State of Puppetless setup and operation

[jpluscplusm]

Hey all 👋

I believe I've seen Puppetless installation and operation of Choria touted as being somewhere on the roadmap. I'm starting without any Puppet infra, and not having used Puppet for over a decade, so I thought I'd ask about running Choria without Puppet present:

1. If I manually (or mechanically, but not with puppet) assemble the right binaries, configs, certs, etc on disk, would a Choria setup start running, or is there something absolutely Puppet-centric baked into the server or client runtime?
2. If it started running successfully, are there operations which I'd be prevented from running because they're absolutely dependent on Puppet? Given choria.io/docs/deployment/first-user I'm wondering about choria enroll - are there other commands that have zero chance of working; and how critical are they?

[ripienaar]

1. Yes, that will work - the main integration point and magic is around the CA. If you replace with your own CA set plugin.security.provider=file and then set plugin.security.file.ca|certificate|key and you should be fine. You will need to create client certs the way puppet would with the user.mcollective format cnames
2. Enroll yes, but also of course any of the package and service behaviors as that uses puppet under the covers - in fact all the agents are distributed with puppet so you'd have to deal with that.

Bigger picture for puppetless though isnt this manual shitshow, its a whole new way of building choria. If you take a glance through https://github.com/ripienaar/choria-compose you'll see there it builds a new non-x509 centric security model around JWTs and ed25519. It has a provisioner component to deliver configuration to the nodes (replacing CM) and there are plugins to deliver agents to the nodes (but not the old mcollective compat agents atm, a new kind)

And once provisioned it provides RPC APIs for managing the fleet - reprovisioning etc and desired state based plugin distribution based on data in KV.

All of the puppetless stuff above works today (see the compose) but I havnt packaged it into a end user friendly distribution of sorts.