<div dir="ltr"><br><div>We manage configurations with a Salt state, and the application we integrated with Kea that we built in-house generates the scope definitions as YAML, so it's easy to push changes into the Salt state file.</div><div><br></div><div>It's not fully automated yet as the Kea version we're using doesn't support a configuration syntax test option, but that's on our internal roadmap so that a merge to the master branch will trigger a Jenkins job to incorporate updates automatically, test, and deploy.<br><br>The benefit for us of using Salt is that scope changes go through code review like everything else, so that lowers the risk of bad changes and builds an audit trail if they get introduced.</div><div><br></div><div>cheers,</div><div>Klaus</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Nov 27, 2017 at 7:49 AM, Hugh Connolly <span dir="ltr"><<a href="mailto:hconnolly@gcet.net" target="_blank">hconnolly@gcet.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div id="m_4702437327697232652divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Check out Rudder</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">If very happy with it.</p>
<p style="margin-top:0;margin-bottom:0"><a href="https://www.rudder-project.org/site/" class="m_4702437327697232652OWAAutoLink" id="m_4702437327697232652LPlnk563854" target="_blank">https://www.rudder-project.<wbr>org/site/</a></p>
<div id="m_4702437327697232652LPBorder_GT_15117976923010.19703351089356902" style="margin-bottom:20px;overflow:auto;width:100%;text-indent:0px">
<table id="m_4702437327697232652LPContainer_15117976922840.5718481374260787" cellspacing="0" style="width:90%;background-color:rgb(255,255,255);overflow:auto;padding-top:20px;padding-bottom:20px;margin-top:20px;border-top:1px dotted rgb(200,200,200);border-bottom:1px dotted rgb(200,200,200)">
<tbody>
<tr valign="top" style="border-spacing:0px">
<td id="m_4702437327697232652TextCell_15117976922860.10581602484974195" colspan="2" style="vertical-align:top;padding:0px;display:table-cell">
<div id="m_4702437327697232652LPRemovePreviewContainer_15117976922860.3740081731106122"></div>
<div id="m_4702437327697232652LPExpandDescriptionContainer_15117976922860.3316198224461546"></div>
<div id="m_4702437327697232652LPTitle_15117976922860.3834089566209684" style="color:rgb(0,120,215);font-weight:400;font-size:21px;font-family:wf_segoe-ui_light,"Segoe UI Light","Segoe WP Light","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif;line-height:21px">
<a id="m_4702437327697232652LPUrlAnchor_15117976922880.47392589952701925" href="https://www.rudder-project.org/site/" style="text-decoration:none" target="_blank">Rudder</a></div>
<div id="m_4702437327697232652LPMetadata_15117976922880.5968937280612099" style="margin:10px 0px 16px;color:rgb(102,102,102);font-weight:400;font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif;font-size:14px;line-height:14px">
<a href="http://www.rudder-project.org" target="_blank">www.rudder-project.org</a></div>
<div id="m_4702437327697232652LPDescription_15117976922900.9418330402944617" style="display:block;color:rgb(102,102,102);font-weight:400;font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif;font-size:14px;line-height:20px;max-height:100px;overflow:hidden">
Rudder is an easy to use, web-driven, role-based solution for IT Infrastructure Automation and Compliance.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
That or Chef, Puppet etc.
