一、Prerequisite
OS : CentOS-7.0-1406-x86_64-DVD.iso
Time Server : NTP Server
|
SERVER NAME |
IP PLAN |
|
chef_server |
192.168.100.10 |
|
chef_workstation |
192.168.100.11 |
|
chefnode-1 |
192.168.100.12 |
IP Plan:
rpm package(chef_server):
autogen-libopts-5.18-5.el7.x86_64.rpm
ntp-4.2.6p5-25.el7.centos.x86_64.rpm
chef-server-core-12.15.7-1.el7.x86_64.rpm
rpm package(chef workstation):
chefdk-1.4.3-1.el7.x86_64.rpm
git-1.8.3.1-6.el7_2.1.x86_64.rpm
rpm package(chef node):
chef-13.1.31-1.el7.x86_64.rpm
二、Configure OS Environment
2.1 Configure the /etc/hosts
add the content of below into /etc/hosts every node:
192.168.100.10 chef_server
192.168.100.11 chef_workstation
192.168.100.12 chefnode-1
2.2 Setting the NTP Server On chef_server node
2.2.1 Install NTP package
[root@chef_server ~]# rpm -Uvh autogen-libopts-5.18-5.el7.x86_64.rpm
warning: autogen-libopts-5.18-5.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:autogen-libopts-5.18-5.el7 ################################# [100%]
[root@chef_server ~]# rpm -Uvh ntp-4.2.6p5-25.el7.centos.x86_64.rpm --nodeps
warning: ntp-4.2.6p5-25.el7.centos.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:ntp-4.2.6p5-25.el7.centos ################################# [100%]
[root@chef_server ~]# systemctl start ntpd
[root@chef_server ~]# systemctl status ntpd
ntpd.service - Network Time Service
Loaded: loaded (/usr/lib/systemd/system/ntpd.service; disabled)
Active: active (running) since Thu 2017-06-15 23:40:59 CST; 11s ago
Process: 2681 ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 2682 (ntpd)
CGroup: /system.slice/ntpd.service
├─2682 /usr/sbin/ntpd -u ntp:ntp -g
└─2683 /usr/sbin/ntpd -u ntp:ntp -g
2.2.2 Configure the NTP Server
[root@chef_server ~]# vim /etc/ntp.conf
driftfile /var/lib/ntp/drift
restrict default nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict ::1
# delete
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst
# add
server 127.127.1.0
fudge 127.127.1.0 stratum 1
includefile /etc/ntp/crypto/pw
keys /etc/ntp/keys
disable monitor
[root@chef_server ~]# systemctl restart ntpd
[root@chef_server ~]# ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
*LOCAL(0) .LOCL. 1 l 6 64 1 0.000 0.000 0.000
2.2.3 disable the service named firewalld
[root@chef_server ~]# systemctl status firewalld
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: active (running) since Thu 2017-06-15 23:17:24 CST; 37min ago
Main PID: 782 (firewalld)
CGroup: /system.slice/firewalld.service
└─782 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
Jun 15 23:17:24 chef_server systemd[1]: Started firewalld - dynamic firewall daemon.
[root@chef_server ~]# systemctl stop firewalld
[root@chef_server ~]# systemctl status firewalld
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: inactive (dead) since Thu 2017-06-15 23:55:50 CST; 2s ago
Main PID: 782 (code=exited, status=0/SUCCESS)
Jun 15 23:17:24 chef_server systemd[1]: Started firewalld - dynamic firewall daemon.
Jun 15 23:55:48 chef_server systemd[1]: Stopping firewalld - dynamic firewall daemon...
Jun 15 23:55:50 chef_server systemd[1]: Stopped firewalld - dynamic firewall daemon.
NOTE THAT: if you don’t want to stop the firewall ,The Chef server requires the following ports to be open through the firewall
Run the following command to allow 80 and 443 through the firewall.
firewall-cmd --permanent --zone public --add-service http
firewall-cmd --permanent --zone public --add-service https
firewall-cmd --reload
2.2.4 Verify configure and Synchronization
On chef_workstation
[root@chef_workstation ~]# ntpdate chef_server
16 Jun 00:21:55 ntpdate[3239]: adjust time server 192.168.100.10 offset 0.006277 sec
On chefnode-1
[root@chefnode-1 ~]# ntpdate chef_server
16 Jun 00:22:02 ntpdate[3629]: step time server 192.168.100.10 offset 51936.191786 sec
三、Configure Chef Server
3.1 Install chef server package on server node
Install the chef server package and download from the site: https://downloads.chef.io/
[root@chef_server ~]# rpm -Uvh chef-server-core-12.15.7-1.el7.x86_64.rpm
warning: chef-server-core-12.15.7-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:chef-server-core-12.15.7-1.el7 ################################# [100%]
[root@chef_server ~]# chef-server-ctl reconfigure
……
Chef Client finished, 493/1080 resources updated in 03 minutes 39 seconds
Chef Server Reconfigured!
