Controls-docs/rhel8/design_guiding_principles.md

Design Guiding Principles

This page describes the design decisions made for RHEL-8 and the reasoning.

General

• To prefer software and solutions with support available externally
  This is to reduce the risk of isolated knowledge leaving PSI as well as to reduce the support load of present PSI Linux Engineers.
• To prefer to enable self-service for Linux as wide as possible at PSI
  This is to enable users and to give space for Proof of Concepts and trial and error.

Red Hat Satellite

to supersede bob/sysdb

Red Hat Satellite is an all-in-one product to

• Deploy and install Linux systems
• Manage Linux software repositories centrally
• Visualization of software status on hosts
• Can install machines in DMZ environments via Capsules
• Has role based access control (RBAC) to support PSI division segregation

Ansible Configuration Management

to supersede Puppet

Ansible

• Has a lower learning curve than Puppet
• Results can be achieved faster than in Puppet
• Ansible is in strategic focus of Red Hat
• Puppet is/will go out-of-support from Red Hat
• Ansible Galaxy provides many externally maintained collections and roles

Ansible Tower

to supersede Puppet

Ansible Tower / AWX

• Is a central automation solution and can run Ansible playbooks centrally
• Be used as Ansible Configuration Management for RHEL-8+ systems
• Allows flexible control
• Can be used as general purpose automation platform
• Has role based access control (RBAC) to support PSI division and network segregation

User Management

SSSD and Microsoft Active Directory to supersede legacy pam customizations

• To prefer to attach all RHEL-8+ systems to the central PSI Microsoft Active Directory (AD) via SSSD
• To prefer centrally managing users and groups for Linux in AD
• To prefer to manage system access for Linux in AD
• To prefer to integrate Linux user, group and access management into ServiceNow as a self-service

Network Filesystems

to focus on local disks and optionally provide Network Fileystem support

• By default to place home directories on local disks
  This is to avoid users being affected to network issues on logins. Such as missing authentication tokens or shared and locked files in firefox profiles.
  The homes on network shares still being accessable if requested.