ncf - a powerful and structured CFEngine framework

transcript

Normation – CC-BY-SAnormation.com

A powerful and structuredCFEngine framework

Jonathan CLARKE – jcl@normation.com@jooooooon42 (that's 7 'o's)

Normation – CC-BY-SAnormation.com 2

ncfwww.ncf.io

Who am I?

● Jonathan Clarke

● Title: Co-founder & Product lead at Normation

● Origins: Sysadmin, infrastructure management

● Now: Automation + “running a company”-stuff

● Contributor to free software:

– Co-creator of Rudder

– Contributor to CFEngine, OpenLDAP

● Co-organizer of events:

ncfwww.ncf.io

This presentationis about cakes

Photo CC BY 2.0 from http://www.flickr.com/photos/misscreativecakes/

ncfwww.ncf.io

Reminder: how are cakes made?

1. Ingredients

+2. Recipes

Photo CC BY-NC 2.0 from http://www.flickr.com/photos/tnemily/

Photo CC BY 2.0 from http://www.flickr.com/photos/misscreativecakes/

ncfwww.ncf.io

Background

A bunch ofCFEngine consultants

● > 4 years● Multiple companies: small, large & huge● Various uses: security, provisioning, DR...

We always got the same feedback

ncfwww.ncf.io

Feedback #1: CFEngine rocks!

CFEngine rocksMulti-platformLinux, Android, BSD, AIX, HP-UX, Solaris, Windows...

Open SourceGPLv3

Small footprint, scalableA few MB of RAM,just seconds to run...

Continuous checkingAgent based approach,no push

Resilient to errorsNetwork outages, failures,unavailable resources...

ncfwww.ncf.io

Feedback #2: CFEngine is hard!

CFEngine is hard

Too much “do it yourself”Building your own policy structure from blank slate

Steep learning curveSyntax is unusual, hardto learn and understand

Lack of feedbackOutput is hard to read,“what is going on?”

Workarounds for bugsNo way of systematically using a workaround

“Flour, eggs, milk and butter”As in: https://digitalelf.net/2013/04/a-case-study-in-cfengine-layout/

ncfwww.ncf.io

Feedback #2: CFEngine is hard!

Learning to bake cakes on your own is frustrating.

Photo CC BY-NC-SA 2.0 from http://www.flickr.com/photos/penguincakes/

ncfwww.ncf.io

Brief dilemma...

Can we fix this?

We've worked around this for customers, let's make it reusable!

CHALLENGE ACCEPTED.

ncfwww.ncf.io

Approach

Too much do it yourselfBuilding your own policy structure from blank slate

1) Provide a structured layout to start from

2) Provide single-purpose, reusable “methods” to get the basics done

ncfwww.ncf.io

Steep learning curveSyntax is unusual, hardto learn and understand

Approach

1) Hide the weirder syntaxinside these reusable “methods”

2) Only require a subset of syntaxto write everyday policies (method calls)

ncfwww.ncf.io

Approach

1) Implement workarounds into those reusable “methods” (and use them)

2) Automated tests to make sure the bugs don't “come back”

Workarounds for bugsNo way of systematically using a workaround

ncfwww.ncf.io

Lack of feedbackOutput is hard to read,“what is going on?”

Approach

1) Now everything goes through reusable “methods”, build automatic feedback in

2) Make the feedback format customisable and extensible

ncfwww.ncf.io

Result

“Forget baking,I'm gonna get some

cakes from the shop”Photo CC BY-NC-SA 2.0 from http://www.flickr.com/photos/omarsc/

ncfwww.ncf.io

Result

We created ncf

ncf is a frameworkthat runs in pure CFEngine language,to help structure CFEngine policy and

provide reusable, single purpose components distributed under the GPLv3 license.

ncfwww.ncf.io

Result

Example === 1000 words

With ncf:

ncfwww.ncf.io

Result

Example === 1000 wordsWithout ncf:

This is actuallyover-simplified:- No feedback- No exceptions for different OSes- No advanced options

ncfwww.ncf.io

Result

Example === 1000 words

With ncf, automatic feedback:R: [DEBUG] Promise kept, not doing anything: Install package ntp in version latestR: [INFO] Promise repaired, made a change: Build file /etc/ntp.conf from template ntp.confR: [INFO] Promise repaired, made a change: Restart service ntpR: [DEBUG] Promise kept, not doing anything: Ensure that service ntp is running

ncfwww.ncf.io

How does it work?

How does it work?CFEngine 3 can have self-contained “bundles” that you can call with parameters.

logger

package_install file_from_template service_restart

Outputs structured messages

ncfwww.ncf.io

A layered approach

A layered approachServices

Techniques

IT Ops Knowledge

Generic methods

CFEngine basics

ncf internals

IT services: “Corporate web site”

Components of services: “Apache”

Shared information: “httpd” package name

Unit tasks: “Copy file”, “Install package”

CFEngine standard libraries

Framework config and magic :)

ncfwww.ncf.io

A layered approach

A layered approachServices

Techniques

IT Ops Knowledge

Generic methods

CFEngine basics

ncf internals

IT services: “Corporate web site”

Components of services: “Apache”

Shared information: “httpd” package name

Unit tasks: “Copy file”, “Install package”

CFEngine standard libraries

Framework config and magic :)

ncfwww.ncf.io

Each generic_method does one thing and one thing only

Philosophy

Core principles

Objective not subjective

KISSDRY

ExtensibleOpen source

ncfwww.ncf.io

Available generic_methods

ncfwww.ncf.io

Online documentation

http://www.ncf.io/pages/reference.html

ncfwww.ncf.io

Current status

Project is young, but robustNeed more generic methods

Ohloh statistics:

Source: http://www.ohloh.net/p/ncf-project

Actually CFEngine

Normation – CC-BY-SAnormation.com

Questions?

Check it out on:http://www.ncf.io/

Jonathan CLARKE – jcl@normation.com@jooooooon42 (that's 7 'o's)

ncf - a powerful and structured CFEngine framework

Technology