[root@chef_server ~]# chef-server-ctl status
run: bookshelf: (pid 12149) 193s; run: log: (pid 12187) 193s
run: nginx: (pid 11960) 197s; run: log: (pid 12564) 188s
run: oc_bifrost: (pid 11858) 199s; run: log: (pid 11901) 198s
run: oc_id: (pid 11950) 198s; run: log: (pid 11956) 197s
run: opscode-erchef: (pid 12387) 190s; run: log: (pid 12311) 192s
run: opscode-expander: (pid 12034) 194s; run: log: (pid 12105) 194s
run: opscode-solr4: (pid 12000) 195s; run: log: (pid 12020) 195s
run: postgresql: (pid 11816) 199s; run: log: (pid 11841) 199s
run: rabbitmq: (pid 11304) 211s; run: log: (pid 11163) 216s
run: redis_lb: (pid 10796) 248s; run: log: (pid 12555) 188s
3.2 Create an admin User or Organization
User Name: admin
First Name: admin
Last Name: admin
Email: admin@chef.io
Password: password
File Name: admin.pem
Path: /root
[root@chef_server ~]# chef-server-ctl user-create admin admin admin admin@chef.io password -f /root/admin.pem
[root@chef_server ~]# chef-server-ctl org-create chef "CHEF, Inc" --association_user admin -f /root/chef-validator.pem
四、Configure Chef Workstation
4.1 Install chef dk package on chef workstation node
Download the package from the site : https://downloads.chef.io/
[root@chef_workstation ~]# rpm -Uvh chefdk-1.4.3-1.el7.x86_64.rpm
warning: chefdk-1.4.3-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:chefdk-1.4.3-1.el7 ################################# [100%]
Thank you for installing Chef Development Kit!
4.2 Configure the PATH
[root@chef_workstation bin]# export PATH="/opt/chefdk/embedded/bin:${HOME}/.chefdk/gem/ruby/2.1.0/bin:$PATH"
Verify the configure
[root@chef_workstation bin]# which ruby
/opt/chefdk/embedded/bin/ruby
4.3 Install Git
[root@chef_workstation ~]# rpm -Uvh git-1.8.3.1-6.el7_2.1.x86_64.rpm --nodeps
warning: git-1.8.3.1-6.el7_2.1.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:git-1.8.3.1-6.el7_2.1 ################################# [100%]
[root@chef_workstation ~]# git --version
git version 1.8.3.1
4.4 Create chef repo directory
[root@chef_workstation ~]# chef generate repo chef-repo
[root@chef_workstation ~]# cd chef-repo/
[root@chef_workstation chef-repo]# ls -al
total 32
drwxr-xr-x. 7 root root 4096 Jun 16 01:20 .
dr-xr-x---. 6 root root 4096 Jun 16 01:20 ..
-rw-r--r--. 1 root root 1133 Jun 16 01:20 chefignore
-rw-r--r--. 1 root root 255 Jun 16 01:20 .chef-repo.txt
drwxr-xr-x. 3 root root 36 Jun 16 01:20 cookbooks
drwxr-xr-x. 3 root root 36 Jun 16 01:20 data_bags
drwxr-xr-x. 2 root root 41 Jun 16 01:20 environments
drwxr-xr-x. 7 root root 4096 Jun 16 01:20 .git
-rw-r--r--. 1 root root 2121 Jun 16 01:20 .gitignore
-rw-r--r--. 1 root root 70 Jun 16 01:20 LICENSE
-rw-r--r--. 1 root root 1499 Jun 16 01:20 README.md
drwxr-xr-x. 2 root root 41 Jun 16 01:20 roles
4.5 Create the user and email for git
[root@chef_workstation ~]# git config --global user.name "admin"
[root@chef_workstation ~]# git config --global user.email "admin@chef.io"
4.6 Create the repo for git
[root@chef_workstation ~]# cd chef-repo/
[root@chef_workstation chef-repo]# git init
Reinitialized existing Git repository in /root/chef-repo/.git/
4.7 Create the hidden folder .chef under /root/chef-repo
the hidden folder .chef under /root/chef-repo so that stores the RSA keys
[root@chef_workstation chef-repo]# mkdir -p ~/chef-repo/.chef
NOTE THAT:Since this hidden directory stores the RSA keys, it should not be exposed to the public. To do that we will add this directory to “.gitignore” to prevent uploading the contents to GitHub
[root@chef_workstation chef-repo]# echo '.chef' >> ~/chef-repo/.gitignore
[root@chef_workstation chef-repo]# git add .
