The slide deck from my talk at Puppetize PDX, Oct 2019. It covers how to use the Puppet patching module os_patching (https://forge.puppet.com/albatrossflavour/os_patching) and the background and principles of its design.

1. Puppetizing the pain out of
patching
Tony Green (he/him)
tgreen@albatrossflavour.com
@albatrossflavour

2. Me

3. TL;DRIt's late in the conference, how about we get the demo out of
the way first and then we can talk about the how and why.

4. Principles

5. Principles
1. Do one thing and do it well

6. Principles
1. Do one thing and do it well
2. Canonical data is on the node

7. Principles
1. Do one thing and do it well
2. Canonical data is on the node
3. Blocked means blocked

8. Principles
1. Do one thing and do it well
2. Canonical data is on the node
3. Blocked means blocked
4. Automagically updated

9. Principles
1. Do one thing and do it well
2. Canonical data is on the node
3. Blocked means blocked
4. Automagically updated
5. Single, centralised, interface for reporting

10. Principles
1. Do one thing and do it well
2. Canonical data is on the node
3. Blocked means blocked
4. Automagically updated
5. Single, centralised, interface for reporting
6. Unified orchestration options with self service

11. Why?

13. -- Jake Rogers

14. Facter

15. • Updates
• Blackout windows
• Pinned package list
• Last run state
• Patch window
• Reboot override
• Pending reboot state
• Blockers

16. Cache files

17. Patch windows

18. Use hiera ...

19. or the console.

20. Then run the agent

21. Blackouts

22. Patch blockers
• During blackout window
• Invalid blackout window
• Warnings present 1
1
Configurable option

23. Patch blockers
You cannot patch....I am a servant of the Secret Fire,
wielder of the flame of Anor. You cannot patch. The dark
fire will not avail you, flame of Udûn. Go back to the
Shadow! You cannot patch.

24. Warnings• Package resources with versions that aren't locked at the OS
layer
• Fact cache files don't exist
• Fact cache files have not been recently updated

25. Security only patching

26. And then run the task

27. To reboot, or not to reboot,
that is the question

28. Reboot required?

29. Reboot options
• always
• never
• patched
• smart

30. https//bit.ly/os_patching

31. Integrations

33. Sample queries

34. Roadmap• Agentless patching through Bolt
• Chocolatey
• Puppet Remediate
• BSD support (Thanks to Romain Tartière)
• AIX and Solaris
• Gems
• ...?

35. Special thanks to
• Not Potato
• Brett Gray
• Rob Nelson
• Tommy McNeely
• Geoff Williams
• Jake Rogers
• Nathan Giuliani

36. Very special thanks to
Yasmin Rajabi and the bolt/tasks team.
Without you, none of this would be possible.

37. Thank you!
tgreen@albatrossflavour.com
"
@albatrossflavour
#
https//bit.ly/os_patching

38. Questions?