5

I am new to Puppet, and I am wondering if it is an effective solution for patch/pkg management on Solaris as well as Linux. I am more interested on the Solaris side. So far am unable to locate any relevant documentation. Where can I find documentation on how to handle this?

2 Answers 2

5

Patch management is a very broad topic that can have variables like company policy. Therefore there is no out of the box solution that fits all needs, and therefore, puppet only comes with the tools to create solutions that match your specific requirements.

For Rpm or Apt based Linux, all you need is custom repositories, which can be created by rsync, or mrepo, or Satellite or Pulp. Then use puppet to point your servers to these repositories. Puppet can then use Rpm or Apt to manage packages for you. (Check other pages on that site)

Pulp also lets you track what RPM packages are present on what servers, and install them remotely. You could use puppet to install and configure Pulp on your servers. Pulp is a new and not so mature product btw. The features that pulp offers could by built using puppet with some thought and effort.

For Solaris, if it's an individual package, you could use the "pkgadd" provider.

To selectively install multiple Solaris patches, or to install "all the latest" patches, you could use an external script along with puppet "Exec".

There is a popular open source script that people use to manage patches on Solaris. PCA. With PCA, you can create internal mirrors of Sun patches, and configure servers to use those mirrors, instead of going out to the internet.

For installing Solaris packages, you can use the "bldcat" tool from OpenCSW to build internal package repositories. Then you can use "pkgutil" in Puppet to install your internal (and CSW) Solaris packages.

Your architecture then becomes very similar to Linux + yum or Apt.

1
  • Thanks for you detailed reply. I will look into the tools that you mentioned.
    – vs_sa
    Nov 8, 2011 at 15:39
2

Solaris (at least up to and including 10) is a little different to Linux in that it has "patches", wbich aren't the same as "packages". So, to provide some information about what you could do in Solaris:

At a very basic level, you can tell Puppet to do something onlyif an external command succeeds, or unless an external command succeeds.

So thinking of this in terms of Solaris patches, you could write yourself a little module to ensure particular patches are installed. That module would check (eg. by parsing the output of "showrev -p", or perhaps grovelling around in /var/sadm if you're confident) that the patch isn't already applied, before applying it.

2
  • IMO, it is easier to use pca, instead of writing your own code for patches.
    – Not Now
    Nov 14, 2011 at 18:32
  • 1
    Nothing in what I suggested precludes using pca to actually do the work.
    – Cos
    Nov 14, 2011 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .