100px;"/></a>
???

* who has seen this picture before because I reviewed/merged your pull request?

---
class: center, middle, inverse

# Vox Pupuli &<br/> OpenVoxProject

???

---
background-image: url(contributors.svg)
background-size: contain

## Vox Pupuli Community growth over time

???

Vox Pupuli maintain all the ecosystem tooling and modules

Foreman uses a lot of them and contributes to them
---

* Same people as Vox Pupuli

* Split orgs to make permission management easier

* Makes it easier to move one or the other to the Linux Foundation or similar, if we ever want to do that

]

<a href='https://betadots.de' alt='company website betadots'><img src="logo-1181x1181.png" alt="drawing" style="position: fixed; bottom: 12px; left: 20px; width: 100px;"/></a>
.footnote[[bastelfreak](https://github.com/bastelfreak) for [Vox Pupuli](https://voxpupuli.org)]

???

---

* Same people as Vox Pupuli

* Split orgs to make permission management easier

* Makes it easier to move one or the other to the Linux Foundation or similar, if we ever want to do that

* We continue the open source development of Bolt, Facter, Puppet Agent/DB/Server

* Perforce stopped their work on it last November and continues in a private & commercial fork
]

???

---
class: center, middle, inverse

# Puppet Enterprise

## also known as PE

???

* Who ever installed or used PE?
---
.left-column[
## PE
]

]

???

---

* Naming things!
]

???

---

* Naming things!

* What do you think is the "PE Console"?
]

???

---

---

???

* PE subscription: open source components + Console + support contract

* now demo https://pe.tim.betadots.training/

TimIsTesting2024!
---

???

Node overview similar to Foreman
* all nodes and their states, links to reports

---

???

you can create groups

---

???

you can create groups

---

---

```json
{
  "puppet_task_version": 1,
  "supports_noop": false,
  "description": "Rename branch",
  "parameters": {
    "control_repo_branch": {
      "description": "Control-repo branch",
      "type": "String[1]"
    }
  }
}
```

```sh
#!/bin/bash
pushd /tmp/control-repo || exit
git branch -m production old_prod
git branch -m "$PT_control_repo_branch" production
```
]

???

* bolt takes user input and validates it against the schema in the metadata file
* reuse existing puppet datatypes
---

* Plans apply puppet code, execute Bolt or Puppet functions, start tasks or other plans

```puppet
# @param message the string we want to paste to STDOUT
plan test::foo (
  String[1] $message = 'Hi VoxConf!',
) {
  out::message($message)
  run_task('puppet_agent::install', get_targets('all'))
}
```
]

???

---

???

* Inventory describes the nodes I have and which transport protocol to use

* the default inventory is just a yaml file

---

* Uses WinRM or SSH by default as transport protocol

* Also native support for Docker, lxd, Jails, podman
]

???

---

* Uses WinRM or SSH by default as transport protocol

* Also native support for Docker, lxd, Jails, podman

* Most used inventory plugin: PuppetDB
]

???

The inventory will be generated based on PQL queries. For example: all nodes I have, or a specific operating system version

Inventory plugins are just tasks! So you could use your favourite language to write a plugin to get nodes from the foreman api!

---

* Uses WinRM or SSH by default as transport protocol

* Also native support for Docker, lxd, Jails, podman

* Most used inventory plugin: PuppetDB

* There is also a Foreman inventory plugin! [forge.puppet.com/modules/foreman_inventory](https://forge.puppet.com/modules/andeman/foreman_inventory/tasks)
]

???

A foreman plugin already exists
---

# Bolt is the missing part in the ecosystem for imperative workflows and orchestration

## It combines scripts and Puppet code

???