<p></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Or just rsync and cron.</p>
</div>
<hr style="display:inline-block;width:98%">
<div id="m_4702437327697232652divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Sutherland, Rob <<a href="mailto:Robert.B.Sutherland@windstream.com" target="_blank">Robert.B.Sutherland@<wbr>windstream.com</a>><br>
<b>Sent:</b> Thursday, November 23, 2017 10:10:16 AM<br>
<b>To:</b> Hugh Connolly; Klaus Steden; SoupNazi izaNpuoS<br>
<b>Cc:</b> KEA-Users (<a href="mailto:kea-users@lists.isc.org" target="_blank">kea-users@lists.isc.org</a>)<br>
<b>Subject:</b> RE: [Kea-users] DHCP redundancy [faked-from]</font>
<div> </div>
</div><div><div class="h5">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_4702437327697232652x_WordSection1">
<p class="m_4702437327697232652x_MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">I’m using that setup as well: Pacemaker with a replicated postgres lease database. It works quite well. There’s only one missing piece: a way to keep the configuration
in sync across nodes. In the database, perhaps? (aside: the configuration is quite fluid in our production environment, changing multiple times per day).</span></p>
<p class="m_4702437327697232652x_MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="m_4702437327697232652x_MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Kea-users [mailto:<a href="mailto:kea-users-bounces@lists.isc.org" target="_blank">kea-users-bounces@<wbr>lists.isc.org</a>]
<b>On Behalf Of </b>Hugh Connolly<br>
<b>Sent:</b> Wednesday, November 22, 2017 8:34 AM<br>
<b>To:</b> Klaus Steden; SoupNazi izaNpuoS<br>
<b>Cc:</b> KEA-Users (<a href="mailto:kea-users@lists.isc.org" target="_blank">kea-users@lists.isc.org</a>)<br>
<b>Subject:</b> Re: [Kea-users] DHCP redundancy [faked-from]</span></p>
</div>
</div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
<div id="m_4702437327697232652x_divtagdefaultwrapper">
<p><span style="font-family:"Calibri","sans-serif";color:black">I'm working on something similar.</span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"> </span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">It uses 2+ Kea instances with the postgresql lease db in Amazons RDS. </span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">To manage the VIP the cluster uses ocf_heartbeat_IPaddr2 (pacemaker)</span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"> </span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Works quite well thus far. </span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"> </span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">What do you think?</span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"> </span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">One improvement (beyond in-housing the Postgresql cluster) that comes to mind is better fencing in PCS to restart the service or shutdown the node if there is a problem. Something beyond just
checking that the service is running, maybe checking the ports?</span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"> </span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Was fairly straight forward to setup</span></p>
</div>
<div class="m_4702437327697232652x_MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="m_4702437327697232652x_divRplyFwdMsg">
<p class="m_4702437327697232652x_MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> Kea-users <<a href="mailto:kea-users-bounces@lists.isc.org" target="_blank">kea-users-bounces@lists.isc.<wbr>org</a>>
on behalf of Klaus Steden <<a href="mailto:klausfiend@gmail.com" target="_blank">klausfiend@gmail.com</a>><br>
<b>Sent:</b> Friday, November 17, 2017 4:14:00 PM<br>
<b>To:</b> SoupNazi izaNpuoS<br>
<b>Cc:</b> KEA-Users (<a href="mailto:kea-users@lists.isc.org" target="_blank">kea-users@lists.isc.org</a>)<br>
<b>Subject:</b> Re: [Kea-users] DHCP redundancy</span> </p>
<div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
</div>
</div>
<div>
<div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
<div>
<p class="m_4702437327697232652x_MsoNormal">Our implementation uses a single database backend (which is itself HA, but the endpoint is a VIP, so it appears to be just a single host) with a different server per environment running a Kea server. It seems they coexist quite happily
as long as they're not trying to both handle the same row/table, which means each environment only uses a single IP helper.</p>
</div>
<div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
</div>
<div>
<p class="m_4702437327697232652x_MsoNormal">We use Monit on the servers themselves to keep the Kea daemon running, since as noted it doesn't retry when it encounters an error talking to the database; the whole system is generally fairly resilient, FWIW, even if it's less than industrial
