search

chef-boneyard / chef-client

Development repository for Chef Client cookbook
http://supermarket.chef.io/cookbooks/chef-client
Apache License 2.0
175 stars 421 forks source link
chef chef-client cookbook hacktoberfest

readme

Chef Client Cookbook

Build Status Cookbook Version

This cookbook is used to configure a system to run the Chef Infra Client.

Deprecation

This cookbook is no longer under active maintenance. The functionality previously provided here is now built into Chef Infra Client itself making it easier to configure Chef Infra Client without the need for external dependencies.

See these built-in resources for managing client.rb configuration and setting up Chef Infra Client to run on a schedule:

What about older Chef Infra Client Releases

If you're using an Infra Client release before the above resources shipped, you can keep using this cookbook without issue. Just keep in mind that at some point in the future changes to Chef Infra Client may cause this cookbook to stop working. We believe the built-in resoures offer a more powerful configuration options for users. The approach offered by these resources also align with our own best practices and we'd highly suggest moving towards those resources for configuring your Chef Infra Client.

The new resources are missing x, y, or z

If there's af feature missing from the new resources please do let us know at https://github.com/chef/chef/issues. We will not be replicating all functionality of this cookbook, but we are interested in hearing what the community needs to manage their systems.

Requirements

Platforms

Chef

Cookbooks

See USAGE.

Resources

The chef-client cookbook provides several resources for setting up Chef Infra Client to run on a schedule. When possible these resources should be used instead of the legacy attributes / recipes as these same resources will be included in Chef Infra Client 16+ out of the box.

chef_client_scheduled_task

The chef_client_scheduled_task resource setups up Chef Infra Client to run as a scheduled task on Windows. You can use this resource directly in any of your own recipes. Using this resource to configure Chef Infra Client running as a scheduled task allows you to control where you store the user credentials instead of storing them as node attributes. This is useful if you want to store these credentials in an encrypted databag or other secrets store.

Actions

Properties

chef_client_cron

The chef_client_cron resource sets up Chef Infra Client to run as a cron job using a cron.d configuration file on Linux hosts or a job in /etc/crontab for other Unix operating systems. You can use this resource directly in any of your own recipes.

Actions

Properties

chef_client_trusted_certificate

The chef_client_trusted_certificate allows you to add a certificate to Chef Infra Client's set of trusted certificates. This is helpful when adding internal certificates for systems that the Chef Infra Client will later need to communicate with using SSL. You can use this resource directly in any of your own recipes.

Actions

Properties

Examples

chef_client_trusted_certificate 'self-signed.badssl.com' do
  certificate <<~CERT
  -----BEGIN CERTIFICATE-----
  MIIDeTCCAmGgAwIBAgIJAPziuikCTox4MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNV
  BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
  c2NvMQ8wDQYDVQQKDAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTAeFw0x
  OTEwMDkyMzQxNTJaFw0yMTEwMDgyMzQxNTJaMGIxCzAJBgNVBAYTAlVTMRMwEQYD
  VQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ8wDQYDVQQK
  DAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEB
  BQADggEPADCCAQoCggEBAMIE7PiM7gTCs9hQ1XBYzJMY61yoaEmwIrX5lZ6xKyx2
  PmzAS2BMTOqytMAPgLaw+XLJhgL5XEFdEyt/ccRLvOmULlA3pmccYYz2QULFRtMW
  hyefdOsKnRFSJiFzbIRMeVXk0WvoBj1IFVKtsyjbqv9u/2CVSndrOfEk0TG23U3A
  xPxTuW1CrbV8/q71FdIzSOciccfCFHpsKOo3St/qbLVytH5aohbcabFXRNsKEqve
  ww9HdFxBIuGa+RuT5q0iBikusbpJHAwnnqP7i/dAcgCskgjZjFeEU4EFy+b+a1SY
  QCeFxxC7c3DvaRhBB0VVfPlkPz0sw6l865MaTIbRyoUCAwEAAaMyMDAwCQYDVR0T
  BAIwADAjBgNVHREEHDAaggwqLmJhZHNzbC5jb22CCmJhZHNzbC5jb20wDQYJKoZI
  hvcNAQELBQADggEBAGlwCdbPxflZfYOaukZGCaxYK6gpincX4Lla4Ui2WdeQxE95
  w7fChXvP3YkE3UYUE7mupZ0eg4ZILr/A0e7JQDsgIu/SRTUE0domCKgPZ8v99k3A
  vka4LpLK51jHJJK7EFgo3ca2nldd97GM0MU41xHFk8qaK1tWJkfrrfcGwDJ4GQPI
  iLlm6i0yHq1Qg1RypAXJy5dTlRXlCLd8ufWhhiwW0W75Va5AEnJuqpQrKwl3KQVe
  wGj67WWRgLfSr+4QG1mNvCZb2CkjZWmxkGPuoP40/y7Yu5OFqxP5tAjj4YixCYTW
  EVA0pmzIzgBg+JIe3PdRy27T0asgQW/F4TY61Yk=
  -----END CERTIFICATE-----
  CERT
end

