Table of Contents
controls/def.cf
Table of Contents
This is where most common variables and classes are defined. Note its variable scope can be augmented with def.json.
common bodies
def
Prototype: def
Description: Common settings for the Masterfiles Policy Framework
Implementation:
bundle common def
{
vars:
any::
"augments_inputs"
slist => {},
if => not( isvariable( "augments_inputs" ) ),
comment => "It's important that we define this list, even if it's empty
or we get errors about the list being unresolved.";
# Your domain name, for use in access control
# Note: this default may be inaccurate!
"domain"
string => "$(sys.domain)",
comment => "Define a global domain for all hosts",
handle => "common_def_vars_domain",
if => not(isvariable("domain"));
# Mail settings used by body executor control found in controls/cf_execd.cf
"mailto"
string => "root@$(def.domain)",
if => not(isvariable("mailto"));
"mailfrom"
string => "root@$(sys.uqhost).$(def.domain)",
if => not(isvariable("mailfrom"));
"smtpserver"
string => "localhost",
if => not(isvariable("smtpserver"));
# List here the IP masks that we grant access to on the server
"acl"
slist => {
# Allow everything in my own domain.
# Note that this:
# 1. requires def.domain to be correctly set
# 2. will cause a DNS lookup for every access
# ".*$(def.domain)",
# Assume /16 LAN clients to start with
"$(sys.policy_hub)/16",
# Uncomment below if HA is used
#"@(def.policy_servers)"
# "2001:700:700:3.*",
# "217.77.34.18",
# "217.77.34.19",
},
comment => "Define an acl for the machines to be granted accesses",
handle => "common_def_vars_acl",
if => and(not(isvariable("override_data_acl")), not(isvariable("acl"))),
meta => { "defvar" };
# Out of the hosts in allowconnects, trust new keys only from the
# following ones. This is open by default for bootstrapping.
"trustkeysfrom"
slist => {
# COMMENT THE NEXT LINE OUT AFTER ALL MACHINES HAVE BEEN BOOTSTRAPPED.
"0.0.0.0/0", # allow any IP
},
comment => "Define from which machines keys can be trusted",
if => and(not(isvariable("override_data_trustkeysfrom")),
not(isvariable("trustkeysfrom"))),
meta => { "defvar" };
## List of the hosts not using the latest protocol that we'll accept connections from
## (absence of this option or empty list means allow none)
"control_server_allowlegacyconnects"
slist => {},
if => not( isvariable( "control_server_allowlegacyconnects" ) );
# Users authorized to request executions via cf-runagent
"control_server_allowusers_non_policy_server"
slist => { "root" },
if => not( isvariable( "control_server_allowusers_non_policy_server" ) );
"control_server_allowusers_policy_server"
slist => {},
if => not( isvariable( "control_server_allowusers_policy_server" ) );
policy_server::
"control_server_allowusers" -> { "CFE-3544", "ENT-6666" }
handle => "def_control_server_allowusers_policy_server",
slist => { @(control_server_allowusers_policy_server) },
meta => { "inventory", "attribute_name=Allowed users for cf-runagent" },
if => not(isvariable("control_server_allowusers"));
!policy_server::
"control_server_allowusers" -> { "CFE-3544", "ENT-6666" }
handle => "def_control_server_allowusers_non_policy_server",
slist => { @(control_server_allowusers_non_policy_server) },
meta => { "inventory", "attribute_name=Allowed users for cf-runagent" },
if => not(isvariable("control_server_allowusers"));
# Executor controls
any::
