Rewrote the whole website to get rid on a heavy theme
This commit is contained in:
parent
3ea54810ad
commit
60d3abc6ec
122 changed files with 346 additions and 2558 deletions
5
content/blog/cfengine/_index.md
Normal file
5
content/blog/cfengine/_index.md
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
title: "Cfengine"
|
||||
linkTitle: "Cfengine"
|
||||
weight: 40
|
||||
---
|
||||
153
content/blog/cfengine/leveraging-yaml.md
Normal file
153
content/blog/cfengine/leveraging-yaml.md
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
---
|
||||
title: "Leveraging yaml with cfengine"
|
||||
linkTitle: "Leveraging yaml with cfengine"
|
||||
date: 2018-09-25
|
||||
description: >
|
||||
How to leverage yaml inventory files with cfengine
|
||||
---
|
||||
|
||||
CFEngine has core support for JSON and YAML. You can use this support to read, access, and merge JSON and YAML files and use these to keep policy files internal and simple. You
|
||||
access the data using the usual cfengine standard primitives.
|
||||
|
||||
The use case bellow lacks a bit or error control with argument validation, it will fail miserably if the YAML file is invalid.
|
||||
|
||||
## Example yaml
|
||||
|
||||
In `cmdb/hosts/andromeda.yaml` we describe some properties of a host named andromeda:
|
||||
|
||||
{{< highlight yaml >}}
|
||||
domain: adyxax.org
|
||||
host_interface: dummy0
|
||||
host_ip: "10.1.0.255"
|
||||
|
||||
tunnels:
|
||||
collab:
|
||||
port: 1195
|
||||
ip: "10.1.0.15"
|
||||
peer: "10.1.0.14"
|
||||
remote_host: collab.example.net
|
||||
remote_port: 1199
|
||||
legend:
|
||||
port: 1194
|
||||
ip: "10.1.0.3"
|
||||
peer: "10.1.0.2"
|
||||
remote_host: legend.adyxax.org
|
||||
remote_port: 1195
|
||||
{{< /highlight >}}
|
||||
|
||||
## Reading the yaml
|
||||
|
||||
I am bundling the values in a common bundle, accessible globally. This is one of the first bundles processed in the order my policy files are loaded. This is just an extract, you can load multiple files and merge them to distribute common
|
||||
settings :
|
||||
{{< highlight yaml >}}
|
||||
bundle common g
|
||||
{
|
||||
vars:
|
||||
has_host_data::
|
||||
"host_data" data => readyaml("$(sys.inputdir)/cmdb/hosts/$(sys.host).yaml", 100k);
|
||||
classes:
|
||||
any::
|
||||
"has_host_data" expression => fileexists("$(sys.inputdir)/cmdb/hosts/$(sys.host).yaml");
|
||||
}
|
||||
{{< /highlight >}}
|
||||
|
||||
## Using the data
|
||||
|
||||
### Cfengine agent bundle
|
||||
|
||||
We access the data using the global g.host_data variable, here is a complete example :
|
||||
{{< highlight yaml >}}
|
||||
bundle agent openvpn
|
||||
{
|
||||
vars:
|
||||
any::
|
||||
"tunnels" slist => getindices("g.host_data[tunnels]");
|
||||
files:
|
||||
any::
|
||||
"/etc/openvpn/common.key"
|
||||
create => "true",
|
||||
edit_defaults => empty,
|
||||
perms => system_owned("440"),
|
||||
copy_from => local_dcp("$(sys.inputdir)/templates/openvpn/common.key.cftpl"),
|
||||
classes => if_repaired("openvpn_common_key_repaired");
|
||||
methods:
|
||||
any::
|
||||
