diff --git a/slide-deck.html b/slide-deck.html index 8eb669e..0329b50 100644 --- a/slide-deck.html +++ b/slide-deck.html @@ -7,9 +7,380 @@ - + + + @@ -19,11 +390,11 @@

CFEngine in a day

-
-

Before we start

+
+

Before we start

-
-

Schedule

+
+

Schedule

@@ -85,8 +456,8 @@

Schedule

-
-

Use the source

+
+

Use the source

github.com/nickanderson/cfengine-training

@@ -99,8 +470,8 @@

Use the source

-
-

Hi, I'm Nick

+
+

Hi, I'm Nick

  • Wife, 2 kids and a dog
  • Sysadmin/Infrastructure Engineer/Doer of things
  • @@ -133,8 +504,8 @@

    Hi, I'm Nick

-
-

Who are you?

+
+

Who are you?

  • Name
  • Role
  • @@ -145,8 +516,8 @@

    Who are you?

-
-

What this training covers

+
+

What this training covers

  • What is CFEngine
  • High level architecture overview
  • @@ -158,8 +529,8 @@

    What this training covers

-
-

Why Automation?

+
+

Why Automation?

Every time someone logs onto a system by hand, they jeopardize everyone's @@ -170,8 +541,8 @@

Why Automation?

-
-

What is CFEngine?

+
+

What is CFEngine?

  • Modern
  • Secure
  • @@ -193,8 +564,8 @@

    What is CFEngine?

-
-

History

+
+

History

  • Written by Mark Burgess
  • Originally released in 1993.
  • @@ -215,8 +586,8 @@

    History

-
-

Small

+
+

Small

As of Feb 2020:

@@ -236,8 +607,8 @@

Small

-
-

Secure

+
+

Secure

A good track record.

@@ -248,15 +619,15 @@

Secure

-
-

Portable

+
+

Portable

Known to run on many platforms, and interesting places.

-
-

Where_CFEngine_Runs_2016-10-15_15-20-42.png +

+

@@ -299,12 +670,12 @@

Portable

-
-

Resilient & Autonomous

+
+

Resilient & Autonomous

-
-

2020-02-18_11-16-51_JAN15_05_179787493.jpg +

+

@@ -334,8 +705,8 @@

Resilient & Autonomous

-
-

Declarative

+
+

Declarative

Focus on the desired end state.

@@ -360,15 +731,15 @@

Declarative

-
-

declarative_vs_imperative_crop_2016-10-15_15-28-37.png +

+

-
-

Declarative vs Imperative

-
+
+

Declarative vs Imperative

+
 bundle agent main             | #!/bin/env/bash
 {                             | PKG="openssh-server"
   packages:                   | rpm -q ${PKG} || yum install ${PKG}
@@ -398,8 +769,8 @@ 

Declarative vs Imperative

-
-

Typical use cases

+
+

Typical use cases

  • Any local resource/state
      @@ -444,11 +815,11 @@

      Typical use cases

-
-

Editions

+
+

Editions

-
-

Community (core)

+
+

Community (core)

-
-

Enterprise Features

+
+

Enterprise Features

  • Mission Portal (Web UI)
  • @@ -483,8 +854,8 @@

    Enterprise Features

-
-

Enterprise

+
+

Enterprise

-
-

Release schedule

+
+

Release schedule

  • Every 6 months
  • New LTS series every 1.5 years
  • @@ -501,8 +872,8 @@

    Release schedule

-
-

Current Releases

+
+

Current Releases

  • 3.15 ( December 2019 - December 2022 )
      @@ -527,18 +898,18 @@

      Current Releases

-
-

Tools

-
+
+

Tools

+
-
-

cf-remote

+
+

cf-remote

Tooling to facilitate the deployment of CFEngine.

-
+
 Commands (use cf-remote COMMAND --help to get more info):
   {info,install,uninstall,packages,list,download,run,save,sudo,scp,spawn,show,destroy,deploy}
     info                Get info about the given hosts
@@ -561,8 +932,8 @@ 

cf-remote

-
-

Install cf-remote

+
+

Install cf-remote

exec 2>&1
@@ -572,8 +943,8 @@ 

Install cf-remote

-
-

Install and bootstrap with cf-remote

+
+

Install and bootstrap with cf-remote

cf-remote install --hub 34.252.28.73 --bootstrap 172.31.30.237
@@ -581,8 +952,8 @@ 

Install and bootstrap with cf-remote

-
-

Learn more about cf-remote

+
+

Learn more about cf-remote

-
-

cfbs

+
+

cfbs

Manage CFEngine Build projects (adding modules, policy files, updating etc.)

-
+
 usage: cfbs [-h] [--loglevel LOGLEVEL] [--version] [--force]
             [--non-interactive] [--index INDEX] [--check]
             [--checksum CHECKSUM] [--keep-order] [--git {yes,no}]
@@ -615,8 +986,8 @@ 

cfbs

-
-

Install cfbs

+
+

Install cfbs

exec 2>&1
@@ -626,8 +997,8 @@ 

Install cfbs

-
-

Initialize a project

+
+

Initialize a project

exec 2>&1
@@ -637,8 +1008,8 @@ 

Initialize a project

-
-

Build a project

+
+

Build a project

exec 2>&1
@@ -647,8 +1018,8 @@ 

Build a project

-
-

cf-locate

+
+

cf-locate

cf-locate
Command line tool to help locate and optionally display a body or bundle within a policy
@@ -667,8 +1038,8 @@

cf-locate

-
-

Installing cf-locate

+
+

Installing cf-locate

It's a perl script and you will need File::HomeDir.

@@ -684,8 +1055,8 @@

Installing cf-locate

-
-

Using cf-locate

+
+

Using cf-locate

exec 2>&1
@@ -704,8 +1075,8 @@ 

Using cf-locate

-
-

masterfiles-stage

+
+

masterfiles-stage

  • Maintain multiple checkouts of policy sets.
  • @@ -723,17 +1094,17 @@

    masterfiles-stage

-
-

Client/Server Architecture

+
+

Client/Server Architecture

-
-

2020-02-18_11-34-56_ClientServerArchitecture.png +

+

-
-

Client Server Communications

+
+

Client Server Communications

  • Utilizes port 5308 (grep 5308 /etc/services)
  • Encrypted (TLS)
  • @@ -756,24 +1127,24 @@