[root@chef_workstation chef-repo]# git commit -m "initial commit"
[master (root-commit) 26d359d] initial commit
16 files changed, 471 insertions(+)
create mode 100644 .chef-repo.txt
create mode 100644 .gitignore
create mode 100644 LICENSE
create mode 100644 README.md
create mode 100644 chefignore
create mode 100644 cookbooks/README.md
create mode 100644 cookbooks/example/README.md
create mode 100644 cookbooks/example/attributes/default.rb
create mode 100644 cookbooks/example/metadata.rb
create mode 100644 cookbooks/example/recipes/default.rb
create mode 100644 data_bags/README.md
create mode 100644 data_bags/example/example_item.json
create mode 100644 environments/README.md
create mode 100644 environments/example.json
create mode 100644 roles/README.md
create mode 100644 roles/example.json
[root@chef_workstation chef-repo]# git status
# On branch master
nothing to commit, working directory clean
4.8 Copy the RSA Keys to the Workstation:
Copy the RSA key from chef server node to chef workstation node
[root@chef_workstation chef-repo]# scp -pr root@chef_server:/root/admin.pem /root/chef-repo/.chef/
[root@chef_workstation chef-repo]# scp -pr root@chef_server:/root/chef-validator.pem /root/chef-repo/.chef/
4.9 Create knife.rb File:
create and edit the knife.rb file
[root@chef_workstation chef-repo]# vim ~/chef-repo/.chef/knife.rb
current_dir = File.dirname(__FILE__)
log_level :info
log_location STDOUT
node_name "admin"
client_key "#{current_dir}/admin.pem"
validation_client_name "chef-validator"
validation_key "#{current_dir}/chef-validator.pem"
chef_server_url "https://chef_server/organizations/chef"
syntax_check_cache_path "#{ENV['HOME']}/.chef/syntaxcache"
cookbook_path ["#{current_dir}/../cookbooks"]
4.10 Testing Knife:
[root@chef_workstation ~]# cd /root/chef-repo
[root@chef_workstation chef-repo]# knife client list
ERROR: SSL Validation failure connecting to host: chef_server - SSL_connect returned=1 errno=0 state=error: certificate verify failed
ERROR: Could not establish a secure connection to the server.
Use `knife ssl check` to troubleshoot your SSL configuration.
If your Chef Server uses a self-signed certificate, you can use
`knife ssl fetch` to make knife trust the server's certificates.
Original Exception: OpenSSL::SSL::SSLError: SSL Error connecting to https://chef_server/organizations/chef/clients - SSL_connect returned=1 errno=0 state=error: certificate verify failed
4.11 Check SSL
[root@chef_workstation chef-repo]# knife ssl check
Connecting to host chef_server:443
ERROR: The SSL certificate of chef_server could not be verified
Certificate issuer data: /C=US/O=YouCorp/OU=Operations/CN=chef_server
Configuration Info:
OpenSSL Configuration:
* Version: OpenSSL 1.0.2j 26 Sep 2016
* Certificate file: /opt/chefdk/embedded/ssl/cert.pem
* Certificate directory: /opt/chefdk/embedded/ssl/certs
Chef SSL Configuration:
* ssl_ca_path: nil
* ssl_ca_file: nil
* trusted_certs_dir: "/root/chef-repo/.chef/trusted_certs"
TO FIX THIS ERROR:
If the server you are connecting to uses a self-signed certificate, you must
configure chef to trust that server's certificate.
By default, the certificate is stored in the following location on the host
where your chef-server runs:
/var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt
Copy that file to your trusted_certs_dir (currently: /root/chef-repo/.chef/trusted_certs)
using SSH/SCP or some other secure method, then re-run this command to confirm
that the server's certificate is now trusted.
[root@chef_workstation chef-repo]# knife ssl fetch
WARNING: Certificates from chef_server will be fetched and placed in your trusted_cert
directory (/root/chef-repo/.chef/trusted_certs).
Knife has no means to verify these are the correct certificates. You should
verify the authenticity of these certificates after downloading.
