Chef集中管理工具实践

╰半夏微凉° 2022-08-07 08:46 248阅读 0赞

## Chef集中管理工具实践之 (0) 什么是Chef ##

**目录结构**  
[Chef集中管理工具实践之 (0) 什么是Chef][Chef_ _0_ _Chef]  
[Chef集中管理工具实践之 (1) 环境部署][Chef_ _1_]  
[Chef集中管理工具实践之 (2) 服务器配置][Chef_ _2_]  
[Chef集中管理工具实践之 (3) 自定义配置][Chef_ _3_]

**本文内容**  
Chef集中管理工具实践之 (0) 什么是Chef

**参考资料**  
[http://my.oschina.net/williamherrychina/blog/63576][http_my.oschina.net_williamherrychina_blog_63576]  
[http://www.rubycc.com/bbs/topic\_detail/91][http_www.rubycc.com_bbs_topic_detail_91]  
[http://gigix.thoughtworkers.org/2011/2/19/chef-1][http_gigix.thoughtworkers.org_2011_2_19_chef-1]

**Chef社区站点**  
[http://community.opscode.com/][http_community.opscode.com]

**1.1 初识Chef**  
初识Chef，我们可以先了解一下DevOps运动 [ http://zh.wikipedia.org/wiki/DevOps][http_zh.wikipedia.org_wiki_DevOps]，简单点说，就是传统的软件组织将开发、IT运营和质量保障设为各自分离的部门，而DevOps运动的出现是由于软件行业日益清晰地认识到：为了按时交付软件产品和服务，开发和运营工作必须紧密合作。  
所以Chef简单点说，就是DevOps运动中的一项重要工具成员，是一个同时面向开发与运维的集中管理工具。

想像一下我们现在需要搭建一台MySQL Database Slave服务器，安装过程我们手动操作了没过多久，又需要第二台，这时候我们会想，如果之后安装第一台的时候把操作过程执行的命令写成脚本，现在安装第二台，运行一下脚本就行了，节约时间而且不容易出错。

Chef就相当于这样的一个脚本管理工具，但功能要强大得多，可定制性强，Chef将脚本命令代码化，定制时只需要修改代码，安装的过程就是执行代码的过程。  
打个比方，Chef就像一个制作玩具的工厂，它可以把一些原材料做成漂亮的玩具， 它有一些模板，你把原材料放进去，选择一个模板(比如怪物史莱克)，它就会制造出这个玩具，服务器的配置也是这样，一台还没有配置的服务器，你给它指定一个模板(role或recipe)， Chef就会把它配置成你想要的线上服务器。

**1.2 Chef和Puppet比较**  
就服务器的集中管理工具而言，知名度与Chef平分天下的是叫“Puppet”的工具，它们是OSS知名度排名最前的2个。

让我们来比较下它们的不同：

<table> 
 <tbody> 
  <tr> 
   <td><strong><span style="background-color:rgb(192,192,192)">比较</span></strong></td> 
   <td><strong><span style="background-color:rgb(192,192,192)">Puppet</span></strong></td> 
   <td><strong><span style="background-color:rgb(192,192,192)">Chef</span></strong></td> 
  </tr> 
  <tr> 
   <td>历史</td> 
   <td>有一些</td> 
   <td>还年轻</td> 
  </tr> 
  <tr> 
   <td>用户</td> 
   <td>多，有名的公司也在用</td> 
   <td>还比较少，有一些公司如37signals在使用</td> 
  </tr> 
  <tr> 
   <td>开发的活跃度</td> 
   <td>中等</td> 
   <td>活跃（感觉正在旺季）</td> 
  </tr> 
  <tr> 
   <td>文档</td> 
   <td>多</td> 
   <td>也足够了</td> 
  </tr> 
  <tr> 
   <td>设定文件</td> 
   <td>用专用的文法书写（外部DSL）</td> 
   <td>用Ruby书写（内部DSL）</td> 
  </tr> 
  <tr> 
   <td>设定的构成</td> 
   <td>有点难懂</td> 
   <td>相对容易理解，命名等很合适</td> 
  </tr> 
  <tr> 
   <td>依存关系的处理</td> 
   <td>运行次序状况由系统端决定</td> 
   <td>像Makefile，基本上是书写顺序，相比Puppet更具脚本风格</td> 
  </tr> 
  <tr> 
   <td>必要的中间软件</td> 
   <td>没有</td> 
   <td>服务端需要有CouchDB、RabbitMQ</td> 
  </tr> 
  <tr> 
   <td>安装</td> 
   <td>简单，用gem的安装就可以</td> 
   <td>服务端安装比较麻烦。客户端简单，只需要gem就可以了</td> 
  </tr> 
  <tr> 
   <td>和其他系统的协作</td> 
   <td>感觉基本上没有</td> 
   <td>因为使用RESTful的服务API，用JSON可以取值，能做许多事</td> 
  </tr> 
 </tbody> 
</table>

**1.3 Chef结构**  
这是Chef的结构图，对图做一点解释:

![chef.png][]

有一个中心服务器(运行chef-server)  
Chef将数据存储在CouchDB数据库里面  
RabbitMQ和chef-solo等提供搜索的功能  
Chef还提供了个图形的用户界面(cher-server-webui)  
Workstation上有一个pem文件，knift(对Chef进行配置)利用它作为认证来和chef-server通过REST API进行通信  
Workstation将配置(利用Recipe等描述各Client应该如何配置自己)上传到服务器  
Client上有一个pem文件，chef-client利用它作为认证来和chef-server通过REST API进行通信  
当新加一个Client的时候，需要从中心服务器上拷贝validator.pem到新加的Client  
它利用这个pem进行注册得到自己的client.pem进行以后的认证  
Client连到Chef服务器查看如何配置自己，然后进行自我配置

**1.4 Chef的三种管理模式**  
Chef-Solo  
由一台普通电脑控制所有的服务器，不需要专设一台chef-server

Client-Server  
所有的服务器作为chef-client，统一由chef-server进行管理，管理包括安装、配置等工作 chef-server可以自建，但安装的东西较多，由于使用solr作为全文搜索引擎，还需要安装java

Opscode Platform  
类似于Client-Server，只是Server端不需要自建，而是采用http://www.opscode.com提供的chef-server服务

而上面三种管理模式，无疑Client-Server模式是最好，也是最复杂的，因为这样可以在本地环境中搭建一个私有的Chef集中管理环境而无需依赖任何第三方的平台。  
  
**1.5 Chef能做什么**  
Chef能做什么，答案的Anything，这个实际上很好理解，只要你可以对一台服务执行命令，你就可以对这台服务做任何配置(不是有那句话嘛:Where there is a SHELL， there is a way)  
这里大家可能对Chef有一些误解，由于Chef使用类似模板的方法对服务进行配置， 大家可能认识它只适合于一些配置比较类似的服务， 这里完全小看Chef了，就拿官方的mysql cookbook来说，它可以同时支持众多OS平台：  
debian ubuntu centos suse fedora redhat scientific amazon freebsd windows，当你对Chef有了更深的了解后你就不会感到惊讶了。

**1.6 Chef是怎么工作的**  
如果忽略所有的细节，Chef是这样工作的：  
在Workstation上定义各个Client应该如何配置自己，然后将这些信息上传到中心服务器  
每个Client连到中心服务器查看如何配置自己，然后进行自我配置  
因此，在Chef的环境搭建完成以后，绝大部分工作是在Workstation上进行的，只有在工作完成以后，决定应用到Client的时候，才会操作Server与Client。

**1.7 对Chef中各个名词的形象解释**  
Chef 大厨  
我就是个新手大厨，我想要烹调一桌服务器大餐，也就是一台体面的、可以用来满足某种用途的服务器。

Cookbook 菜谱  
别人写好的一本书，书上写着一堆相关菜色的做法（比如“家常川菜”）。一些出色的服务器大厨已经写了 很多菜谱 ，这些是我要学习和抄袭的。

Recipe 菜谱里的一道菜色（比如“麻婆豆腐”）  
服务器大餐里的某一部分该怎么做，都在菜色里写着呢。

所以，整个故事就是：  
作为一个新手大厨（Chef），我想要从现成的很多菜谱（Cookbook）里挑选几道合适的菜色（Recipe），组合成一道大餐（服务器）来款待我的客人。  
等我的手艺熟练之后我还会写我自己的菜色和菜谱，来创造属于我自己的大餐。

Chef的主要目标就是：把服务器配置变成源代码。  
这样做的好处有两个：  
自动化  
我可以很轻松地把一台服务器大餐的做法直接照搬到另一台服务器上，于是我就得到了另一台大餐。

配置管理  
服务器的配置信息能够很好的通过Git来管理，可以分享，可以多人协作，可以跟踪变化历史。

Chef使用服务器—客户端模式管理所有需要配置的机器，使用Chef涉及至少三台机器：  
一台开发机器Workstation，在上面编写大餐的做法；  
一台Chef服务器，管理所有要配置的Chef客户端，给它们下发配置信息；  
多台Chef客户端（Node），就是我将要烹调出的大餐。