"mpf_admit_cf_runagent_shell_selected" -> { "ENT-6673", "ENT-6666" }
handle => "mpf_admit_cf_runagent_shell_default",
if => not( isvariable( "mpf_admit_cf_runagent_shell" )),
slist => { @(def.policy_servers) },
meta => { "inventory", "attribute_name=Allowed hosts for cf-runagent", "derived-from=def.policy_servers" },
comment => concat( "By default we admit our policy servers to initiate",
"agent runs via cf-runagent");
"mpf_admit_cf_runagent_shell_selected" -> { "ENT-6673", "ENT-6666" }
handle => "mpf_admit_cf_runagent_shell_augments",
if => isvariable( "mpf_admit_cf_runagent_shell" ),
slist => { @(def.mpf_admit_cf_runagent_shell) },
meta => { "inventory", "attribute_name=Allowed hosts for cf-runagent", "derived-from=def.mpf_admit_cf_runagent_shell" },
comment => concat( "Users can override the default set of hosts that ",
"can initiate agent runs via cf-runagent.");
# Executor Controls
## Default splaytime to 4 unless it's already defined (via augments)
"control_executor_splaytime"
string => "4",
if => not( isvariable( "control_executor_splaytime" ) ),
comment => "Splaytime controls the number of minutes hosts execution
should be splayed over. This value should be less than the
number of minutes between scheduled executions";
## Default agent_expireafter to 120 unless it's already defined (via augments)
"control_executor_agent_expireafter" -> { "ENT-4208" }
string => "120",
if => not( isvariable( "control_executor_agent_expireafter" ) ),
comment => "This controls the number of minutes after no data has been
recieved by cf-execd from a cf-agent process before that
cf-agent process is killed.";
## Default schedule unless it's already defined (via augments)
"control_executor_schedule_value"
slist => {
"Min00", "Min05", "Min10", "Min15",
"Min20", "Min25", "Min30", "Min35",
"Min40", "Min45", "Min50", "Min55",
},
if => not( isvariable( control_executor_schedule) ),
comment => "This variable defines the list of classes that should
trigger exec_command if any of them are defined.";
# schedule cant use a data structure directly, so we must use an
# intermediary variable to convert it to list
"control_executor_schedule_value"
slist => getvalues(control_executor_schedule),
if => not( isvariable( control_executor_schedule_value) ),
comment => "This variable defines the list of classes that should
trigger exec_command if any of them are defined.";
# Users allowed on sockets
# Set the users allowed by default, if not already set (e.g. via augments)
"control_executor_runagent_socket_allow_users"
slist => { "cfapache" },
unless => isvariable( $(this.promiser) ),
if => and( "enterprise_edition", "am_policy_hub");
# Agent Controls
"control_agent_abortclasses" -> { "ENT-4823" }
slist => { },
comment => "The control body has a variable, so a valid list must be defined or the agent will error",
if => not( isvariable( $(this.promiser) ));
"control_agent_abortbundleclasses" -> { "ENT-4823" }
slist => { "abortbundle" },
comment => "The control body has a variable, so a valid list must be defined or the agent will error",
if => not( isvariable( $(this.promiser) ));
"control_agent_default_repository"
string => ifelse( isvariable( "control_agent_default_repository"),
$(control_agent_default_repository),
"$(sys.workdir)/backups"),
if => "mpf_control_agent_default_repository";
"control_agent_maxconnections"
int => "30",
if => not( isvariable( "control_agent_maxconnections" ) );
