copy additional files during update policy run to maintain autonomy of client if server is missing

[craigcomstock]

I have a bunch of files that don't match the "files considered for copy during policy update" patterns and many of the files don't have an extension so don't really work with that mechanism.

e.g.

files:
  "/etc/package/somefile"
    copy_from => remote_dcp("/var/cfengine/masterfiles/files/somefile", "$(sys.policy_hub)");

I see there are hooks for additional policy files and bundles to extend update policy.

I would assume this would be the "way to go" so I can add some similar remote_dcp bits for each host and ensure that the files are in place on the client so that it can fix things that get broken even if it can't reach the policy server.

Any other recommendations?

[craigcomstock]

I used the referred to hooks in masterfiles policy framework and had success.

I am using a cfbs Build project so in my cfbs.json I added a json file:

custom_update.json:

{
  "variables": {
    "default:def.update_inputs": {
      "value": [
        "services/foo/custom_update.cf"
      ]
    },
    "default:def.control_common_update_bundlesequence_end": {
      "value": [
        "foo_update_policy"
      ]
    }
  }
}

and then added it as a step to an already existing cfbs module:

        "json ./custom_update.json def.json",

I had to remember to use bodies from the update policy, mostly update_policy.cf and update/lib.cf and NOT the standard ones from masterfiles/lib/*.

So remote_dcp became u_remote_dcp_missing_ok and recurse became u_recurse.

custom_update.cf

bundle agent foo_update_policy
{
  classes:
    "foo_host" expression => fileexists("/etc/foo_host.flag");

  files:
    foo_host::
      "${sys.inputdir}/files/foo_host"
        perms => u_mog("0644", "root", "root" ),
        copy_from => u_remote_dcp_missing_ok("${sys.masterdir}/files/foo_host", "${sys.policy_hub}"),
        depth_search => u_recurse("inf");
}

So I use either a flag file, /etc/foo_host.flag, or host specific data to add default:foo_host so that this policy is only activated on hosts I want it on.

In this case the files in my policy set under files/foo_host and subdirectories are copied to /var/cfengine/inputs/files/foo_host for use anytime regardless of whether the host can still contact the hub.

QED. Thanks CFEngine. :)

[nickanderson]

So do I understand correctly that in this model you have separate update bundle per host?

The only thing that I really wanted to highlight is that as I recall, connection caching is a bundle level thing. So, it is cheaper if all of your remote copies occur within the same bundle.

So, on the copy side at least, it's more efficient to say have an update bundle per host where that bundle is only called on that host than to have an update bundle per service where a single host might have multiple services present. The former can be a bit of a management nightmare, so another alternative is to strictly use data. Have one bundle that copies these remote files based off of some variable value, and set that variable value as necessary. That way you still get the benefit of connection caching without having to have a bundle per host.