**1.8 接着，我们可以开始以下过程**  
目前，我们对Chef已经有了一个基本的了解，接下来就可以通过以下步骤进行亲身实践，来加深理解。

## Chef集中管理工具实践之 (1) 环境部署 ##

**本文内容**  
Chef集中配置管理工具实践之 (1) 环境部署

**参考资料**  
[http://wiki.opscode.com/pages/viewpage.action?pageId=24773429][http_wiki.opscode.com_pages_viewpage.action_pageId_24773429]  
[http://wiki.opscode.com/display/chef/Installing+Chef+Server+on+Debian+or+Ubuntu+using+Packages][http_wiki.opscode.com_display_chef_Installing_Chef_Server_on_Debian_or_Ubuntu_using_Packages]  
[http://wiki.opscode.com/display/chef/Workstation+Setup+for+Debian+and+Ubuntu][http_wiki.opscode.com_display_chef_Workstation_Setup_for_Debian_and_Ubuntu]  
[http://wiki.opscode.com/display/chef/Knife+Bootstrap][http_wiki.opscode.com_display_chef_Knife_Bootstrap]

**环境介绍**  
OS: Ubuntu 10.10 Server 64-bit //经过验证在12.04.1以及12.10上也成功实现部署。  
Servers:  
chef-server:10.6.1.170  
chef-workstation:10.6.1.171  
chef-client-1:10.6.1.172  
chef-client-2:10.6.1.173

**1. 安装配置Chef Server**  
编辑hosts  
ubuntu@chef-server:~$ sudo vim /etc/hosts

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>127.0.0.1&nbsp;&nbsp; localhost</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>3</code></td> 
   <td><code>10.6.1.170 chef-server</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>4</code></td> 
   <td><code>10.6.1.171 chef-workstation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>5</code></td> 
   <td><code>10.6.1.172 chef-client-1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>6</code></td> 
   <td><code>10.6.1.173 chef-client-2</code></td> 
  </tr> 
 </tbody> 
</table>

注意：  
将本机的hostname在/etc/hosts中添加一条IP解析记录，这一点非常重要。  
因为后面在安装chef-server的过程中，会首先安装rabbitmq-server，缺少该解析记录的话，会导致rabbitma-server启动失败，进而影响到所有其它chef-server软件包的正常安装，如果不清楚这一点的话，会给问题的排查带来很大的不便。

创建 /etc/apt/sources.list.d/opscode.list  
ubuntu@chef-server:~$ sudo echo "deb http://apt.opscode.com/ \`lsb\_release -cs\`-0.10 main" | sudo tee /etc/apt/sources.list.d/opscode.list

添加GPG Key  
ubuntu@chef-server:~$ sudo mkdir -p /etc/apt/trusted.gpg.d  
ubuntu@chef-server:~$ sudo gpg --keyserver keys.gnupg.net --recv-keys 83EF826A  
ubuntu@chef-server:~$ sudo gpg --export packages@opscode.com | sudo tee /etc/apt/trusted.gpg.d/opscode-keyring.gpg > /dev/null

ubuntu@chef-server:~$ sudo apt-get update  
ubuntu@chef-server:~$ sudo apt-get install opscode-keyring

安装NTP时间服务器，Chef需要确保workstation与所有client与server的时钟一致  
ubuntu@chef-server:~$ sudo apt-get install ntp

更新现有系统  
ubuntu@chef-server:~$ sudo apt-get upgrade

安装chef-server软件包  
ubuntu@chef-server:~$ sudo apt-get install chef chef-server

输入URL: http://chef-server:4000  
![configuring-chef.png][]

输入密码: chef-server  
![configuring-chef-solr.png][]

该过程执行了如下过程：  
安装Chef Server以及所依赖的软件包如Merb,CouchDB,RabbitMQ等共300多个软件包  
启动CouchDB,RabbitMQ  
启动chef-server-api并运行在4000端口  
启动chef-server-webui并运行在4040端口  
启动chef-solr-indexer并自动连接到rabbitmq-server  
启动chef-solr,chef-client  
在目录/etc/chef中创建相关的配置文件

安装完成后检查并确认以下端口：  
Chef Server - 4000  
Chef Server WebUI - 4040  
CouchDB - 5984  
RabbitMQ - 5672  
Chef Solr - 8983

ubuntu@chef-server:~$ sudo netstat -lntp

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>01</code></td> 
   <td><code>Active Internet connections (only servers)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>tcp&nbsp;&nbsp; 0&nbsp;&nbsp; 0 0.0.0.0:22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 11402/sshd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>04</code></td> 
   <td><code>tcp&nbsp;&nbsp; 0&nbsp;&nbsp; 0 0.0.0.0:4000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 31998/merb : chef-s&nbsp; </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>tcp&nbsp;&nbsp; 0&nbsp;&nbsp; 0 0.0.0.0:4040&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 32168/merb : chef-s</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>tcp&nbsp;&nbsp; 0&nbsp;&nbsp; 0 0.0.0.0:5672&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 30470/beam</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>tcp&nbsp;&nbsp; 0&nbsp;&nbsp; 0 127.0.0.1:5984&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 30518/beam&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>08</code></td> 
   <td><code>tcp&nbsp;&nbsp; 0&nbsp;&nbsp; 0 0.0.0.0:41891&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 30128/beam&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>09</code></td> 
   <td><code>tcp6&nbsp; 0&nbsp;&nbsp; 0 :::22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :::*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 11402/sshd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>tcp6&nbsp; 0&nbsp;&nbsp; 0 127.0.0.1:8983&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :::*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 31760/java</code></td> 
  </tr> 
 </tbody> 
</table>

登陆Web UI  
![chef-server-ui-login.png][]

地址：http://chef-server:4040 （正常访问需要在本地电脑的hosts中添加“10.6.1.170 chef-server”）  
账号：admin  
密码：chef-server

安装配置knife命令行工具  
ubuntu@chef-server:~$ mkdir -p ~/.chef  
ubuntu@chef-server:~$ sudo cp /etc/chef/validation.pem /etc/chef/webui.pem ~/.chef  
ubuntu@chef-server:~$ sudo chown -R $USER ~/.chef

ubuntu@chef-server:~$ knife configure -i

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>01</code></td> 
   <td><code>WARNING: No knife configuration </code> <code>file</code> <code>found</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>Where should I put the config </code> <code>file</code><code>? [/home/ubuntu/.chef/knife.rb] </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>Please enter the chef server URL: [<a href="http://chef-server:4000/" rel="nofollow">http://chef-server:4000</a>] <a href="http://chef-server:4000/" rel="nofollow">http://chef-server:4000</a></code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>04</code></td> 
   <td><code>Please enter a clientname </code><code>for</code> <code>the new client: [ubuntu] </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>Please enter the existing admin clientname: [chef-webui] </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>Please enter the location of the existing admin client's private key: [/etc/chef/webui.pem] .chef/webui.pem</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>Please enter the validation clientname: [chef-validator] </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>08</code></td> 
   <td><code>Please enter the location of the validation key: [/etc/chef/validation.pem] .chef/validation.pem</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>09</code></td> 
   <td><code>Please enter the path to a chef repository (or leave blank): </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>Creating initial API user...</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>11</code></td> 
   <td><code>Created client[ubuntu]</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>12</code></td> 
   <td><code>Configuration </code><code>file</code> <code>written to /home/ubuntu/.chef/knife.rb</code></td> 
  </tr> 
 </tbody> 
</table>

执行knife命令，检查是否能连接到指定的Chef Server  
ubuntu@chef-server:~$ knife client list

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>chef-validator</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>2</code></td> 
   <td><code>chef-webui</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>3</code></td> 
   <td><code>ubuntu</code></td> 
  </tr> 
 </tbody> 
</table>

ubuntu@chef-server:~$ knife cookbook list

ubuntu@chef-server:~$ sudo apt-get install ntp

为工作站安装并配置Knife Client  
ubuntu@chef-server:~$ knife client create chef-workstation -d -a -f /home/ubuntu/.chef/chef-workstation.pem

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>Created client[chef-workstation]</code></td> 
  </tr> 
 </tbody> 
</table>

ubuntu@chef-server:~$ knife client show chef-workstation

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>admin:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </code><code>true</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>chef_type:&nbsp;&nbsp; client</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>04</code></td> 
   <td><code>json_class:&nbsp; Chef::ApiClient</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>name:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chef-workstation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>public_key:&nbsp; -----BEGIN RSA PUBLIC KEY-----</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>MIIBCgKCAQEA1RAa+jf733FtoTv64msykO3/SEe8G/YhPgA2S3NfWdgh+LbuhCdT</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>08</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>9IjX3Hio3U/rj6VGeICJkCfWZy7NM9pTaPzH+gJdFbkLrLW1GSoEKMJ/f9IkxRcS</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>09</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>7vdySU05IrPOF9PqcMvrME4xYzsFzIXDz1CbWBs08SuMfjP9qHfeStfBQaoQ8rLp</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>mOGI0VMOU/CrlfNsAPLbUgVVylKfcmop1dCO6My53xW/qogfg/8Af0qtk7tyjVFi</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>11</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>K+umCjmHmtW09qg5467p7xf4WSUYh076pb3ofbTi0o3VJi8Dz+qGISjvAVf3Y1As</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>12</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>mwkam0IBM5sK41r/Suki9UQanKWsiDm0CQIDAQAB</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>13</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-----END RSA PUBLIC KEY-----</code></td> 
  </tr> 
 </tbody> 
</table>

