[原]Chef_Server and Chef_WorkStation and Chef_Client Install Guide[by haibo]
Posted my_cool2007
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了[原]Chef_Server and Chef_WorkStation and Chef_Client Install Guide[by haibo]相关的知识，希望对你有一定的参考价值。
一、Prerequisite
OS : CentOS-7.0-1406-x86_64-DVD.iso
Time Server : NTP Server
|
SERVER NAME |
IP PLAN |
|
chef_server |
192.168.100.10 |
|
chef_workstation |
192.168.100.11 |
|
chefnode-1 |
192.168.100.12 |
IP Plan:
rpm package(chef_server):
autogen-libopts-5.18-5.el7.x86_64.rpm
ntp-4.2.6p5-25.el7.centos.x86_64.rpm
chef-server-core-12.15.7-1.el7.x86_64.rpm
rpm package(chef workstation):
chefdk-1.4.3-1.el7.x86_64.rpm
git-1.8.3.1-6.el7_2.1.x86_64.rpm
rpm package(chef node):
chef-13.1.31-1.el7.x86_64.rpm
二、Configure OS Environment
2.1 Configure the /etc/hosts
add the content of below into /etc/hosts every node:
192.168.100.10 chef_server
192.168.100.11 chef_workstation
192.168.100.12 chefnode-1
2.2 Setting the NTP Server On chef_server node
2.2.1 Install NTP package
[[email protected]_server ~]# rpm -Uvh autogen-libopts-5.18-5.el7.x86_64.rpm
warning: autogen-libopts-5.18-5.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:autogen-libopts-5.18-5.el7 ################################# [100%]
[[email protected]_server ~]# rpm -Uvh ntp-4.2.6p5-25.el7.centos.x86_64.rpm --nodeps
warning: ntp-4.2.6p5-25.el7.centos.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:ntp-4.2.6p5-25.el7.centos ################################# [100%]
[[email protected]_server ~]# systemctl start ntpd
[[email protected]_server ~]# systemctl status ntpd
ntpd.service - Network Time Service
Loaded: loaded (/usr/lib/systemd/system/ntpd.service; disabled)
Active: active (running) since Thu 2017-06-15 23:40:59 CST; 11s ago
Process: 2681 ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 2682 (ntpd)
CGroup: /system.slice/ntpd.service
├─2682 /usr/sbin/ntpd -u ntp:ntp -g
└─2683 /usr/sbin/ntpd -u ntp:ntp -g
2.2.2 Configure the NTP Server
[[email protected]_server ~]# vim /etc/ntp.conf
driftfile /var/lib/ntp/drift
restrict default nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict ::1
# delete
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst
# add
server 127.127.1.0
fudge 127.127.1.0 stratum 1
includefile /etc/ntp/crypto/pw
keys /etc/ntp/keys
disable monitor
[[email protected]_server ~]# systemctl restart ntpd
[[email protected]_server ~]# ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
*LOCAL(0) .LOCL. 1 l 6 64 1 0.000 0.000 0.000
2.2.3 disable the service named firewalld
[[email protected]_server ~]# systemctl status firewalld
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: active (running) since Thu 2017-06-15 23:17:24 CST; 37min ago
Main PID: 782 (firewalld)
CGroup: /system.slice/firewalld.service
└─782 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
Jun 15 23:17:24 chef_server systemd[1]: Started firewalld - dynamic firewall daemon.
[[email protected]_server ~]# systemctl stop firewalld
[[email protected]_server ~]# systemctl status firewalld
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: inactive (dead) since Thu 2017-06-15 23:55:50 CST; 2s ago
Main PID: 782 (code=exited, status=0/SUCCESS)
Jun 15 23:17:24 chef_server systemd[1]: Started firewalld - dynamic firewall daemon.
Jun 15 23:55:48 chef_server systemd[1]: Stopping firewalld - dynamic firewall daemon...
Jun 15 23:55:50 chef_server systemd[1]: Stopped firewalld - dynamic firewall daemon.
NOTE THAT: if you don’t want to stop the firewall ,The Chef server requires the following ports to be open through the firewall
Run the following command to allow 80 and 443 through the firewall.
firewall-cmd --permanent --zone public --add-service http
firewall-cmd --permanent --zone public --add-service https
firewall-cmd --reload
2.2.4 Verify configure and Synchronization
On chef_workstation
[[email protected]_workstation ~]# ntpdate chef_server
16 Jun 00:21:55 ntpdate[3239]: adjust time server 192.168.100.10 offset 0.006277 sec
On chefnode-1
[[email protected] ~]# ntpdate chef_server
16 Jun 00:22:02 ntpdate[3629]: step time server 192.168.100.10 offset 51936.191786 sec
三、Configure Chef Server
3.1 Install chef server package on server node
Install the chef server package and download from the site: https://downloads.chef.io/
[[email protected]_server ~]# rpm -Uvh chef-server-core-12.15.7-1.el7.x86_64.rpm
warning: chef-server-core-12.15.7-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:chef-server-core-12.15.7-1.el7 ################################# [100%]
[[email protected]_server ~]# chef-server-ctl reconfigure
……
Chef Client finished, 493/1080 resources updated in 03 minutes 39 seconds
Chef Server Reconfigured!
