ret ini clean end com run err contents etc

一、Prerequisite

OS : CentOS-7.0-1406-x86_64-DVD.iso

Time Server : NTP Server

SERVER NAME	IP PLAN
chef_server	192.168.100.10
chef_workstation	192.168.100.11
chefnode-1	192.168.100.12

IP Plan:

rpm package(chef_server):

autogen-libopts-5.18-5.el7.x86_64.rpm

ntp-4.2.6p5-25.el7.centos.x86_64.rpm

chef-server-core-12.15.7-1.el7.x86_64.rpm

rpm package(chef workstation):

chefdk-1.4.3-1.el7.x86_64.rpm

git-1.8.3.1-6.el7_2.1.x86_64.rpm

rpm package(chef node):

chef-13.1.31-1.el7.x86_64.rpm

二、Configure OS Environment

2.1 Configure the /etc/hosts

add the content of below into /etc/hosts every node:

192.168.100.10 chef_server

192.168.100.11 chef_workstation

192.168.100.12 chefnode-1

2.2 Setting the NTP Server On chef_server node

2.2.1 Install NTP package

[[email protected]_server ~]# rpm -Uvh autogen-libopts-5.18-5.el7.x86_64.rpm

warning: autogen-libopts-5.18-5.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY

Preparing... ################################# [100%]

Updating / installing...

1:autogen-libopts-5.18-5.el7 ################################# [100%]

[[email protected]_server ~]# rpm -Uvh ntp-4.2.6p5-25.el7.centos.x86_64.rpm --nodeps

warning: ntp-4.2.6p5-25.el7.centos.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY

Preparing... ################################# [100%]

Updating / installing...

1:ntp-4.2.6p5-25.el7.centos ################################# [100%]

[[email protected]_server ~]# systemctl start ntpd

[[email protected]_server ~]# systemctl status ntpd

ntpd.service - Network Time Service

Loaded: loaded (/usr/lib/systemd/system/ntpd.service; disabled)

Active: active (running) since Thu 2017-06-15 23:40:59 CST; 11s ago

Process: 2681 ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS (code=exited, status=0/SUCCESS)

Main PID: 2682 (ntpd)

CGroup: /system.slice/ntpd.service

├─2682 /usr/sbin/ntpd -u ntp:ntp -g

└─2683 /usr/sbin/ntpd -u ntp:ntp -g

2.2.2 Configure the NTP Server

[[email protected]_server ~]# vim /etc/ntp.conf

driftfile /var/lib/ntp/drift

restrict default nomodify notrap nopeer noquery

restrict 127.0.0.1

restrict ::1

# delete

server 0.centos.pool.ntp.org iburst

server 1.centos.pool.ntp.org iburst

server 2.centos.pool.ntp.org iburst

server 3.centos.pool.ntp.org iburst

# add

server 127.127.1.0

fudge 127.127.1.0 stratum 1

includefile /etc/ntp/crypto/pw

keys /etc/ntp/keys

disable monitor

[[email protected]_server ~]# systemctl restart ntpd

[[email protected]_server ~]# ntpq -p

remote refid st t when poll reach delay offset jitter

==============================================================================

*LOCAL(0) .LOCL. 1 l 6 64 1 0.000 0.000 0.000

2.2.3 disable the service named firewalld

[[email protected]_server ~]# systemctl status firewalld

firewalld.service - firewalld - dynamic firewall daemon

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)

Active: active (running) since Thu 2017-06-15 23:17:24 CST; 37min ago

Main PID: 782 (firewalld)

CGroup: /system.slice/firewalld.service

└─782 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Jun 15 23:17:24 chef_server systemd[1]: Started firewalld - dynamic firewall daemon.

[[email protected]_server ~]# systemctl stop firewalld

[[email protected]_server ~]# systemctl status firewalld

firewalld.service - firewalld - dynamic firewall daemon

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)

Active: inactive (dead) since Thu 2017-06-15 23:55:50 CST; 2s ago

Main PID: 782 (code=exited, status=0/SUCCESS)

Jun 15 23:17:24 chef_server systemd[1]: Started firewalld - dynamic firewall daemon.

Jun 15 23:55:48 chef_server systemd[1]: Stopping firewalld - dynamic firewall daemon...

Jun 15 23:55:50 chef_server systemd[1]: Stopped firewalld - dynamic firewall daemon.