**2. 安装配置chef-workstation**  
编辑hosts  
ubuntu@chef-workstation:~$ vim /etc/hosts

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>127.0.0.1&nbsp;&nbsp; localhost</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>3</code></td> 
   <td><code>10.6.1.170 chef-server</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>4</code></td> 
   <td><code>10.6.1.171 chef-workstation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>5</code></td> 
   <td><code>10.6.1.172 chef-client-1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>6</code></td> 
   <td><code>10.6.1.173 chef-client-2</code></td> 
  </tr> 
 </tbody> 
</table>

安装Ruby与其它依赖包  
ubuntu@chef-workstation:~$ sudo apt-get install ruby ruby-dev libopenssl-ruby rdoc ri irb build-essential wget ssl-cert curl

安装RubyGems  
ubuntu@chef-workstation:~$ cd /tmp  
ubuntu@chef-workstation:~$ curl -O http://production.cf.rubygems.org/rubygems/rubygems-1.8.10.tgz  
ubuntu@chef-workstation:~$ tar zxf rubygems-1.8.10.tgz  
ubuntu@chef-workstation:~$ cd rubygems-1.8.10  
ubuntu@chef-workstation:/tmp/rubygems-1.8.10$ sudo ruby setup.rb --no-format-executable

安装Chef Gem  
ubuntu@chef-workstation:/tmp/rubygems-1.8.10$ sudo gem install chef --no-ri --no-rdoc

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>01</code></td> 
   <td><code>Fetching: mixlib-config-1.1.2.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>Fetching: mixlib-cli-1.2.2.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>Fetching: mixlib-log-1.4.1.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>04</code></td> 
   <td><code>Fetching: mixlib-authentication-1.3.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>Fetching: mixlib-shellout-1.1.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>Fetching: systemu-2.5.2.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>Fetching: yajl-ruby-1.1.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>08</code></td> 
   <td><code>Building native extensions.&nbsp; This could take a </code><code>while</code><code>...</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>09</code></td> 
   <td><code>Fetching: ipaddress-0.8.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>Fetching: ohai-6.14.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>11</code></td> 
   <td><code>Fetching: mime-types-1.19.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>12</code></td> 
   <td><code>Fetching: rest-client-1.6.7.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>13</code></td> 
   <td><code>Fetching: bunny-0.7.9.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>14</code></td> 
   <td><code>[Version 0.7.8] </code><code>test</code> <code>suite cleanup (eliminated some race conditions related to queue.message_count)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>15</code></td> 
   <td><code>Fetching: json-1.6.1.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>16</code></td> 
   <td><code>Building native extensions.&nbsp; This could take a </code><code>while</code><code>...</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>17</code></td> 
   <td><code>Fetching: polyglot-0.3.3.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>18</code></td> 
   <td><code>Fetching: treetop-1.4.12.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>19</code></td> 
   <td><code>Fetching: net-</code><code>ssh</code><code>-2.2.2.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>20</code></td> 
   <td><code>Fetching: net-</code><code>ssh</code><code>-gateway-1.1.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>21</code></td> 
   <td><code>Fetching: net-</code><code>ssh</code><code>-multi-1.1.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>22</code></td> 
   <td><code>Fetching: highline-1.6.15.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>23</code></td> 
   <td><code>Fetching: erubis-2.7.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>24</code></td> 
   <td><code>Fetching: moneta-0.6.0.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>25</code></td> 
   <td><code>Fetching: uuidtools-2.1.3.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>26</code></td> 
   <td><code>Fetching: chef-10.16.2.gem (100%)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>27</code></td> 
   <td><code>Successfully installed mixlib-config-1.1.2</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>28</code></td> 
   <td><code>Successfully installed mixlib-cli-1.2.2</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>29</code></td> 
   <td><code>Successfully installed mixlib-log-1.4.1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>30</code></td> 
   <td><code>Successfully installed mixlib-authentication-1.3.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>31</code></td> 
   <td><code>Successfully installed mixlib-shellout-1.1.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>32</code></td> 
   <td><code>Successfully installed systemu-2.5.2</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>33</code></td> 
   <td><code>Successfully installed yajl-ruby-1.1.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>34</code></td> 
   <td><code>Successfully installed ipaddress-0.8.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>35</code></td> 
   <td><code>Successfully installed ohai-6.14.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>36</code></td> 
   <td><code>Successfully installed mime-types-1.19</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>37</code></td> 
   <td><code>Successfully installed rest-client-1.6.7</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>38</code></td> 
   <td><code>Successfully installed bunny-0.7.9</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>39</code></td> 
   <td><code>Successfully installed json-1.6.1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>40</code></td> 
   <td><code>Successfully installed polyglot-0.3.3</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>41</code></td> 
   <td><code>Successfully installed treetop-1.4.12</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>42</code></td> 
   <td><code>Successfully installed net-</code><code>ssh</code><code>-2.2.2</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>43</code></td> 
   <td><code>Successfully installed net-</code><code>ssh</code><code>-gateway-1.1.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>44</code></td> 
   <td><code>Successfully installed net-</code><code>ssh</code><code>-multi-1.1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>45</code></td> 
   <td><code>Successfully installed highline-1.6.15</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>46</code></td> 
   <td><code>Successfully installed erubis-2.7.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>47</code></td> 
   <td><code>Successfully installed moneta-0.6.0</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>48</code></td> 
   <td><code>Successfully installed uuidtools-2.1.3</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>49</code></td> 
   <td><code>Successfully installed chef-10.16.2</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>50</code></td> 
   <td><code>23 gems installed</code></td> 
  </tr> 
 </tbody> 
</table>

安装Git  
ubuntu@chef-workstation:~$ sudo apt-get -y install git-core  
ubuntu@chef-workstation:~$ git --version  
git version 1.7.1

创建Chef Repository  
备注：Chef的大部分配置工作都是在Workstaion中的Chef Repository中完成的，不同的Chef Repository可以管理不同的Chef Server。  
ubuntu@chef-workstation:~$ sudo git clone git://github.com/opscode/chef-repo.git /opt/chef-local

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>Initialized empty Git repository </code> <code>in</code> <code>/opt/chef-</code><code>local</code><code>/.git/</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>2</code></td> 
   <td><code>remote: Counting objects: 199, </code> <code>done</code><code>.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>3</code></td> 
   <td><code>remote: Compressing objects: 100% (117/117), </code><code>done</code><code>.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>4</code></td> 
   <td><code>remote: Total 199 (delta 72), reused 162 (delta 49)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>5</code></td> 
   <td><code>Receiving objects: 100% (199/199), 30.34 KiB | 10 KiB/s, </code><code>done</code><code>.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>6</code></td> 
   <td><code>Resolving deltas: 100% (72/72), </code> <code>done</code><code>.</code></td> 
  </tr> 
 </tbody> 
</table>

ubuntu@chef-workstation:~$ cd /opt/chef-local/  
ubuntu@chef-workstation:/opt/chef-local$ ls  
README.md Rakefile certificates chefignore config cookbooks data\_bags environments roles

创建配置文件夹  
ubuntu@chef-workstation:/opt/chef-local$ sudo mkdir -p .chef

传输pem认证文件到Workstation  
ubuntu@chef-workstation:/opt/chef-local$ sudo scp ubuntu@chef-server:/home/ubuntu/.chef/chef-workstation.pem .chef/  
ubuntu@chef-workstation:/opt/chef-local$ sudo scp ubuntu@chef-server:/home/ubuntu/.chef/validation.pem .chef/

ubuntu@chef-workstation:/opt/chef-local$ ls .chef/  
chef-workstation.pem validation.pem

ubuntu@chef-workstation:/opt/chef-local$ sudo knife configure

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>01</code></td> 
   <td><code>WARNING: No knife configuration </code> <code>file</code> <code>found</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>Where should I put the config </code> <code>file</code><code>? [/home/ubuntu/.chef/knife.rb] .chef/knife.rb</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>Please enter the chef server URL: [<a href="http://chef-workstation:4000/" rel="nofollow">http://chef-workstation:4000</a>] <a href="http://chef-server:4000/" rel="nofollow">http://chef-server:4000</a></code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>04</code></td> 
   <td><code>Please enter an existing username or clientname </code><code>for</code> <code>the API: [ubuntu] chef-workstation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>Please enter the validation clientname: [chef-validator] </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>Please enter the location of the validation key: [/etc/chef/validation.pem] .chef/validation.pem</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>Please enter the path to a chef repository (or leave blank): /opt/chef-</code><code>local</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>You must place your client key </code> <code>in</code><code>:</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>11</code></td> 
   <td><code>&nbsp;&nbsp;</code><code>/opt/chef-</code><code>local</code><code>/.chef/chef-workstation.pem</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>12</code></td> 
   <td><code>Before running commands with Knife!</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>16</code></td> 
   <td><code>You must place your validation key </code> <code>in</code><code>:</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>17</code></td> 
   <td><code>&nbsp;&nbsp;</code><code>/opt/chef-</code><code>local</code><code>/.chef/validation.pem</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>18</code></td> 
   <td><code>Before generating instance data with Knife!</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>21</code></td> 
   <td><code>Configuration </code><code>file</code> <code>written to /opt/chef-</code><code>local</code><code>/.chef/knife.rb</code></td> 
  </tr> 
 </tbody> 
</table>