[[email protected]_server ~]# chef-server-ctl status
run: bookshelf: (pid 12149) 193s; run: log: (pid 12187) 193s
run: nginx: (pid 11960) 197s; run: log: (pid 12564) 188s
run: oc_bifrost: (pid 11858) 199s; run: log: (pid 11901) 198s
run: oc_id: (pid 11950) 198s; run: log: (pid 11956) 197s
run: opscode-erchef: (pid 12387) 190s; run: log: (pid 12311) 192s
run: opscode-expander: (pid 12034) 194s; run: log: (pid 12105) 194s
run: opscode-solr4: (pid 12000) 195s; run: log: (pid 12020) 195s
run: postgresql: (pid 11816) 199s; run: log: (pid 11841) 199s
run: rabbitmq: (pid 11304) 211s; run: log: (pid 11163) 216s
run: redis_lb: (pid 10796) 248s; run: log: (pid 12555) 188s
3.2 Create an admin User or Organization
User Name: admin
First Name: admin
Last Name: admin
Email: [email protected]
Password: password
File Name: admin.pem
Path: /root
[[email protected]_server ~]# chef-server-ctl user-create admin admin admin [email protected] password -f /root/admin.pem
[[email protected]_server ~]# chef-server-ctl org-create chef "CHEF, Inc" --association_user admin -f /root/chef-validator.pem
四、Configure Chef Workstation
4.1 Install chef dk package on chef workstation node
Download the package from the site : https://downloads.chef.io/
[[email protected]_workstation ~]# rpm -Uvh chefdk-1.4.3-1.el7.x86_64.rpm
warning: chefdk-1.4.3-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:chefdk-1.4.3-1.el7 ################################# [100%]
Thank you for installing Chef Development Kit!
4.2 Configure the PATH
[[email protected]_workstation bin]# export PATH="/opt/chefdk/embedded/bin:${HOME}/.chefdk/gem/ruby/2.1.0/bin:$PATH"
Verify the configure
[[email protected]_workstation bin]# which ruby
/opt/chefdk/embedded/bin/ruby
4.3 Install Git
[[email protected]_workstation ~]# rpm -Uvh git-1.8.3.1-6.el7_2.1.x86_64.rpm --nodeps
warning: git-1.8.3.1-6.el7_2.1.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:git-1.8.3.1-6.el7_2.1 ################################# [100%]
[[email protected]_workstation ~]# git --version
git version 1.8.3.1
4.4 Create chef repo directory
[[email protected]_workstation ~]# chef generate repo chef-repo
[[email protected]_workstation ~]# cd chef-repo/
[[email protected]_workstation chef-repo]# ls -al
total 32
drwxr-xr-x. 7 root root 4096 Jun 16 01:20 .
dr-xr-x---. 6 root root 4096 Jun 16 01:20 ..
-rw-r--r--. 1 root root 1133 Jun 16 01:20 chefignore
-rw-r--r--. 1 root root 255 Jun 16 01:20 .chef-repo.txt
drwxr-xr-x. 3 root root 36 Jun 16 01:20 cookbooks
drwxr-xr-x. 3 root root 36 Jun 16 01:20 data_bags
drwxr-xr-x. 2 root root 41 Jun 16 01:20 environments
drwxr-xr-x. 7 root root 4096 Jun 16 01:20 .git
-rw-r--r--. 1 root root 2121 Jun 16 01:20 .gitignore
-rw-r--r--. 1 root root 70 Jun 16 01:20 LICENSE
-rw-r--r--. 1 root root 1499 Jun 16 01:20 README.md
drwxr-xr-x. 2 root root 41 Jun 16 01:20 roles
4.5 Create the user and email for git
[[email protected]_workstation ~]# git config --global user.name "admin"
[[email protected]_workstation ~]# git config --global user.email "[email protected]"
4.6 Create the repo for git
[[email protected]_workstation ~]# cd chef-repo/
[[email protected]_workstation chef-repo]# git init
Reinitialized existing Git repository in /root/chef-repo/.git/
4.7 Create the hidden folder .chef under /root/chef-repo
the hidden folder .chef under /root/chef-repo so that stores the RSA keys
[[email protected]_workstation chef-repo]# mkdir -p ~/chef-repo/.chef
NOTE THAT:Since this hidden directory stores the RSA keys, it should not be exposed to the public. To do that we will add this directory to “.gitignore” to prevent uploading the contents to GitHub
[[email protected]_workstation chef-repo]# echo ‘.chef‘ >> ~/chef-repo/.gitignore
[[email protected]_workstation chef-repo]# git add .