# Because in some versions of cfengine bundlesequence in body common
# control does not support does not support iteration over data containers
# we must first pick out the bundles into a shallow container that we can
# then get a regular list from using getvalues().
"tbse" data => mergedata( "def.control_common_bundlesequence_end" );
"bundlesequence_end" slist => getvalues( tbse );
"tbse" data => mergedata( "def.control_common_bundlesequence_classification" );
"bundlesequence_classification" slist => getvalues( tbse );
"control_common_ignore_missing_bundles" -> { "CFE-2773" }
string => ifelse( strcmp( $(control_common_ignore_missing_bundles), "true" ),
"true",
"false");
"control_common_ignore_missing_inputs" -> { "CFE-2773" }
string => ifelse( strcmp( $(control_common_ignore_missing_inputs), "true" ),
"true",
"false");
# Agent controls
@if minimum_version(3.18.0)
# TODO When 3.18 is the oldest supported LTS, redact this macro and associated protections
"control_agent_files_single_copy" -> { "CFE-3622" }
slist => { },
if => not( isvariable( "control_agent_files_single_copy" ) ),
comment => "Default files_single_copy to an empty list if it is not
defined. It is expected that users can override the default
by setting this value from the augments file (def.json).";
@endif
"control_server_maxconnections"
int => "200",
if => not( isvariable( "control_server_maxconnections" ) );
debian::
"environment_vars"
handle => "common_def_vars_environment_vars",
comment => "Environment variables of the agent process. The values
of environment variables are inherited by child commands.",
slist => {
"DEBIAN_FRONTEND=noninteractive",
# "APT_LISTBUGS_FRONTEND=none",
# "APT_LISTCHANGES_FRONTEND=none",
};
# End change #
any::
"dir_masterfiles" string => translatepath("$(sys.masterdir)"),
comment => "Define masterfiles path",
handle => "common_def_vars_dir_masterfiles";
"dir_reports" string => translatepath("$(sys.workdir)/reports"),
comment => "Define reports path",
handle => "common_def_vars_dir_reports";
"dir_bin" string => translatepath("$(sys.bindir)"),
comment => "Define binary path",
handle => "common_def_vars_dir_bin";
"dir_data"
string => ifelse( isvariable( "def.dir_data"),
$(def.dir_data),
"$(sys.workdir)/data"),
comment => "Define data path",
handle => "common_def_vars_dir_data";
"dir_modules" string => translatepath("$(sys.workdir)/modules"),
comment => "Define modules path",
handle => "common_def_vars_dir_modules";
# TODO: Remove after 3.15 is no longer supported (December 18th 2022)
"dir_plugins" -> { "CFE-3618" }
string => translatepath("$(sys.workdir)/plugins"),
comment => "Define plugins path",
handle => "common_def_vars_dir_plugins";
"dir_templates"
string => ifelse( isvariable( "def.dir_templates"),
$(def.dir_templates),
"$(sys.workdir)/templates"),
comment => "Define templates path",
handle => "common_def_vars_dir_templates";
"cf_apache_user" string => "cfapache",
comment => "User that CFEngine Enterprise webserver runs as",
handle => "common_def_vars_cf_cfapache_user";
"cf_apache_group" string => "cfapache",
comment => "Group that CFEngine Enterprise webserver runs as",
handle => "common_def_vars_cf_cfapache_group";
policy_server|am_policy_hub::
# Only hubs serve software updates
"dir_master_software_updates" -> { "ENT-4953" }
string => "$(sys.workdir)/master_software_updates",
handle => "common_def_vars_dir_serve_master_software_updates",
comment => "Path where software updates are served from the policy hub.
This variable is overridable via augments as
vars.dir_master_software_updates. All remote agents request this path
via the master_software_updates shortcut.",
if => not( isvariable( "def.dir_master_software_updates" ));
solaris::
"cf_runagent_shell"
string => "/usr/bin/sh",
comment => "Define path to shell used by cf-runagent",
handle => "common_def_vars_solaris_cf_runagent_shell";
!(windows|solaris)::
"cf_runagent_shell"
string => "/bin/sh",
comment => "Define path to shell used by cf-runagent",
handle => "common_def_vars_cf_runagent_shell";
any::
"base_log_files" slist =>
{
"$(sys.workdir)/cf3.$(sys.uqhost).runlog",
"$(sys.workdir)/promise_summary.log",
};
"enterprise_log_files" slist =>
{
"$(sys.workdir)/cf_notkept.log",
"$(sys.workdir)/cf_repair.log",
"$(sys.workdir)/state/cf_value.log",
"$(sys.workdir)/outputs/dc-scripts.log",
"$(sys.workdir)/state/promise_log.jsonl",
"$(sys.workdir)/state/classes.jsonl",
};
"hub_log_files" slist =>
{
"$(sys.workdir)/httpd/logs/access_log", # Mission Portal
"$(sys.workdir)/httpd/logs/error_log", # Mission Portal
"/var/log/postgresql.log",
};
"max_client_history_size" -> { "cf-hub", "CFEngine Enterprise" }
int => "50M",
unless => isvariable(max_client_history_size),
comment => "The threshold of report diffs which will trigger purging of
diff files.";
enterprise.!am_policy_hub::
# CFEngine's own log files
"cfe_log_files" slist => { @(base_log_files), @(enterprise_log_files) };
enterprise.am_policy_hub::
# CFEngine's own log files
"cfe_log_files" slist => { @(base_log_files), @(enterprise_log_files), @(hub_log_files) };
!enterprise::
# CFEngine's own log files
"cfe_log_files" slist => { @(base_log_files) };
# Directories where logs are rotated and old files need to be purged.
any::
"log_dir[outputs]" string => "$(sys.workdir)/outputs";
"log_dir[reports]" string => "$(sys.workdir)/reports";
# TODO ENT-6845 - move package module logs to $(sys.workdir)/log/something
windows::
"log_dir[package_logs]" string => "$(const.dirsep)cfengine_package_logs";
enterprise.am_policy_hub::
"log_dir[application]" string => "$(sys.workdir)/httpd/htdocs/application/logs";
any::
"cfe_log_dirs" slist => getvalues( log_dir );
# MPF controls
"mpf_log_dir_retention"
string => "30",
if => not( isvariable ( mpf_log_dir_retention ) ),
comment => "The default log file retention in cfe_log_dirs is 30 days
unless it's already been defined (augments).";
"mpf_log_file_retention"
string => "10",
if => not( isvariable( mpf_log_file_retention) ),
comment => "This is the number of rotated versions of mpf log files to
save";
"mpf_log_file_max_size"
string => "1M",
if => not( isvariable( mpf_log_file_max_size) ),
comment => "When individual mpf log files reach this size they should be
rotated so that we don't fill up the disk";
"purge_scheduled_reports_older_than_days" -> { "ENT-4404" }
string => "30",
if => not( isvariable( purge_scheduled_reports_older_than_days ) ),
comment => "This controls the maximum age of artifacts generated by the
asynchronous query API and scheduled reports.";
"mpf_extra_autorun_inputs" -> { "CFE-3524" }
slist => {},
unless => isvariable( $(this.promiser) );
# Enterprise HA Related configuration
# enable_cfengine_enterprise_hub_ha is defined below
# Disabled by default
enable_cfengine_enterprise_hub_ha::
"standby_servers" slist => filter("$(sys.policy_hub)", "ha_def.ips", false, true, 10);
"policy_servers" slist => { "$(sys.policy_hub)", "@(standby_servers)" };
!enable_cfengine_enterprise_hub_ha::
"policy_servers" slist => {"$(sys.policy_hub)"};
enterprise_edition.policy_server::
"control_hub_exclude_hosts"
slist => { "" },
unless => isvariable(control_hub_exclude_hosts);
"control_hub_hub_schedule"
comment => "By default Enterprise hubs initiate pull collection once every 5 minutes.",
slist => { "Min00", "Min05", "Min10", "Min15", "Min20",
"Min25", "Min30", "Min35", "Min40", "Min45",
"Min50", "Min55" },
unless => isvariable(control_hub_hub_schedule);
"control_hub_query_timeout"
comment => "Configurable timeout for cf-hub outgoing connections",
string => "0", # 0 = default is set by cf-hub binary
unless => isvariable(control_hub_query_timeout);
"control_hub_port"
comment => "cf-hub performs pull collection on port 5308, unless
overridden by augments",
string => "5308",
unless => isvariable(control_hub_port);
"control_hub_client_history_timeout"
comment => "cf-hub instructs clients to discard reports older than this
many hours to avoid a condition where a build up of reports
causes a client to never be fully collected from",
string => "6",
unless => isvariable(control_hub_port);
"mpf_access_rules_collect_calls_admit_ips"
slist => { @(def.acl) },
unless => isvariable(mpf_access_rules_collect_calls_admit_ips);
enterprise_edition.client_initiated_reporting_enabled::
"control_server_call_collect_interval"
string => "5",
unless => isvariable(control_server_call_collect_interval);
"control_server_collect_window" -> { "ENT-4102" }
string => "30",
unless => isvariable(control_server_collect_window);
enterprise_edition.policy_server::
"default_data_select_host_monitoring_include"
comment => "Most people have monitoring systems, so instead of collecting data people won't use we save the work unless its requested.",
slist => { },
unless => isvariable( default_data_select_host_monitoring_include );
"default_data_select_policy_hub_monitoring_include"
comment => "Collect all the monitoring data from the hub itself. It can be useful in diagnostics.",
slist => { ".*" },
unless => isvariable( default_data_select_policy_hub_monitoring_include );
classes:
"_have_control_agent_files_single_copy" -> { "CFE-3622"}
expression => isvariable( "def.control_agent_files_single_copy" );
"_have_control_executor_runagent_socket_allow_users"
expression => isvariable( "def.control_executor_runagent_socket_allow_users" );
"cfengine_recommendations_enabled"
expression => "!cfengine_recommendations_disabled";
