main.cf (d8ead41cb0b258116a0b3b1ce74753512d6ded8fe1837e34d6083852995674ba)

7 kB, 192 lines, CFEngine policy:

bundle agent cfe_internal_core_main
{
  methods:

    !mpf_auto_am_policy_hub_state_disabled::

      "Verify policy hub state" -> { "CFE-3073" }
        usebundle => mpf_auto_am_policy_hub_state,
        if => not( fileexists( "$(sys.statedir)/am_policy_hub" ));

    any::

#   NB! On a container host this may kill CFEngine processes inside containers.
#       See https://dev.cfengine.com/issues/6906

    !mpf_disable_cfe_internal_limit_robot_agents::
      "Limit concurrent agents" -> { "CFE-1799" }
        usebundle => cfe_internal_limit_robot_agents,
        handle => "cfe_internal_management_limit_cfe_agents",
        comment => "Manage CFE processes";

    any::

      "any"
        usebundle => cfe_internal_log_rotation,
        handle => "cfe_internal_management_log_rotation",
        comment => "Rotate CFEngine logs so we don't fill the disk";

    cfe_internal_core_watchdog_disabled::

      "Disable Core Watchdog"
        usebundle => cfe_internal_core_watchdog("disabled");

    cfe_internal_core_watchdog_enabled::

      "Enable Core Watchdog"
        usebundle => cfe_internal_core_watchdog("enabled");

    mpf_augments_control_enabled::
      "mpf_augments_control"
        usebundle => mpf_augments_control;

}

bundle agent mpf_auto_am_policy_hub_state
# @brief Ensure that `$(sys.statedir)/am_policy_hub` file is present when expected
{
  files:

      # We think we are a policy hub if the policy server (the host you
      # bootstrapped to) resolves to an IP found on the host. This is intended
      # to prevent accidental removal of the am_policy_hub state file.

      "$(sys.statedir)/am_policy_hub"
        create => "true",
        if => some( escape( $(sys.policy_server) ), @(sys.ipaddresses) );

}
bundle agent mpf_augments_control
# @brief Restart cfenigne components when one of the control variables has changed.
#
# While the agent itsef will reload its config upon notice of policy change
# this bundle specifically handles changes to variables used in the MPF which may
# come from external data sources which are unknown to the components themselves.
{

@if minimum_version(3.10)

      # This policy leverages variablesmatching_as_data() (available since
      # 3.10.0) and the -top- mustache extension (available since 3.9.0).

  vars:

      # Variables and their data which might necessitate a component restart
      "server_controls"   data => variablesmatching_as_data("default:def.control_server_.*");
      "executor_controls" data => variablesmatching_as_data("default:def.control_executor_.*");
      "monitor_controls"  data => variablesmatching_as_data("default:def.control_monitor_.*");
      "hub_controls"      data => variablesmatching_as_data("default:def.control_hub_.*");
      "runagent_controls" data => variablesmatching_as_data("default:def.control_runagent_.*");

      "common_controls"   data => variablesmatching_as_data("default:def.control_common_.*");
      "agent_controls"    data => variablesmatching_as_data("default:def.control_agent_.*");

      # Serialized data for tracking state
      "server_controls_state"   string => string_mustache("{{$-top-}}", server_controls);
      "executor_controls_state" string => string_mustache("{{$-top-}}", executor_controls);
      "monitor_controls_state"  string => string_mustache("{{$-top-}}", monitor_controls);
      "hub_controls_state"      string => string_mustache("{{$-top-}}", hub_controls);
      "runagent_controls_state" string => string_mustache("{{$-top-}}", runagent_controls);

      "common_controls_state"   string => string_mustache("{{$-top-}}", common_controls);
      "agent_controls_state"    string => string_mustache("{{$-top-}}", agent_controls);

  files:

      "$(sys.workdir)$(const.dirsep)state$(const.dirsep)mpf_hub_controls"
        create => "true",
        edit_line => insert_lines( $(hub_controls_state) ),
        edit_defaults => empty,
        classes => results("bundle", "hub_controls" );

      "$(sys.workdir)$(const.dirsep)state$(const.dirsep)mpf_server_controls"
        create => "true",
        edit_line => insert_lines( $(server_controls_state) ),
        edit_defaults => empty,
        classes => results("bundle", "server_controls" );

      "$(sys.workdir)$(const.dirsep)state$(const.dirsep)mpf_monitor_controls"
        create => "true",
        edit_line => insert_lines( $(monitor_controls_state) ),
        edit_defaults => empty,
        classes => results("bundle", "monitor_controls" );

      "$(sys.workdir)$(const.dirsep)state$(const.dirsep)mpf_executor_controls"
        create => "true",
        edit_line => insert_lines( $(executor_controls_state) ),
        edit_defaults => empty,
        classes => results("bundle", "executor_controls" );

      "$(sys.workdir)$(const.dirsep)state$(const.dirsep)mpf_runagent_controls"
        create => "true",
        edit_line => insert_lines( $(runagent_controls_state) ),
        edit_defaults => empty,
        classes => results("bundle", "runagent_controls" );

      # Note a change in common controls is not expected to trigger any
      # component restart, its simply tracked for completeness.

      "$(sys.workdir)$(const.dirsep)state$(const.dirsep)mpf_common_controls"
        create => "true",
        edit_line => insert_lines( $(common_controls_state) ),
        edit_defaults => empty,
        classes => results("bundle", "common_controls" );

    # No need to restart cf-agent it as its not long running. We simply track the details for completeness.

      "$(sys.workdir)$(const.dirsep)state$(const.dirsep)mpf_agent_controls"
        create => "true",
        edit_line => insert_lines( $(agent_controls_state) ),
        edit_defaults => empty,
        classes => results("bundle", "agent_controls" );

  services:

    systemd::

      "cf-serverd"
        service_policy => "restart",
        if => "(server_controls_repaired|runagent_controls_repaired)";

      "cf-monitord"
        service_policy => "restart",
        if => "monitor_controls_repaired";

    systemd.enterprise_edition.(am_policy_hub|policy_server)::

      "cf-hub"
        service_policy => "restart",
        if => "hub_controls_repaired";


      # Well, this is dangerous we might kill our own agent
      # "cf-execd"
      #   service_policy => "restart",
      #   if => "(execd_controls_repaired|runagent_controls_repaired)";

  processes:

       !systemd::

         "cf-serverd"
           signals => { "term" },
           if => "(server_controls_repaired|runagent_controls_repaired)";

         "cf-monitord"
           signals => { "term" },
           if => "monitor_controls_repaired";

    systemd.enterprise_edition.(am_policy_hub|policy_server)::

      "cf-hub"
        signals => { "term" },
        if => "hub_controls_repaired";


       # Well, this is dangerous we might kill our own agent
       #  "cf-execd"
       #    signals => { "term" },
       #    if => "(execd_controls_repaired|runagent_controls_repaired)";

@endif
}