[[email protected]_workstation chef-repo]# git commit -m "initial commit"
[master (root-commit) 26d359d] initial commit
16 files changed, 471 insertions(+)
create mode 100644 .chef-repo.txt
create mode 100644 .gitignore
create mode 100644 LICENSE
create mode 100644 README.md
create mode 100644 chefignore
create mode 100644 cookbooks/README.md
create mode 100644 cookbooks/example/README.md
create mode 100644 cookbooks/example/attributes/default.rb
create mode 100644 cookbooks/example/metadata.rb
create mode 100644 cookbooks/example/recipes/default.rb
create mode 100644 data_bags/README.md
create mode 100644 data_bags/example/example_item.json
create mode 100644 environments/README.md
create mode 100644 environments/example.json
create mode 100644 roles/README.md
create mode 100644 roles/example.json
[[email protected]_workstation chef-repo]# git status
# On branch master
nothing to commit, working directory clean
4.8 Copy the RSA Keys to the Workstation:
Copy the RSA key from chef server node to chef workstation node
[[email protected]_workstation chef-repo]# scp -pr [email protected]_server:/root/admin.pem /root/chef-repo/.chef/
[[email protected]_workstation chef-repo]# scp -pr [email protected]_server:/root/chef-validator.pem /root/chef-repo/.chef/
4.9 Create knife.rb File:
create and edit the knife.rb file
[[email protected]_workstation chef-repo]# vim ~/chef-repo/.chef/knife.rb
current_dir = File.dirname(__FILE__)
log_level :info
log_location STDOUT
node_name "admin"
client_key "#{current_dir}/admin.pem"
validation_client_name "chef-validator"
validation_key "#{current_dir}/chef-validator.pem"
chef_server_url "https://chef_server/organizations/chef"
syntax_check_cache_path "#{ENV[‘HOME‘]}/.chef/syntaxcache"
cookbook_path ["#{current_dir}/../cookbooks"]
4.10 Testing Knife:
[[email protected]_workstation ~]# cd /root/chef-repo
[[email protected]_workstation chef-repo]# knife client list
ERROR: SSL Validation failure connecting to host: chef_server - SSL_connect returned=1 errno=0 state=error: certificate verify failed
ERROR: Could not establish a secure connection to the server.
Use `knife ssl check` to troubleshoot your SSL configuration.
If your Chef Server uses a self-signed certificate, you can use
`knife ssl fetch` to make knife trust the server‘s certificates.
Original Exception: OpenSSL::SSL::SSLError: SSL Error connecting to https://chef_server/organizations/chef/clients - SSL_connect returned=1 errno=0 state=error: certificate verify failed
4.11 Check SSL
[[email protected]_workstation chef-repo]# knife ssl check
Connecting to host chef_server:443
ERROR: The SSL certificate of chef_server could not be verified
Certificate issuer data: /C=US/O=YouCorp/OU=Operations/CN=chef_server
Configuration Info:
OpenSSL Configuration:
* Version: OpenSSL 1.0.2j 26 Sep 2016
* Certificate file: /opt/chefdk/embedded/ssl/cert.pem
* Certificate directory: /opt/chefdk/embedded/ssl/certs
Chef SSL Configuration:
* ssl_ca_path: nil
* ssl_ca_file: nil
* trusted_certs_dir: "/root/chef-repo/.chef/trusted_certs"
TO FIX THIS ERROR:
If the server you are connecting to uses a self-signed certificate, you must
configure chef to trust that server‘s certificate.
By default, the certificate is stored in the following location on the host
where your chef-server runs:
/var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt
Copy that file to your trusted_certs_dir (currently: /root/chef-repo/.chef/trusted_certs)
using SSH/SCP or some other secure method, then re-run this command to confirm
that the server‘s certificate is now trusted.
[[email protected]_workstation chef-repo]# knife ssl fetch
WARNING: Certificates from chef_server will be fetched and placed in your trusted_cert
directory (/root/chef-repo/.chef/trusted_certs).
Knife has no means to verify these are the correct certificates. You should
verify the authenticity of these certificates after downloading.