验证配置是否正确  
ubuntu@chef-workstation:~$ sudo ntpdate chef-server

确认Knife工具能否连接到Chef Server  
ubuntu@chef-workstation:~$ knife client list

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>chef-server</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>2</code></td> 
   <td><code>chef-validator</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>3</code></td> 
   <td><code>chef-webui</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>4</code></td> 
   <td><code>chef-workstation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>5</code></td> 
   <td><code>ubuntu</code></td> 
  </tr> 
 </tbody> 
</table>

ubuntu@chef-workstation:~$ knife client show chef-validator

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>admin:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </code><code>false</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>chef_type:&nbsp;&nbsp; client</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>04</code></td> 
   <td><code>json_class:&nbsp; Chef::ApiClient</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>name:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chef-validator</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>public_key:&nbsp; -----BEGIN RSA PUBLIC KEY-----</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>MIIBCgKCAQEA00/AWJL5mThj+pSXEB2gMKdTdHFm0pGi2hXAoBwm4/ZlnO4p2iwI</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>08</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>/skfZMepVm8SAkSMIhz7ZC+jN/+Kqas7es0E+iv9ei0BF4Q41Y5kKMFctuElYbPH</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>09</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>ImRCVTcQJ6m7BPS0Tczhy87jk6QlhsDsrnhNyUEgM5XRVNO+NzqeqZ+UMOWd9k2q</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>KTJhbtHdx7ILdjZ5SBsiIMBhBNni2D0Y34BDtddsXCn1eyTWwGZxZTRZuDDXnls+</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>11</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>aZaqogKoZ40d6h6ZVGh6nmmpdPDi9YdCIqFtWe5LF5bwIy7K6qBVgiOqU0x3Xek3</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>12</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>d1eZG/8C+4FWjAm1h856npvmMOpVip9w8QIDAQAB</code></td> 
  </tr> 
 </tbody> 
</table>

**3. 安装配置chef-client**  
编辑hosts  
ubuntu@chef-client-1:~$ vim /etc/hosts

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>127.0.0.1&nbsp;&nbsp; localhost</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>3</code></td> 
   <td><code>10.6.1.170 chef-server</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>4</code></td> 
   <td><code>10.6.1.171 chef-workstation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>5</code></td> 
   <td><code>10.6.1.172 chef-client-1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>6</code></td> 
   <td><code>10.6.1.173 chef-client-2</code></td> 
  </tr> 
 </tbody> 
</table>

与chef-server同步时间  
ubuntu@chef-client-1:~$ sudo ntpdate chef-server

Boostrap可以用来将目标节点初始化为一个Client  
ubuntu@chef-workstation:~$ knife bootstrap --help

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>01</code></td> 
   <td><code>knife bootstrap FQDN (options)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--bootstrap-proxy PROXY_URL&nbsp; The proxy server </code><code>for</code> <code>the node being bootstrapped</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--bootstrap-version VERSION&nbsp; The version of Chef to </code><code>install</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-s, --server-url URL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Chef Server URL</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-k, --key KEY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; API Client Key</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--[no-]color&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Use colored output, defaults to enabled</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>08</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-c, --config CONFIG&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The configuration </code><code>file</code> <code>to use</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>09</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--defaults&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Accept default values </code><code>for</code> <code>all questions</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--disable-editing&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Do not </code><code>open</code> <code>EDITOR, just accept the data as is</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>11</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-d, --distro DISTRO&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Bootstrap a distro using a template</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>12</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-e, --editor EDITOR&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Set the editor to use </code><code>for</code> <code>interactive commands</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>13</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-E, --environment ENVIRONMENT&nbsp;&nbsp;&nbsp; Set the Chef environment</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>14</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-j JSON_ATTRIBS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; A JSON string to be added to the first run of chef-client</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>15</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--json-attributes</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>16</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-F, --</code><code>format</code> <code>FORMAT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Which </code><code>format</code> <code>to use </code><code>for</code> <code> output</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>17</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--hint HINT_NAME[=HINT_FILE] Specify Ohai Hint to be </code><code>set</code> <code>on the bootstrap target.&nbsp; Use multiple --hint options to specify multiple hints.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>18</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--[no-]host-key-verify&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Verify host key, enabled by default.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>19</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-i IDENTITY_FILE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The SSH identity </code><code>file</code> <code>used </code> <code>for</code> <code>authentication</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>20</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--identity-</code><code>file</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>21</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-u, --user USER&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; API Client Username</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>22</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--prerelease&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Install the pre-release chef gems</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>23</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--print-after&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Show the data after a destructive operation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>24</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-r, --run-list RUN_LIST&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Comma separated list of roles/recipes to apply</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>25</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-G, --</code><code>ssh</code><code>-gateway GATEWAY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The </code><code>ssh</code> <code>gateway</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>26</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-P, --</code><code>ssh</code><code>-password PASSWORD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The </code><code>ssh</code> <code>password</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>28</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-x, --</code><code>ssh</code><code>-user USERNAME&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The </code><code>ssh</code> <code>username</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>29</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--template-</code><code>file</code> <code>TEMPLATE&nbsp;&nbsp;&nbsp;&nbsp; Full path to location of template to use</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>30</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code><code>--</code><code>sudo</code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <code>Execute the bootstrap via </code><code>sudo</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>31</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-V, --verbose&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; More verbose output. Use twice </code><code>for</code> <code>max verbosity</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>32</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-</code><code>v</code><code>, --version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Show chef version</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>33</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-y, --</code><code>yes</code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <code>Say </code><code>yes</code> <code> to all prompts </code><code>for</code> <code> confirmation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>34</code></td> 
   <td><code>&nbsp;&nbsp;&nbsp;&nbsp;</code><code>-h, --help&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Show this message</code></td> 
  </tr> 
 </tbody> 
</table>

下面我们对chef-client-1进行初始化  
ubuntu@chef-workstation:~$ sudo knife bootstrap 10.6.1.172 -x ubuntu -P password --sudo

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>01</code></td> 
   <td><code>Bootstrapping Chef on 10.6.1.172</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>02</code></td> 
   <td><code>10.6.1.172 --2012-11-09 03:34:40--&nbsp; <a href="http://opscode.com/chef/" rel="nofollow"> http://opscode.com/chef/</a></code><code>install</code><code>.sh</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>03</code></td> 
   <td><code>10.6.1.172 Resolving opscode.com... </code> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>05</code></td> 
   <td><code>10.6.1.172 Connecting to opscode.com|184.106.28.83|:80... </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>06</code></td> 
   <td><code>10.6.1.172 connected.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>07</code></td> 
   <td><code>10.6.1.172 HTTP request sent, awaiting response... </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>08</code></td> 
   <td><code>10.6.1.172 301 Moved Permanently</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>09</code></td> 
   <td><code>10.6.1.172 Location: <a href="http://www.opscode.com/chef/" rel="nofollow"> http://www.opscode.com/chef/</a></code><code>install</code><code>.sh [following]</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>10</code></td> 
   <td><code>10.6.1.172 --2012-11-09 03:34:41--&nbsp; <a href="http://www.opscode.com/chef/" rel="nofollow"> http://www.opscode.com/chef/</a></code><code>install</code><code>.sh</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>11</code></td> 
   <td><code>10.6.1.172 Resolving www.opscode.com... </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>13</code></td> 
   <td><code>10.6.1.172 Reusing existing connection to opscode.com:80.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>14</code></td> 
   <td><code>10.6.1.172 HTTP request sent, awaiting response... </code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>16</code></td> 
   <td><code>10.6.1.172 Length: 6396 (6.2K) [application/x-sh]</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>17</code></td> 
   <td><code>10.6.1.172 Saving to: `STDOUT'</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>20</code></td> 
   <td><code>10.6.1.172 Downloading Chef 10.16.2 </code> <code>for</code> <code>ubuntu...</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>23</code></td> 
   <td><code>10.6.1.172 2012-11-09 03:34:42 (18.7 KB/s) - written to stdout [6396/6396]</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>25</code></td> 
   <td><code>10.6.1.172 Installing Chef 10.16.2</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>26</code></td> 
   <td><code>10.6.1.172 Selecting previously deselected package chef.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>27</code></td> 
   <td><code>10.6.1.172 (Reading database ... </code> </td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>28</code></td> 
   <td><code>(Reading database ... 60%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>29</code></td> 
   <td><code>(Reading database ... 65%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>30</code></td> 
   <td><code>(Reading database ... 70%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>31</code></td> 
   <td><code>(Reading database ... 75%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>32</code></td> 
   <td><code>(Reading database ... 80%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>33</code></td> 
   <td><code>(Reading database ... 85%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>34</code></td> 
   <td><code>(Reading database ... 90%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>35</code></td> 
   <td><code>(Reading database ... 95%</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>36</code></td> 
   <td><code>(Reading database ... 41378 files and directories currently installed.)</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>37</code></td> 
   <td><code>10.6.1.172 Unpacking chef (from .../chef_10.16.2_amd64.deb) ...</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>38</code></td> 
   <td><code>10.6.1.172 Setting up chef (10.16.2-1.ubuntu.10.04) ...</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>39</code></td> 
   <td><code>10.6.1.172 Thank you </code><code>for</code> <code>installing Chef!</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>41</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Client key /etc/chef/client.pem is not present - registering</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>42</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: HTTP Request Returned 404 Not Found: Cannot load node chef-client-1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>43</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Setting the run_list to [] from JSON</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>45</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Run List expands to []</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>46</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>47</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Starting Chef Run </code><code>for</code> <code>chef-client-1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>48</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Running start handlers</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>49</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Start handlers complete.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>50</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Loading cookbooks []</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>51</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:48+08:00] WARN: Node chef-client-1 has an empty run list.</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>52</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Chef Run complete </code><code>in</code> <code>0.438462677 seconds</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>53</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Running report handlers</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>54</code></td> 
   <td><code>10.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Report handlers complete</code></td> 
  </tr> 
 </tbody> 
</table>