* bolt has more features, please check them out
* but this isn't a bolt talk, just an intro
* bolt is just an open source tool with a CLI

* bolt is the ansible counterpart
---

* Orchestrator can run Puppet tasks and Plans
* Basically an API & Web UI for bolt
]

---

* Orchestrator can run Puppet tasks and Plans
* Basically an API & Web UI for bolt
* Similar concept as the remote execution within Foreman!
]

---
class: center, middle, inverse

# How do we<br/>migrate?

---

.left-column[
## PE
## Bolt
## PE & Bolt
## Marriage
]
.right-column[
![firewall](pe2foreman1.drawio.svg)

]
<a href='https://betadots.de' alt='company website betadots'><img src="logo-1181x1181.png" alt="drawing" style="position: fixed; bottom: 12px; left: 20px; width: 100px;"/></a>
.footnote[[bastelfreak](https://github.com/bastelfreak) for [Vox Pupuli](https://voxpupuli.org)]

???

* Current PE
* different services on one box

---
.left-column[
## PE
## Bolt
## PE & Bolt
## Marriage
]
.right-column[
![firewall](pe2foreman3.drawio.svg)

* Configure foreman-proxy on PE infra
* PE uses `pe-puppet` user, not `puppet`, supported by [theforeman/foreman_proxy 28.0.0](https://github.com/theforeman/puppet-foreman_proxy/commit/6645a728185d19d2226fbc7c4530d4341727365e)
* PE is still the ENC
* Foremans node.rb pushes facts to foreman, PE support in [theforeman/puppserver_foreman 4.1.0](https://github.com/theforeman/puppet-puppetserver_foreman/commit/2f6c193f8e6579dce76c90a6ff289a632cbd9039)
]

???

The foreman module will detect if its running on a PE node and use the correct user
---

```puppet
# https://github.com/puppetlabs/puppet-enterprise_issues/issues/55
ini_setting { 'enable reporting into Foreman':
  ensure  => 'present',
  path    => '/etc/puppetlabs/puppet/puppet.conf',
  setting => 'reports',
  value   => 'puppetdb,foreman',
  section => 'master',
  notify  => Service['pe-puppetserver'],
}
```

* we need to tell PE to use the foreman report processor

* Perforce renamed master section to server years ago
]
<a href='https://betadots.de' alt='company website betadots'><img src="logo-1181x1181.png" alt="drawing" style="position: fixed; bottom: 12px; left: 20px; width: 100px;"/></a>
.footnote[[bastelfreak](https://github.com/bastelfreak) for [Vox Pupuli](https://voxpupuli.org)]

???

You can use the server section, but it will always create the master section as well

master section was renamed to server. puppet master of master renamed to primary. master renamed to compiler
---

* we need to tell PE to use the foreman report processor

* Perforce renamed master section to server years ago

* except for PE, where I still need to set the master section
]
<a href='https://betadots.de' alt='company website betadots'><img src="logo-1181x1181.png" alt="drawing" style="position: fixed; bottom: 12px; left: 20px; width: 100px;"/></a>
.footnote[[bastelfreak](https://github.com/bastelfreak) for [Vox Pupuli](https://voxpupuli.org)]

???

You can use the server section, but it will always create the master section as well
---

]

---

* we need to tell PE to use the foreman report processor

* Perforce renamed master section to server years ago

* except for PE, where I still need to set the master section

* Why does that even work?
]

???

---

* we need to tell PE to use the foreman report processor

* Perforce renamed master section to server years ago

* except for PE, where I still need to set the master section

* Why does that even work?

* PE doesn't manage puppet.conf out of the box on puppetservers
]

???

---

]

---
.left-column[
## PE
## Bolt
## PE & Bolt
## Marriage
]
.right-column[

* PE now speaks to foreman

* We can add openvox-server on additional machines

* Move agents from PE puppetserver to openvox-server

* Perforce legacy open source agents / PE agents / OpenVox Agents are all compatible with PE puppetserver / legacy opensource puppetserver / openvox-server
]
<a href='https://betadots.de' alt='company website betadots'><img src="logo-1181x1181.png" alt="drawing" style="position: fixed; bottom: 12px; left: 20px; width: 100px;"/></a>
.footnote[[bastelfreak](https://github.com/bastelfreak) for [Vox Pupuli](https://voxpupuli.org)]

???