Attributes

The following attributes affect the behavior of the chef-client program when running as a service through one of the service recipes, or in cron with the cron recipe, or are used in the recipes for various settings that require flexibility.

The following attributes are set on a per-platform basis, see the attributes/default.rb file for default values.

Chef Client Config

For the most current information about Chef Client configuration, read the documentation..

Recipes

This section describes the recipes in the cookbook and how to use them in your environment.

config

Sets up the /etc/chef/client.rb config file from a template and reloads the configuration for the current chef-client run.

See USAGE for more information on how the configuration is rendered with attributes.

service recipes

The chef-client::service recipe includes one of the chef-client::INIT_STYLE_service recipes based on the attribute, node['chef_client']['init_style']. The individual service recipes can be included directly, too. For example, to use the init scripts, on a node or role's run list:

recipe[chef-client::init_service]

Use this recipe on systems that should have a chef-client daemon running, such as when Knife bootstrap was used to install Chef on a new system.

default

Includes the chef-client::service recipe by default on *nix platforms and the task recipe for Windows hosts.

delete_validation

Use this recipe to delete the validation certificate (default /etc/chef/validation.pem) when using a chef-client after the client has been validated and authorized to connect to the server.

cron

Use this recipe to run chef-client as a cron job rather than as a service. The cron job runs after random delay that is between 0 and 90 seconds to ensure that the chef-clients don't attempt to connect to the chef-server at the exact same time. You should set node['chef_client']['init_style'] = 'none' when you use this mode but it is not required.

task

Use this recipe to run chef-client on Windows nodes as a scheduled task. Without modifying attributes the scheduled task will run 30 minutes after the recipe runs, with each chef run rescheduling the run 30 minutes in the future. By default the job runs as the system user. The time period between runs can be modified with the default['chef_client']['task']['frequency_modifier'] attribute and the user can be changed with the default['chef_client']['task']['user'] and default['chef_client']['task']['password'] attributes.

Usage

Use the recipes as described above to configure your systems to run Chef as a service via cron / scheduled task or one of the service management systems supported by the recipes.

The chef-client::config recipe is only required with init style init (default setting for the attribute on debian/redhat family platforms, because the init script doesn't include the pid_file option which is set in the config.

If you wish to accept the Chef license before upgrading to Chef 15 you must use the chef-client::config recipe or set the chef_license value in your config manually. See Accepting the Chef license for more details or other ways to accept the license.

The config recipe is used to dynamically generate the /etc/chef/client.rb config file. The template walks all attributes in node['chef_client']['config'] and writes them out as key:value pairs. The key should be the configuration directive. For example, the following attributes (in a role):

default_attributes(
  "chef_client" => {
    "config" => {
      "ssl_verify_mode" => ":verify_peer",
      "client_fork" => true
    }
  }
)

will render the following configuration (/etc/chef/client.rb):

chef_server_url "https://api.chef.io/organizations/MYORG"
validation_client_name "MYORG-validator"
ssl_verify_mode :verify_peer
node_name "config-ubuntu-1204"
client_fork true

The chef_server_url, node_name and validation_client_name are set by default in the attributes file from Chef::Config. They are presumed to come from the knife bootstrap command when setting up a new node for Chef. To set the node name to the default value (the node['fqdn'] attribute), it can be set false. Be careful when setting this or the Server URL, as those values may already exist.

