Table of Contents
In this tutorial, I will take you through the steps to install Chef 13 on RedHat/CentOS 7. Chef DevOps is a tool for accelerating application delivery and DevOps Collaboration. Chef helps solve the problem by treating infrastructure as code. Rather than manually changing anything, the machine setup is described in a Chef recipe.
Install Chef
Before going through the steps to install chef and configure it, you need to make sure that all prerequisites are in place.
Step 1: Prerequisites
a)Make sure wget is installed in all the Chef systems
b)Below are the minimum configuration required on Chef Server, Chef Workstation and Chef Client.
Chef Server – 4 CPU, 4 GB Memory
Chef Workstation – 1 CPU, 1 GB Memory
Chef Client – 1 CPU, 1 GB Memory
c)Set the Hostname and IP Address in your /etc/hosts as follows:-
vi /etc/hosts
192.168.0.105 chef-server
192.168.0.108 chef-workstation
192.168.0.107 chef-client
d)GIT must be installed on chef-workstation node.
Step 2: Download and Install Chef Server Core
Download and install the Latest Chef Server Core 13 Package from Download Chef Package(This is the latest at the time of writing)
[root@chef-server ~]# rpm -ivh chef-server-core-13.1.13-1.el7.x86_64.rpm
warning: chef-server-core-13.1.13-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:chef-server-core-13.1.13-1.el7 ################################# [100%]
Step 3: Reconfigure Chef
If you do any changes in Chef, you need to run chef-server-ctl reconfigure to check the configuration.
[root@chef-server ~]# chef-server-ctl reconfigure
Starting Chef Infra Client, version 15.4.45
...................................................................................................
Recipe: private-chef::postgresql
* component_runit_service[postgresql] action restart
Recipe: <Dynamically Defined Resource>
* service[postgresql] action nothing (skipped due to action :nothing)
* runit_service[postgresql] action restart (up to date)
(up to date)
Recipe: private-chef::nginx
* component_runit_service[nginx] action restart
Recipe: <Dynamically Defined Resource>
* service[nginx] action nothing (skipped due to action :nothing)
* runit_service[nginx] action restart (up to date)
(up to date)
Running handlers:
Running handlers complete
Chef Infra Client finished, 56/581 resources updated in 03 minutes 01 seconds
Chef Server Reconfigured!
Step 4: Check Server Status
Once configuration is completed, verify the Chef Server status by chef-server-ctl command.
[root@chef-server ~]# chef-server-ctl status
run: bookshelf: (pid 1288) 651s; run: log: (pid 1287) 651s
run: nginx: (pid 7184) 256s; run: log: (pid 1308) 651s
run: oc_bifrost: (pid 1285) 651s; run: log: (pid 1277) 651s
run: oc_id: (pid 1279) 651s; run: log: (pid 1278) 651s
run: opscode-erchef: (pid 1303) 651s; run: log: (pid 1302) 651s
run: opscode-expander: (pid 1284) 651s; run: log: (pid 1275) 651s
run: opscode-solr4: (pid 3468) 335s; run: log: (pid 1280) 651s
run: postgresql: (pid 7170) 256s; run: log: (pid 1273) 651s
run: rabbitmq: (pid 1306) 651s; run: log: (pid 1305) 651s
run: redis_lb: (pid 3496) 333s; run: log: (pid 1295) 651s
Step 5: Create Admin and Organization
Create an admin user
[root@chef-server ~]# chef-server-ctl user-create admin John Wick admin@cyberithub.local test@123$ -f /etc/chef/admin.pem
Syntax:-
chef-server-ctl user-create USER_NAME FIRST_NAME LAST_NAME EMAIL 'PASSWORD' -f PATH_FILE_NAME
Create an organization and associate above user with this organization.
[root@chef-server ~]# chef-server-ctl org-create cyberithub "CyberITHub, Inc" --association_user admin -f /etc/chef/cyberithub-validator.pem
Syntax:-
chef-server-ctl org-create short_name 'full_organization_name' --association_user user_name --filename ORGANIZATION-validator.pem
Note:- Make sure organization short name after org-create should be all in lower case.
Step 6: Allow Service http and https through Firewall
You need to allow http and https service through firewall for the incoming traffic from client systems.
[root@chef-server ~]# firewall-cmd --permanent --zone public --add-service http success [root@chef-server ~]# firewall-cmd --permanent --zone public --add-service https success [root@chef-server ~]# firewall-cmd --reload success
Step 7: Download and Install Chef Workstation
Download Chef Workstation Package using wget as shown below from Download Chef Link.
