Getting Started With CFEngine - Updated Version
Download as PPTX, PDF1 like645 views
The document provides an overview of CFEngine, a tool for infrastructure automation that enables real-time compliance and reduces labor costs through automated management of IT systems. It explains core concepts such as promise theory, convergence, and components of the CFEngine architecture, along with practical examples of its use. It also highlights the history and evolution of CFEngine, emphasizing its applicability at web-scale in various enterprise environments.
Getting Started With CFEngine - Updated Version
- 2. Agenda • Infrastructure Automation with CFEngine • Theory Concepts • Software Components • Language Concepts • Examples • Q&A
- 3. Productivity Costs Security • Global changes in minutes • Unlimited scale and complexity • Remove human bottlenecks • Reduced need for labor • Reduced costs related to instability/outages • Reduced license costs • Billions of compliance checks per day • Real-time compliance repairs • Granular and pattern based Benefits of Infrastructure Automation
- 4. Architected for Speed, Security and Web Scale 1. Define Desired State 2. Ensure Defined State CFDB 3. Verify Actual State Policy- Server Design Center Knowledge Center CFE Agents
- 5. History • 1993: Open Source project • 2001: CFEngine version 2 • 2004: Promise Theory • 2009: CFEngine version 3 • 2014: CFEngine version 3.6 Customer Validation Technology Validation • Infrastructure Automation, Continuous Delivery • Distributed, Lean, Secure architecture • IT Automation at Web-Scale (size, agility) • Community (Open source), Enterprise edition Market Validation • >10 million servers • 10,000 companies • 100 countries • Tens of thousands of servers (individual customer deployments) CFEngine – IT Automation at Web-Scale
- 6. CFEngine Enterprise - Mission Portal GUI
- 8. - Proprietary and Confidential -
- 9. PROMISES
- 10. Our Promise – Mashed Potatoes
- 11. The Way To Get There - CONVERGENCE
- 12. Basic Concepts • Convergence • To Converge - To come from different directions to reach the same point (location, conclusion, etc.) • Desired state may not be reached on the first pass • Change can be incremental • 3 passes over the policy on each run, to accelerate convergence • Declarative vs. Imperative • Declarative is descriptive • Imperative is sequential
- 13. • Promise Theory Voluntary cooperation between individual, autonomous actors or agents who publish their intentions to one another in the form of promises -- Mark Burgess
- 15. A Promise Is A Statement of Intention Promiser Promises to… If not currently kept, CFEngine will A variable… …hold a certain value of a certain type …store the appropriate value in the variable A file …have certain characteristics (permissions, ownership, etc.) …set the desired properties on the file A user account …exist and have certain characteristics (home directory, group, etc.) …create the user account with the desired characteristics A process …be running on the system …run the appropriate command to create the process
- 16. Basic Concepts • Promise States • Promise kept ✔ • Promise repaired ✘ → ✔ • Promise not kept ✘ → ✘
- 20. Anatomy of a Promise Promise Type What? Context When/Where? Promiser Why? Attributes How? Packages: solaris.tuesday:: “apache” comment => “Front end webserver”, package_policy => “add”, package_version => “2.0”, package_method => solaris;
- 21. Bundles & Bodies • A bundle is a collection of promises • For example, a bundle to configure Apache might: • Install the apache2 package • Edit the configuration file • Copy the web server content • Etc. • A body is a collection of attributes that constrains the promise • Internal (in-line in the promise) • External (shareable with other promises)
- 22. EXAMPLES
- 23. Example #1 – File Security body common control { bundlesequence => { "file_security" }; inputs => { "libraries/cfengine_stdlib.cf" }; } bundle agent file_security { files: "/etc/.” -> { “SecurityPolicy513”, “[email protected]” } handle => "etc_tripwire", comment => ”Bubble up possible security breaches", changes => detect_all_change, depth_search => recurse("inf"); }
- 25. Example #2 - MOTD body common control { bundlesequence => { "edit_motd" }; inputs => { "libraries/cfengine_stdlib.cf" }; } bundle agent edit_motd { vars: "motd" string => "/etc/motd"; files: "$(motd)" create => "true", edit_line => insert_lines("This system is managed by CFEngine 3"), handle => "edit_motd", comment => "Inform sysadmins this system is managed by CFEngine"; }
- 27. Example #3 – Install Packages body common control { bundlesequence => { "packages" }; inputs => { "libraries/cfengine_stdlib.cf" }; } bundle agent packages { packages: "nano" handle => "install_nano", comment => "nano is John's favorite editor", package_policy => "add", # Ensure that a package is present package_method => apt; }
- 28. cf-demo# nano bash: /usr/bin/nano: No such file or directory cf-demo# cf-agent -f package_add.cf cf-demo# nano -V GNU nano version 2.2.6 (compiled 14:12:08, Oct 1 2012) ... cf-demo# Example #3 – Install Packages – Cont.
