Cfg on Miek Gieben

Config Management, part III: Rolling Back

Fri, 02 Feb 2024 15:20:33 +0100

In the previous part we looked how a micro language would look like, now I want to focus on what it means to roll back to a previous version. First take a look at an instruction that have no obvious reverse: CHMOD

When rolling back CHMOD you want to revert to the previous permissions. This would work automatically if there was an older CHMOD that would also set the permission, but in a lot of situations you probably just go with the (package) defaults. This implies you don’t know what a CHMOD reversal would be, and that implies we need to track that, like in a proper journal. As said each instruction has an implicit condition, if that condition doesn’t hold, it executes the instruction, we can utilize that state and save it in the journal. Let’s see in detail how this would work with something like CHMOD.

Config Management, part II: Microcode Language

Thu, 01 Feb 2024 15:20:33 +0100

The first part.

This cfg mgmt system uses a micro language to perform the changes on the target system. This language is limited in its scope and has the following “instructions”:

INSTRUCTION	ARITY	ARGUMENTS	REMARK
REM	1	TEXT	a comment
MKDIR	2	MODE PATH	create a directory
COPY	2	SRC-PATH DST-PATH	copy a file
CHMOD	2	MODE PATH	set the mode
CHOWN	2	USER/ID PATH	set the owner
CHGRP	2	GROUP/ID PATH	set the group
RM	1	PATH	rm the file
EXEC	1	CMD	install a package

These micro-instruction basically all call a simple system call to make the changes. Note, except for the latter this is the Unix API of everything is a file. EXEC is now only used to install/deinstall a package; of course such a generic instruction is ripe for abuse…

Config Management

Mon, 29 Jan 2024 14:20:33 +0100

this project needs a name and a domain.

After many years of playing with YAML in k8s, I’ve returned to using CFEngine (at work). The last config management software before that was Puppet. An issue I see with all modern config management tooling is the lack of monitoring and the impossibility to cleanly roll back. In k8s it works better, but that’s only for pods running in k8s (which are stateless), not the underlying machines.