验证chef-client-1是否已经注册  
ubuntu@chef-workstation:~$ knife client list

[view source][]

[print][] [?][Link 1]

<table> 
 <tbody> 
  <tr> 
   <td><code>1</code></td> 
   <td><code>chef-client-1</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>2</code></td> 
   <td><code>chef-server</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>3</code></td> 
   <td><code>chef-validator</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>4</code></td> 
   <td><code>chef-webui</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>5</code></td> 
   <td><code>chef-workstation</code></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td><code>6</code></td> 
   <td><code>ubuntu</code></td> 
  </tr> 
 </tbody> 
</table>

从上面可以看出chef-client-1已经成功注册到了chef-server中，整个环境 chef-workstation => chef-server => chef-client-1 已经搭建成功。

**4. 接着，我们可以开始以下过程**

## Chef集中管理工具实践之 (2) 服务器配置 ##

**本文内容**  
Chef集中配置管理工具实践之 (2) 服务器配置

**参考资料**  
[http://wiki.opscode.com/display/ChefCN/Just+Enough+Ruby+for+Chef][http_wiki.opscode.com_display_ChefCN_Just_Enough_Ruby_for_Chef]  
[http://wiki.opscode.com/display/chef/Fast+Start+Guide][http_wiki.opscode.com_display_chef_Fast_Start_Guide]  
[http://gigix.thoughtworkers.org/2011/1/30/devops][http_gigix.thoughtworkers.org_2011_1_30_devops]  
[http://gigix.thoughtworkers.org/2011/2/20/chef-2-rails-server][http_gigix.thoughtworkers.org_2011_2_20_chef-2-rails-server]  
[http://gigix.thoughtworkers.org/2011/3/2/chef-3-first-cookbook][http_gigix.thoughtworkers.org_2011_3_2_chef-3-first-cookbook]  
[http://gigix.thoughtworkers.org/2011/3/12/devops-readings][http_gigix.thoughtworkers.org_2011_3_12_devops-readings]

**环境介绍**  
OS: Ubuntu 10.10 Server 64-bit  
Servers:  
chef-server:10.6.1.170  
chef-workstation:10.6.1.171  
chef-client-1:10.6.1.172

**1. 从这里开始**  
通过前面的两个章节，我们认识了什么是Chef，并成功的部署好了整个环境。但目前Chef具体能做什么，能实现什么具体的功能，其实还是一头雾水的。  
在这一个章节，我们会通过使用Chef完成对用户账号和SSH Server的集中管理来加深理解。

前面，我们在提到Cookbook 菜谱的时候，提到 “一些出色的大厨已经写了很多菜谱，这些是我要学习和抄袭的。”真实的意思就是，Chef社区已经有了许多官方的cookbook以及优秀的社区成员所编写的cookbook提供下载使用，我们只需要阅读它们的README文件，就可以很快速方便的使用了。这就是我在这一个章节所讲的内容。

而“等我的手艺熟练之后我还会写我自己的菜色和菜谱，来创造属于我自己的大餐。”真实的意思就是，在我熟悉了如何使用别人的cookbook以后，便可以尝试借鉴并编写适合自己的cookbook，用来对自己的服务器进行一些自定义的，特有的管理，而这些管理可能在其它环境里并不适用。这是我在下一个章节要讲的内容。

**2. 如何开始**  
首先，我们来明确一下马上要进行的任务，就是“使用Chef完成对用户账号和SSH Server的配置”。

接着，我们可以登录到Chef的官方社区http://community.opscode.com/cookbooks，搜索是否已经存在有相关的cookbook提供使用。  
通过搜索之后，我们可以确定有如下cookbook能够帮助我们完成任务：  
1) 用户账号: user  
2) SSH Server: openssh

ubuntu@chef-workstation:~$ cd /opt/chef-local/  
查看knife配置  
ubuntu@chef-workstation:/opt/chef-local$ cat .chef/knife.rb

log_level                :info
    log_location             STDOUT
    node_name                'chef-workstation'
    client_key               '/opt/chef-local/.chef/chef-workstation.pem'
    validation_client_name   'chef-validator'
    validation_key           '/opt/chef-local/chef/validation.pem'
    chef_server_url          'http://chef-server:4000'
    cache_type               'BasicFile'
    cache_options( :path => '/opt/chef-local/.chef/checksums' )
    cookbook_path [ '/opt/chef-local/cookbooks' ]

**2.1 首先，让我们来部署并使用user来管理用户**  
下载cookbook  
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook site install user

Installing user to /opt/chef-local/cookbooks
    Checking out the master branch.
    Creating pristine copy branch chef-vendor-user
    Downloading user from the cookbooks site at version 0.3.0 to /opt/chef-local/cookbooks/user.tar.gz
    Cookbook saved: /opt/chef-local/cookbooks/user.tar.gz
    Removing pre-existing version.
    Uncompressing user version 0.3.0.
    removing downloaded tarball
    1 files updated, committing changes
    Creating tag cookbook-site-imported-user-0.3.0
    Checking out the master branch.
    Updating a3bec38..f06cc56
    Fast-forward
     cookbooks/user/.gitignore                          |    2 +
     cookbooks/user/.travis.yml                         |    6 +
     cookbooks/user/CHANGELOG.md                        |   95 +++++
     cookbooks/user/README.md                           |  391 ++++++++++++++++++++
     cookbooks/user/Rakefile                            |   33 ++
     cookbooks/user/attributes/default.rb               |   42 ++
     cookbooks/user/metadata.json                       |   35 ++
     cookbooks/user/metadata.rb                         |   14 +
     cookbooks/user/providers/account.rb                |  173 +++++++++
     cookbooks/user/recipes/data_bag.rb                 |   52 +++
     cookbooks/user/recipes/default.rb                  |   18 +
     cookbooks/user/resources/account.rb                |   40 ++
     .../user/templates/default/authorized_keys.erb     |    7 +
     13 files changed, 908 insertions(+), 0 deletions(-)
     create mode 100644 cookbooks/user/.gitignore
     create mode 100644 cookbooks/user/.travis.yml
     create mode 100644 cookbooks/user/CHANGELOG.md
     create mode 100644 cookbooks/user/README.md
     create mode 100644 cookbooks/user/Rakefile
     create mode 100644 cookbooks/user/attributes/default.rb
     create mode 100644 cookbooks/user/metadata.json
     create mode 100644 cookbooks/user/metadata.rb
     create mode 100644 cookbooks/user/providers/account.rb
     create mode 100644 cookbooks/user/recipes/data_bag.rb
     create mode 100644 cookbooks/user/recipes/default.rb
     create mode 100644 cookbooks/user/resources/account.rb
     create mode 100644 cookbooks/user/templates/default/authorized_keys.erb
    Cookbook user version 0.3.0 successfully installed

ubuntu@chef-workstation:/opt/chef-local$ cd cookbooks/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks$ ls

README.md  user

每个模块下面的README.md文件非常有用，讲解了该模块的配置方法以及与chef-server如何通信。  
比如，我们通过阅读了user的README.md之后，就会知道我们需要建立一个名为users的data bag，将用户的信息写成一个个json文件放在下面，再通过override\_attributes在role的配置文件中指定需要配置的用户。

ubuntu@chef-workstation:/opt/chef-local/cookbooks$ cd user/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/user$ ll

total 76
    drwxr-xr-x 7 root root  4096 Nov 15 20:31 ./
    drwxr-xr-x 3 root root  4096 Nov 15 20:31 ../
    -rw-r--r-- 1 root root    18 Nov 15 20:31 .gitignore
    -rw-r--r-- 1 root root   141 Nov 15 20:31 .travis.yml
    -rw-r--r-- 1 root root  2705 Nov 15 20:31 CHANGELOG.md
    -rw-r--r-- 1 root root 11753 Nov 15 20:31 README.md
    -rw-r--r-- 1 root root   813 Nov 15 20:31 Rakefile
    drwxr-xr-x 2 root root  4096 Nov 15 20:31 attributes/
    -rw-r--r-- 1 root root 13048 Nov 15 20:31 metadata.json
    -rw-r--r-- 1 root root   538 Nov 15 20:31 metadata.rb
    drwxr-xr-x 2 root root  4096 Nov 15 20:31 providers/
    drwxr-xr-x 2 root root  4096 Nov 15 20:31 recipes/
    drwxr-xr-x 2 root root  4096 Nov 15 20:31 resources/
    drwxr-xr-x 3 root root  4096 Nov 15 20:31 templates/

ubuntu@chef-workstation:/opt/chef-local/cookbooks/user$ cd recipes/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/user/recipes$ ls

data_bag.rb  default.rb

dongguo@chef-workstation:/opt/chef-local/cookbooks/user/attributes$ ls

default.rb

上传cookbook到chef-server  
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook upload user

Uploading user         [0.3.0]
    Uploaded 1 cookbook.