### Enable special features policies. Set to "any" to enable.
# Auto-load files in "services/autorun" and run bundles tagged "autorun".
# Disabled by default!
"services_autorun" -> { "jira:CFE-2135" }
comment => "This class enables the automatic parsing running of bundles
tagged with 'autorun'. Evaluation limitations require that
this class is set at the beginning of the agent run, so it
must be defined in the augments file (def.json), or as an
option to the agent with --define or -D. Changing the
expression here will *NOT* work correctly. Setting the class
here will result in an error due to the autorun bundle not
being found.",
expression => "!any";
# Internal CFEngine log files rotation
"cfengine_internal_rotate_logs" expression => "any";
# Enable or disable agent email output (also see mailto, mailfrom and
# smtpserver)
"cfengine_internal_agent_email" expression => "any";
"cfengine_internal_disable_agent_email" expression => "!any";
# Enable or disable external watchdog to ensure cf-execd is running
"cfe_internal_core_watchdog_enabled" expression => "!any";
"cfe_internal_core_watchdog_disabled" expression => "!any";
# Transfer policies and binaries with encryption
# you can also request it from the command line with
# -Dcfengine_internal_encrypt_transfers
# NOTE THAT THIS CLASS ALSO NEEDS TO BE SET IN update.cf
"cfengine_internal_encrypt_transfers" expression => "!any";
# Do not purge policies that don't exist on the server side.
# you can also request it from the command line with
# -Dcfengine_internal_purge_policies_disabled
# NOTE THAT THIS CLASS ALSO NEEDS TO BE SET IN update.cf
"cfengine_internal_purge_policies_disabled" expression => "!any";
# Preserve permissions of the policy server's masterfiles.
# you can also request it from the command line with
# -Dcfengine_internal_preserve_permissions
# NOTE THAT THIS CLASS ALSO NEEDS TO BE SET IN update.cf
"cfengine_internal_preserve_permissions" expression => "!any";
# Class defining which versions of cfengine are (not) supported
# by this policy version.
# Also note that this policy will only be run on enterprise policy_server
"postgresql_maintenance_supported"
expression => "(policy_server.enterprise.!enable_cfengine_enterprise_hub_ha)|(policy_server.enterprise.enable_cfengine_enterprise_hub_ha.hub_active)";
# This class is for PosgreSQL maintenance
# pre-defined to every Sunday at 2 a.m.
# This can be changed later on.
"postgresql_full_maintenance" expression => "postgresql_maintenance_supported.Sunday.Hr02.Min00_05";
# Run vacuum job on database
# pre-defined to every night except Sunday when full cleanup is executed.
"postgresql_vacuum" expression => "postgresql_maintenance_supported.!Sunday.Hr02.Min00_05";
# Enable CFEngine Enterprise HA Policy
"enable_cfengine_enterprise_hub_ha" expression => "!any";
#"enable_cfengine_enterprise_hub_ha" expression => "enterprise_edition";
# Enable failover to node which is outside cluster
#"failover_to_replication_node_enabled" expression => "enterprise_edition";
# Enable cleanup of agent report diffs when they exceed
# `def.max_client_history_size`
"enable_cfe_internal_cleanup_agent_reports" -> { "cf-hub", "CFEngine Enterprise" }
expression => "enterprise_edition",
comment => "If reports are not collected for an extended period of time
the disk may fill up or cause additional collection
issues.";
# Enable paths to POSIX tools instead of native tools when possible.
"mpf_stdlib_use_posix_utils" expression => "any";
# TODO Remove from MPF after 3.12 EOL
"cfredis_in_enterprise" -> { "ENT-2797" }
or => { "cfengine_3_7", "cfengine_3_8", "cfengine_3_9", "cfengine_3_10", "cfengine_3_11" };
"cfconsumer_in_enterprise" -> { "ENT-2797" }
or => { "cfengine_3_7", "cfengine_3_8", "cfengine_3_9", "cfengine_3_10", "cfengine_3_11" };
}
inventory_control
Prototype: inventory_control
Description: Inventory control bundle
This common bundle is for controlling whether some inventory bundles are disabled.
