ADMIN

Chef
Management
‐r http://s3.amazonaws.com/U
chef‐solo/bootstrap‐latest.tar.gz
The tool creates a couple of directories,
corrects the configuration files,
and adds chef-client to the init
scripts. The latter ensures that the client
will talk to the server on booting
and execute any recipe changes that
have occurred in the meantime.
After this, the client has to register
with the server. To allow this to happen,
copy the /​etc/​chef/​validation.
pem file from the server to the /​etc/​
chef/​directory client-side and then
restart the client manually:
sudo chef‐client
The client automatically creates a key,
which you need to add to the /​etc/​
chef/​client.pem file and which will
sign every transaction with the server
from this point on. Then you want
to delete the validation.pem file for
security reasons.
Librarian
Now that you have the server and the
client running, the next step is to create
a repository server-side for your
recipes: This is simply a hierarchy of
multiple, standardized (sub-)directories.
Of course, you could create
them all manually, but the template
provided by Opscode does a quicker
job; you just need to download and
unpack:
wget http://github.com/opscode/U
chef‐repo/tarball/master
tar ‐zxf opscode‐chef‐repo‐U
123454567878.tar.gz
Because this cryptic number is difficult
to remember in the daily grind,
you might want to rename the directory
(incidentally, the number comes
from the versioning system and represents
the Commit ID):
mv opscode‐chef‐repo‐123454567878 U
chef‐repo
cd chef‐repo
[Table 1] explains the directory hierarchy
in chef-repo.
The recipes stored here are injected
into the server by a tool named knife.
To prepare a recipe for action, run the
command
knife configure ‐i
and confirm the default responses by
pressing Enter – except, enter your
own username when asked Your client
user name?, and type . (dot) in
response to the Path to a chef repository
(or leave blank)? query. Knife
then registers a new client on the
Chef server, creates the above-mentioned
certificate in /​.chef/​
my-knife.pem, and finally creates the
/​.chef/​knife.rb configuration file.
Convenience Food
Multiple recipes with the same objective
can be grouped in a cookbook.
For example, the mysql cookbook contains
all the recipes required to install
and set up the free database. For an
initial test, it is a good idea to look for
a simple cookbook [5].
In the section that follows, I will use
the cookbook for emacs from the applications
group as an example. In
this example, I’ll use the package
manager to install the popular Emacs
text editor.
After downloading the Cookbook archive,
unpack it in the cookbooks subdirectory,
then introduce the server to
the new recipes:
rake upload_cookbooks
The rake command automatically
calls knife with the correct parameters,
and knife then uploads all the
cookbooks from the corresponding directory.
To upload a single cookbook
to the server, do this:
rake upload_cookbook[emacs]
The target, upload_cookbook, is defined
in the Rakefile provided by the
repository.
GUI Management
The server now knows the emacs
cookbook, but the clients don’t. To
change this, launch a browser and access
the web front end with http://​
chefserver.example.com:4040. Chef
does not offer SSL encryption here. If
you prefer a more secure approach,
you could use Apache as a proxy.
In the form that then appears, log in
by typing the admin username [Figure
2]. The matching password is stored
in the web_ui_admin_default_password
line of the /​etc/​chef/​server.rb file.
01 {
01 {
Listing 4: ~/​chef.json for the Client
02 "bootstrap": {
03 "chef": {
04 "url_type": "http",
05 "init_style": "runit",
06 "path": "/srv/chef",
07 "serve_path": "/srv/chef",
08 "server_fqdn": "chefserver.example.com"
09 }
10 },
11 "run_list": [ "recipe[bootstrap::client]" ]
12 }
Listing 3: ~/​chef.json for the Server
02 "bootstrap": {
03 "chef": {
04 "url_type": "http",
05 "init_style": "runit",
06 "path": "/srv/chef",
07 "serve_path": "/srv/chef",
08 "server_fqdn": "chefserver.example.com",
09 "webui_enabled": true
10 }
11 },
12 "run_list": [ "recipe[bootstrap::server]" ]
13 }
Listing 2: SSL Certificates for the Chef Server
01 server_ssl_req="/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=chef.example.com/
emailAddress=ops@example.com"
02 openssl genrsa 2048 > /etc/chef/validation.key
03 openssl req ‐subj "${server_ssl_req}" ‐new ‐x509 ‐nodes ‐sha1 ‐days 3650 ‐key /etc/chef/validation.key
> /etc/chef/validation.crt
04 cat /etc/chef/validation.key /etc/chef/validation.crt > /etc/chef/validation.pem
05 openssl genrsa 2048 > /etc/chef/webui.key
06 openssl req ‐subj "${server_ssl_req}" ‐new ‐x509 ‐nodes ‐sha1 ‐days 3650 ‐key /etc/chef/webui.key > /
etc/chef/webui.crt
07 cat /etc/chef/webui.key /etc/chef/webui.crt > /etc/chef/webui.pem
www.admin-magazine.com
Admin 01
71