stark525

Infrastructure Testing: Sanity Checking VPC Routes

Testing Infrastructure is hard; testing VPCs is even harder

Infrastructure testing is hard. My entire career I've tried to bring traditional development testing practices into operations. Linters. Rspec. Mock objects. These tools provide semantic and syntax checking, as well as unit and integration level coverage for infrastructure as code. Ideally, we would also test the system after the code is deployed. End-to-end infrastructure testing has always been a stretch goal -- too time-consuming to implement from scratch. This is especially true of network level testing. I am not aware of any existing tools that provide self-contained, end-to-end tests to ensure VPCs, subnets, and route tables are properly configured. As a result, production network deployments can be incredibly anxiety-inducing. Recently, my coworkers and I set up an entire VPC (virtual private cloud) using infrastructure as code, but felt we need

stark525

    def get_ip_of_peer_instances_and_write_to_settings_file(self):
        '''
        This is run on the source EC2 instance as part of UserData bootstrapping
        1) Look at the peer(s)' VPC CloudFormation Stack's Outputs for a list of subnets, public or private as defined
        in the constructor.
        2) Find instances in those subnets created by this library
        3) Get the Private IP address of target instances and write it to a local configuration file          
        '''

        # Query for peer CloudFormation, get instances

stark525

#!/usr/bin/env python

import boto3
import json
import base64

def headers_to_go_style(headers):
    retval = {}
    for k, v in headers.items():
        retval[k] = [v]

stark525

git clone https://<private-git>/codebattles
git checkout -b dstark

stark525

hiera_config=/some/other/path/hiera.yaml

stark525

eyaml encrypt -s 'secretpassword' -l 'parameter-lookup'

stark525

---
pkcs7_private_key: '/var/lib/puppet/keys/private_key.pkcs7.pem'
pkcs7_public_key: '/var/lib/puppet/keys/public_key.pkcs7.pem'

stark525

ln -s /etc/hiera.yaml /etc/puppet/hiera.yaml

stark525

:backends:
    - eyaml
    - yaml

:yaml:
    :datadir: '/etc/puppet/hieradata'
:eyaml:
    :datadir: '/etc/puppet/hieradata'

    # If using the pkcs7 encryptor (default)

stark525

chown -R puppet:puppet /var/lib/puppet/keys
chmod -R 0500 /var/lib/puppet/keys
chmod 0400 /var/lib/puppet/keys/*.pem