NOTE THAT: if you don’t want to stop the firewall ,The Chef server requires the following ports to be open through the firewall

Run the following command to allow 80 and 443 through the firewall.

firewall-cmd --permanent --zone public --add-service http

firewall-cmd --permanent --zone public --add-service https

firewall-cmd --reload

2.2.4 Verify configure and Synchronization

On chef_workstation

[[email protected]_workstation ~]# ntpdate chef_server

16 Jun 00:21:55 ntpdate[3239]: adjust time server 192.168.100.10 offset 0.006277 sec

On chefnode-1

[[email protected] ~]# ntpdate chef_server

16 Jun 00:22:02 ntpdate[3629]: step time server 192.168.100.10 offset 51936.191786 sec

三、Configure Chef Server

3.1 Install chef server package on server node

Install the chef server package and download from the site: https://downloads.chef.io/

[[email protected]_server ~]# rpm -Uvh chef-server-core-12.15.7-1.el7.x86_64.rpm

warning: chef-server-core-12.15.7-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY

Preparing... ################################# [100%]

Updating / installing...

1:chef-server-core-12.15.7-1.el7 ################################# [100%]

[[email protected]_server ~]# chef-server-ctl reconfigure

……

Chef Client finished, 493/1080 resources updated in 03 minutes 39 seconds

Chef Server Reconfigured!

[[email protected]_server ~]# chef-server-ctl status

run: bookshelf: (pid 12149) 193s; run: log: (pid 12187) 193s

run: nginx: (pid 11960) 197s; run: log: (pid 12564) 188s

run: oc_bifrost: (pid 11858) 199s; run: log: (pid 11901) 198s

run: oc_id: (pid 11950) 198s; run: log: (pid 11956) 197s

run: opscode-erchef: (pid 12387) 190s; run: log: (pid 12311) 192s

run: opscode-expander: (pid 12034) 194s; run: log: (pid 12105) 194s

run: opscode-solr4: (pid 12000) 195s; run: log: (pid 12020) 195s

run: postgresql: (pid 11816) 199s; run: log: (pid 11841) 199s

run: rabbitmq: (pid 11304) 211s; run: log: (pid 11163) 216s

run: redis_lb: (pid 10796) 248s; run: log: (pid 12555) 188s

3.2 Create an admin User or Organization

User Name: admin

First Name: admin

Last Name: admin

Email: [email protected]

Password: password

File Name: admin.pem

Path: /root

[[email protected]_server ~]# chef-server-ctl user-create admin admin admin [email protected] password -f /root/admin.pem

[[email protected]_server ~]# chef-server-ctl org-create chef "CHEF, Inc" --association_user admin -f /root/chef-validator.pem

四、Configure Chef Workstation

4.1 Install chef dk package on chef workstation node

Download the package from the site : https://downloads.chef.io/

[[email protected]_workstation ~]# rpm -Uvh chefdk-1.4.3-1.el7.x86_64.rpm

warning: chefdk-1.4.3-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY

Preparing... ################################# [100%]

Updating / installing...

1:chefdk-1.4.3-1.el7 ################################# [100%]

Thank you for installing Chef Development Kit!

4.2 Configure the PATH

[[email protected]_workstation bin]# export PATH="/opt/chefdk/embedded/bin:${HOME}/.chefdk/gem/ruby/2.1.0/bin:$PATH"

Verify the configure

[[email protected]_workstation bin]# which ruby

/opt/chefdk/embedded/bin/ruby

4.3 Install Git

[[email protected]_workstation ~]# rpm -Uvh git-1.8.3.1-6.el7_2.1.x86_64.rpm --nodeps

warning: git-1.8.3.1-6.el7_2.1.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY

Preparing... ################################# [100%]

Updating / installing...

1:git-1.8.3.1-6.el7_2.1 ################################# [100%]

[[email protected]_workstation ~]# git --version

git version 1.8.3.1

4.4 Create chef repo directory

[[email protected]_workstation ~]# chef generate repo chef-repo

[[email protected]_workstation ~]# cd chef-repo/

[[email protected]_workstation chef-repo]# ls -al

total 32

drwxr-xr-x. 7 root root 4096 Jun 16 01:20 .

dr-xr-x---. 6 root root 4096 Jun 16 01:20 ..

-rw-r--r--. 1 root root 1133 Jun 16 01:20 chefignore

-rw-r--r--. 1 root root 255 Jun 16 01:20 .chef-repo.txt

drwxr-xr-x. 3 root root 36 Jun 16 01:20 cookbooks

drwxr-xr-x. 3 root root 36 Jun 16 01:20 data_bags

drwxr-xr-x. 2 root root 41 Jun 16 01:20 environments

drwxr-xr-x. 7 root root 4096 Jun 16 01:20 .git

-rw-r--r--. 1 root root 2121 Jun 16 01:20 .gitignore

-rw-r--r--. 1 root root 70 Jun 16 01:20 LICENSE

-rw-r--r--. 1 root root 1499 Jun 16 01:20 README.md

drwxr-xr-x. 2 root root 41 Jun 16 01:20 roles

4.5 Create the user and email for git

[[email protected]_workstation ~]# git config --global user.name "admin"

[[email protected]_workstation ~]# git config --global user.email "[email protected]"

4.6 Create the repo for git

[[email protected]_workstation ~]# cd chef-repo/

[[email protected]_workstation chef-repo]# git init

Reinitialized existing Git repository in /root/chef-repo/.git/

4.7 Create the hidden folder .chef under /root/chef-repo

the hidden folder .chef under /root/chef-repo so that stores the RSA keys

[[email protected]_workstation chef-repo]# mkdir -p ~/chef-repo/.chef

NOTE THAT:Since this hidden directory stores the RSA keys, it should not be exposed to the public. To do that we will add this directory to “.gitignore” to prevent uploading the contents to GitHub

[[email protected]_workstation chef-repo]# echo ‘.chef‘ >> ~/chef-repo/.gitignore

[[email protected]_workstation chef-repo]# git add .

[[email protected]_workstation chef-repo]# git commit -m "initial commit"

[master (root-commit) 26d359d] initial commit

16 files changed, 471 insertions(+)

create mode 100644 .chef-repo.txt

create mode 100644 .gitignore

create mode 100644 LICENSE

create mode 100644 README.md

create mode 100644 chefignore

create mode 100644 cookbooks/README.md

create mode 100644 cookbooks/example/README.md

create mode 100644 cookbooks/example/attributes/default.rb

create mode 100644 cookbooks/example/metadata.rb

create mode 100644 cookbooks/example/recipes/default.rb

create mode 100644 data_bags/README.md

create mode 100644 data_bags/example/example_item.json

create mode 100644 environments/README.md

create mode 100644 environments/example.json

create mode 100644 roles/README.md

create mode 100644 roles/example.json

[[email protected]_workstation chef-repo]# git status

# On branch master

nothing to commit, working directory clean

4.8 Copy the RSA Keys to the Workstation:

Copy the RSA key from chef server node to chef workstation node

[[email protected]_workstation chef-repo]# scp -pr [email protected]_server:/root/admin.pem /root/chef-repo/.chef/

[[email protected]_workstation chef-repo]# scp -pr [email protected]_server:/root/chef-validator.pem /root/chef-repo/.chef/

4.9 Create knife.rb File:

create and edit the knife.rb file

[[email protected]_workstation chef-repo]# vim ~/chef-repo/.chef/knife.rb

current_dir = File.dirname(__FILE__)

log_level :info

log_location STDOUT

node_name "admin"

client_key "#{current_dir}/admin.pem"

validation_client_name "chef-validator"

validation_key "#{current_dir}/chef-validator.pem"

chef_server_url "https://chef_server/organizations/chef"

syntax_check_cache_path "#{ENV[‘HOME‘]}/.chef/syntaxcache"

cookbook_path ["#{current_dir}/../cookbooks"]

4.10 Testing Knife:

[[email protected]_workstation ~]# cd /root/chef-repo

[[email protected]_workstation chef-repo]# knife client list

ERROR: SSL Validation failure connecting to host: chef_server - SSL_connect returned=1 errno=0 state=error: certificate verify failed

ERROR: Could not establish a secure connection to the server.

Use `knife ssl check` to troubleshoot your SSL configuration.

If your Chef Server uses a self-signed certificate, you can use

`knife ssl fetch` to make knife trust the server‘s certificates.

Original Exception: OpenSSL::SSL::SSLError: SSL Error connecting to https://chef_server/organizations/chef/clients - SSL_connect returned=1 errno=0 state=error: certificate verify failed

4.11 Check SSL

[[email protected]_workstation chef-repo]# knife ssl check

Connecting to host chef_server:443

ERROR: The SSL certificate of chef_server could not be verified

Certificate issuer data: /C=US/O=YouCorp/OU=Operations/CN=chef_server

Configuration Info:

OpenSSL Configuration:

* Version: OpenSSL 1.0.2j 26 Sep 2016

* Certificate file: /opt/chefdk/embedded/ssl/cert.pem

* Certificate directory: /opt/chefdk/embedded/ssl/certs

Chef SSL Configuration:

* ssl_ca_path: nil

* ssl_ca_file: nil

* trusted_certs_dir: "/root/chef-repo/.chef/trusted_certs"

TO FIX THIS ERROR:

If the server you are connecting to uses a self-signed certificate, you must

configure chef to trust that server‘s certificate.

By default, the certificate is stored in the following location on the host

where your chef-server runs:

/var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt

Copy that file to your trusted_certs_dir (currently: /root/chef-repo/.chef/trusted_certs)

using SSH/SCP or some other secure method, then re-run this command to confirm

that the server‘s certificate is now trusted.

[[email protected]_workstation chef-repo]# knife ssl fetch

WARNING: Certificates from chef_server will be fetched and placed in your trusted_cert

directory (/root/chef-repo/.chef/trusted_certs).

