Re: Failsafe.cf in cfengine 3.18

thierry thunot <[email protected]> writes:

> Hello all ;) i have a question about cfengine 3.18 and the automatic
> generation of failsafe.cf in /var/cfengine/input. How can I generate
> this file on 3.18, does it work differently?

Hi Thierry,

`failsafe.cf' is generated when non-interactive policy runs fail syntax
validation.

For example, here we can see that:

- Initially `failsafe.cf' does /not/ exist in inputs.
  ,----
  | [root@hub ~]# ls /var/cfengine/inputs/
  | cfbs  cfe_internal  cf_promises_release_id  cf_promises_validated  controls  def.json  inventory  lib  modules  promises.cf  services  standalone_self_upgrade.cf  templates  update.cf
  `----

- We break the policy
  ,----
  | [root@hub ~]# echo BROKEN >> /var/cfengine/masterfiles/promises.cf 
  `----

- We initiate `cf-execd' to run once, it detects failure, but skips
  generation of `failsafe.cf' since interactive mode is detected.
  ,----
  | [root@hub ~]# cf-execd -KIFO
  | /var/cfengine/inputs/promises.cf:393:7: error: syntax error
  | BROKEN
  |       ^
  | /var/cfengine/inputs/promises.cf:393:7: error: Expected 'bundle' or 'body' keyword, wrong input 'BROKEN'
  | BROKEN
  |       ^
  |    error: There are syntax errors in policy files
  |    error: Policy failed validation with command '"/var/cfengine/bin/cf-promises" -c "/var/cfengine/inputs/promises.cf"'
  |    error: Failsafe condition triggered. Interactive session detected, skipping failsafe.cf execution.
  |    error: Error reading CFEngine policy. Exiting...
  `----

- Indeed, no `failsafe.cf' is present in inputs
  ,----
  | [root@hub ~]# ls /var/cfengine/inputs/
  | cfbs  cfe_internal  cf_promises_release_id  cf_promises_validated  controls  def.json  inventory  lib  modules  promises.cf  services  standalone_self_upgrade.cf  templates  update.cf
  `----

- We wait for an unattended, non-interactive execution and check again
  seeing that indeed, there is a `failsafe.cf' present
  ,----
  | [root@hub ~]# sleep 300; ls /var/cfengine/inputs
  | cfbs          cf_promises_release_id          cf_promises_validated          controls  failsafe.cf  lib      promises.cf  standalone_self_upgrade.cf  update.cf
  | cfe_internal  cf_promises_release_id.cfsaved  cf_promises_validated.cfsaved  def.json  inventory    modules  services     templates
  `----

Note: `cf-agent --bootstrap' leverages the internal `failsafe.cf', and
you can find it [in our source here].

I would expect the policy update to be handled by `update.cf'. Can you
explain how you use `failsafe.cf' to update your policy?


> Have you ever noticed this behavior?

I try to avoid committing broken policy that results in `failsafe.cf'
being used. I have memory that there may be some bug or desired feature
around not using a generated `failsafe.cf' if a custom one is present
but I am unsure if that's actually a bug or a feature request or if
there is a ticket for it or even how it could be accomplished to
reliably allow a custom failsafe.cf to be used instead (i guess we could
look for a preferred_failsafe.cf and use that if present instead of the
internally generated one).


[in our source here]
<https://github.com/cfengine/core/blob/master/libpromises/failsafe.cf>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/87h7ctyxo1.fsf%40northern.tech.

-- 
Nick Anderson | Doer of Things | (+1) 785-550-1767 | https://northern.tech

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/87h7ctyxo1.fsf%40northern.tech.