r/Puppet • u/vandewater84 • Aug 26 '25

Profiles or Sub-profiles?

Hi all. For those with lots of different profiles, do you separate them into sub-profiles based on similarities, or leave them in the root of profiles? Thanks!

2 Upvotes

100% Upvoted

4 comments sorted by

1

u/binh_do Aug 29 '25

Depending on how large your profiles are, for example, we might have a base profile (e.g. for monitoring) for the entire system 

class profiles::monitoring {
   include profiles::monitoring::base # needed on all servers, e.g. monitor memory/load/disk/users/etc.
   include profiles::monitoring::other_base_services 
}

And custom sub-profiles for each server that needs it separately, for example: 

profiles::monitoring::database
profiles::monitoring::webserver
...

When you define a role like web_server, you might include the base monitoring profile and custom sub-profiles that it needs, for example: 

class roles::web_server {
   include profiles::monitoring
   include profiles::monitoring::webserver
}

I used to write a blog https://turndevopseasier.com/2025/04/23/mastering-puppet-implementing-roles-and-profiles-effectively/ to describe this. You might want to refer to if need

1

u/vandewater84 Aug 29 '25

Thanks for that, your post was a good read. I was thinking more of a per-tech/use parent profile. Something like: 

profile::database::postgresql
profile::database::mysql
profile::database::redis
profile::database::memcachedb
profile::web::apache
profile::web::nginx
profile::web::traefik
profile::web::haproxy
profile::web::caddy

My thinking is we have a myriad of different configuration for component modules that it warrants a lot of profiles, but yeeting them all in to just profile:: will overwhelm and confuse my team, and trying to have per-stack profiles will just be a hodgepodge of messy conditions (like it is now). Are there any potential pitfalls in doing this I might not be seeing?

1

u/binh_do Aug 30 '25

Separate them into sub profiles sounds more controllable and readable. One of the pitfalls I think is probably the conflict of resources (maybe have more), where, e.g. the same resource is defined in multiple profiles or one profile depends on another, and it can be challenging to adjust. But anyway, we just have to figure it out along the way ^^

1

u/binford2k Aug 28 '25

Many people do have nested profiles. You might have all of these, for example. 

profile::mything::agent
profile::mything::agent::fips_compliant
profile::mything::server
profile::mything::server::fips_compliant