[[cfengine3]]
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docpublic:systemes:linux:cfengine3 [2013/07/19 13:03] PROCACCIA [bundlesequence] |
docpublic:systemes:linux:cfengine3 [2013/12/24 15:14] (current) procacci@tem-tsp.eu [references] |
||
|---|---|---|---|
| Line 18: | Line 18: | ||
| * http:// | * http:// | ||
| * http:// | * http:// | ||
| + | * https:// | ||
| ===== install server ===== | ===== install server ===== | ||
| Line 93: | Line 94: | ||
| ===== install client ===== | ===== install client ===== | ||
| - | here we install manually cfengine package on the client (next we'll do it automatically via cobbler) | + | here we install manually cfengine package on the client (next we'll do it |
| < | < | ||
| Line 318: | Line 319: | ||
| ==== bundlesequence ==== | ==== bundlesequence ==== | ||
| - | finally we need to tell cfengine server | + | finally we need to tell cfengine server |
| < | < | ||
| Line 385: | Line 386: | ||
| < | < | ||
| - | copy_from => secure_cp("/ | + | copy_from => secure_cp("/ |
| </ | </ | ||
| / | / | ||
| Line 396: | Line 397: | ||
| </ | </ | ||
| + | Now that " | ||
| + | < | ||
| + | [root@cfengine3 masterfiles]# | ||
| + | bundle server access_rules() | ||
| + | { | ||
| + | | ||
| + | any:: | ||
| + | # disi | ||
| + | " | ||
| + | | ||
| + | comment => "Grant access to the policy disi updates", | ||
| + | admit => { " | ||
| + | </ | ||
| otherwise you get an error on the client telling you | otherwise you get an error on the client telling you | ||
| Line 404: | Line 418: | ||
| </ | </ | ||
| + | ==== secure_cp ==== | ||
| + | I first used remote_cp instaed of secure_cp to ciopy files, howerver when the file changed on the server it wasn't replaced on the client because it was more recent ! | ||
| + | |||
| + | indeed from libraries/ | ||
| + | |||
| + | < | ||
| + | body copy_from secure_cp(from, | ||
| + | { | ||
| + | source | ||
| + | servers | ||
| + | compare | ||
| + | encrypt | ||
| + | verify | ||
| + | } | ||
| + | |||
| + | ## | ||
| + | |||
| + | body copy_from remote_cp(from, | ||
| + | { | ||
| + | servers | ||
| + | source | ||
| + | compare | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | and from https:// | ||
| + | |||
| + | |||
| + | ===== bootstrap cfengine from cobbler ===== | ||
| + | |||
| + | we use cobbler to install +100 stations (fedora) via PXEboot + kickstart. | ||
| + | in order to fully automate the install + configuration of those stations we need to tell cobbler in its post install process to install cfengine and bootstrap the client station on the cfengine server | ||
| + | |||
| + | reference | ||
| + | |||
| + | * https:// | ||
| + | * https:// | ||
| + | |||
| + | in our kickstart template we call 2 snippets to do the job | ||
| + | < | ||
| + | [root@cobbler2 cobbler]# grep disi kickstarts/ | ||
| + | $SNIPPET(' | ||
| + | $SNIPPET(' | ||
| + | </ | ||
| + | |||
| + | those snippet repectlively install cfengine and then bootstrap the client the easy way since the version 3.2.0, if you are willing to automatically accept keys from the clients , cf http:// | ||
| + | |||
| + | < | ||
| + | [root@cobbler2 snippets]# cat disi_post_install_packages | ||
| + | yum -y install cfengine-community | ||
| + | yum -y install autofs | ||
| + | |||
| + | [root@cobbler2 snippets]# cat disi_cfengine_bootstrap | ||
| + | # start cfengine3 registration | ||
| + | / | ||
| + | # end cfengine3 registration | ||
| + | </ | ||
