Re: Bootstrap in chroot

"'Vratislav Podzimek' via help-cfengine" <[email protected]> Wed, 22 May 2024 12:50:44 +0200
Newsgroups	gmane.comp.sysutils.cfengine.general
Message-ID	<[email protected]>
Hi Markus,

On Mon, 2024-05-20 at 02:58 -0700, Markus Rexhepi-Lindberg wrote:
> Is it possible to bootstrap a host running in a chroot?
> 
> I want to bootstrap a host during its provisioning stage were it currently runs in a chroot environment. While bootstrapping cf-agent complains that the cf-execd daemon is not running, which seems to be the case since cfengine3.service is not allowed to start in a chroot environment.
> 
> ```
> # chroot /target cf-agent -B <cfehub>
>  notice: Bootstrap mode: implicitly trusting server, use --trust-server=no if server trust is already established
>    notice: Trusting new key: MD5=<redacted>
>  R: Bootstrapping from host '<redacted>' via built-in policy '/var/cfengine/inputs/failsafe.cf'
>  R: This autonomous node assumes the role of voluntary client
>  R: Updated local policy from policy server
>  R: Triggered an initial run of the policy
>  R: Restarted systemd unit cfengine3
>     error: Bootstrapping failed, cf-execd is not running
>    notice: Bootstrap mode: implicitly trusting server, use --trust-server=no if server trust is already established
> ```
> 
> I managed to workaround this by first trying to bootstrap, which fails, then manually start cf-execd in the chroot and finally try to bootstrap again which succeeds.
> 
> ```
> # chroot /traget cf-execd
> # chroot /target cf-agent -B <cfehub>
> R: Bootstrapping from host '<redacted>' via built-in policy '/var/cfengine/inputs/failsafe.cf'
> R: This autonomous node assumes the role of voluntary client
> R: Updated local policy from policy server
> R: Triggered an initial run of the policy
>   notice: Bootstrap to '<redacted>' completed successfully!
> ```
> 
> This works but feels like a hack. Is there another way this could be done?
Did you check if the second run is necessary? AFAICT, the error about cf-execd
not running is a valid one, but it doesn't mean that the rest of the bootstrap
process didn't run or failed. I'd expect the host to be bootstrapped just fine
just with the daemons (cf-execd, cf-serverd, cf-monitord) not running. So I
think you can skip the last step, but you should start the other two daemons in
the chroot as well.

--
Vratislav

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/ae036b1cced0152857105ee5a84e937aff8ce97e.camel%40northern.tech.
signature.asc (application/pgp-signature, 833 B)