    Client Server Communications

-
-

Agent Components

+
+

Agent Components

-
-

Agent Components

+
+

Agent Components

-
-

cfengine_agent_components_diagram_2016-10-15_16-01-34.png +

+

-
-

cf-hub

+
+

cf-hub

-
-

cfengine_agent_components_diagram_cf-hub_2016-10-15_16-03-31.png +

+

@@ -796,11 +1167,11 @@

cf-hub

-
-

cf-runagent

+
+

cf-runagent

-
-

cfengine_agent_components_diagram_cf-runagent_2016-10-15_21-11-14.png +

+

@@ -833,11 +1204,11 @@

cf-runagent

-
-

cf-serverd

+
+

cf-serverd

-
-

cfengine_agent_components_diagram_cf-serverd_2016-10-15_21-16-21.png +

+

@@ -872,11 +1243,11 @@

cf-serverd

-
-

cf-key

+
+

cf-key

-
-

cfengine_agent_components_diagram_cf-key_2016-10-15_21-18-51.png +

+

@@ -903,11 +1274,11 @@

cf-key

-
-

cf-promises

+
+

cf-promises

-
-

cfengine_agent_components_diagram_cf-promises_2016-10-15_21-21-02.png +

+

@@ -934,11 +1305,11 @@

cf-promises

-
-

cf-monitord

+
+

cf-monitord

-
-

cfengine_agent_components_diagram_cf-monitord_2016-10-15_21-22-23.png +

+

@@ -965,11 +1336,11 @@

cf-monitord

-
-

cf-execd

+
+

cf-execd

-
-

cfengine_agent_components_diagram_cf-execd_2016-10-15_21-24-05.png +

+

@@ -996,11 +1367,11 @@

cf-execd

-
-

cf-agent

+
+

cf-agent

-
-

cfengine_agent_components_diagram_cf-agent_2016-10-15_21-25-11.png +

+

@@ -1034,8 +1405,8 @@

cf-agent

-
-

cf-secret

+
+

cf-secret

  • Encrypts and decrypts files using CFEngine keys
  • @@ -1050,14 +1421,14 @@

    cf-secret

-
-

cf-check

+
+

cf-check

  • Inspect, validate, and repair embedded databases
-
+
 
 cf-check:
 	Utility for diagnosis and repair of local CFEngine databases.
@@ -1083,14 +1454,14 @@ 

cf-check

-
-

cf-net

+
+

cf-net

  • Command line utility for interacting with cf-serverd as a client
-
+
 Usage: cf-net [OPTIONS] COMMAND
 
 Options:
@@ -1122,8 +1493,8 @@ 

cf-net

-
-

cf-reactor

+
+

cf-reactor

  • CFEngine event reaction daemon
  • Enterprise Hub Specific
  • @@ -1132,8 +1503,8 @@

    cf-reactor

-
-

Pop Quiz

+
+

Pop Quiz

  • What needs to happen before remote agents can get policy from the hub?
  • @@ -1155,7 +1526,7 @@

    Pop Quiz

    -
  • What is the meaning of life, the universe and everything?
  • +
  • What is the answer to the ultimate question of life, the universe and everything?
@@ -1165,7 +1536,7 @@

Pop Quiz

Where is the policy that the agent runs by default?
$(sys.default_policy_path) , /var/cfengine/inputs/promises.cf, /var/cfengine/inputs, or $(sys.inputdir)
What port needs to be open bidirectionally?
5308
How does information from client hosts get into the Enterprise Hub Database?
They are collected by cf-hub. Hub initiated collection, Client initiated advertisement of availability.
-
What is the meaning of life, the universe and everything?
42. In The Hitchhiker's Guide to the Galaxy by Douglas Adams, is the "Answer to the Ultimate Question of Life, the Universe, and Everything", calculated by a supercomputer named Deep Thought over a period of 7.5M years.
+
What is the answer to the ultimate question of life, the universe and everything?
42. In The Hitchhiker's Guide to the Galaxy by Douglas Adams, is the "Answer to the Ultimate Question of Life, the Universe, and Everything", calculated by a supercomputer named Deep Thought over a period of 7.5M years.
@@ -1174,8 +1545,8 @@

Pop Quiz

-
-

MPF & stdlib

+
+

MPF & stdlib

The default "Masterfiles"

@@ -1192,8 +1563,8 @@

MPF & stdlib

-
-

Overview

+
+

Overview

  • promises.cf
  • update.cf
  • @@ -1226,8 +1597,8 @@

    Overview

-
-

User Entries

+
+

User Entries

  • $(sys.workdir)/data/host_specific.json (Augments)
  • def.json (Augments)
  • @@ -1256,17 +1627,17 @@

    User Entries

-
-

Unattended Policy Execution Overview

+
+

Unattended Policy Execution Overview

-
-

MPF-policy-execution-high-level.png +

+

-
-

Pop Quiz

+
+

Pop Quiz

  • What is the MPF?
  • @@ -1278,7 +1649,7 @@

    Pop Quiz

    -
  • When is the MPF typically upgraded?
  • +
  • At what point in the Upgrade Process should the MPF be upgraded?
@@ -1286,7 +1657,7 @@

Pop Quiz

What is the MPF?
The Masterfiles Policy Framework. The default policy set.
Where do you configure most MPF tunables?
Augments
-
When is the MPF typically upgraded?
First
+
At what point in the Upgrade Process should the MPF be upgraded?
First
@@ -1295,12 +1666,12 @@

Pop Quiz

-
-

Promise Theory

+
+

Promise Theory

-
-

Promise Theory Principles and Appications +

+

Promise Theory Principles and Appications

@@ -1319,12 +1690,12 @@

Promise Theory

-
-

Promises

+
+

Promises

-
-

Thinking in Promises +

+

Thinking in Promises

@@ -1347,19 +1718,19 @@

Promises

-
-

Basic Concepts

+
+

Basic Concepts

-
-

Language

+
+

Language

-
-

Promise outcomes/results

+
+

Promise outcomes/results

  • kept
  • repaired
  • @@ -1405,8 +1776,8 @@

    Promise outcomes/results

-
-

Promise types

+
+

Promise types

access, build_xpath, classes, commands, databases, defaults, delete_attribute, delete_lines, delete_text, delete_tree, field_edits, files, guest_environments, insert_lines, insert_text, insert_tree, measurements, meta, methods, packages, processes, replace_patterns, reports, roles, services, set_attribute, set_text, storage, users, vars

@@ -1420,18 +1791,18 @@

Promise types

-
-

Custom Promise Types

+
+

Custom Promise Types

    -
  • Available starting with 3.20
  • +
  • Available starting with 3.17.0
  • Can be written in any language
  • Bash and Python libraries available
-
-

Syntax Structure

+
+

Syntax Structure

bundle type name
@@ -1441,6 +1812,8 @@ 

Syntax Structure

context:: "promiser" -> { "optional", "stakeholder" } + handle => "unique_promise_identifier", + depends_on => { "handles", "must_be_kept_or_repaired_first" }, attribute_1 => value_1, attribute_2 => value_2, meta => { "tag1", "tag2", "tag3=something" }, @@ -1474,8 +1847,8 @@

Syntax Structure

-
-

Bundles

+
+

Bundles

  • Collection of logically related promises
  • Are not functions
  • @@ -1508,8 +1881,8 @@

    Bundles

-
-

Example bundles hold some state

+
+

Example bundles hold some state

bundle agent main
@@ -1530,11 +1903,11 @@ 

Example bundles hold some state

-
bundle agent set_item_in_bag(item, value)
+
bundle agent set_item_in_bag(item, condition)
 {
   vars:
-    "$(item)" string => "$(value)";
-    "array[$(item)]" string => "$(value)";
+    "$(item)" string => "$(condition)";
+    "array[$(item)]" string => "$(condition)";
 }
 bundle agent report_bag_contents
 {
@@ -1582,8 +1955,8 @@ 

