Feature Friday #15: bundlesmatching()

Did you know bundles can have tags too?

That’s right! You can tag a bundle by defining tags as a meta promise on a bundle.

For example:

bundle agent example_bundle_tag
{
    meta:
      "tags" slist => { "tag_1", "tag_2" };
}

You’ve likely encountered bundles tagged with autorun. These tags trigger automatic execution of bundles in lexical order whenever the services_autorun class is defined. However, you’re not limited to autorun. You can create custom tags to suite your specific needs. Perhaps you want to tag bundles associated with a particular compliance framework or identify the primary developer/team responsible for maintenance.

bundle agent example_bundle_tags
{
    meta:
      "tags" slist => { "security", "maintainer=Nick Anderson" };
}

The tags can function as documentation, but you can also use them to build your own - specialized - autorun policy. For example, to run all the security bundles.

bundle agent sec_2
{
    meta:
      "tags" slist => { "security", "stig", "maintainer=Nick Anderson" };
    reports: "$(this.bundle) implements a STIG.";
}
bundle agent sec_1
{
    meta:
      "tags" slist => { "security", "cis", "maintainer=Nick Anderson" };
    reports: "$(this.bundle) implements a CIS benchmark.";
}
bundle agent security_bundles
{
  vars:
      "bundles" slist => sort( bundlesmatching( ".*", "security" ), lex);

  methods: "$(bundles)";
}
bundle agent __main__
{
  methods: "security_bundles";
}

cf-agent --no-lock --log-level info --file /tmp/feature-friday-15.cf

R: sec_1 implements a CIS benchmark.
R: sec_2 implements a STIG.

Happy Friday! 🎉