Config Management

Chapter 50: Configuration Management with Puppet/Chef

Overview

This chapter covers Puppet and Chef configuration management tools.

---

50.1 Puppet Basics

Architecture

              Puppet Architecture
+------------------------------------------------------------------+
|                                                                   |
|   Puppet Master                                                   |
|   +------------------------------------------------------------+ |
|   | Catalog compilation                                        | |
|   | Manifests (.pp files)                                     | |
|   | Module distribution                                        | |
|   +------------------------------------------------------------+ |
|                                                                   |
|   Agent (Puppet Agent)                                           |
|   +------------------------------------------------------------+ |
|   | Facter - System facts                                     | |
|   | Apply catalog                                             | |
|   | Report to master                                          | |
|   +------------------------------------------------------------+ |
|                                                                   |
+------------------------------------------------------------------+

---

50.2 Puppet Manifests

Basic Manifest

/etc/puppetlabs/code/environments/production/manifests/site.pp

# Package resource
package { 'nginx':
  ensure => installed,
}

# Service resource
service { 'nginx':
  ensure     => running,
  enable     => true,
  requires   => Package['nginx'],
}

# File resource
file { '/etc/nginx/nginx.conf':
  ensure  => file,
  source  => 'puppet:///modules/nginx/nginx.conf',
  require => Package['nginx'],
  notify  => Service['nginx'],
}

Resource Types

# User
user { 'deploy':
  ensure     => present,
  shell      => '/bin/bash',
  home       => '/home/deploy',
  managehome => true,
}

# Group
group { 'developers':
  ensure => present,
}

# Cron
cron { 'backup':
  command => '/usr/local/bin/backup.sh',
  hour    => '2',
  minute  => '0',
}

---

50.3 Puppet Modules

Module Structure

nginx/

# ├── manifests/
# │   ├── init.pp
# │   ├── install.pp
# │   ├── config.pp
# │   └── service.pp
# ├── files/
# │   └── nginx.conf
# └── templates/
#     └── nginx.conf.erb

Using Modules

# Include class
include nginx

# Declare class with parameters
class { 'nginx':
  version => '1.24.0',
}

---

50.4 Chef Basics

Architecture

              Chef Architecture
+------------------------------------------------------------------+
|                                                                   |
|   +----------------+     +----------------+     +--------------+ |
|   | Chef Server    | <-- | Chef Client    | --> | Cookbooks    | |
|   | (Central)      |     | (On node)      |     | (Recipes)    | |
|   +----------------+     +----------------+     +--------------+ |
|           |                       |                      |        |
|           v                       v                      v        |
|   +----------------+     +----------------+     +--------------+ |
|   | Workstation   |     | Ohai           |     | Attributes   | |
|   | (knife)       |     | (System facts) |     | (Variables)  | |
|   +----------------+     +----------------+     +--------------+ |
|                                                                   |
+------------------------------------------------------------------+

---

50.5 Chef Cookbooks

Recipe Example

cookbooks/nginx/recipes/default.rb

# Install package
package 'nginx' do
  action :install
end

# Start service
service 'nginx' do
  action [:enable, :start]
end

# Template config
template '/etc/nginx/nginx.conf' do
  source 'nginx.conf.erb'
  owner 'root'
  group 'root'
  mode '0644'
  notifies :restart, 'service[nginx]'
end

Resources

# File
cookbook_file '/etc/motd' do
  source 'motd'
  mode '0644'
end

# Execute
execute 'update-apt' do
  command 'apt-get update'
  not_if { ::File.exist?('/var/cache/apt/initialized') }
end

# Template
template '/etc/app.conf' do
  variables(
    app_name: 'myapp',
    port: 8080
  )
end

---

50.6 Chef Tools

Knife Commands

# Upload cookbook
knife cookbook upload nginx

# Bootstrap node
knife bootstrap node.example.com -x admin -P password

# Run chef-client
knife ssh 'role:web' 'sudo chef-client'

# List nodes
knife node list
knife node show node1

---

50.7 Comparison

Tools Comparison

+------------------------------------------------------------------+
| Feature        | Puppet        | Chef         | Ansible        |
+----------------+---------------+--------------+----------------+
| Language       | DSL (.pp)     | Ruby (.rb)   | YAML           |
| Agent          | Required      | Required     | Optional       |
| Push/Pull      | Pull          | Pull         | Push           |
| Learning Curve | Moderate      | Steep        | Easy           |
| Enterprise     | Yes           | Yes          | Yes            |
| Idempotent     | Yes           | Yes          | Yes            |
+------------------------------------------------------------------+

---

Why This Matters in DevOps/SRE

Configuration management tools are essential for IaC:

        Configuration Management in DevOps/SRE
+------------------------------------------------------------------+
|                                                                   |
|    Tool Selection:                                                 |
|    +----------------------------------------------------------+  |
|    | Puppet -> Enterprise, mature                      |  |
|    | Chef -> Ruby-based, developer-friendly          |  |
|    | Ansible -> Agentless, YAML-based               |  |
|    +----------------------------------------------------------+  |
|                                                                   |
|    Industry Trends:                                                 |
|    +----------------------------------------------------------+  |
|    | Ansible gaining popularity for agentless simplicity     |  |
|    | Puppet/Chef still used in enterprise                 |  |
|    | Cloud-native tools emerging                          |  |
|    +----------------------------------------------------------+  |
|                                                                   |
+------------------------------------------------------------------+

Practical Impact:

• Choose right tool for your organization
• Understand trade-offs between tools
• Enable configuration management at scale

---

Common Mistakes & Anti-Patterns

1. Not Using Version Control

# WRONG: Storing configs in shared drive
# No history, no rollback

# CORRECT: Use Git
# Store all configs in version control
# Use GitOps workflow

2. Not Testing Changes

# WRONG: Applying changes directly to production
# puppet apply production.pp

# CORRECT: Use testing pipeline
# Development -> Staging -> Production
# Use tools like Test Kitchen, serverspec

3. Not Managing Secrets Properly

# WRONG: Hardcoded passwords in config files
# db_password = "secret123"

# CORRECT: Use secret management
# HashiCorp Vault integration
# Ansible Vault, Chef Vault

---

Summary

In this chapter, you learned:

• ✅ Puppet architecture and manifests
• ✅ Puppet resources and modules
• ✅ Chef architecture and cookbooks
• ✅ Chef recipes and resources
• ✅ Tools comparison

---

Next Chapter

Chapter 50: Infrastructure as Code

---

Last Updated: February 2026