---

* You can already manage OpenVox with the foreman puppet modules!

```yaml
---
puppet::client_package: openvox-agent
puppet::server::package: openvox-server
puppetdb::puppetdb_package: openvoxdb
puppetdb::master::config::terminus_package: openvoxdb-termini
foreman::providers::oauth: false
```

```puppet
# on the foreman node
package { 'oauth':
  ensure   => 'installed',
  provider => 'puppet_gem',
}
```

* Foremans puppet-agent-oauth rpm/deb package depends on `puppet-agent`, not all OpenVox packages have `provides puppet-agent` in their metadata yet!
]

???

---

* For years, PE customers just wanted to run Foreman + Bolt tasks/plan via API

* Perforce ignored it: https://github.com/puppetlabs/puppet-enterprise_issues/issues/28

]

???

Customers wanted that Perforce writes a plugin for Foreman, to speak to their orchestrator
---

* For years, PE customers just wanted to run Foreman + Running Bolt tasks/plan via API

* Perforce ignored it: https://github.com/puppetlabs/puppet-enterprise_issues/issues/28

* We started a little side project https://community.theforeman.org/t/rfc-integrating-bolt-into-remote-execution/39901

???

* building it with https://overlookinfratech.com/
---

.left-column[
## PE
## Bolt
## PE & Bolt
## Marriage
]
.right-column[
.smallimg[![marriage](marriage.drawio.svg)]
]
<a href='https://betadots.de' alt='company website betadots'><img src="logo-1181x1181.png" alt="drawing" style="position: fixed; bottom: 12px; left: 20px; width: 100px;"/></a>

???

---

---

* You can already run Foreman with OpenVox Agent/DB/Server packages

]

???

---

* You can already run Foreman with OpenVox Agent/DB/Server packages

* You can already use OpenVox Agents with Puppet Enterprise
]

???

* There are bolt plans available to purge the puppet agent and reinstall the openvox agent!
---

* You can already run Foreman with OpenVox Agent/DB/Server packages

* You can already use OpenVox Agents with Puppet Enterprise

* You can already connect your Puppet Enterprise to Foreman
]

???

---

* You can already run Foreman with OpenVox Agent/DB/Server packages

* You can already use OpenVox Agents with Puppet Enterprise

* You can already connect your Puppet Enterprise to Foreman

* Soon we will have Bolt Tasks/Plans integration in Foreman
]

???

---

* You can already run Foreman with OpenVox Agent/DB/Server packages

* You can already use OpenVox Agents with Puppet Enterprise

* You can already connect your Puppet Enterprise to Foreman

* Soon we will have Bolt Tasks/Plans integration in Foreman

* With Choria, we have a scaleable open source broker Setup to replace the pxp-agent and PE-Orchestrator
]

???

---

* You can already run Foreman with OpenVox Agent/DB/Server packages

* You can already use OpenVox Agents with Puppet Enterprise

* You can already connect your Puppet Enterprise to Foreman

* Soon we will have Bolt Tasks/Plans integration in Foreman

* With Choria, we have a scaleable open source broker Setup to replace the pxp-agent and PE-Orchestrator

* Different companies offer consulting & support & training for Foreman & OpenVox
]

???

---

# There is no reason to run<br/> Puppet Enterprise anymore

???

---

.right-column[
* All memes are a homage to the awesome WAT talk, [destroyallsoftware.com/talks/wat](https://www.destroyallsoftware.com/talks/wat)

* For feedback: `bastelfreak` on Libera.Chat IRC or [tim@bastelfreak.de](mailto:tim@bastelfreak.de)

* This talk and previous ones: <a href='https://github.com/bastelfreak/talks'>github.com/bastelfreak/talks</a>

### Thanks for your attention!

???