strength.</p>
</div>
<div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
</div>
<div>
<p class="m_4702437327697232652x_MsoNormal">cheers,</p>
</div>
<div>
<p class="m_4702437327697232652x_MsoNormal">Klaus</p>
</div>
</div>
<div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
<div>
<p class="m_4702437327697232652x_MsoNormal">On Fri, Nov 17, 2017 at 6:48 AM, SoupNazi izaNpuoS <<a href="mailto:soupnazi34@gmail.com" target="_blank">soupnazi34@gmail.com</a>> wrote:</p>
<div>
<p class="m_4702437327697232652x_MsoNormal">Not at all. It does split the pools, automatically. You just need to make sure you don't use more than 90% of your addresses as it may have difficulty transferring IPs amongst the devices if you do (say if the secondary runs out, the
primary may not be able to send IPs to it).</p>
</div>
<div>
<div>
<div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
<div>
<p class="m_4702437327697232652x_MsoNormal">On Fri, Nov 17, 2017 at 9:44 AM, John Ratliff <<a href="mailto:john@bluemarble.net" target="_blank">john@bluemarble.net</a>> wrote:</p>
<p class="m_4702437327697232652x_MsoNormal">On 11/17/2017 9:37 AM, SoupNazi izaNpuoS wrote:</p>
<p class="m_4702437327697232652x_MsoNormal">Out of curiosity, was there a reason you didn't use the built in failover configuration in ISC DHCP?</p>
<p class="m_4702437327697232652x_MsoNormal" style="margin-bottom:12.0pt"><br>
It's extremely confusing to me. Perhaps my understanding is flawed, but as I understand it, you need to split your pool and have one side responsible for their individual split. Our pools do not have enough spare IPs to allow that. It just never seemed work
the effort.<br>
<br>
--John</p>
<div>
<div>
<p class="m_4702437327697232652x_MsoNormal"><br>
On Fri, Nov 17, 2017 at 9:25 AM, John Ratliff <<a href="mailto:john@bluemarble.net" target="_blank">john@bluemarble.net</a> <mailto:<a href="mailto:john@bluemarble.net" target="_blank">john@bluemarble.net</a>>> wrote:<br>
<br>
I'm seeking best practice advice on how to setup DHCP server<br>
redundancy with kea.<br>
<br>
With ISC DHCP, I used VRRP with two servers and configured it to<br>
send the dhcp-server-identifier option as the VRRP IP. Then I would<br>
run a script that sync'd the lease database automatically via cron.<br>
<br>
This process is messy and error prone, so I would like to use kea<br>
instead.<br>
<br>
The subnets I am allocating via DHCP is not the same subnet that the<br>
server is in, so we use ip-helper statements to forward DHCP<br>
requests to the server.<br>
<br>
I have kea using mySQL as a lease backend. The mySQL server is not<br>
on the same machine as kea.<br>
<br>
My first thought was to use VRRP and supply the<br>
dhcp-server-identifier option again. I ran into a problem though<br>
that if kea started before VRRP, it wouldn't listen on the VRRP IP.<br>
There is probably a solution to that, but I don't have one yet.<br>
<br>
So then I changed the router configuration to use two ip-helper<br>
statements, sending the request to both primary and secondary kea<br>
servers; I also removed the dhcp-server-identifier option. This<br>
seems to work.<br>
<br>
Is this a reasonable setup for DHCP redundancy with kea? Is there a<br>
better option I might want to consider? Are there any concerns I<br>
should be aware of with both servers being active?<br>
<br>
Thanks.<br>
______________________________<wbr>_________________<br>
Kea-users mailing list</p>
</div>
</div>
<p class="m_4702437327697232652x_MsoNormal" style="margin-bottom:12.0pt"> <a href="mailto:Kea-users@lists.isc.org" target="_blank">
Kea-users@lists.isc.org</a> <mailto:<a href="mailto:Kea-users@lists.isc.org" target="_blank">Kea-users@lists.isc.<wbr>org</a>><br>
<a href="https://lists.isc.org/mailman/listinfo/kea-users" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/kea-users</a><br>
<<a href="https://lists.isc.org/mailman/listinfo/kea-users" target="_blank">https://lists.isc.org/<wbr>mailman/listinfo/kea-users</a>><br>
<br>
</p>
<p class="m_4702437327697232652x_MsoNormal"> </p>
</div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
</div>
</div>
</div>
<p class="m_4702437327697232652x_MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>_________________<br>
Kea-users mailing list<br>
<a href="mailto:Kea-users@lists.isc.org" target="_blank">Kea-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/kea-users" target="_blank">https://lists.isc.org/mailman/<wbr>listinfo/kea-users</a></p>
</div>
<p class="m_4702437327697232652x_MsoNormal"> </p>
</div>
</div>
</div>
</div>
</div></div></div>
</blockquote></div><br></div>