Example bundles hold some state

-
-

Bundles for logical abstraction

+
+

Bundles for logical abstraction

For example, a bundle to configure Apache might:

@@ -1599,8 +1972,8 @@

Bundles for logical abstraction

-
-

Bundle types

+
+

Bundle types

cf-promises --syntax-description json | jq '.bundleTypes | keys[]'
@@ -1625,8 +1998,8 @@ 

Bundle types

-
-

Bundlesequence

+
+

Bundlesequence

  • main is the default
  • __main__ is treated as main if in $(sys.policy_entry_filename)
  • @@ -1656,8 +2029,8 @@

    Bundlesequence

-
-

Bodies

+
+

Bodies

  • Collection of attributes
  • Have a type ( e.g. classes, perms, copy_from )
  • @@ -1694,8 +2067,8 @@

    Bodies

-
-

Special bodies that control agent behavior

+
+

Special bodies that control agent behavior

  • body common control
  • body file control
  • @@ -1721,8 +2094,8 @@

    Special bodies that control agent behavior

-
-

Default bodies

+
+

Default bodies

-
-

Normal Order

+
+

Normal Order

  • The order in which CFEngine executes promises @@ -1789,8 +2162,8 @@

    Normal Order

-
-

Example:

+
+

Example:

bundle agent illustrating_normal_order
@@ -1838,8 +2211,8 @@ 

Example:

-
-

Convergence

+
+

Convergence

  • A basic principal of CFEngine
  • @@ -1848,8 +2221,8 @@

    Convergence

-
-

2020-10-28_14-14-05_convergence.png +

+

@@ -1866,8 +2239,8 @@

Convergence

-
-

Augments (host_specific.json, def.json)

+
+

Augments (host_specific.json, def.json)

  • Very early definition
  • host_specific.json processed first (if present), variables defined here have precedence over other augments
  • @@ -1887,8 +2260,8 @@

    Augments (host_specific.json, def.json

-
-

Example augments

+
+

Example augments

    -
  • Simple syntax
    +
  • Simple syntax
    {
    @@ -1926,7 +2299,7 @@ 

    Example augments

  • -
  • Advanced syntax
    +
  • Advanced syntax
      -
    • classes
      +
    • classes
      {
      @@ -1962,7 +2335,7 @@ 

      Example augments

    • -
    • vars/variables
      +
    • vars/variables
      {
      @@ -1993,8 +2366,8 @@ 

      Example augments

-
-

Example policy using augments

+
+

Example policy using augments

bundle agent main
@@ -2013,8 +2386,8 @@ 

Example policy using augments

-
-

Example output

+
+

Example output

cf-agent --no-lock --file ./examples/augments/augments.cf
@@ -2028,8 +2401,8 @@ 

Example output

-
-

Policy always wins!

+
+

Policy always wins!

bundle common def
@@ -2063,8 +2436,8 @@ 

Policy always wins!

-
-

Example output

+
+

Example output

cf-agent --no-lock --file ./examples/augments/augments-policy-wins.cf
@@ -2079,8 +2452,8 @@ 

Example output

-
-

Multiple augments

+
+

Multiple augments

Merge more augments on top.

@@ -2115,8 +2488,8 @@

Multiple augments

-
-

Multiple augments: Example policy

+
+

Multiple augments: Example policy

-
-

Macros

+
+

Macros

  • Conditional parsing based on version and features
  • Use for supporting future syntax, speed optimizations
  • @@ -2156,8 +2529,8 @@

    Macros

-
-

Version based

+
+

Version based

  • minimum_version
  • maximum_version
  • @@ -2192,8 +2565,8 @@

    Version based

-
-

Feature based

+
+

Feature based

  • Feature Macro documentation
  • @@ -2224,14 +2597,14 @@

    Feature based

-
-

Else

+
+

Else

  • Must come after an @if macro
-
+
 bundle agent extractor
 {
 @if minimum_version(3.16)
@@ -2248,15 +2621,15 @@ 

Else

}
-
-

Functions

+
+

Functions

There are 181 functions as of 3.21.0

-
-

Pop Quiz

+
+

Pop Quiz

  • What is a bundle?
  • @@ -2335,12 +2708,12 @@

    Pop Quiz

-
-

Making Decisions: Context Classes and Expressions

+
+

Making Decisions: Context Classes and Expressions

-
-

Classes

+
+

Classes

  • Restrict promises based on context
  • Usable in bundles and bodies
  • @@ -2368,8 +2741,8 @@

    Classes

-
-

What classes are defined?

+
+

What classes are defined?

cf-promises --show-classes
@@ -2398,8 +2771,8 @@ 

What classes are defined?

-
-

Example

+
+

Example

cf-promises --show-classes | tail -n+2 | awk -vORS=", " '{print $1}'
@@ -2425,8 +2798,8 @@ 

Example

-
-

Class expressions

+
+

Class expressions

Table 1: A rough schedule (this varies greatly).
@@ -2476,8 +2849,8 @@

Class expressions

-
-

Example illustrating class expressions

+
+

Example illustrating class expressions

bundle agent main
@@ -2509,8 +2882,8 @@ 

Example illustrating class expressions

-
-

Class types

+
+

Class types

  • Hard Classes
  • Soft Classes
  • @@ -2518,8 +2891,8 @@

    Class types

-
-

Hard classes

+
+

Hard classes

  • Defined by agent
  • Not configurable
  • @@ -2534,8 +2907,8 @@

    Hard classes

-
-

Soft classes

+
+

Soft classes

  • Defined by policy
  • Based on anything
  • @@ -2547,8 +2920,8 @@

    Soft classes

-
-

Valid Class names

+
+

Valid Class names

  • Allowed characters include [a-zA-Z0-9_]
  • Canonify a string to produce a valid class name @@ -2565,8 +2938,8 @@

    Valid Class names

-
-

Example of automatic canonification

+
+

Example of automatic canonification

bundle agent main
@@ -2598,36 +2971,91 @@ 

Example of automatic canonification

-
-

Class scope

+
+

Class scope

+

+Classes have one of two scopes: +

+ +
+
Namespace
The class is visible from other bundles
+
Bundle
The class is only visible from within the bundle it was defined
+ +
+ +

+Caveat methods promises that use inherit => "true" +

+ + + +
+
+

Namespace scoped classes

    -
  • Namespace scoped classes are accessible from any bundle. (theNamespace:the_class|anotherNamespace:another_class::
  • +
  • Aka globally scoped
  • +
  • Accessible from any bundle
  • Persist until end of agent run or explicitly undefined.
  • -
  • Bundle scoped classes are only accessible from within the bundle the class was defined, or bundles actuated via methods where inheritance is specified
  • +
  • Must be used if want reported to CFEngine Enterprise Hub
  • All hard classes are namespace scoped
+ + +
+
+