创建role  
ubuntu@chef-workstation:/opt/chef-local$ cd roles/  
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu\_servers.rb

name "ubuntu_servers"
    description "The base role applied to all nodes."
    run_list(
        "recipe[user]",
        "recipe[user::data_bag]"
    )
    override_attributes(
        "users" => [ "ubuntu" ]
    )

上传role到chef-server  
ubuntu@chef-workstation:/opt/chef-local$ sudo knife role from file roles/ubuntu\_servers.rb

Updated Role ubuntu_servers!

为user这个cookbook创建data\_bag  
ubuntu@chef-workstation:/opt/chef-local$ cd data\_bags/  
ubuntu@chef-workstation:/opt/chef-local/data\_bags$ sudo mkdir users  
ubuntu@chef-workstation:/opt/chef-local/data\_bags$ sudo vim users/ubuntu.json

{
        "id"       : "ubuntu",
        "gid": "admin",
        "comment"  : "ubuntu",
        "home"     : "/home/ubuntu",
        "create_user_group":"false",
        "ssh_keygen": "false",
        "ssh_keys" : "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+upV++0vIM2PuD2XvH+zOUF6JsfofPCvCdqZ/Wg0GaRvcuPpKs7Ua2APSs
    vtvEz9ohQvexS1DO4G1ZjIO20dsc82BHTFxd3DmZyQ8g/CLoIKIdkDImSffQxBYM//8URvtk16HTmuYVY9poalbVh
    lErhg0xSbyx/DQfOChfc34T8481iWPZ0pnJLj7z5AUvYR8fcWGtbMhveoyKuB4VocsQvKfgVUauS1jIGGac7kC8XG
    Vc6fEVzzTycS7dTypzHDJp3I9wHWoiMF4SD5MRb0sEhlvaOtryHGVdcfFj4Mrdiu8NepL7yyCb9qGdB7QbT1+hNCn
    ZukWP4Iz6yzATLzS"
    }

上传data\_bag到chef-server  
ubuntu@chef-workstation:/opt/chef-local/data\_bags$ sudo knife data bag create users

Created data_bag[users]

ubuntu@chef-workstation:/opt/chef-local/data\_bags$ sudo knife data bag from file users users/ubuntu.json

Updated data_bag_item[users::ubuntu]

为节点增加run\_list，即将ubuntu\_servers这个角色赋给chef-client-1  
ubuntu@chef-workstation:/opt/chef-local$ sudo knife node run\_list add chef-client-1 "role\[ubuntu\_servers\]"

run_list:  role[ubuntu_servers]

在chef-client-1上执行chef-client拉取配置  
ubuntu@chef-client-1:~$ sudo chef-client

INFO: *** Chef 10.16.2 ***
    INFO: Run List is [role[ubuntu_servers]]
    INFO: Run List expands to [user, user::data_bag]
    INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
    INFO: Starting Chef Run for chef-client-1
    INFO: Running start handlers
    INFO: Start handlers complete.
    INFO: Loading cookbooks [user]
    INFO: Processing user_account[ubuntu] action create (user::data_bag line 36)
    INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
    INFO: user[ubuntu] altered
    INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: directory[/home/ubuntu/.ssh] created directory /home/ubuntu/.ssh
    INFO: directory[/home/ubuntu/.ssh] owner changed to 1000
    INFO: directory[/home/ubuntu/.ssh] group changed to 109
    INFO: directory[/home/ubuntu/.ssh] mode changed to 700
    INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: directory[/home/ubuntu] group changed to 109
    INFO: directory[/home/ubuntu] mode changed to 2755
    INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
    INFO: template[/home/ubuntu/.ssh/authorized_keys] updated content
    INFO: template[/home/ubuntu/.ssh/authorized_keys] owner changed to 1000
    INFO: template[/home/ubuntu/.ssh/authorized_keys] group changed to 109
    INFO: template[/home/ubuntu/.ssh/authorized_keys] mode changed to 600
    INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
    INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
    INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148)
    INFO: Chef Run complete in 0.766601698 seconds
    INFO: Running report handlers
    INFO: Report handlers complete

我们可以看到，chef-client已经成功拉取到了ubuntu这个用户的信息，并自动的进行了一系列的配置。  
至此，我们就成功的使用Chef的user这个cookbook完成一次服务器的自动化部署。

**2.2 接着，让我们来通过Chef完成OpenSSH的配置**  
在本地提交刚刚的一系列修改，因为我们使用了git来管理Chef的配置。  
ubuntu@chef-workstation:/opt/chef-local$ sudo git commit -a -m "update"

安装openssh的cookbook  
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook site install openssh

Installing openssh to /opt/chef-local/cookbooks
    Checking out the master branch.
    Creating pristine copy branch chef-vendor-openssh
    Downloading openssh from the cookbooks site at version 1.1.2 to /opt/chef-local/cookbooks/openssh.tar.gz
    Cookbook saved: /opt/chef-local/cookbooks/openssh.tar.gz
    Removing pre-existing version.
    Uncompressing openssh version 1.1.2.
    removing downloaded tarball
    1 files updated, committing changes
    Creating tag cookbook-site-imported-openssh-1.1.2
    Checking out the master branch.
    Updating 8945cc6..ea9f570
    Fast-forward
     cookbooks/openssh/.gitignore                       |    4 +
     cookbooks/openssh/CHANGELOG.md                     |   19 ++
     cookbooks/openssh/CONTRIBUTING                     |   29 +++
     cookbooks/openssh/Gemfile                          |    3 +
     cookbooks/openssh/LICENSE                          |  201 ++++++++++++++++++++
     cookbooks/openssh/README.md                        |  122 ++++++++++++
     cookbooks/openssh/attributes/default.rb            |  125 ++++++++++++
     .../files/default/tests/minitest/config_test.rb    |   38 ++++
     .../files/default/tests/minitest/default_test.rb   |   13 ++
     .../default/tests/minitest/support/helpers.rb      |   13 ++
     cookbooks/openssh/metadata.json                    |   37 ++++
     cookbooks/openssh/metadata.rb                      |   12 ++
     cookbooks/openssh/recipes/default.rb               |   73 +++++++
     cookbooks/openssh/templates/default/port_ssh.erb   |    2 +
     cookbooks/openssh/templates/default/ssh_config.erb |   11 +
     .../openssh/templates/default/sshd_config.erb      |   11 +
     16 files changed, 713 insertions(+), 0 deletions(-)
     create mode 100644 cookbooks/openssh/.gitignore
     create mode 100644 cookbooks/openssh/CHANGELOG.md
     create mode 100644 cookbooks/openssh/CONTRIBUTING
     create mode 100644 cookbooks/openssh/Gemfile
     create mode 100644 cookbooks/openssh/LICENSE
     create mode 100644 cookbooks/openssh/README.md
     create mode 100644 cookbooks/openssh/attributes/default.rb
     create mode 100644 cookbooks/openssh/files/default/tests/minitest/config_test.rb
     create mode 100644 cookbooks/openssh/files/default/tests/minitest/default_test.rb
     create mode 100644 cookbooks/openssh/files/default/tests/minitest/support/helpers.rb
     create mode 100644 cookbooks/openssh/metadata.json
     create mode 100644 cookbooks/openssh/metadata.rb
     create mode 100644 cookbooks/openssh/recipes/default.rb
     create mode 100644 cookbooks/openssh/templates/default/port_ssh.erb
     create mode 100644 cookbooks/openssh/templates/default/ssh_config.erb
     create mode 100644 cookbooks/openssh/templates/default/sshd_config.erb
    Cookbook openssh version 1.1.2 successfully installed

我们可以看到openssh的cookbook已经被安装了  
ubuntu@chef-workstation:/opt/chef-local/cookbooks$ ls

README.md  openssh  user

同样，通过仔细阅读README.md，我们可以了解这个cookbook的用法，就是通过在attributes中修改对应的参数，然后再通过添加到role的配置文件中即可。  
ubuntu@chef-workstation:/opt/chef-local/cookbooks$ cd openssh/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh$ ls

CHANGELOG.md  CONTRIBUTING  Gemfile  LICENSE  README.md  attributes  files  metadata.json  metadata.rb  recipes  templates

ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ ls

default.rb

打开attributes中的default参数配置文件，我们可以看到有很多的选项都已经被定义好了。  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ sudo vim default.rb

#
    # Cookbook Name:: openssh
    # Attributes:: default
    #
    # Author:: Ernie Brodeur 
    # Copyright 2008-2012, Opscode, Inc.
    #
    # Licensed under the Apache License, Version 2.0 (the "License");
    # you may not use this file except in compliance with the License.
    # You may obtain a copy of the License at
    #
    #     http://www.apache.org/licenses/LICENSE-2.0
    #
    # Unless required by applicable law or agreed to in writing, software
    # distributed under the License is distributed on an "AS IS" BASIS,
    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    # See the License for the specific language governing permissions and
    # limitations under the License.
    #
    # Attributes are commented out using the default config file values.
    # Uncomment the ones you need, or set attributes in a role.
    #
    
    default['openssh']['package_name'] = case node['platform_family']
                                         when "rhel", "fedora"
                                           %w{openssh-clients openssh}
                                         when "arch"
                                           %w{openssh}
                                         else
                                           %w{openssh-client openssh-server}
                                         end
    
    default['openssh']['service_name'] = case node['platform_family']
                                         when "rhel", "fedora"
                                           "sshd"
                                         else
                                           "ssh"
                                         end
    
