Re: [Infrastructures] Is cfengine a good tool?

[Jamie Wilkinson]

Quoting Tim Writer <tim@starnix.com>:

> If you don't mind me asking, how many systems are you using it on now?  I'm
> only using it on a couple of servers but I'm trying to use it in an
> "infrastructure" style.  IOW, I'm trying to script all customization beyond
> the initial, scripted installation with cfengine.  I still don't really
> trust
> it and would be uncomfortable running it on many more systems.

All our new machines have cfengine installed on them from the beginning, and all
configuration is managed by cfengine (except Apache, but that's a goal for
later).  The long term goal is for any machine to be immediately replaceable
with another, requiring operator intervention *only* to restore the user data
from backups.  This is pretty easy for new machines, because they're being built
and no-one yet relies on them, but for our existing setups, they've been pretty
heavily customised and so the process of putting them under cfengine control is
by nature a long and labourious process.  Getting our network totally automated
with cfengine is going to take somewhere in the order of 6 months -- not due to
any failings in cfengine, though, merely by the nature of the task.

The -v and -n flags to cfagent are great, though, so I can run cfengine on a
production machine and see what might have happened.

It certainly is a big leap of faith the first few times you run cfengine on a
machine and give it the power to ruin your systems.  The only advice I can give
is use the -n option liberally, build some qa processes around your input files,
use a test system (user-mode-linux is great for this) and read the tutorial and
reference until your head hurts.

Jamie