Non default namespace

+
    +
  • Beware confusing namespace scope with specific namespace
  • +
  • Referencing non-default namespace scoped classes +class_in_current_NS|anotherNS:another_class::
  • + +
+ + +
+
+

Bundle scoped classes

    -
  • Namespace scoped classes are also referred to as "global" classes.
  • -
  • Inventoried classes must be namespace scoped.
  • +
  • Accessible from within the bundle where they were defined
  • + +
+ +
-
-

Class scope rules

+
+

Class scope rules

Table 2: Class Expressions
- +@@ -2653,18 +3081,36 @@

Class scope rules

Table 3: Default scope for classes type promisesTable 3: Default scope for classes type promises
    -
  • classes bodies default to namespace scope
  • +
  • classes bodies (define classes based on promise results default to namespace scope)
-

-Pro Tip: Use bundle scoped classes whenever possible. -

+
+
+

Example class scopes for classes type promises

+
+ +
bundle agent bundle0
+{
+  classes:
+      "I_will_be_bundle_scoped"
+        expression => "any";
+}
+bundle common bundle1
+{
+  classes:
+      "I_will_be_namespace_scoped"
+        expression => "any";
+}
+
+
-
-

Define custom classes by expression

+
+

Pro tips

+
    +
  • Use bundle scoped classes whenever possible.
  • +
  • Define classes that describe the current state, not desired action.
  • + +
+ +
+
+

Example class names

+
+ +
bundle agent sshd_config
+{
+  services:
+      "sshd"
+        service_policy => "start";
+
+    sshd_config_repaired.proposed_sshd_config_validated::
+      "sshd"
+        service_policy => "restart";
+}
+
+
+
+
+

Define custom classes by expression

bundle agent main
@@ -2701,8 +3180,8 @@ 

Define custom classes by expression

-
-

Define custom classes by promise outcome

+
+

Define custom classes by promise outcome

bundle agent main
@@ -2729,8 +3208,8 @@ 

Define custom classes by promise outcome

-
-

Example - traditional class expressions

+
+

Example - traditional class expressions

bundle agent main
@@ -2762,8 +3241,8 @@ 

Example - traditional class expressions

-
-

Example - restrict individual promises with if and unless

+
+

Example - restrict individual promises with if and unless

bundle agent main
@@ -2797,8 +3276,8 @@ 

Example - restrict individual promises with if and unless

-
-

Example - variable class expressions

+
+

Example - variable class expressions

bundle agent main
@@ -2841,8 +3320,8 @@ 

Example - variable class expressions

-
-

Functions that return "context"

+
+

Functions that return "context"

cf-promises --syntax-description json | jq '.functions | \
@@ -2856,8 +3335,8 @@ 

Functions that return "context"

-
-

Pop Quiz

+
+

Pop Quiz

  • What types of classes are there?
  • @@ -2909,12 +3388,12 @@

    Pop Quiz

-
-

Variables & Data Types

+
+

Variables & Data Types

-
-

Variable Scoping

+
+

Variable Scoping

  • All variables are globally accessible
  • $(variable), @(list or data container)
  • @@ -2928,8 +3407,8 @@

    Variable Scoping

-
-

Datatypes

+
+

Datatypes

  • string, int, real
  • slist, ilist, rlist
  • @@ -2938,8 +3417,8 @@

    Datatypes

-
-

Example - strings

+
+

Example - strings

bundle agent main
@@ -2982,8 +3461,8 @@ 

Example - strings

-
-

Example - numbers

+
+

Example - numbers

bundle agent main
@@ -3046,9 +3525,20 @@ 

Example - numbers

-
inf
a constant representing an "unlimited", value.
+
inf
a constant representing an "unlimited", value. But, not in all cases.
+

+https://docs.cfengine.com/docs/master/reference-language-concepts-variables.html#scalar-variables +

+ +

+inf is a special value that in the code corresponds to the magic number of 999999999 (nine nines). Thus any function that accepts a number, can accept inf without a problem. Keep in mind though that you can get a higher number if you set the upper limit manually, but that's almost never a problem. +

+ +

+For a few functions inf is being treated specially and truly means "there is no limit" instead of "nine nines limit". This is the case for the maxbytes parameter and applies to most read* functions. +

@@ -3080,7 +3570,7 @@

Example - numbers

"inf ($(inf_is)) < biggest_int ($(biggest_int))" if => isgreaterthan( $(biggest_int), $(inf_is) ); - "$(biggest_int) is $(with) greater than $(inf_is)" + "biggest_int ($(biggest_int)) is $(with) greater than inf ($(inf_is))" with => format( "%0.0f", eval( "$(biggest_int)-$(inf_is)", math, infix)); } bundle agent __main__ @@ -3092,12 +3582,32 @@

Example - numbers

 R: inf (999999999) < biggest_int (99999999999)
-R: 99999999999 is 99000000000 greater than 999999999
+R: biggest_int (99999999999) is 99000000000 greater than inf (999999999)
 
+ + +
-
-

Example - lists

+
+

Example - lists

bundle agent main
@@ -3129,7 +3639,7 @@ 

Example - lists

-
+
 R: var1 = '1'
 R: var1 = '2'
 R: var1 = '3'
@@ -3151,8 +3661,8 @@ 

Example - lists

-
-

Example - list iteration (loops)

+
+

Example - list iteration (loops)

bundle agent main
@@ -3173,7 +3683,7 @@ 

Example - list iteration (loops)

-
+
 R: 1
 R: 2
 R: 3
@@ -3201,8 +3711,8 @@ 

Example - list iteration (loops)

-
-

Example - "Classic" Arrays

+
+

Example - "Classic" Arrays

bundle agent main
@@ -3232,8 +3742,8 @@ 

Example - "Classic" Arrays

-
-

Example - data containers

+
+

Example - data containers

bundle agent main
@@ -3257,20 +3767,48 @@ 

Example - data containers

+ +
-
+
 R: URL = 'https://mirror.int.cfengine.com/RHEL6/updates'
 
-
-

Differences between "Classic Arrays" and "Data containers"

+
+

Associative Arrays vs Data containers

+
    +
  • Data containers defined as a single variable
  • +
  • Associative Arrays aka Classic arrays +
      +
    • collection of individual variables
    • +
    • cleared at the start of each bundle evaluation
    • + +
  • + +
+
+
+

Example Associative Arrays vs Data containers

bundle agent main
@@ -3287,22 +3828,25 @@ 

Differences between "Classic Arrays" and "Data containers"vars: "ClassicArray[key]" string => "value"; "ClassicArray[deep]" slist => { "list" }; + "ClassicArray[nevermind]" + string => "value", + if => "notdefined"; "DataContainer" data => '{ "key": "value", "deep": [ "list" ] }'; reports: "ClassicArray:$(with)" - with => string_mustache( "{{%-top-}}", ClassicArray); + with => storejson( ClassicArray); "DataContainer:$(with)" - with => string_mustache( "{{%-top-}}", DataContainer); + with => storejson( DataContainer); }

