Dynamic CFEngine3

Although this website is predominatly written in Dutch, because it is aimed at Dutch people using Debian, this set of pages is in English. The reason behind this is Webhuis' desire to support the international CFEngine community.

The dynamics is in the data

A best practice in CFEgine is to make promises or bundles as generic as possible, so that they suite the needs of as many situations as possible. Hosts and Domains contain specific information or data that is applicable to the Host only and that to be used in the configuration of the Host.

Host taylor made provisioning of promises

Dynamic CFEngine is the Webhuis way of providing a taylor made set of promises to each and every node. Webhuis believe this is a security feature, because the host only has the bundles and the data it needs.
Webhuis offers Dynamic CFEngine under GPL-2 as its contribution to the community.

How does it work?

Dynamic CFEngine extends on convergence because it provides the promises to the system in a convergent way, not all the promises are available as of the bootstrap of the host. The Webhuis example setup is structured:

• A host belongs to a domain
• A host has a role

In the example the host, domain and role bundles contain data that drive the common logic in the common bundles. When the host is bootstrapped to the CFEngine Master Hub it starts configuring itself by pulling the host and domain bundles from the hub. The host bundles file contains the role information, which convergently is being pulled from the hub in a subsequent iteration.

Data driven approach

Because the data in the host, domain and role bundles drive the common logic in the common bundles Dynamic CFEngine makes little use of classes or contexts. The context is defined beforehand and no decisions have to be made, thus leading to a reduction of complexity in the logic in the common bundles.

The structure

The bundlesequence in promises.cf is as follows:

• "role"
• "g"
• "update"
• "@(webhuis_common)"
• "${g.class_domain}"
• "${g.class_host}"
• "${role.role}"

Step by step

In the first iteration almost everything fails, the bundles g, update and the bundlesequence in @(webhuis_common) will execute but will not fulfill all the promises. In the example "${g.class_domain}" is replaced by webhuis_nl, "${g.class_host}" is replaced by bur and "${role.role}" is replaced by backup_recovery. @(webhuis_common) is an slist that contains the bundle names "common_bundles", "os_layer", "hardening".

bundle common role

The bundle common role is the first bundle to be executed when available to the host. It defines the common variable role that has the name of the role to the system and it sets a class with the name of the role. Here you find the bundle common role details.

bundle common g

The bundle common g is contained in promises.cf and it defines common variables to the system. In the Webhuis Dynamic CFEngine3 solution two special slist variables are generated, in order to have dynamic inputs. The dynamic inputs consists of two branches

• A standard inputs branch in /var/cfengine/inputs
• A dynamic inputs specific branch /var/cfengine/inputs-webhuis

Here you find the bundle common g details.

bundle agent webhuis common

The bundle webhuis_common carries out common tasks like installing base packages and housekeeeping. Still it uses the variables of the dynamic bundles.
Here you find the bundle agent webhuis common details.

bundle agent webhuis_nl

The bundle common role is the first bundle to be executed when available to the host. It defines the common variable role that has the name of the role to the system and it sets a class with the name of the role. Here you find the bundle agent webhuis_nl details.

bundle agent bur

The bundle common role is the first bundle to be executed when available to the host. It defines the common variable role that has the name of the role to the system and it sets a class with the name of the role. Here you find the agent bur details.

bundle agent backup_recovery

The bundle common role is the first bundle to be executed when available to the host. It defines the common variable role that has the name of the role to the system and it sets a class with the name of the role. Here you find the bundle agent backup_recovery details.

---

Return to: Cfengine