Policy setup and structure
The current version of the Webhuis CFEngine policies are an evolution of Dynamic CFEngine.
Disadvantages of Dynamic CFEngine
Convergence is one of the fundamental principles of CFEngine the dynamic setup relies on too heavily, because policies are being used to identify dependent and subsequent policies. Policies are being derived from the concept of the 'role' a system has, components are defined in the role and convergently become available to the system. A role has one or more components that may depend on the platform or the flavor of the system. Convergence towards the Desired State is meant for configuring a system, not for the composition of the policy set.
- This may lead to a temporarily inconsistent policy set
- Developers tend to reject this setup, they want to have the policy set available right from the beginning
- The role concept as it was, was far from perfect, because of the redundancy in the different roles.
More on Roles
The role defines the system in every aspect.
- The hardware it has available
- The software it autonomously installs, configures and runs
Many roles look similar when it comes to many configuration aspects, but there always are those little differences. Those differences prevent the definition of a generic policy and provide redundancy in policies at best. Large parts of the role redundantly define the promises.
Enter the Role Profile concept.
Role Profile
The concept of 'role' and components had to be refined in order to meet the requirement of generic policies, while avoiding redundancy. Many roles look very similar when it comes to the definition of:
- Interfaces, usually a common interface and an admin interface
- Infrastructural components, like host name resolution and time configuration
- Platform components, the most commonly used standard software
Many roles share very basic profile following the description above, the standard support profile, the profile consists of a set of policies and templates. The CFEngine policy hub has the most basic role imaginable and configures itself with policies and templates available in the standard support profile.
Implementation
The identified elements of the standard support reside in the policies tree in the subdirectory 'pool', the policies in bundles and templates in templates,
└── roadshow_policies
├── pool
│ ├── bundles
│ ├── templates
Return to: CFEngine