-
- -
+
+

Example Associative Arrays vs Data containers output

+
 R: ClassicArray:{
   "deep": [
     "list"
@@ -3318,8 +3862,8 @@ 

Differences between "Classic Arrays" and "Data containers"

-
-

Pop Quiz

+
+

Pop Quiz

  • Which component makes changes to your system?
  • @@ -3368,11 +3912,13 @@

    Pop Quiz

    + +
-
-

Policy Examples

+
+

Policy Examples

-
-

Enable services_autorun

-
+
+

Enable services_autorun

+
 [root@hub masterfiles]# cat > def.json <<EOF
 {
   "vars": {
@@ -3419,8 +3965,8 @@ 

Enable services_autorun

-
-

Create a file

+
+

Create a file

examples/00-20-example-create_file.cf

@@ -3463,8 +4009,8 @@

Create a file

-
-

Update file

+
+

Update file

examples/00-20-example-update_file.cf

@@ -3518,8 +4064,8 @@

Update file

-
-

Make sure a package is installed and service running

+
+

Make sure a package is installed and service running

examples/00-20-example-package_and_service.cf

@@ -3599,8 +4145,8 @@

Make sure a package is installed and service running

-
-

Competing implementations of packages promises

+
+

Competing implementations of packages promises

  • methods (legacy) vs modules (modern)
  • @@ -3633,8 +4179,8 @@

    Competing implementations of packages promises

-
-

Classify role based on hostname

+
+

Classify role based on hostname

examples/00-20-example-classes-role_by_hostname.cf

@@ -3663,8 +4209,8 @@

Classify role based on hostname

-
-

Classify geographic location by network

+
+

Classify geographic location by network

examples/00-20-example-classes-geographic_location_by_network

@@ -3767,8 +4313,8 @@

Classify geographic location by network

-
-

Manage key value entries in a config file

+
+

Manage key value entries in a config file

examples/00-20-example-key_value_config.cf

@@ -3859,7 +4405,7 @@

Manage key value entries in a config file

-
+
 [root@hub masterfiles]# cf-agent -KID DEBUG_ssh_config,DEBUG_ssh_config_manage_kv
     info: Installing cfe_internal_non_existing_package...
 R: DEBUG ssh_config: PermitRootLogin = 'no'
@@ -3877,8 +4423,8 @@ 

Manage key value entries in a config file

-
-

Templating a file with mustache

+
+

Templating a file with mustache

examples/00-20-example-mustache_template_inline_using_datastate.cf

@@ -3917,8 +4463,8 @@

Templating a file with mustache

-
-

Mustache extensions

+
+

Mustache extensions

  • -top- data handed to the templating engine
  • @ Currently iterated key
  • @@ -4036,8 +4582,8 @@

    Mustache extensions

-
-

Inventory SSH Host Keys

+
+

Inventory SSH Host Keys

@@ -4075,7 +4621,7 @@

Inventory SSH Host Keys

-
+
 R: /etc/ssh/ssh_host_ed25519_key.pub
         type: ed25519
         fingerprint: SHA256:NA04HcvSPZ/wAp/vJUIcOV799ImTWnbFEX0R9R2SXUI
@@ -4091,8 +4637,8 @@ 

Inventory SSH Host Keys

-
-

Interacting with APIs from within CFEngine Policy

+
+

Interacting with APIs from within CFEngine Policy

-
+
 # cf-agent --no-lock --log-level info --file examples/example-url_get-wtfismyip-v0.cf
 R: {
   "content": "{\n    \"YourFuckingIPAddress\": \"24.143.34.87\",\n    \"YourFuckingLocation\": \"Tonganoxie, KS, United States\",\n    \"YourFuckingHostname\": \"24-143-34-87-dynamic.midco.net\",\n    \"YourFuckingISP\": \"Midco\",\n    \"YourFuckingTorExit\": false,\n    \"YourFuckingCountryCode\": \"US\"\n}\n",
@@ -4208,27 +4754,27 @@ 

Interacting with APIs from within CFEngine Policy

-
-

Policy Exercises

-
+
+

Policy Exercises

+
-
-

Edit a file

+
+

Edit a file

Write a policy that populates /etc/issue with legaleze.

-
-

Create local users

+
+

Create local users

Write a policy that creates at least 2 users.

-
-

Inventory the local users

+
+

Inventory the local users

Tag the variable(s) that contain the usernames you promised for inventory.

@@ -4240,8 +4786,8 @@

Inventory the local users

-
-

Create a file

+
+

Create a file

Write a policy that ensures /etc/cron.allow is populated with one of the previously created users allowed to have cron jobs.

@@ -4251,96 +4797,40 @@

Create a file

-
-

Inventory users in /etc/cron.allow

+
+

Inventory users in /etc/cron.allow

Inventory the users listed in /etc/cron.allow

-
-

Enable sshd banner

+
+

Enable sshd banner

Write a policy that enables the ssh banner and directs it to /etc/issue. sshd should be restarted after changing its configuration.

-
-

Multiple outcomes

-
- -
touch /tmp/immutable
-sudo chattr +i /tmp/immutable
-
-
- -
-
- -
- -
bundle agent example_multiple_outcomes
-{
-  files:
-    "/tmp/immutable"
-      create => "true",
-      edit_line =>  example_edit_line,
-      classes => results("bundle", "my_id");
-
-  vars:
-    "classes" slist => classesmatching(".*my_id.*");
-
-  reports:
-    "Found Class = '$(classes)'";
-}
-
-bundle edit_line example_edit_line
-{
-  insert_lines:
-    "I want to edit an immutable file";
-}
-bundle agent __main__{methods:"example_multiple_outcomes";}
-
-
- -
-
- -
-    info: Inserted the promised line 'I want to edit an immutable file' into '/tmp/immutable' after locator
-    info: insert_lines promise 'I want to edit an immutable file' repaired
-   error: Can't rename '/tmp/immutable.cf-after-edit' to '/tmp/immutable' - so promised edits could not be moved into place. (rename: Operation not permitted)
-   error: Unable to save file '/tmp/immutable' after editing
-   error: Errors encountered when actuating files promise '/tmp/immutable'
-R: Found Class = 'my_id_failed'
-R: Found Class = 'my_id_not_kept'
-R: Found Class = 'my_id_error'
-R: Found Class = 'my_id_kept'
-R: Found Class = 'my_id_reached'
-   error: Method 'example_multiple_outcomes' failed in some repairs
-
- -

-Refer to implementation of the results classes body in the stdlib. -

+
+

Install ntpd and configure driftfile

+
    +
  • Install ntp
  • +
  • Ensure service is running
  • +
  • Configure path to driftfile /var/lib/ntp/drift?
  • +
  • Make sure service is restarted if configuration file content is altered
  • -
    - -
    sudo chattr -i /tmp/immutable
    -sudo rm /tmp/immutable
    -
    -
    +
-
-

Report

+
+

Report

Write a policy that defines a name in separate parts (at least 3). Then have CFEngine report the name in a random order.