[root@chef-workstation ~]# wget https://packages.chef.io/files/stable/chefdk/4.6.35/el/7/chefdk-4.6.35-1.el7.x86_64.rpm
--2019-12-14 07:08:35-- https://packages.chef.io/files/stable/chefdk/4.6.35/el/7/chefdk-4.6.35-1.el7.x86_64.rpm
Resolving packages.chef.io (packages.chef.io)... 151.101.158.110
Connecting to packages.chef.io (packages.chef.io)|151.101.158.110|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 95358147 (91M) [application/x-rpm]
Saving to: ‘chefdk-4.6.35-1.el7.x86_64.rpm’
100%[==============================================================================================================================>] 95,358,147 5.26MB/s in 19s
2019-12-14 07:08:54 (4.77 MB/s) - ‘chefdk-4.6.35-1.el7.x86_64.rpm’ saved [95358147/95358147]
Install Chefdk using rpm command as shown below.
[root@chef-workstation ~]# rpm -ivh chefdk-4.6.35-1.el7.x86_64.rpm
warning: chefdk-4.6.35-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:chefdk-4.6.35-1.el7 ################################# [100%]
Thank you for installing ChefDK!
You can find some tips on getting started at https://learn.chef.io
Verify Chef development kit once it is installed using below command.
[root@chef-workstation ~]# chef verify
Verification of component 'chef-vault' succeeded.
Verification of component 'openssl' succeeded.
Verification of component 'delivery-cli' succeeded.
Verification of component 'git' succeeded.
Verification of component 'foodcritic' succeeded.
Verification of component 'test-kitchen' succeeded.
Verification of component 'chef-apply' succeeded.
Verification of component 'opscode-pushy-client' succeeded.
Verification of component 'berkshelf' succeeded.
Verification of component 'tk-policyfile-provisioner' succeeded.
Verification of component 'fauxhai' succeeded.
Verification of component 'chefspec' succeeded.
Verification of component 'chef-dk' failed.
Verification of component 'inspec' succeeded.
Verification of component 'chef-sugar' succeeded.
Verification of component 'chef-client' succeeded.
Verification of component 'knife-spork' succeeded.
Verification of component 'generated-cookbooks-pass-chefspec-and-foodcritic' succeeded.
Verification of component 'package installation' succeeded.
Step 8: Create Repo
Once Chef Development Kit is installed, you need to create a repo using chef generate repo command as shown below.
[root@chef-workstation ~]# chef generate repo chef-repo
Generating Chef Infra repo chef-repo
- Ensuring correct Chef Infra repo file content
Your new Chef Infra repo is ready! Type `cd chef-repo` to enter it.
You can list and check the directory structure.
[root@chef-workstation ~]# ls -lrt chef-repo/
total 12
-rw-r--r--. 1 root root 70 Dec 14 07:28 LICENSE
-rw-r--r--. 1 root root 1338 Dec 14 07:28 README.md
-rw-r--r--. 1 root root 1176 Dec 14 07:28 chefignore
drwxr-xr-x. 3 root root 38 Dec 14 07:28 data_bags
drwxr-xr-x. 2 root root 23 Dec 14 07:28 policyfiles
drwxr-xr-x. 3 root root 38 Dec 14 07:28 cookbooks
Step 9: Add Version Control
We need to first create the git user and provide the user email address as well.
[root@chef-workstation ~]# git config --global user.name "admin" [root@chef-workstation ~]# git config --global user.email "admin@cyberithub.local"
Go to the chef-repo directory and initialize it using below command.
[root@chef-workstation ~]# cd ~/chef-repo/ [root@chef-workstation chef-repo]# git init Reinitialized existing Git repository in /root/chef-repo/.git/
Create a hidden .chef directory under /root/chef-repo to store all the RSA Keys and add .chef under .gitignore to prevent the public view of this directory.
[root@chef-workstation chef-repo]# mkdir -p ~/chef-repo/.chef [root@chef-workstation chef-repo]# echo '.chef' >> ~/chef-repo/.gitignore
Add all the current files and commit it.
[root@chef-workstation chef-repo]# git add . [root@chef-workstation chef-repo]# git commit -m "initial commit" [master (root-commit) d345fde] initial commit 13 files changed, 462 insertions(+) create mode 100644 .chef-repo.txt create mode 100644 .gitignore create mode 100644 LICENSE create mode 100644 README.md create mode 100644 chefignore create mode 100644 cookbooks/README.md create mode 100644 cookbooks/example/README.md create mode 100644 cookbooks/example/attributes/default.rb create mode 100644 cookbooks/example/metadata.rb create mode 100644 cookbooks/example/recipes/default.rb create mode 100644 data_bags/README.md create mode 100644 data_bags/example/example_item.json create mode 100644 policyfiles/README.md [root@chef-workstation chef-repo]# git status # On branch master nothing to commit, working directory clean
Step 10: Copy RSA Keys to Workstation
Now we need to copy the .pem to workstation system which we generated on Chef Server using scp command below.