Knife has no means to verify these are the correct certificates. You should

verify the authenticity of these certificates after downloading.

Adding certificate for chef_server in /root/chef-repo/.chef/trusted_certs/chef_server.crt

[[email protected]_workstation chef-repo]# knife ssl check

Connecting to host chef_server:443

Successfully verified certificates from `chef_server‘

4.12 Verify the client connection

[[email protected]_workstation chef-repo]# knife client list

chef-validator

The output confirms the verification has been completed successfully.

五、Configure Chef client Node

Bootstrapping a node is a process of installing chef-client on a target machine so that it can run as a chef-client node and communicate with the chef server.From the workstation, you can bootstrap the node either by using the node’s root user, or a user with elevated privileges.

[[email protected]_workstation .chef]# knife bootstrap chefnode-1 -x root -P password --sudo

Important options:

-x: The ssh username

-P: The ssh password

-p: The ssh port

-N: Set your chef-client node name. Leaving this out will usually make hostname being used as the chef-client node name.

[[email protected]_workstation .chef]# knife bootstrap chefnode-1 -x root -P password --sudo

Doing old-style registration with the validation key at /root/chef-repo/.chef/chef-validator.pem...

Delete your validation key in order to use your user credentials instead

Connecting to chefnode-1

chefnode-1 -----> Existing Chef installation detected

chefnode-1 Starting the first Chef Client run...

chefnode-1 Starting Chef Client, version 13.1.31

chefnode-1 Creating a new client identity for chefnode-1 using the validator key.

chefnode-1 resolving cookbooks for run list: []

chefnode-1 Synchronizing Cookbooks:

chefnode-1 Installing Cookbook Gems:

chefnode-1 Compiling Cookbooks...

chefnode-1 [2017-06-16T03:07:47+08:00] WARN: Node chefnode-1 has an empty run list.

chefnode-1 Converging 0 resources

chefnode-1

chefnode-1 Running handlers:

chefnode-1 Running handlers complete

chefnode-1 Chef Client finished, 0/0 resources updated in 02 seconds

[[email protected]_workstation .chef]# knife node list

chefnode-1

[[email protected]_workstation .chef]# knife client show chefnode-1

admin: false

chef_type: client

name: chefnode-1

validator: false

六、Create a Simple Chef Cookbooks

create cookbook test_cookbook

[[email protected]_workstation ~]# cd ~/chef-repo/cookbooks/

[[email protected]_workstation cookbooks]# chef generate cookbook test_cookbook

Generating cookbook test_cookbook

- Ensuring correct cookbook file content

- Ensuring delivery configuration

- Ensuring correct delivery build cookbook content

Your cookbook is ready. Type `cd test_cookbook` to enter it.

There are several commands you can run to get started locally developing and testing your cookbook.

Type `delivery local --help` to see a full list.

Why not start by writing a test? Tests for the default recipe are stored at:

test/smoke/default/default_test.rb

If you‘d prefer to dive right in, the default recipe can be found at:

recipes/default.rb

[[email protected]_workstation recipes]# vim default.rb

#

# Cookbook:: test_cookbook

# Recipe:: default

#

# Copyright:: 2017, The Authors, All Rights Reserved.

#

execute ‘cp_file‘ do

command ‘cp /etc/hosts /root‘

ignore_failure true

end

Upload the Cookbook:

Once your cookbook is complete, you can upload them on to your Chef server

[[email protected]_workstation cookbooks]# knife cookbook upload test_cookbook

Uploading test_cookbook [0.1.0]

Uploaded 1 cookbook.

Check the version of cookbook

[[email protected]_workstation cookbooks]# knife cookbook list

test_cookbook 0.1.0

Add the Cookbook to your node:

You can add a cookbook to the run_list of a particular node using the following command

[[email protected]_workstation cookbooks]# knife node run_list add chefnode-1 test_cookbook

chefnode-1:

run_list: recipe[test_cookbook]

Ececute the action in cookbook on chef node

[[email protected] ~]# chef-client

Starting Chef Client, version 13.1.31

resolving cookbooks for run list: ["test_cookbook"]

Synchronizing Cookbooks:

- test_cookbook (0.1.0)

Installing Cookbook Gems:

Compiling Cookbooks...

Converging 1 resources

Recipe: test_cookbook::default

* execute[cp_file] action run

- execute cp /etc/hosts /root

Running handlers:

Running handlers complete

Chef Client finished, 1/1 resources updated in 02 seconds

vreufy the result

[[email protected] ~]# ls

anaconda-ks.cfg hosts

Resources Reference

https://docs.chef.io/resources.html

[原]Chef_Server and Chef_WorkStation and Chef_Client Install Guide[by haibo]