"any" usebundle => install_package("$(this.bundle)", "openvpn");
|
||||
"any" usebundle => openvpn_tunnel("$(tunnels)");
|
||||
services:
|
||||
linux::
|
||||
"openvpn@$(tunnels)"
|
||||
service_policy => "start",
|
||||
classes => if_repaired("tunnel_$(tunnels)_service_repaired");
|
||||
commands:
|
||||
any::
|
||||
"/usr/sbin/service openvpn@$(tunnels) restart" classes => if_repaired("tunnel_$(tunnels)_service_repaired"), ifvarclass => "openvpn_common_key_repaired";
|
||||
reports:
|
||||
any::
|
||||
"$(this.bundle): common.key repaired" ifvarclass => "openvpn_common_key_repaired";
|
||||
"$(this.bundle): $(tunnels) service repaired" ifvarclass => "tunnel_$(tunnels)_service_repaired";
|
||||
}
|
||||
|
||||
bundle agent openvpn_tunnel(tunnel)
|
||||
{
|
||||
classes:
|
||||
any::
|
||||
"has_remote" and => { isvariable("g.host_data[tunnels][$(tunnel)][remote_host]"), isvariable("g.host_data[tunnels][$(tunnel)][remote_port]") };
|
||||
files:
|
||||
any::
|
||||
"/etc/openvpn/$(tunnel).conf"
|
||||
create => "true",
|
||||
edit_defaults => empty,
|
||||
perms => system_owned("440"),
|
||||
edit_template => "$(sys.inputdir)/templates/openvpn/tunnel.conf.cftpl",
|
||||
template_method => "cfengine",
|
||||
classes => if_repaired("openvpn_$(tunnel)_conf_repaired");
|
||||
commands:
|
||||
any::
|
||||
"/usr/sbin/service openvpn@$(tunnel) restart" classes => if_repaired("tunnel_$(tunnel)_service_repaired"), ifvarclass => "openvpn_$(tunnel)_conf_repaired";
|
||||
reports:
|
||||
any::
|
||||
"$(this.bundle): $(tunnel).conf repaired" ifvarclass => "openvpn_$(tunnel)_conf_repaired";
|
||||
"$(this.bundle): $(tunnel) service repaired" ifvarclass => "tunnel_$(tunnel)_service_repaired";
|
||||
}
|
||||
{{< /highlight >}}
|
||||
|
||||
### Template file
|
||||
|
||||
Templates can reference the g.host_data too, like in the following :
|
||||
{{< highlight cfg >}}
|
||||
[%CFEngine BEGIN %]
|
||||
proto udp
|
||||
port $(g.host_data[tunnels][$(openvpn_tunnel.tunnel)][port])
|
||||
dev-type tun
|
||||
dev tun_$(openvpn_tunnel.tunnel)
|
||||
comp-lzo
|
||||
script-security 2
|
||||
|
||||
ping 10
|
||||
ping-restart 20
|
||||
ping-timer-rem
|
||||
persist-tun
|
||||
persist-key
|
||||
|
||||
cipher AES-128-CBC
|
||||
|
||||
secret /etc/openvpn/common.key
|
||||
ifconfig $(g.host_data[tunnels][$(openvpn_tunnel.tunnel)][ip]) $(g.host_data[tunnels][$(openvpn_tunnel.tunnel)][peer])
|
||||
|
||||
user nobody
|
||||
[%CFEngine centos:: %]
|
||||
group nobody
|
||||
[%CFEngine ubuntu:: %]
|
||||
group nogroup
|
||||
|
||||
[%CFEngine has_remote:: %]
|
||||
remote $(g.host_data[tunnels][$(openvpn_tunnel.tunnel)][remote_host]) $(g.host_data[tunnels][$(openvpn_tunnel.tunnel)][remote_port])
|
||||
|
||||
[%CFEngine END %]
|
||||
{{< /highlight >}}
|
||||
|
||||
## References
|
||||
- https://docs.cfengine.com/docs/master/examples-tutorials-json-yaml-support-in-cfengine.html
|
||||
- https://docs.cfengine.com/docs/3.10/reference-functions-readyaml.html
|
||||
- https://docs.cfengine.com/docs/3.10/reference-functions-mergedata.html
|
||||
Loading…
Add table
Add a link
Reference in a new issue