Implementation:
bundle common inventory_control
{
vars:
"lldpctl_exec" string => ifelse(fileexists("/usr/sbin/lldpctl"), "/usr/sbin/lldpctl",
fileexists("/usr/local/bin/lldpctl"), "/usr/local/bin/lldpctl",
"/usr/sbin/lldpctl");
"lldpctl_json" string => "$(lldpctl_exec) -f json",
unless => isvariable("def.lldpctl_json");
"lldpctl_json" string => "$(def.lldpctl_json)",
if => isvariable("def.lldpctl_json");
"lsb_exec" string => "/usr/bin/lsb_release";
"mtab" string => "/etc/mtab";
"proc" string => "/proc";
vars:
freebsd::
"dmidecoder" string => "/usr/local/sbin/dmidecode";
!freebsd::
"dmidecoder" string => "/usr/sbin/dmidecode";
classes:
# setting this disables all the inventory modules except package_refresh
"disable_inventory" expression => "!any";
# disable specific inventory modules below
# by default disable the LSB inventory if the general inventory
# is disabled or the binary is missing. Note that the LSB
# binary is typically not very fast.
"disable_inventory_lsb" expression => "disable_inventory";
"disable_inventory_lsb" not => fileexists($(lsb_exec));
# by default disable the dmidecode inventory if the general
# inventory is disabled or the binary does not exist. Note that
# typically this is a very fast binary.
"disable_inventory_dmidecode" expression => "disable_inventory";
"disable_inventory_dmidecode" not => fileexists($(dmidecoder));
# by default disable the LLDP inventory if the general inventory
# is disabled or the binary does not exist. Note that typically
# this is a reasonably fast binary but still may require network
# I/O.
"disable_inventory_LLDP" expression => "disable_inventory";
"disable_inventory_LLDP" not => fileexists($(lldpctl_exec));
# by default run the package inventory refresh every time, even
# if disable_inventory is set
"disable_inventory_package_refresh" expression => "!any";
# by default disable the mtab inventory if the general inventory
# is disabled or $(mtab) is missing. Note that this is very
# fast.
"disable_inventory_mtab" expression => "disable_inventory";
"disable_inventory_mtab" not => fileexists($(mtab));
# by default disable the fstab inventory if the general
# inventory is disabled or $(sys.fstab) is missing. Note that
# this is very fast.
"disable_inventory_fstab" expression => "disable_inventory";
"disable_inventory_fstab" not => fileexists($(sys.fstab));
# by default disable the proc inventory if the general
# inventory is disabled or /proc is missing. Note that
# this is typically fast.
"disable_inventory_proc" expression => "disable_inventory|freebsd";
"disable_inventory_proc" not => isdir($(proc));
reports:
verbose_mode.disable_inventory::
"$(this.bundle): All inventory modules disabled";
verbose_mode.!disable_inventory_lsb::
"$(this.bundle): LSB module enabled";
verbose_mode.!disable_inventory_dmidecode::
"$(this.bundle): dmidecode module enabled";
verbose_mode.!disable_inventory_LLDP::
"$(this.bundle): LLDP module enabled";
verbose_mode.!disable_inventory_mtab::
"$(this.bundle): mtab module enabled";
verbose_mode.!disable_inventory_fstab::
"$(this.bundle): fstab module enabled";
verbose_mode.!disable_inventory_proc::
"$(this.bundle): proc module enabled";
verbose_mode.!disable_inventory_package_refresh::
"$(this.bundle): package_refresh module enabled";
DEBUG|DEBUG_def::
"Executor Schedule: $(def.control_executor_schedule_value)";
}