Adding certificate for chef_server in /root/chef-repo/.chef/trusted_certs/chef_server.crt
[root@chef_workstation chef-repo]# knife ssl check
Connecting to host chef_server:443
Successfully verified certificates from `chef_server'
4.12 Verify the client connection
[root@chef_workstation chef-repo]# knife client list
chef-validator
The output confirms the verification has been completed successfully.
五、Configure Chef client Node
Bootstrapping a node is a process of installing chef-client on a target machine so that it can run as a chef-client node and communicate with the chef server.From the workstation, you can bootstrap the node either by using the node’s root user, or a user with elevated privileges.
[root@chef_workstation .chef]# knife bootstrap chefnode-1 -x root -P password --sudo
Important options:
-x: The ssh username
-P: The ssh password
-p: The ssh port
-N: Set your chef-client node name. Leaving this out will usually make hostname being used as the chef-client node name.
[root@chef_workstation .chef]# knife bootstrap chefnode-1 -x root -P password --sudo
Doing old-style registration with the validation key at /root/chef-repo/.chef/chef-validator.pem...
Delete your validation key in order to use your user credentials instead
Connecting to chefnode-1
chefnode-1 -----> Existing Chef installation detected
chefnode-1 Starting the first Chef Client run...
chefnode-1 Starting Chef Client, version 13.1.31
chefnode-1 Creating a new client identity for chefnode-1 using the validator key.
chefnode-1 resolving cookbooks for run list: []
chefnode-1 Synchronizing Cookbooks:
chefnode-1 Installing Cookbook Gems:
chefnode-1 Compiling Cookbooks...
chefnode-1 [2017-06-16T03:07:47+08:00] WARN: Node chefnode-1 has an empty run list.
chefnode-1 Converging 0 resources
chefnode-1
chefnode-1 Running handlers:
chefnode-1 Running handlers complete
chefnode-1 Chef Client finished, 0/0 resources updated in 02 seconds
[root@chef_workstation .chef]# knife node list
chefnode-1
[root@chef_workstation .chef]# knife client show chefnode-1
admin: false
chef_type: client
name: chefnode-1
validator: false
六、Create a Simple Chef Cookbooks
create cookbook test_cookbook
[root@chef_workstation ~]# cd ~/chef-repo/cookbooks/
[root@chef_workstation cookbooks]# chef generate cookbook test_cookbook
Generating cookbook test_cookbook
- Ensuring correct cookbook file content
- Ensuring delivery configuration
- Ensuring correct delivery build cookbook content
Your cookbook is ready. Type `cd test_cookbook` to enter it.
There are several commands you can run to get started locally developing and testing your cookbook.
Type `delivery local --help` to see a full list.
Why not start by writing a test? Tests for the default recipe are stored at:
test/smoke/default/default_test.rb
If you'd prefer to dive right in, the default recipe can be found at:
recipes/default.rb
[root@chef_workstation recipes]# vim default.rb
#
# Cookbook:: test_cookbook
# Recipe:: default
#
# Copyright:: 2017, The Authors, All Rights Reserved.
#
execute 'cp_file' do
command 'cp /etc/hosts /root'
ignore_failure true
end
Upload the Cookbook:
Once your cookbook is complete, you can upload them on to your Chef server
[root@chef_workstation cookbooks]# knife cookbook upload test_cookbook
Uploading test_cookbook [0.1.0]
Uploaded 1 cookbook.
Check the version of cookbook
[root@chef_workstation cookbooks]# knife cookbook list
test_cookbook 0.1.0
Add the Cookbook to your node:
You can add a cookbook to the run_list of a particular node using the following command
[root@chef_workstation cookbooks]# knife node run_list add chefnode-1 test_cookbook
chefnode-1:
run_list: recipe[test_cookbook]
Ececute the action in cookbook on chef node
[root@chefnode-1 ~]# chef-client
Starting Chef Client, version 13.1.31
resolving cookbooks for run list: ["test_cookbook"]
Synchronizing Cookbooks:
- test_cookbook (0.1.0)
Installing Cookbook Gems:
Compiling Cookbooks...
Converging 1 resources
Recipe: test_cookbook::default
* execute[cp_file] action run
- execute cp /etc/hosts /root
Running handlers:
Running handlers complete
Chef Client finished, 1/1 resources updated in 02 seconds
vreufy the result
[root@chefnode-1 ~]# ls
anaconda-ks.cfg hosts
Resources Reference
https://docs.chef.io/resources.html