-
-

Example solution

+
+

Example solution

-
-

Trigger an action when a file changes

+
+

Trigger an action when a file changes

Write policy to monitor a file for change. When a change is seen report Winner Winner Chicken Dinner. Manually edit the file, show how cfengine detects and @@ -4380,8 +4870,8 @@

Trigger an action when a file changes

-
-

Automatically abort based on file presence

+
+

Automatically abort based on file presence

Write a policy that will abort cfengine execution if the file $(sys.statedir)/abort_agent_execution exists. @@ -4392,28 +4882,28 @@

Automatically abort based on file presence

-
-

Delete file based on age

+
+

Delete file based on age

Write a policy that will delete $(sys.statedir)/abort_agent_execution if it is older than 1 hour.

-
-

Kill a process

+
+

Kill a process

Write a policy to kill irssi running on webservers. No need for our webservers to be connected to IRC.

-
+
 cp /bin/sleep /tmp/irssi
 /tmp/irssi 5000
 
-
-

Building on example-url_get-wtfismyip-v0.cf

+
+

Building on example-url_get-wtfismyip-v0.cf

  • Let's use the response content from the previous example in a template to manage a file.
  • @@ -4557,8 +5047,8 @@

    Building on example-url_get-wtfismyip-v0.cf

    -
    -

    Inventory batteries

    +
    +

    Inventory batteries

    • /sys/class/power_supply/BAT*/capacity
        @@ -4572,22 +5062,44 @@

        Inventory batteries

    -
    -

    Strip suffixes from a list of filenames

    +
    +

    Strip suffixes from a list of filenames

    -Given a list of filenames, ( 1.txt, 2.txt, 3.txt ) strip the suffix ( .txt ) and get the prefix into a new list. +Given a list of filenames strip the suffix and get the prefix into a new list.

    +

    +E.g. given a list containing 1.txt, 2.txt, 3.txt produce a list containing 1, 2, 3. +

    + +
    +
    +

    Manage files described by a data container

    +
    + +
    [
    +   {
    +     "name": "/tmp/create-multiple-files-with.content-1.txt",
    +     "content": "Hello CFEngine!"
    +   },
    +   {
    +     "name": "/tmp/create-multiple-files-with.content-2.txt",
    +     "content": "Bye CFEngine!"
    +   }
    + ]
    +
    +
    +
    -
    -

    Enterprise Reporting

    -
    +
    +

    Enterprise Reporting

    +
    -
    -

    APIs

    +
    +

    APIs

    • Host
    • Inventory
    • @@ -4621,8 +5133,8 @@

      APIs

    -
    -

    Host API

    +
    +

    Host API

    curl -s -k --user $AUTHUSER:$PASSWORD \
    @@ -4664,13 +5176,13 @@ 

    Host API

    -
    -

    Inventory API

    -
    +
    +

    Inventory API

    +
    -
    -

    Inventory API attributes

    +
    +

    Inventory API attributes

    curl -q -k --user $AUTHUSER:$PASSWORD \
    @@ -4692,7 +5204,7 @@ 

    Inventory API attributes

    -
    +
     "Policy Release Id"
     "EC2 Image ID"
     "CPU sockets"
    @@ -4788,8 +5300,8 @@ 

    Inventory API attributes

    -
    -

    Inventory API Query

    +
    +

    Inventory API Query

    curl -q -k --user $AUTHUSER:$PASSWORD \
    @@ -4818,8 +5330,8 @@ 

    Inventory API Query

    -
    -

    Health API

    +
    +

    Health API

    curl -s -k --user $AUTHUSER:$PASSWORD \
    @@ -4874,8 +5386,8 @@ 

    Health API

    -
    -

    Query API

    +
    +

    Query API

    -
    -

    Base64 encoded query links

    +
    +

    Base64 encoded query links

    +
    +
    +

    Actions

    +

    +Actions API enables you to perform specific actions such a requesting report collection and triggering un-scheduled agent runs. +

    + +

    +Note: Triggered actions (agent run, report collection) will not work for hosts that the hub cannot initiate connections to, e.g. hosts behind NAT. +

    + +
    +
    +

    Trigger report collection

    +
    + +
    exec 2>&1
    +/var/cfengine/bin/curl \
    +    --insecure \
    +    --user admin:admin \
    +    --write-out "HTTP %{response_code}" \
    +    --request POST \
    +    -H 'content-tyupe: application/json' \
    +    -d '{"hostkey": "SHA=55425b6c6c5fcd1ea7f00cf45736a3acd87a3503dc61abaf268ca59f47fe4a05" }' \
    +    https://hub.example.com/api/actions/report_collection
    +:
    +
    +
    + +
    +Array
    +HTTP 202
    +
    + +
    +
    +

    Trigger agent run

    +
    + +
    exec 2>&1
    +/var/cfengine/bin/curl \
    +    --insecure \
    +    --user admin:admin \
    +    --write-out "HTTP %{response_code}" \
    +    --request POST \
    +    -H 'content-tyupe: application/json' \
    +    -d '{"hostkey": "SHA=55425b6c6c5fcd1ea7f00cf45736a3acd87a3503dc61abaf268ca59f47fe4a05" }' \
    +    https://hub.example.com/api/actions/agent_run
    +:
    +
    +
    + +
    +{
    +"output" : "",
    +"exit_code": 0
    +}
    +
    +HTTP 202
    +
    + +
    -
    -

    What's New

    -
    +
    +

    What's New

    +
    -
    -

    Coming up in 3.21…

    +
    +

    Coming up in 3.21…

    -
    -

    In 3.20

    +
    +

    In 3.20

    • Build in Mission Portal
    -
    -

    In 3.19

    +
    +

    In 3.19

    • Importable Compliance Reports in Mission Portal
    -
    -

    In 3.18

    +
    +

    In 3.18

    • Host specific data (CMDB) in Mission Portal
    • More powerful Augments syntax
    • @@ -5084,8 +5658,8 @@

      In 3.18

    -
    -

    In 3.17

    +
    +

    In 3.17

    • New functions:
        @@ -5100,14 +5674,14 @@

        In 3.17

    -
    -

    In 3.16

    -
    +
    +

    In 3.16

    +
    -
    -

    Components

    -
    +
    +

    Components

    +
     Usage: cf-secret COMMAND [OPTIONS] [FILE]
     
     Commands:
    @@ -5186,8 +5760,8 @@ 

    Components

    -
    -

    Promise attributes

    +
    +

    Promise attributes

    bundle agent example_file_content
    @@ -5210,7 +5784,7 @@ 

    Promise attributes

    -
    +
         info: Created file '/tmp/hello_string', mode 0600
         info: Updated content of '/tmp/hello_string' with content 'Hello from string!'
         info: files promise '/tmp/hello_string' repaired
    @@ -5219,8 +5793,8 @@ 

    Promise attributes

    -
    -

    Functions

    +
    +

    Functions

    Complementary to new macros:

