Fleet management plane - how a Linux fleet is operated

A Linux fleet is 10+ hosts operated as one. The management plane is the set of services that keep the fleet configured, secure, and observable. This lesson covers the architecture.

The management plane

Management plane
├── Identity (LDAP, AD, FreeIPA)
├── Configuration (Ansible, Puppet, Salt)
├── Secrets (Vault, KMS)
├── Monitoring (Prometheus, Grafana, Loki)
├── Logging (centralised)
├── Patching (apt, dnf, automation)
├── Backup (offsite, immutable)
└── Communication (chat, paging)

Each component is a service the fleet depends on. They themselves are Linux services that need to be reliable.

Design principles

• Centralised: one source of truth for configuration, identity, secrets.
• Version controlled: every change is in git.
• Idempotent: applying the same configuration twice has the same effect.
• Audited: who did what, when.
• Reversible: rollback is a feature, not an afterthought.
• Self-hosted or managed: choose based on operational capacity.

The components

Identity

• FreeIPA: open-source identity with LDAP, Kerberos, DNS, certificate authority.
• Active Directory: Microsoft; common in enterprises.
• 389 Directory Server: open-source LDAP.
• OpenLDAP: classic LDAP.
• Keycloak: identity and access management with SSO.

For a Linux fleet, FreeIPA is the natural choice. AD works if the fleet is mixed with Windows.

Configuration

• Ansible: agentless, YAML, large ecosystem. Best default.
• Puppet: pull, agent, declarative.
• Salt: pull or push, fast, complex.
• Chef: pull, agent, Ruby.

For new designs, Ansible. For existing, stay with what works.

Secrets

• HashiCorp Vault: open-source, dynamic secrets, policies.
• AWS Secrets Manager: managed, KMS-integrated.
• Azure Key Vault: managed, Azure-integrated.
• GCP Secret Manager: managed, GCP-integrated.
• sops + git: encrypted files in git.

For self-hosted, Vault. For cloud, the cloud provider’s secret manager.

Monitoring

• Prometheus + Grafana: metrics + dashboards.
• Loki: logs.
• Tempo: traces.
• OTel: unified pipeline.

See Part XLIV for details.

Self-hosted vs managed

For most production, the management plane is self-hosted (Ansible, FreeIPA, Vault) on dedicated infrastructure. The data plane (workloads) is often cloud.

Knowledge check