Adding certificate for chef_server in /root/chef-repo/.chef/trusted_certs/chef_server.crt
[[email protected]_workstation chef-repo]# knife ssl check
Connecting to host chef_server:443
Successfully verified certificates from `chef_server‘
4.12 Verify the client connection
[[email protected]_workstation chef-repo]# knife client list
chef-validator
The output confirms the verification has been completed successfully.
五、Configure Chef client Node
Bootstrapping a node is a process of installing chef-client on a target machine so that it can run as a chef-client node and communicate with the chef server.From the workstation, you can bootstrap the node either by using the node’s root user, or a user with elevated privileges.
[[email protected]_workstation .chef]# knife bootstrap chefnode-1 -x root -P password --sudo
Important options:
-x: The ssh username
-P: The ssh password
-p: The ssh port
-N: Set your chef-client node name. Leaving this out will usually make hostname being used as the chef-client node name.
[[email protected]_workstation .chef]# knife bootstrap chefnode-1 -x root -P password --sudo
Doing old-style registration with the validation key at /root/chef-repo/.chef/chef-validator.pem...
Delete your validation key in order to use your user credentials instead
Connecting to chefnode-1
chefnode-1 -----> Existing Chef installation detected
chefnode-1 Starting the first Chef Client run...
chefnode-1 Starting Chef Client, version 13.1.31
chefnode-1 Creating a new client identity for chefnode-1 using the validator key.
chefnode-1 resolving cookbooks for run list: []
chefnode-1 Synchronizing Cookbooks:
chefnode-1 Installing Cookbook Gems:
chefnode-1 Compiling Cookbooks...
chefnode-1 [2017-06-16T03:07:47+08:00] WARN: Node chefnode-1 has an empty run list.
chefnode-1 Converging 0 resources
chefnode-1
chefnode-1 Running handlers:
chefnode-1 Running handlers complete
chefnode-1 Chef Client finished, 0/0 resources updated in 02 seconds
[[email protected]_workstation .chef]# knife node list
chefnode-1
[[email protected]_workstation .chef]# knife client show chefnode-1
admin: false
chef_type: client
name: chefnode-1
validator: false
六、Create a Simple Chef Cookbooks
create cookbook test_cookbook
[[email protected]_workstation ~]# cd ~/chef-repo/cookbooks/
[[email protected]_workstation cookbooks]# chef generate cookbook test_cookbook
Generating cookbook test_cookbook
- Ensuring correct cookbook file content
- Ensuring delivery configuration
- Ensuring correct delivery build cookbook content
Your cookbook is ready. Type `cd test_cookbook` to enter it.
There are several commands you can run to get started locally developing and testing your cookbook.
Type `delivery local --help` to see a full list.
Why not start by writing a test? Tests for the default recipe are stored at:
test/smoke/default/default_test.rb
If you‘d prefer to dive right in, the default recipe can be found at:
recipes/default.rb
[[email protected]_workstation recipes]# vim default.rb
#
# Cookbook:: test_cookbook
# Recipe:: default
#
# Copyright:: 2017, The Authors, All Rights Reserved.
#
execute ‘cp_file‘ do
command ‘cp /etc/hosts /root‘
ignore_failure true
end
Upload the Cookbook:
Once your cookbook is complete, you can upload them on to your Chef server
[[email protected]_workstation cookbooks]# knife cookbook upload test_cookbook
Uploading test_cookbook [0.1.0]
Uploaded 1 cookbook.
Check the version of cookbook
[[email protected]_workstation cookbooks]# knife cookbook list
test_cookbook 0.1.0
Add the Cookbook to your node:
You can add a cookbook to the run_list of a particular node using the following command
[[email protected]_workstation cookbooks]# knife node run_list add chefnode-1 test_cookbook
chefnode-1:
run_list: recipe[test_cookbook]
Ececute the action in cookbook on chef node
[[email protected] ~]# chef-client
Starting Chef Client, version 13.1.31
resolving cookbooks for run list: ["test_cookbook"]
Synchronizing Cookbooks:
- test_cookbook (0.1.0)
Installing Cookbook Gems:
Compiling Cookbooks...
Converging 1 resources
Recipe: test_cookbook::default
* execute[cp_file] action run
- execute cp /etc/hosts /root
Running handlers:
Running handlers complete
Chef Client finished, 1/1 resources updated in 02 seconds
vreufy the result
[[email protected] ~]# ls
anaconda-ks.cfg hosts
Resources Reference
https://docs.chef.io/resources.html
以上是关于[原]Chef_Server and Chef_WorkStation and Chef_Client Install Guide[by haibo]的主要内容，如果未能解决你的问题，请参考以下文章
CF743B Chloe and the sequence 题解 分治
CF 713C Sonya and Problem Wihtout a Legend（DP）