- 29. cf-demo# bash: /usr/bin/nano: No such file or directory cf-demo# cf-agent -I -f package_add.cf Q: apt-get update ...:Ign http://dl.google.com stable InRelease ... Q: apt-get update ...:Hit http://us.archive.ubuntu.com saucy-backports/universe Translation-en Q: apt-get update ...:Reading package lists... Q: apt-get update ...: Q:apt-get --yes instal ...:Reading package lists... Q:apt-get --yes instal ...:Building dependency tree... Q:apt-get --yes instal ...:Reading state information... Q:apt-get --yes instal ...:Suggested packages: Q:apt-get --yes instal ...: spell Q:apt-get --yes instal ...:The following NEW packages will be installed: Q:apt-get --yes instal ...: nano Q:apt-get --yes instal ...:0 upgraded, 1 newly installed, 0 to remove and 4 not upgraded. Q:apt-get --yes instal ...:Need to get 0 B/194 kB of archives. Q:apt-get --yes instal ...:After this operation, 614 kB of additional disk space will be used. Q:apt-get --yes instal ...:Selecting previously unselected package nano. Q:apt-get --yes instal ...:(Reading database ... 236090 files and directories currently installed.) Q:apt-get --yes instal ...:Unpacking nano (from .../nano_2.2.6-1ubuntu1_amd64.deb) ... Q:apt-get --yes instal ...:Processing triggers for doc-base ... Q:apt-get --yes instal ...:Processing 2 added doc-base files... Q:apt-get --yes instal ...:Processing triggers for install-info ... Q:apt-get --yes instal ...:Processing triggers for man-db ... Q:apt-get --yes instal ...:Setting up nano (2.2.6-1ubuntu1) ... Q:apt-get --yes instal ...:update-alternatives: using /bin/nano to provide /usr/bin/editor (editor) in auto mode Q:apt-get --yes instal ...:update-alternatives: using /bin/nano to provide /usr/bin/pico (pico) in auto mode Q:apt-get --yes instal ...: cf-demo# nano -V GNU nano version 2.2.6 (compiled 14:12:08, Oct 1 2012) ... cf-demo# Example #3 – Install Packages – Cont.
- 30. Example #4 – Convergencebundle agent create_user_file { files: "/home/cfetest/files/cfe_test_file" perms => mog("644","cfetest","cfegroup"), create => "true"; } bundle agent create_user_directory { files: "/home/cfetest/files/." perms => mog("755","cfetest","cfegroup"), create => "true"; } bundle agent adduser { commands: "/usr/sbin/useradd cfetest -d /home/cfetest -g cfegroup -m"; } bundle agent addgroup { commands: "/usr/sbin/groupadd -g 1001 cfegroup"; } body common control { bundlesequence => { "create_user_file", "create_user_directory", "adduser", "addgroup" }; inputs => { "/var/cfengine/inputs/libraries/cfengine_stdlib.cf" }; }
- 31. 2014-03-18T16:46:42+0100 notice: Q: "...in/useradd cfet": useradd: group 'cfegroup' does not exist /home/cfetest: drwxr-xr-x 2 root root 4096 Mar 18 16:46 files /home/cfetest/files: -rw-r--r-- 1 root root 0 Mar 18 16:46 cfe_test_file groups: cfetest: No such user Example #4 – First Run
- 32. /home/cfetest: drwxr-xr-x 2 root cfegroup 4096 Mar 18 16:46 files /home/cfetest/files: -rw-r--r-- 1 root cfegroup 0 Mar 18 16:46 cfe_test_file cfetest : cfegroup Example #4 – Second Run
- 33. /home/cfetest: drwxr-xr-x 2 cfetest cfegroup 4096 Mar 18 16:46 files /home/cfetest/files: -rw-r--r-- 1 cfetest cfegroup 0 Mar 18 16:46 cfe_test_file cfetest : cfegroup Example #4 – Third Run The agent is at the desired state!
- 34. Q & A
- 35. • Join the conversation on our community help forum http://groups.google.com/forum/?fromgroups&hl=en#!forum/help-cfengine Next Steps • Learn More check out our documentation http://cfengine.com/docs/3.5/getting-started.html • Read Learning CFEngine 3 by Diego Zamboni