clean use of cobbler/kickstart and cfengine

Wes Hardin wes.hardin at maxim-ic.com
Fri Jul 1 15:48:50 UTC 2011


On 06/30/2011 11:44 AM, Jonathan Sabo wrote:
> On Thu, Jun 30, 2011 at 12:31 PM, David Lee <David.Lee at ecmwf.int> wrote:
>> (I'm new to cobbler, and using v 2.0.11)
>>
>> This is really a request for ideas.
>>
>> I'm trying to set up a network deployment and maintenance framework for
>> a rapidly growing number of Linux boxes.
>>
>> Cobbler, even though I'm new to it, seems to be an absolute treat.  Thanks!
>>
>> Cobbler principally does the installation of a clean OS (more or less
>> "out of the box" from the manufacturer) onto the disk.  I am strongly
>> resisting any urge to do any fine-grained tuning at this point, because
>> that should actually be classed as the first steps of the next item...
>>
>> 'cfengine' (v3.1.4) is ideal for long-term maintenance of such
>> installations.
>>
>> But it would be good if that installation procedure could be adjusted
>> just a little bit to include the installation of the 'cfengine3' rpm
>> from somewhere (as it is not part of the RHEL distribution) and a
>> minimal bit of associated scripting (or similar) to tickle 'cfengine'
>> into action as the freshly installed machine first boots.
>>
>> What might be a good, clean way to glue that cfengine install/initialise
>> onto the back end of the cobbler-based installation?
>>
> 
> I would suggest using Puppet over Cfengine for many reasons but either way....
> 
> You can take your Cfengine packages and put them in a yum repo and
> then add that repository to your cobbler master.  Perhaps someone else
> hosts the yum repo and you just mirror it.  Add that repo to a profile
> and then assign it to a system.  Then on install that system will be
> able to yum -y install cfengine and friends and you can add that to
> your installers answerfile aka kickstart. So then you have a system
> that's being rebuilt and it has your configuration management system
> installed....  Now you just have to configure it...

Except for the Puppet part ;-), Jonathan is exactly right.  But I'll try to
expand upon that with a real example.

The guts of my Kickstart are mostly just for determining disk layout and package
selection.  The %post section is just enough to get Cfengine installed,
bootstrapped, and executed.  Cfengine takes care of all the customization done
to the machine.  Any other configuration done before the %post is susceptible to
being changed by Cfengine later.

%post --interpreter=/bin/bash --log=/root/post-install.txt
ntpdate 10.18.30.50
hwclock --utc --systohc
rm -f /etc/yum.repos.d/*
$yum_config_stanza
echo "COBBLERSERVER=$server" > /etc/my_cobbler_server
$SNIPPET('post_yum_installs')
$SNIPPET('post_cfengine')

It breaks down like this:

Set the clock so we don't have any time issues.

"$yum_config_stanza" is a Cobbler thing for getting the yum repo configuration
from Cobbler.  I have my own repo managed by Cobbler (another thing Cobbler does
just wonderfully) where I drop in my Cfengine packages and other 3rd party stuff
I want.

The post_yum_installs snippet basically just expands to a "yum -y install" of a
few packages, one of them being my Cfengine package.

After that, the post_cfengine snippet actually does the bootstrapping and
execution of Cfengine.  The procedure I have is particular to my own
installation since I build my own Cfengine packages and it requires a few
externalities to complete, but the basic flow is this:

1) Get the failsafe.cf from the policy host.  I setup Apache to serve up the
failsafe.cf so I can easily get it with a wget.

2) "/var/cache/cfengine/bin/cf-agent --bootstrap --inform --no-lock" Use the
agent to download the rest of the policy.  Run that from the same directory that
you downloaded the failsafe.cf in, if it wasn't the configured inputs directory.

3) "/var/cache/cfengine/bin/cf-agent --inform --no-lock --define kickstart_mode"
 Execute policy.  I define a class called "kickstart_mode" because there are
some things that don't have to happen while I'm still installing, like stopping
services, because they'll be taken care of by the reboot at the end of the install.

When I reboot, I have a fully configured system, ready to go.
-- 
/* Wes Hardin */
UNIX/Linux Systems Administrator, IT Engineering Support
Maxim Integrated Products: Innovation Delivered


More information about the cobbler mailing list