    @@ -5345,8 +5919,8 @@

    Functions

    -
    -

    Macros

    +
    +

    Macros

    • maximum_version
    • else
    • @@ -5383,20 +5957,20 @@

      Macros

    -
    -

    Enterprise Edition

    +
    +

    Enterprise Edition

    • Compliance Reports
    -
    -

    In 3.15

    -
    +
    +

    In 3.15

    +
    -
    -

    Functions

    +
    +

    Functions

    • basename()
    • read_module_protocol()
    • @@ -5497,13 +6071,13 @@

      Functions

    -
    -

    In 3.14

    -
    +
    +

    In 3.14

    +
    -
    -

    Functions

    +
    +

    Functions

    • classfiltercsv() (back-ported to 3.12.1)
    • @@ -5568,7 +6142,7 @@

      Functions

    -
    +
     R: Filtered data: [
       {
         "Sort": "1",
    @@ -5594,13 +6168,13 @@ 

    Functions

    -
    -

    In 3.13

    -
    +
    +

    In 3.13

    +
    -
    -

    Functions

    +
    +

    Functions

    • string_replace()
    • @@ -5632,13 +6206,13 @@

      Functions

    -
    -

    In 3.12

    -
    +
    +

    In 3.12

    +
    -
    -

    Functions

    +
    +

    Functions

    • hash_to_int()
    • @@ -5673,8 +6247,8 @@

      Functions

      R: 'world' hashed to: 760
    -
    -

    Library main bundles

    +
    +

    Library main bundles

    • Default bundle per policy file
    • Useful for testing
    • @@ -5791,7 +6365,7 @@

      Library main

    -
    +
     example_library__main__1.cf
     example_library__main__2.cf
     example_library__main__.cf
    @@ -5859,8 +6433,8 @@ 

    Library main

    -
    -

    –log-level option

    +
    +

    –log-level option

    bundle agent main
    @@ -5883,8 +6457,8 @@ 

    –log-level option

    -
    -

    Promise attributes

    +
    +

    Promise attributes

    • copy_from body attribute missing_ok allows missing upstream files to be considered promise kept
    • files promise template_method accepts inline_mustache
    • @@ -5980,29 +6554,29 @@

      Promise attributes

    -
    -

    sys vars

    +
    +

    sys vars

    • sys.policy_entry*
    -
    -

    In 3.11

    -
    +
    +

    In 3.11

    +
    -
    -

    Promise attributes

    +
    +

    Promise attributes

    • with
    -
    -

    Functions

    +
    +

    Functions

    • data_sysctlvalues()
    • readenvfile()
    • @@ -6030,7 +6604,7 @@

      Functions

    -
    +
     R: {
       "abi.vsyscall32": "1",
       "debug.exception-trace": "1",
    @@ -15574,7 +16148,7 @@ 

    Functions

    -
    +
     R: {
       "BUG_REPORT_URL": "https://bugs.launchpad.net/ubuntu/",
       "HOME_URL": "https://www.ubuntu.com/",
    @@ -15592,13 +16166,13 @@ 

    Functions

    -
    -

    In 3.10

    -
    +
    +

    In 3.10

    +
    -
    -

    Functions

    +
    +

    Functions

    • getuserinfo()
    • isipinsubnet()
    • @@ -15701,13 +16275,13 @@

      Functions

    -
    -

    In 3.9

    -
    +
    +

    In 3.9

    +
    -
    -

    Functions

    +
    +

    Functions

    • callstack_callers()
    • callstack_promisers()
    • @@ -15857,13 +16431,13 @@

      Functions

    -
    -

    In 3.8

    -
    +
    +

    In 3.8

    +
    -
    -

    Functions

    +
    +

    Functions

    • url_get()
    • @@ -15903,13 +16477,13 @@

      Functions

    -
    -

    Special Topics

    -
    +
    +

    Special Topics

    +
    -
    -

    Internal agent upgrade mechanism

    +
    +

    Internal agent upgrade mechanism

    • Place agent packages in /var/cfengine/master_software_updates/$(sys.flavour)_$(sys.arch)
    • @@ -15933,13 +16507,13 @@

      Internal agent upgrade mechanism

    -
    -

    Data transformations

    -
    +
    +

    Data transformations

    +
    -
    -

    Re-parent a data structure

    +
    +

    Re-parent a data structure

    With mergedata() it is possible to wrap data containers inside of a new JSON data structure in the current namespace. @@ -15975,7 +16549,7 @@

    Re-parent a data structure

    -
    +
     R: {
       "pghba": [
         {
    @@ -15990,8 +16564,8 @@ 

    Re-parent a data structure

    -
    -

    Merging a result from variablesmatching_as_data()

    +
    +

    Merging a result from variablesmatching_as_data()

    I see. So, we need to merge the variable values together.

    @@ -16062,7 +16636,7 @@

    Merging a result from variablesmatching_as_data()

    -
    +
     R: merged: [
       {
         "name": "check_ntp_time",
    @@ -16099,8 +16673,8 @@ 

    Merging a result from variablesmatching_as_data()

    -
    -

    Inheriting calling bundles classes

    +
    +

    Inheriting calling bundles classes

    bundle agent parent
    @@ -16136,8 +16710,8 @@ 

    Inheriting calling bundles classes

    R: Second see class parent_1 NOT defined
    -
    -

    Bundles can return data

    +
    +

    Bundles can return data

    bundle agent parent
    @@ -16166,8 +16740,8 @@ 

    Bundles can return data

    default:parent.my_returned_vars[msg] Hello world source=bundle
    -
    -

    Tracking files for change (Tripwire/AIDE)

    +
    +

    Tracking files for change (Tripwire/AIDE)

    multiple ways of achieving this with CFEngine, there are many useful functions, lsdir(), findfiles(), filestat(), file_hash() all come to mind. However, did you know that CFEngine has some native functionality kind of like AIDE or Tripwire?

    @@ -16240,7 +16814,7 @@

    Tracking files for change (Tripwire/AIDE)

    -
    +
     Resetting Observations
     CFEngine Core 3.17.0
     CFEngine Enterprise 3.17.0
    @@ -16362,7 +16936,7 @@ 

    Tracking files for change (Tripwire/AIDE)

    -
    +
     Resetting Observations
     CFEngine Core 3.17.0
     CFEngine Enterprise 3.17.0
    @@ -16529,7 +17103,7 @@ 

    Tracking files for change (Tripwire/AIDE)

    -
    +
     Resetting Observations
     CFEngine Core 3.17.0
     CFEngine Enterprise 3.17.0
    @@ -16586,25 +17160,25 @@ 

    Tracking files for change (Tripwire/AIDE)

    -
    -

    Tips

    +
    +

    Tips

    -
    -

    Use the tools!

    +
    +

    Use the tools!

    -
    -

    Use an editor with syntax highlighting

    +
    +

    Use an editor with syntax highlighting

    -
    -

    Use the docs

    +
    +

    Use the docs

    • Masterfiles Policy Framework (MPF)
    • Function Reference
    -
    -

    Syntax Checking

    +
    +

    Syntax Checking

    cf-promises --eval-functions=yes --full-check \
    @@ -16650,8 +17224,8 @@ 

    Syntax Checking

    -
    -

    noshell vs useshell for commands type promises, execresult(), and returnszero()

    +
    +

    noshell vs useshell for commands type promises, execresult(), and returnszero()

    -
    -

    Debug Reports

    +
    +

    Debug Reports

    Use standardized DEBUG reports for policy development and troubleshooting.

