CFEngine 3.29 released - Continuity

Today, we are pleased to announce the release of CFEngine 3.29.0! The code word for this release is continuity.

This is a non-LTS, not supported, feature release, with features which will become part of the next LTS scheduled for summer 2027.

What’s new

Event-driven policy

CFEngine now allows you to write event-driven policy. Initially we have implemented 3 categories of events - files, users, and packages.

To introduce the idea, here is an example of how to recreate a file whenever it’s deleted:

bundle reactor setup_events
{
  events:
    "Restore /tmp/a when deleted"
      when => file_deleted("/tmp/a"),
      then => create_file("/tmp/a");
}

when specifies when you want the event to be triggered (what is the condition we should watch for). then specifies the bundle(s) which will handle the event - what changes we want to make to the system when reacting to the event. The events promises and reactor bundles are used by cf-reactor - the CFEngine event reaction daemon. Event driven policy is not tied to the normal agent schedule (defaulting to one run every 5 minutes), cf-reactor does all of this independently of cf-agent and cf-execd.

This assumes the file_deleted body and the create_file bundle are already defined somewhere. You might want to put these reusable pieces in one centralized place / library. The complete example, defining those 2, looks like this:

# When to trigger event:
body when file_deleted(file)
{
  file_deleted => "$(file)";
}

# What to do when event triggered:
bundle reactor create_file(file)
{
  files:
    "$(file)" create => "true";
}

# Tie the 2 together (when and then):
bundle reactor setup_events
{
  events:
    "Restore /tmp/a when deleted"
      when => file_deleted("/tmp/a"),
      then => create_file("/tmp/a");
}

To read more about event-driven policy, see our documentation:

CFEngine Docs - cf-reactor

File input for Build modules and group level module input

The CFEngine Build module system has received 2 significant upgrades:

• Modules can now have file(s) as an input.
  • This enables writing modules which take a data file, script, or even policy file as an input from the end user of the module.
  • The UI in Mission Portal has been updated so you can add files to modules which use this feature using a standard browser file upload dialog.
• Module input can now be specified on a group level.
  • Inside a host group in Mission Portal, you can supply input data, right next to the other CMDB data (variables, classes, etc.)

Running Ansible playbooks from CFEngine

We’ve been working on modules to help users using both CFEngine and Ansible in their infrastructure. These modules utilize the module input improvements mentioned above. Read more about this in our recent blog post on the subject:

Dispatching Ansible playbooks with CFEngine

Breaking changes

From time to time, we need to change the behavior of certain features of CFEngine in a way that is not completely backwards compatible. This is usually to address security concerns, bugs causing issues for our users, or features behaving in really unexpected or unintended ways. In such cases, we try to communicate the changes with users, along with what is needed from them (such as adjusting their policy, reports, or API usage). Please take a look at the recent change-in-behavior blog posts, and stay up to date on these via our blog:

CFEngine Blog - change-in-behavior

Changelogs

As always, you can see a full list of changes and improvements in our changelogs:

• 3.29.0 Changelog for CFEngine Community
• 3.29.0 Changelog for CFEngine Enterprise
• 3.29.0 Changelog for Masterfiles Policy Framework

Please note that the Enterprise changelogs contain only changes specific to Enterprise. To get a full overview of all changes in a version, read all 3 changelogs.

Dependency updates

We update dependencies to ensure we have the latest security fixes in the libraries and tools used in CFEngine. The table below shows our dependencies and their versions, with version 3.26.0 for comparison:

Thank you to all the developers and maintainers of Open Source Software which make CFEngine possible!

Downloads

CFEngine Enterprise is free for up to 25 hosts, click here to go to the download pages with new packages. If you are using cf-remote, you can specify this version using the --version command line flag:

cf-remote --version 3.29.0 download

(Since this is a non-LTS release, it will not be the default in cf-remote and other places, even though it is the newest).

Contributions

We encourage all of our users to get involved in the community and contribute. Feel free to use one of the following avenues:

• Ask for help, share an idea, or start a discussion on GitHub Discussions
• Contribute modules to CFEngine Build
• Look through our curated list of issues for new contributors
• Improve the documentation by fixing typos, adding examples, or explaining things you found difficult
• Browse the code or submit a pull request through GitHub
• Submit a bug report or feature request in our issue tracker