[root@chef-workstation chef-repo]# scp -pr root@192.168.0.105:/etc/chef/admin.pem ~/chef-repo/.chef/ The authenticity of host '192.168.0.105 (192.168.0.105)' can't be established. ECDSA key fingerprint is SHA256:V8Y4WCCEJKcQiM52XJz4OdKaYl+jAAb7Eo1ZbzUFU2E. ECDSA key fingerprint is MD5:ce:c7:b6:a2:fe:4a:e4:94:5a:44:7f:46:01:22:26:61. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.0.105' (ECDSA) to the list of known hosts. root@192.168.0.105's password: admin.pem 100% 1674 908.3KB/s 00:00 [root@chef-workstation chef-repo]# scp -pr root@192.168.0.105:/etc/chef/cyberithub-validator.pem ~/chef-repo/.chef/ root@192.168.0.105's password: cyberithub-validator.pem
Step 11: Set up Knife.rb file
You need to setup the knife.rb file as given below.
[root@chef-workstation chef-repo]# vi /root/chef-repo/.chef/knife.rb current_dir = File.dirname(__FILE__) log_level :info log_location STDOUT node_name "admin" client_key "#{current_dir}/admin.pem" validation_client_name "cyberithub-validator" validation_key "#{current_dir}/cyberithub-validator.pem" chef_server_url "https://chef-server/organizations/cyberithub" syntax_check_cache_path "#{ENV['HOME']}/.chef/syntaxcache" cookbook_path ["#{current_dir}/../cookbooks"]
Check the client now.
[root@chef-workstation chef-repo]# knife client list
cyberithub-validator
Note:- if you see below error, then run knife ssl fetch first and then run knife client list again.
[root@chef-workstation chef-repo]# knife client list
ERROR: SSL Validation failure connecting to host: chef-server.cyberithub.local - SSL_connect returned=1 errno=0 state=error: certificate verify failed (error number 1)
ERROR: Could not establish a secure connection to the server.
Use `knife ssl check` to troubleshoot your SSL configuration.
If your server uses a self-signed certificate, you can use
`knife ssl fetch` to make knife trust the server's certificates.
Original Exception: OpenSSL::SSL::SSLError: SSL Error connecting to https://chef-server.cyberithub.local/organizations/cyberithub/clients - SSL_connect returned=1 errno=0 state=error: certificate verify failed (error number 1)
[root@chef-workstation chef-repo]# knife ssl fetch
WARNING: Certificates from chef-server will be fetched and placed in your trusted_cert
directory (/root/chef-repo/.chef/trusted_certs).
Knife has no means to verify these are the correct certificates. You should
verify the authenticity of these certificates after downloading.
Adding certificate for chef-server in /root/chef-repo/.chef/trusted_certs/chef-server.crt
Step 12: Install Chef Client on a Target System
Now lets bootstrap Chef client on a target system using below command:-
[root@chef-workstation chef-repo]# knife bootstrap chef-client -x root -P test@123 --sudo
-x/--winrm-user: This flag is deprecated. Use -U/--connection-user instead.
Connecting to chef-client
The authenticity of host 'chef-client (192.168.0.107)' can't be established.
fingerprint is SHA256:HQiIigCj44Jw8iwJ3KiSdkGPhEKmxp/9iYVttorVic4.
Are you sure you want to continue connecting
? (Y/N) y
Connecting to chef-client
Performing legacy client registration with the validation key at /root/chef-repo/.chef/cyberithub-validator.pem...
Delete your validation key in order to use your user credentials for client registration instead.
Bootstrapping chef-client
[chef-client] -----> Existing Chef Infra Client installation detected
[chef-client] Starting the first Chef Infra Client Client run...
[chef-client] Starting Chef Infra Client, version 15.5.17
[chef-client] Creating a new client identity for chef-client using the validator key.
............................................................................................................................................................................
Check if the node is showing or not
[root@chef-workstation chef-repo]# knife node list
chef-client
Congratulations!!! You have successfully completed the Steps to Install Chef on your Environment.
Also Read: How to install Ansible on Ubuntu 18.04