    # ssh config group
    default['openssh']['client']['host'] = "*"
    # default['openssh']['client']['forward_agent'] = "no"
    # default['openssh']['client']['forward_x11'] = "no"
    # default['openssh']['client']['rhosts_rsa_authentication'] = "no"
    # default['openssh']['client']['rsa_authentication'] = "yes"
    # default['openssh']['client']['password_authentication'] = "yes"
    # default['openssh']['client']['host_based_authentication'] = "no"
    # default['openssh']['client']['gssapi_authentication'] = "no"
    # default['openssh']['client']['gssapi_delegate_credentials'] = "no"
    # default['openssh']['client']['batch_mode'] = "no"
    # default['openssh']['client']['check_host_ip'] = "yes"
    # default['openssh']['client']['address_family'] = "any"
    # default['openssh']['client']['connect_timeout'] = "0"
    # default['openssh']['client']['strict_host_key_checking'] = "ask"
    # default['openssh']['client']['identity_file'] = "~/.ssh/identity"
    # default['openssh']['client']['identity_file_rsa'] = "~/.ssh/id_rsa"
    # default['openssh']['client']['identity_file_dsa'] = "~/.ssh/id_dsa"
    # default['openssh']['client']['port'] = "22"
    # default['openssh']['client']['protocol'] = [ "2 1" ]
    # default['openssh']['client']['cipher'] = "3des"
    # default['openssh']['client']['ciphers'] = [ "aes128-ctr aes192-ctr aes256-ctr arcfour256 arcfour128 aes128-cbc 3des-cbc" ]
    # default['openssh']['client']['macs'] = [ "hmac-md5 hmac-sha1 umac-64@openssh.com hmac-ripemd160" ]
    # default['openssh']['client']['escape_char'] = "~"
    # default['openssh']['client']['tunnel'] = "no"
    # default['openssh']['client']['tunnel_device'] = "any:any"
    # default['openssh']['client']['permit_local_command'] = "no"
    # default['openssh']['client']['visual_host_key'] = "no"
    # default['openssh']['client']['proxy_command'] = "ssh -q -W %h:%p gateway.example.com"
    # sshd config group
    # default['openssh']['server']['port'] = "22"
    # default['openssh']['server']['address_family'] = "any"
    # default['openssh']['server']['listen_address'] = [ "0.0.0.0 ::" ]
    # default['openssh']['server']['protocol'] = "2"
    # default['openssh']['server']['host_key_v1'] = "/etc/ssh/ssh_host_key"
    # default['openssh']['server']['host_key_rsa'] = "/etc/ssh/ssh_host_rsa_key"
    # default['openssh']['server']['host_key_dsa'] = "/etc/ssh/ssh_host_dsa_key"
    # default['openssh']['server']['host_key_ecdsa'] = "/etc/ssh/ssh_host_ecdsa_key"
    # default['openssh']['server']['key_regeneration_interval'] = "1h"
    # default['openssh']['server']['server_key_bits'] = "1024"
    # default['openssh']['server']['syslog_facility'] = "AUTH"
    # default['openssh']['server']['log_level'] = "INFO"
    # default['openssh']['server']['login_grace_time'] = "2m"
    # default['openssh']['server']['permit_root_login'] = "yes"
    # default['openssh']['server']['strict_modes'] = "yes"
    # default['openssh']['server']['max_auth_tries'] = "6"
    # default['openssh']['server']['max_sessions'] = "10"
    # default['openssh']['server']['rsa_authentication'] = "yes"
    # default['openssh']['server']['pub_key_authentication'] = "yes"
    default['openssh']['server']['authorized_keys_file'] = "%h/.ssh/authorized_keys"
    # default['openssh']['server']['rhosts_rsa_authentication'] = "no"
    # default['openssh']['server']['host_based_authentication'] = "no"
    # default['openssh']['server']['ignore_user_known_hosts'] = "no"
    # default['openssh']['server']['ignore_rhosts'] = "yes"
    # default['openssh']['server']['password_authentication'] = "yes"
    # default['openssh']['server']['permit_empty_passwords'] = "no"
    default['openssh']['server']['challenge_response_authentication'] = "no"
    # default['openssh']['server']['kerberos_authentication'] = "no"
    # default['openssh']['server']['kerberos_or_localpasswd'] = "yes"
    # default['openssh']['server']['kerberos_ticket_cleanup'] = "yes"
    # default['openssh']['server']['kerberos_get_afs_token'] = "no"
    # default['openssh']['server']['gssapi_authentication'] = "no"
    # default['openssh']['server']['gssapi_clean_up_credentials'] = "yes"
    default['openssh']['server']['use_p_a_m'] = "yes"
    # default['openssh']['server']['allow_agent_forwarding'] = "yes"
    # default['openssh']['server']['allow_tcp_forwarding'] = "yes"
    # default['openssh']['server']['gateway_ports'] = "no"
    # default['openssh']['server']['x11_forwarding'] = "no"
    # default['openssh']['server']['x11_display_offset'] = "10"
    # default['openssh']['server']['x11_use_localhost'] = "yes"
    # default['openssh']['server']['print_motd'] = "yes"
    # default['openssh']['server']['print_lastlog'] = "yes"
    # default['openssh']['server']['t_c_p_keep_alive'] = "yes"
    # default['openssh']['server']['use_login'] = "no"
    # default['openssh']['server']['use_privilege_separation'] = "yes"
    # default['openssh']['server']['permit_user_environment'] = "no"
    # default['openssh']['server']['compression'] = "delayed"
    # default['openssh']['server']['client_alive_interval'] = "0"
    # default['openssh']['server']['client_alive_count_max'] = "3"
    # default['openssh']['server']['use_dns'] = "yes"
    # default['openssh']['server']['pid_file'] = "/var/run/sshd.pid"
    # default['openssh']['server']['max_startups'] = "10"
    # default['openssh']['server']['permit_tunnel'] = "no"
    # default['openssh']['server']['chroot_directory'] = "none"
    # default['openssh']['server']['banner'] = "none"
    # default['openssh']['server']['subsystem'] =   "sftp   /usr/libexec/sftp-server"

在这里，我们可以修改以下选项使OpenSSH仅支持Key的认证方式，禁用密码登陆。

default['openssh']['server']['password_authentication'] = "yes"
    default['openssh']['server']['use_dns'] = "yes"

修改完成以后，更新openssh的cookbook  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ sudo knife cookbook upload openssh

Uploading openssh        [1.1.2]
    Uploaded 1 cookbook.

将openssh添加到role中  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ cd /opt/chef-local/roles/  
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu\_servers.rb

name "ubuntu_servers"
    description "The base role applied to all nodes."
    run_list(
        "recipe[user]",
        "recipe[user::data_bag]",
        "recipe[openssh]"
    )
    override_attributes(
        "users" => [ "ubuntu" ]
    )

更新role  
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife role from file ubuntu\_servers.rb

Updated Role ubuntu_servers!

到chef-client上拉取配置  
ubuntu@chef-client-1:~$ sudo chef-client

[2012-12-17T20:51:40+08:00] INFO: *** Chef 10.16.2 ***
    [2012-12-17T20:51:41+08:00] INFO: Run List is [role[ubuntu_servers]]
    [2012-12-17T20:51:41+08:00] INFO: Run List expands to [user, user::data_bag, openssh]
    [2012-12-17T20:51:41+08:00] INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
    [2012-12-17T20:51:41+08:00] INFO: Starting Chef Run for chef-client-1
    [2012-12-17T20:51:41+08:00] INFO: Running start handlers
    [2012-12-17T20:51:41+08:00] INFO: Start handlers complete.
    [2012-12-17T20:51:41+08:00] INFO: Loading cookbooks [openssh, user]
    [2012-12-17T20:51:41+08:00] INFO: Processing user_account[ubuntu] action create (user::data_bag line 36)
    [2012-12-17T20:51:41+08:00] INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
    [2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    [2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    [2012-12-17T20:51:41+08:00] INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
    [2012-12-17T20:51:41+08:00] INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
    [2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    [2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    [2012-12-17T20:51:41+08:00] INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
    [2012-12-17T20:51:41+08:00] INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148)
    [2012-12-17T20:51:28+08:00] INFO: Processing package[openssh-client] action install (openssh::default line 27)
    [2012-12-17T20:51:28+08:00] INFO: Processing package[openssh-server] action install (openssh::default line 27)
    [2012-12-17T20:51:28+08:00] INFO: Processing service[ssh] action enable (openssh::default line 30)
    [2012-12-17T20:51:28+08:00] INFO: service[ssh] enabled
    [2012-12-17T20:51:28+08:00] INFO: Processing service[ssh] action start (openssh::default line 30)
    [2012-12-17T20:51:28+08:00] INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 48)
    [2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20121217205128
    [2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] updated content
    [2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] owner changed to 0
    [2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] group changed to 0
    [2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] mode changed to 644
    [2012-12-17T20:51:28+08:00] INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 66)
    [2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] backed up to /var/chef/backup/etc/ssh/sshd_config.chef-20121217205129
    [2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] updated content
    [2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] owner changed to 0
    [2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] group changed to 0
    [2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] mode changed to 644
    [2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] sending restart action to service[ssh] (delayed)
    [2012-12-17T20:51:29+08:00] INFO: Processing service[ssh] action restart (openssh::default line 30)
    [2012-12-17T20:51:29+08:00] INFO: service[ssh] restarted
    [2012-12-17T20:51:29+08:00] INFO: Chef Run complete in 1.742643517 seconds
    [2012-12-17T20:51:29+08:00] INFO: Running report handlers
    [2012-12-17T20:51:29+08:00] INFO: Report handlers complete

