Updating core by rsync

[Christian Linden]

Hi,

for the case there're several hubs and /var/cfengine gets rsynced from one "sourcehub" to all others..

If I update that source hub.. =) Will the other hubs get updated by the next rsync, right?

Maybe better to "service cfengine3 restart"..

Thanks,

Chris

[Nick Anderson]

On 04/27/2016 09:09 AM, Christian Linden wrote:
> Hi,
>
> for the case there're several hubs and /var/cfengine gets rsynced from
> one "sourcehub" to all others..
> If I update that source hub.. =) Will the other hubs get updated by the
> next rsync, right?

If your rsync job is working it probably would.

Just curious, do you have an rsync job on your one "sourcehub" to *push*
the policy to other hubs, or do your other hubs *pull* from your
"sourcehub".

> Maybe better to "service cfengine3 restart"..

This should be unnecessary.

[Christian Linden]

I’ve an rsync job pushing from source, it’s the complete /var/cfengine directory including the policy.
The others can’t pull from where they are, this is why they do exist.

Great easy updating! =)

[Nick Anderson]

On 04/27/2016 09:21 AM, Christian Linden wrote:
> I’ve an rsync job pushing from source, it’s the complete /var/cfengine directory including the policy.
> The others can’t pull from where they are, this is why they do exist.

I think pushing the entirety of /var/cfengine is a *bad* idea.

There are logs and state files and embedded databases. Those things
should not be shared between hubs.

Distributing the policy itself makes sense.

Distributing other directories that you may have created under
/var/cfengine makes sense.

Distributing /var/cfengine/ppkeys *might* make sense, or it might not
depending on the specifics of your environment.

Distributing /var/cfengine/ppkeys/localhost* will result in the
conflation of your hub identities. Maybe that's what you want, maybe not.

[Christian Linden]

hui yes, thanks for hint!

[Christian Linden]

In which conditions does it make sense to distribute /var/cfengine/ppkeys?

And in which to conflate their identities? If one is too weak? In order to loadbalance one big hub with several small ones?

If the hubs can't reach each other due to firewalls it's a bad idea to conflate their identities, right?

c