As another example, to set HTTP proxy configuration settings. By default Chef will not use a proxy.

default_attributes(
  "chef_client" => {
    "config" => {
      "http_proxy" => "http://proxy.mycorp.com:3128",
      "https_proxy" => "http://proxy.mycorp.com:3128",
      "http_proxy_user" => "my_username",
      "http_proxy_pass" => "Awe_some_Pass_Word!",
      "no_proxy" => "*.vmware.com,10.*"
    }
  }
)

Special Behavior

Because attributes are strings and the /etc/chef/client.rb can use settings that are not string, such as symbols, some configuration attributes have resulting lines with special behavior:

default_attributes(
  "chef_client" => {
    "config" => {
      "ssl_verify_mode" => ":verify_peer",
      "log_level" => "debug"
    }
  }
)

will render the following configuration (/etc/chef/client.rb):

ssl_verify_mode :verify_peer
log_level :debug
default_attributes(
  "chef_client" => {
    "config" => {
      "log_location" => "STDOUT"
    }
  }
)

will render the following configuration (/etc/chef/client.rb):

log_location STDOUT

and

default_attributes(
  "chef_client" => {
    "config" => {
      "log_location" => ":syslog"
    }
  }
)

will render the following configuration (/etc/chef/client.rb):

log_location :syslog

The strings "syslog" and "win_evt" will become the symbols :syslog and :win_evt regardless of whether they have an initial colon.

Configuration Includes

The /etc/chef/client.rb file will include all the configuration files in /etc/chef/client.d/*.rb. To create custom configuration, simply render a file resource with file (and the content parameter), template, remote_file, or cookbook_file. For example, in your own cookbook that requires custom Chef client configuration, create the following cookbook_file resource:

chef_gem 'syslog-logger'

cookbook_file "/etc/chef/client.d/myconfig.rb" do
  source "myconfig.rb"
  mode '0644'
  notifies :create, "ruby_block[reload_client_config]"
end

include_recipe 'chef-client::config'

Then create files/default/myconfig.rb with the configuration content you want. For example, if you wish to create a configuration to log to syslog:

require 'syslog-logger'
require 'syslog'

Logger::Syslog.class_eval do
  attr_accessor :sync, :formatter
end

log_location Chef::Log::Syslog.new('chef-client', ::Syslog::LOG_DAEMON)

On Windows:

log_location Chef::Log::WinEvt.new

Requiring Gems

Use the load_gems attribute to install gems that need to be required in the client.rb. This attribute should be a hash. The gem will also be installed with chef_gem. For example, suppose we want to use a Chef Handler Gem, chef-handler-updated-resources, which is used in the next heading. Set the attributes, e.g., in a role:

default_attributes(
  "chef_client" => {
    "load_gems" => {
      "chef-handler-updated-resources" => {
        "require_name" => "chef/handler/updated_resources",
        "version" => "0.1"
      }
    }
  }
)

Each key in load_gems is the name of a gem. Each gem hash can have two keys, the require_name which is the string that will be require'd in /etc/chef/client.rb, and version which is the version of the gem to install. If the version is not specified, the latest version will be installed.

The above example will render the following in /etc/chef/client.rb:

["chef/handler/updated_resources"].each do |lib|
  begin
    require lib
  rescue LoadError
    Chef::Log.warn "Failed to load #{lib}. This should be resolved after a chef run."
  end
end

Start, Report, Exception Handlers

To dynamically render configuration for Start, Report, or Exception handlers, set the following attributes in the config attributes:

This is an alternative to using the chef_handler cookbook.

Each of these attributes must be an array of hashes. The hash has two keys, class (a string), and arguments (an array). For example, to use the report handler in the Requiring Gems section:

default_attributes(
  "chef_client" => {
    "config" => {
      "report_handlers" => [
        {"class" => "SimpleReport::UpdatedResources", "arguments" => []}
      ]
    }
  }
)

If the handler you're using has an initialize method that takes arguments, then pass each one as a member of the array. Otherwise, leave it blank as above.

This will render the following in /etc/chef/client.rb.

report_handlers << SimpleReport::UpdatedResources.new()

Launchd

On macOS and macOS Server, the default service implementation is "launchd".

Since launchd can run a service in interval mode, by default chef-client is not started in daemon mode like on Debian or Ubuntu. Keep this in mind when you look at your process list and check for a running chef process! If you wish to run chef-client in daemon mode, set attribute chef_client.launchd_mode to "daemon".

Installing and updating chef-client

This cookbook does not handle updating the chef-client, as that's out of the cookbook's current scope. To sensibly manage updates of the chef-client's install, we refer you to:

License

Copyright: 2010-2020, Chef Software, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.