Re: Bootstrap in chroot

It seems that the bootstrap fails AFAIK. For instance the 
`/var/cfengine/policy_server.dat` file does not get provisioned.

I first run a bootstrap as I otherwise can't start cf-execd.

Starting cf-execd without running a bootstrap first.
```
# cf-execd
   error: There is no readable input file at 
'/var/cfengine/inputs/promises.cf'. (stat: No such file or directory)
   error: Failsafe condition triggered. Interactive session detected, 
skipping failsafe.cf execution.
   error: Error reading CFEngine policy. Exiting...
```

Running a boostrap and then starting cf-execd.
```
# cf-agent -B <redacted>
  notice: Bootstrap mode: implicitly trusting server, use --trust-server=no 
if server trust is already established
  notice: Trusting new key: MD5=<redacted>
R: Bootstrapping from host '<redacted>' via built-in policy 
'/var/cfengine/inputs/failsafe.cf'
R: This autonomous node assumes the role of voluntary client
R: Updated local policy from policy server
R: Triggered an initial run of the policy
R: Restarted systemd unit cfengine3
   error: Bootstrapping failed, cf-execd is not running
# cf-execd
#
```

After I have done this I attempt to run the policies.
```
# cf-agent -KIC
...
error: No suitable server found for '/var/cfengine/scripts/'
...
```
I get errors suggesting that there is not suitable server to be found/used. 
The policies them self seem to run fine though.

If I run a bootstrap again as the last step.
```
# cf-agent -B <redacted>
  notice: Bootstrap mode: implicitly trusting server, use --trust-server=no 
if server trust is already established
R: Bootstrapping from host '<redacted>' via built-in policy 
'/var/cfengine/inputs/failsafe.cf'
R: This autonomous node assumes the role of voluntary client
R: Updated local policy from policy server
R: Triggered an initial run of the policy
  notice: Bootstrap to '<redacted>' completed successfully!
# ls -l /var/cfengine/policy_server.dat
-rw------- 1 root root 26 May 22 13:35 /var/cfengine/policy_server.dat
```
It goes through and the `/var/cfengine/policy_server.dat` file gets 
provisioned and I do not get "No suitable server ..." errors when running 
`cf-agent`.

--
Markus
On Wednesday, May 22, 2024 at 12:50:51 PM UTC+2 [email protected] 
wrote:

> Hi Markus,
>
> On Mon, 2024-05-20 at 02:58 -0700, Markus Rexhepi-Lindberg wrote:
> > Is it possible to bootstrap a host running in a chroot?
> > 
> > I want to bootstrap a host during its provisioning stage were it 
> currently runs in a chroot environment. While bootstrapping cf-agent 
> complains that the cf-execd daemon is not running, which seems to be the 
> case since cfengine3.service is not allowed to start in a chroot 
> environment.
> > 
> > ```
> > # chroot /target cf-agent -B <cfehub>
> >  notice: Bootstrap mode: implicitly trusting server, use 
> --trust-server=no if server trust is already established
> >    notice: Trusting new key: MD5=<redacted>
> >  R: Bootstrapping from host '<redacted>' via built-in policy 
> '/var/cfengine/inputs/failsafe.cf'
> >  R: This autonomous node assumes the role of voluntary client
> >  R: Updated local policy from policy server
> >  R: Triggered an initial run of the policy
> >  R: Restarted systemd unit cfengine3
> >     error: Bootstrapping failed, cf-execd is not running
> >    notice: Bootstrap mode: implicitly trusting server, use 
> --trust-server=no if server trust is already established
> > ```
> > 
> > I managed to workaround this by first trying to bootstrap, which fails, 
> then manually start cf-execd in the chroot and finally try to bootstrap 
> again which succeeds.
> > 
> > ```
> > # chroot /traget cf-execd
> > # chroot /target cf-agent -B <cfehub>
> > R: Bootstrapping from host '<redacted>' via built-in policy 
> '/var/cfengine/inputs/failsafe.cf'
> > R: This autonomous node assumes the role of voluntary client
> > R: Updated local policy from policy server
> > R: Triggered an initial run of the policy
> >   notice: Bootstrap to '<redacted>' completed successfully!
> > ```
> > 
> > This works but feels like a hack. Is there another way this could be 
> done?
> Did you check if the second run is necessary? AFAICT, the error about 
> cf-execd
> not running is a valid one, but it doesn't mean that the rest of the 
> bootstrap
> process didn't run or failed. I'd expect the host to be bootstrapped just 
> fine
> just with the daemons (cf-execd, cf-serverd, cf-monitord) not running. So I
> think you can skip the last step, but you should start the other two 
> daemons in
> the chroot as well.
>
> --
> Vratislav
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/0a378e7e-d113-42f1-8674-0efdc1e5731en%40googlegroups.com.