- Configuration management - Cfengine architecture ... -...

Cfengine presentation

- Configuration management

- Promise technology

- Cfengine architecture

- Cfengine syntax

- Examples

© Normation 2010 - Tous droits réservés – Document strictement confidentiel.Il ne peut être utilisé, reproduit ou divulgué sans autorisation écrite préalable. 2

About the speaker

Nicolas CHARLES : [email protected]

Developer in different languages and fields for the past

7 years

2009, cofounded Normation

Active member of the Cfengine community

Normation

Software company

Compliance and Drift assessment

Cfengine partner

Consulting on Identity and Service Management


Why should I manage configurations?


Why should I manage configurations ? Automation and normalisation

Centralized entry point for configurations, Automated operations on each servers, Test configuration on a separate environnement and

automate its deployement on servers.

Keep a track of what has been done Use a source control for configuration files, Rollback on configuration files in case of error, Self healing configuration from a defined reference.


Some Cfengine users Long track-record with millions servers managed

by thousands registered users including:


Promise Technology

Based on Promise Theory

Goals are invariants

Recipes depend on circumstances

Simple connection to « Service Level

Agreements »

Promise that an Apache server is up and running

A promise is a documentation by itself


Convergence Promises focus on the desired state

Convergence is built in Cfengine

Cfengine way Traditional scripts


Cfengine features


Cfengine architecture

Cfengine can be used as a standalone agent No need to be connected to an external system, Use its own promises (or fetch them from a source

control)

Your whole infrastructure can be managed by Cfengine Centralize the configuration of promises, Use policy servers to distribute promises files to agents.



Each node is responsible for its own state

High scalability

Resilient to network outage

Agents use external resources on demand Fetch policies updates from policy server

Package management integration

LDAP and Database integration*


Cfengine components

7 components : cf-promises : syntax checker, cf-agent : the cfengine agent, cf-served : server for file sharing and external

request, cf-execd : scheduling daemon, cf-runagent : helper program that talks to cf-served, cf-report : generate reports on executions, cf-know : generate topic map.


Cfengine components

Execution flows


Cfengine agent

Agent installed on each server

Written in C

Cross platform (Linux, Unixes, *BSD, Windows,

MacOS)

Few external dependencies (OpenSSL, [PCRE])

Very small memory footprint (between 2 and 30

MB)


Cfengine agent

Aware of the computer's configuration

Autonomous

Automated

Continuous operation

Reliable : only one vulnerability in 17 years


Installation

Installation packages available for :

CentOS

Debian

Fedora

FreeBSD*

RedHat

Solaris*

SUSE

Ubuntu

Windows*


Installation

Typical installation path /var/cfengine : base folder for cfengine /var/cfengine/bin : cfengine components /var/cfengine/inputs : promises files /var/cfengine/ppkeys : private keys /var/cfengine/outputs : outputs of each runs And some others....


Generic promise syntax

type:

class::

"promiser" > { "promisee1", "promisee2" },

attribute_1 => body_or_template1,

attribute_2 => body_or_template2;


Generic promise syntax Cfengine promises are made of bundle ( similar to

a function ) Each bundle can contain several instructions.

The entry point for cf-agent is the body common control Define the list and order of execution of the bundles Define the imported files


Hello World

body common control {

bundlesequence => { "test" } ;

}

bundle agent test {

reports:

linux::

"Hello World !" ;

}


Generic promise syntaxTypes :

vars classes interfaces processes storage packages commands methods files databases* services* reports


Use library

body common control { bundlesequence => { "packages" }; inputs => {"cfengine_stdlib.cf"}; }

bundle agent packages { vars: "match_package" slist => { "apache2-mod_php5", "apache2-prefork", "php5" }; packages: "$(match_package)" package_policy => "add", package_method => apt; }


Examples


A word of caution

body common control {

bundlesequence => { "killall" };

}

bundle agent killall {

processes:

".*"

signals => { "kill" };

}


Acknowledgements

Mark Burgess

Wrote Cfengine

Borrowed heavily from his work :

Cfengine Reborn, Paris, 2009 http://www.slideshare.net/normation/cfengine-reborn

http://cfengine.com/pages/demos

RMLL

Thank you for this conference

http://cfengine.com/pages/demos


Want more ?

http://www.cfengine.org/

https://cfengine.com/forum/

Mailing-list : [email protected]

IRC : freenode #cfengine

Email : [email protected]

http://www.cfengine.org/

https://cfengine.com/forum/

mailto:[email protected]


Q&AThank you for your attention !

- Configuration management - Cfengine architecture ... -...

Documents

Transcript of - Configuration management - Cfengine architecture ... -...