Chef/Puppet with multiple configuration servers

chefconfiguration-managementpuppet

Does either Puppet or Chef support replicated puppetmasterd/Chef servers? It seems very surprising to me that these tools would force a single point of failure, but I haven't been able to find any mention of this in their docs or Google.

I know Puppet and Chef can be run without a server (possibly updated with, e.g., git as described in http://bitfieldconsulting.com/scaling-puppet-with-distributed-version-control), but this seems like a second-class citizen, and presumably loses some monitoring ability.

Best Answer

For puppet you would need

  1. Identical manifests. This can be accomplished by keeping your manifests in version control and checking them out on each server, which you should be doing anyway.
  2. A single database for stored configuration, if you using it. This is as simple as switching from the default of sqlite to MySQL or PostgreSQL. You could then use those database's tools to replicate the database if desired.
  3. Certificates from the same certificate authority on all puppetmasters. Dan Bode has the best explanation I've seen. However, it may not work the way you expect. Also, I'm not sure how this works with client certificates (i.e. /var/lib/puppet/ssl/ca/signed/*). Maybe their verification is always handled by the single CA (introducing a single point of failure), or maybe the the pem files be distributed to each puppetmaster after they're signed by the CA.
Related Topic