Migration from MCollective to Choria

[mhalano]

Today we use MCollective in a quite large computer environment (3 or 4k machines). We use MCollective so we can run commands on machines but without opening a port on the node (like necessary for SSH, for example). The idea is to do the same with Choria. An authorized client post a message on the broker, Choria server listens to queue for the message (no need to open a port in the node, just on the broker which is ok) and execute it.
An important detail is: we don't do the commands manually, we use an automated system. My question is how I can migrate from the MCollective to use Choria with the minimum downtime. In my head, the ideal solution would be the Choria server could be able to use the Mcollective broker (it's an ActiveMQ instance). So I would replace the mcollectived server for the choria server listening in the ActiveMQ for a while until I turn the key and use the NATS broker. My worry is if I keep both server installed and my automated system send messages to both brokers to execute commands, the commands would be received by both server (mcollectived and choria) and executed twice, which could be a big problem. Any thoughts?

[ripienaar]

hey.

Unfortunately Choria cannot talk to ActiveMQ, they use different ports (though configurable) so you could in theory run both on the same machine as your ActiveMQ.

Other than that whatever you have today should keep working, though:

1. The security model has changed, you don't mention what you use today for security plugin but undoubtably it will change
2. There are a few incompatibilities to be aware of. -S has changed, data plugins are not supported, custom validators are not supported

So given this, you really need a lab setup and test a migration, when you're ready its been known to be a easy migrate but you do need to do a bunch of testing and understand the new security model.

Happy to provide links etc if you have questions following from this.

[mhalano]

To clients and servers authenticate and send/get messages, we use user and password. The nodes already have valid certificates emitted by the Puppet CA. I thought about a plugin or something to use AMQP instead of NATS. I can run the same brokers (ActiveMQ por MCollective and NATS for Choria) in the same machine, but this isn't a pain point. The pain point is how can I guarantee the message will be just processed by one server, MCollective or Choria, not both.

[ripienaar]

There is no possibility of using antyhihng but NATS for the transport with Choria.

You either have to arrange it so the thing that makes the requests does it twice - once on old mco and once on choria - or face downtime. Running both choria and mco on the same machine would not be something I could support.

You should also be aware of the Puppet versions we require - > 6.0