    @@ -16779,8 +17353,8 @@

    Debug Reports

    -
    -

    Promise comments

    +
    +

    Promise comments

    Use promise comments to document WHY the promise is important.

    @@ -16799,8 +17373,8 @@

    Promise comments

    -
    -

    jq

    +
    +

    jq

    -
    -

    cf-runagent

    +
    +

    cf-runagent

    cf-runagent --background=3 --remote-bundles satellite_registration \
    @@ -16904,8 +17478,8 @@ 

    cf-runagent

    -
    -

    Additional Resources

    +
    +

    Additional Resources

    CFEngine Build
    An index of CFEngine related content. Share your content and consume others!
    Learning CFEngine
    Widely considered best book to get a good grounding in CFEngine.
    @@ -16953,25 +17527,25 @@

    Additional Resources

    -
    -

    Wrapping up

    +
    +

    Wrapping up

    Please take a few moments to fill out this survey about your experience: https://www.surveymonkey.com/r/CFEngine-Training

    -
    -

    Appendix

    +
    +

    Appendix

    -
    -

    Git Primer

    +
    +

    Git Primer

    -
    -

    Git

    +
    +

    Git

    Git is the most popular modern version control management tool. Github, Bitbucket, and GitLab all provide great hosted and on prem repository management @@ -16993,13 +17567,13 @@

    Git

    -
    -

    Getting started

    +
    +

    Getting started

    Log into the policy server

    -
    +
     [user@workstation] $ vagrant ssh hub
     [vagrant@hub] $ sudo -i
     
    @@ -17008,16 +17582,16 @@

    Getting started

    Configure git author

    -
    +
     [root@hub masterfiles] # git config -–global user.name “Mr. Slate”
     [root@hub masterfiles] # git config -–global user.email “bossman@slateco.com”
     [root@hub masterfiles] # git config --global push.default simple
     
    -
    -

    Clone builtin repository

    -
    +
    +

    Clone builtin repository

    +
     [root@hub masterfiles] # git clone /opt/cfengine/masterfiles.git /vagrant/masterfiles
     Cloning into '/vagrant/masterfiles'...
     
    @@ -17032,9 +17606,9 @@

    Clone builtin repository

    -
    -

    Add a file to the repository

    -
    +
    +

    Add a file to the repository

    +
     [root@hub masterfiles] # cd /vagrant/masterfiles
     [root@hub masterfiles] # ls
     cfe_internal  Changelog  controls  def.cf  lessons  lib  libraries  promises.cf  services  sketches  update  update.cf
    @@ -17049,9 +17623,9 @@ 

    Add a file to the repository

    -
    -

    Stage and commit the changes

    -
    +
    +

    Stage and commit the changes

    +
     [root@hub masterfiles] # git add file
     [root@hub masterfiles] # git status
     # On branch master
    @@ -17067,9 +17641,9 @@ 

    Stage and commit the changes

    -
    -

    Publish the change

    -
    +
    +

    Publish the change

    +
     [root@hub masterfiles] # git status
     # On branch master
     # Your branch is ahead of 'origin/master' by 1 commit.
    @@ -17090,9 +17664,9 @@ 

    Publish the change

    -
    -

    Modify a file

    -
    +
    +

    Modify a file

    +
     [root@hub masterfiles] # echo HI >> file
     [root@hub masterfiles] # git status
     # On branch master
    @@ -17108,9 +17682,9 @@ 

    Modify a file

    -
    -

    Diff to validate detail of content change

    -
    +
    +

    Diff to validate detail of content change

    +
     [root@hub masterfiles] # git diff
     diff --git a/file b/file
     index 45b983b..313352b 100644
    @@ -17122,9 +17696,9 @@ 

    Diff to validate detail of content change

    -
    -

    Stage and commit the changes

    -
    +
    +

    Stage and commit the changes

    +
     [root@hub masterfiles] # git add file
     [root@hub masterfiles] # git status
     # On branch master
    @@ -17146,9 +17720,9 @@ 

    Stage and commit the changes

    -
    -

    Publish the change

    -
    +
    +

    Publish the change

    +
     [root@hub masterfiles] # git push
     Counting objects: 7, done.
     Delta compression using up to 2 threads.
    @@ -17161,9 +17735,9 @@ 

    Publish the change

    -
    -

    Remove a file

    -
    +
    +

    Remove a file

    +
     [root@hub masterfiles] # git rm file
     # rm 'file'
     [root@hub masterfiles] # git status
    @@ -17180,9 +17754,9 @@ 

    Remove a file

    -
    -

    Publish the change

    -
    +
    +

    Publish the change

    +
     [root@hub masterfiles] # git push
     Counting objects: 3, done.
     Delta compression using up to 2 threads.
    @@ -17195,9 +17769,9 @@ 

    Publish the change

    -
    -

    Place masterfiles into the repository

    -
    +
    +

    Place masterfiles into the repository

    +
     [root@hub masterfiles] # rsync -avz /var/cfengine/masterfiles/ .
     [root@hub masterfiles] # git add -A
     [root@hub masterfiles] # git commit -m "Seed repository with masterfiles"
    @@ -17205,9 +17779,9 @@ 

    Place masterfiles into the repository

    -
    -

    Configure masterfiles for git integration

    -
    +
    +

    Configure masterfiles for git integration

    +
     [root@hub masterfiles]# echo '{ "classes": { "cfengine_internal_masterfiles_update": [ "policy_server" ] } }' > def.json
     [root@hub masterfiles]# git add def.json
     [root@hub masterfiles]# git commit -m "Enable automatic masterfiles update from repository"
    @@ -17239,9 +17813,9 @@ 

    Configure masterfiles for git integration

    -
    -

    Activate current update policy with enablement class

    -
    +
    +

    Activate current update policy with enablement class

    +
     [root@hub masterfiles]# cf-agent --no-lock \
     --verbose \
     --define cfengine_internal_masterfiles_update \
    @@ -17249,9 +17823,9 @@ 

    Activate current update policy with enablement class

    -
    -

    Verify presence of def.json

    -
    +
    +

    Verify presence of def.json

    +
     [root@hub masterfiles]# cat /var/cfengine/masterfiles/def.json
     
    @@ -17265,8 +17839,8 @@

    Verify presence of def.json

    -
    -

    Review

    +
    +

    Review

    Now when the agent runs on hosts that define policy_server policy will be activated that keeps /var/cfengine/masterfiles up to date with whats in the @@ -17280,8 +17854,8 @@

    Review

    -
    -

    Git command reference

    +
    +

    Git command reference

    @@ -17319,8 +17893,8 @@

    Git command reference

    -
    -

    Pop Quiz

    +
    +

    Pop Quiz

    • Who was Mr. Slate?
    • @@ -17350,9 +17924,32 @@

      Pop Quiz

    CFEngine

    - - - + + +