A little policy to render mustache templated cfengine module scripts

[craigcomstock]

In CFEngine we have a feature of module scripts/executables that can be used to gather information and return it via classes/vars to the policy engine.

https://docs.cfengine.com/docs/3.21/reference-language-concepts-modules.html

I was thinking it would be nice if some of these module scripts could be mustache templates.

For this example I created a modules/custom directory under the root of my masterfiles directory.

def.json

{
  "vars":{
    "update_inputs": [ "custom_modules.cf" ],
    "control_common_update_bundlesequence_end": [ "custom_modules" ]
  }
}

custom_modules.cf

bundle agent custom_modules
{
  vars:
    "custom_modules_path" string => "$(sys.workdir)/modules/custom";
    "module_paths" slist => findfiles("$(custom_modules_path)/*.mustache");
    "modules" slist => maplist( string_replace("$(this)", ".mustache", ""), @(module_paths));

  files:
    "$(modules)"
      create => "true",
      edit_template => "$(modules).mustache",
      template_data => datastate(),
      template_method => "mustache";

  reports:
    "module_paths: $(module_paths)";
    "modules: $(modules)";
}

Typically you want to avoid using datastate(). Better would be to inject a small set of necessary information that you need.

modules/custom/one

Hi, I am the first module script!

modules/custom/two.mustache

Hello, I am running CFEngine in {{vars.sys.workdir}}

output when running cf-agent -KIf update.cf

R: module_paths: /var/lib/cfengine/modules/custom/two.mustache
R: modules: /var/lib/cfengine/modules/custom/two

(in this case I am using alpine linux and their standard cfengine community packages so we have /var/lib/cfengine as sys.workdir instead of our typical /var/cfengine)

And in /var/lib/cfengine/modules/custom/two we have

Hello, I am running CFEngine in /var/lib/cfengine

No mention of the module script one since I am only doing findfiles for *.mustache.

That one script is copied over though due to it's location in the modules directory.

[nickanderson]

Nice, I like it. Perhaps it should be elevated to a build module?

[craigcomstock]

Oh yes. I nearly started composing it that way but figured I'd share this for now. 👍