Re: [Puppet Users] Puppet, git & security

2013-05-21 Thread Alex Harvey
On Friday, May 17, 2013 12:35:24 AM UTC+10, Martin Langhoff wrote: > > On Wed, May 15, 2013 at 2:44 AM, Stephen Gran > > wrote: > > Your push server can run git update and then rsync to the masters. > > Why rsync if you have git? > Martin, John, thanks for your feedback - it's very helpful.

Re: [Puppet Users] Puppet, git & security

2013-05-16 Thread Martin Langhoff
On Wed, May 15, 2013 at 2:44 AM, Stephen Gran wrote: > Your push server can run git update and then rsync to the masters. Why rsync if you have git? You have - the machine(s) where you edit and make commits on git, you then _git push_ to what I'll call a "gold" git server - the gold git serv

Re: [Puppet Users] Puppet, git & security

2013-05-16 Thread jcbollinger
On Wednesday, May 15, 2013 9:20:37 PM UTC-5, Alex Harvey wrote: > > > I was actually thinking of doing something similar to what Stephen Gran > suggested above; let rsync can take care of ensuring that all puppet > masters always have the same copy of the same code tree. So in that > situatio

Re: [Puppet Users] Puppet, git & security

2013-05-15 Thread Alex Harvey
On Thursday, May 16, 2013 12:48:22 AM UTC+10, jcbollinger wrote: > > > If you want your masters to rely on a revision control system for > manifests, data, or whatever, then it follows that the masters must be > permitted to access that system. If they may not do so across network > segments,

Re: [Puppet Users] Puppet, git & security

2013-05-15 Thread jcbollinger
On Wednesday, May 15, 2013 1:00:41 AM UTC-5, Alex Harvey wrote: > > > > On Wednesday, May 15, 2013 2:51:14 PM UTC+10, yersinia.spiros wrote: >> >> Sorry for the top posting. >> >> Imho, i think this is a question that could be asked on the git mailing >> list. >> > > Sorry, my question apparen

Re: [Puppet Users] Puppet, git & security

2013-05-14 Thread Stephen Gran
On 15/05/13 07:00, Alex Harvey wrote: On Wednesday, May 15, 2013 2:51:14 PM UTC+10, yersinia.spiros wrote: Sorry for the top posting. Imho, i think this is a question that could be asked on the git mailing list. Sorry, my question apparently isn't clear enough - this definitely

Re: [Puppet Users] Puppet, git & security

2013-05-14 Thread Alex Harvey
On Wednesday, May 15, 2013 2:51:14 PM UTC+10, yersinia.spiros wrote: > > Sorry for the top posting. > > Imho, i think this is a question that could be asked on the git mailing > list. > Sorry, my question apparently isn't clear enough - this definitely isn't a git question that can be answer

Re: [Puppet Users] Puppet, git & security

2013-05-14 Thread Alex Harvey
On Wednesday, May 15, 2013 3:40:28 PM UTC+10, denmat wrote: > > I haven't worked out a pure git way but Jenkins, git export, rsync are a > good solid combo :) > Do you know of any documentation or blog posts from others using a configuration like this? My initial thinking was to use rsync bu

Re: [Puppet Users] Puppet, git & security

2013-05-14 Thread Denmat
I haven't worked out a pure git way but Jenkins, git export, rsync are a good solid combo :) On 15/05/2013, at 14:51, devzero2000 wrote: > Sorry for the top posting. > > Imho, i think this is a question that could be asked on the git mailing list. > > Best > > 2013/5/15, Alex Harvey : >> Hi

Re: [Puppet Users] Puppet, git & security

2013-05-14 Thread devzero2000
Sorry for the top posting. Imho, i think this is a question that could be asked on the git mailing list. Best 2013/5/15, Alex Harvey : > Hi all, > > In my company we have a security policy that frowns upon things like puppet > > masters making git pull requests to other network segments. Allowi

[Puppet Users] Puppet, git & security

2013-05-14 Thread Alex Harvey
Hi all, In my company we have a security policy that frowns upon things like puppet masters making git pull requests to other network segments. Allowing code to be pushed into these segments is less of a problem. This policy makes it difficult to do stuff like, https://puppetlabs.com/blog/git-