可以看到，chef-client-1已经自动的获取到了相应的参数，并更新了OpenSSH的配置文件，并重启了服务。

手动查看OpenSSH的配置文件，可以看到只有我们配置的几行参数内容。不过这里放心，其它的参数都有默认值，所以整个OpenSSH的配置是OK的。  
ubuntu@chef-client-1:~$ cat /etc/ssh/sshd\_config

# Generated by Chef for chef-client-1
    
    AuthorizedKeysFile %h/.ssh/authorized_keys
    ChallengeResponseAuthentication no
    PasswordAuthentication no
    UseDns yes
    UsePAM yes

至此，我们就已经完成了通过Chef来对用户账号以及OpenSSH的配置管理，对于Chef，也应该有了一些具体的认知。  
不过，这仅仅是一个开始，试想如果我们只能通过别人写好的cookbook来修改参数进行服务器的配置，未免也太尴尬了。  
所以，接下来，我们将会创建属于自己的cookbook，随心所欲的来配置服务器！

**3 接着，我们可以开始以下过程**

## Chef集中管理工具实践之 (3) 自定义配置 ##

**本文内容**  
Chef集中管理工具实践之 (3) 自定义配置

**参考资料**  
[http://wiki.opscode.com/display/chef/Resources\#Resources-Service][http_wiki.opscode.com_display_chef_Resources_Resources-Service]

**环境介绍**  
OS: Ubuntu 10.10 Server 64-bit  
Servers:  
chef-server:10.6.1.170  
chef-workstation:10.6.1.171  
chef-client-1:10.6.1.172

**1. 开始创造属于自己的大餐**  
“等我的手艺熟练之后我还会写我自己的菜色和菜谱，来创造属于我自己的大餐。” 在前面我提到过这句话，并且在上一个章节，也通过使用官方社区提供的cookbook完成了账号与openssh的配置。  
在这一章，我们就来编写一个cookbook，将不同的自定义配置任务做成不同的recipe，最后实现对服务器的配置。

**2. 如何开始**  
如何开始呢？使用官方社区的cookbook很简单，只需要修改attributes里面的参数就可以了，如果要自己来写，该怎么写用什么格式呢？  
相信你一定有这个疑问存在。不过你可以尽管放心，Chef的官方社区有很完善的在线文档可供参考的。

上面提到的“参考资料”中的URL，就是对应的文档地址：http://wiki.opscode.com/display/chef/Resources\#Resources-Service  
具体内容很多，我们可以通过右侧的目录结构来理清思绪。

总共有差不多30个模块，每一个都有相应的示例。  
最常用的有：  
账号管理方面 Group,User  
配置文件方面 Template,File,  
脚本命令方面 Script,Execute  
系统服务方面 Cron,Service,Mount,Package

这些模块的具体用法，都可以在上面的页面中找到，在这里我先就不描述了，接下来我们通过实践来理解它们。

**3. 规划接下来要做的事情**  
以我的实际生产环境中遇到的情况为例，操作系统为Ubuntu,有以下几个任务要完成：  
1.新建一个名为project的用户组，并将之前创建的用户ubuntu添加到该组  
2.更改系统默认的APT镜像源为http://old-releases.ubuntu.com  
3.通过apt-get安装build-essential  
4.编译安装pcre 8.10

这一次，我们不再到官方社区去搜寻第三方的cookbook，而是自己来编写一个cookbook。

**3.1 首先，来设计这个cookbook**  
将cookbook命名为mycookbook  
然后分别创建4个不同的recipe，分别命名为  
conf\_group, conf\_sources.list, install\_build-essential, build\_pcre  
来实现对以上4个任务的完成

**3.2 开始编写cookbook  
3.2.1 创建cookbook**  
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook create mycookbook

** Creating cookbook mycookbook
    ** Creating README for cookbook: mycookbook
    ** Creating CHANGELOG for cookbook: mycookbook
    ** Creating metadata for cookbook: mycookbook

ubuntu@chef-workstation:/opt/chef-local$ cd cookbooks/mycookbook/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ ls

CHANGELOG.md  README.md  attributes  definitions  files  libraries  metadata.rb  providers  recipes  resources  templates

ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ cd recipes/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ls

default.rb

**3.2.2 创建recipe conf\_group**  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf\_group.rb

group "project" do
      gid 999
      members [ 'ubuntu' ]
    end

**3.2.3 创建recipe conf\_sources.list**  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf\_sources.list.rb

execute "update" do
      command "sudo apt-get update"
      action :nothing
    end
    
    template "/etc/apt/sources.list" do
      source "sources.list.erb"
      mode 0644
      owner "root"
      group "root"
      notifies :run, "execute[update]", :immediately
    end

ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../templates/default/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ sudo vim sources.list.erb

# Generated by Chef for <%= node['fqdn'] %>
    deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse

**3.2.4 创建recipe install\_build-essential**  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ cd ../../recipes/  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim install\_build-essential.rb

package "build-essential" do
      action :install
    end

**3.2.5 创建recipe build\_pcre**  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim build\_pcre.rb

script "build_pcre" do
      interpreter "bash"
      user "root"
      cwd "/tmp"
      not_if "test -f /usr/local/bin/pcregrep"
      code <<-EOH
      wget http://nchc.dl.sourceforge.net/project/pcre/pcre/8.10/pcre-8.10.tar.gz
      tar zxvf pcre-8.10.tar.gz
      cd pcre-8.10
      ./configure
      make
      make install
      EOH
    end

**3.3 更新并应用编写的cookbook**  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ll

total 28
    drwxr-xr-x  2 root root 4096 Jan  6 18:30 ./
    drwxr-xr-x 10 root root 4096 Jan  6 18:11 ../
    -rw-r--r--  1 root root  305 Jan  6 18:30 build_pcre.rb
    -rw-r--r--  1 root root   56 Jan  6 18:17 conf_group.rb
    -rw-r--r--  1 root root  234 Jan  6 18:19 conf_sources.list.rb
    -rw-r--r--  1 root root  136 Jan  6 18:11 default.rb
    -rw-r--r--  1 root root   51 Jan  6 18:24 install_build-essential.rb

上传cookbook  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo knife cookbook upload mycookbook

Uploading mycookbook     [0.1.0]
    Uploaded 1 cookbook.

查看当前role配置文件  
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../../../roles/  
ubuntu@chef-workstation:/opt/chef-local/roles$ ls

README.md  ubuntu_servers.rb

ubuntu@chef-workstation:/opt/chef-local/roles$ cat ubuntu\_servers.rb

更新role配置文件  
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu\_servers.rb

name "ubuntu_servers"
    description "The base role applied to all nodes."
    run_list(
        "recipe[user]",
        "recipe[user::data_bag]",
        "recipe[openssh]",
        "recipe[mycookbook::conf_group]",
        "recipe[mycookbook::conf_sources.list]",
        "recipe[mycookbook::install_build-essential]",
        "recipe[mycookbook::build_pcre]"
    )
    override_attributes(
        "users" => [ "ubuntu" ]
    )

上传role配置文件  
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife role from file ubuntu\_servers.rb

Updated Role ubuntu_servers!

查看节点  
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node list

chef-client-1
      chef-server

更新节点run\_list  
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node run\_list add chef-client-1 "role\[ubuntu\_servers\]"

run_list:  role[ubuntu_servers]

**3.4 在节点上应用新的cookbook**  
ubuntu@chef-client-1:~$ sudo chef-client

INFO: *** Chef 10.16.2 ***
    INFO: Run List is [role[ubuntu_servers]]
    INFO: Run List expands to [user, user::data_bag, openssh, mycookbook::conf_group, mycookbook::conf_sources.list, mycookbook::install_build-essential, mycookbook::build_pcre]
    INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
    INFO: Starting Chef Run for chef-client-1
    INFO: Running start handlers
    INFO: Start handlers complete.
    INFO: Loading cookbooks [mycookbook, openssh, user]
    INFO: Storing updated cookbooks/openssh/recipes/default.rb in the cache.
    INFO: Storing updated cookbooks/openssh/attributes/default.rb in the cache.
    INFO: Storing updated cookbooks/openssh/.gitignore in the cache.
    INFO: Storing updated cookbooks/openssh/metadata.rb in the cache.
    INFO: Storing updated cookbooks/openssh/README.md in the cache.
    INFO: Storing updated cookbooks/openssh/LICENSE in the cache.
    INFO: Storing updated cookbooks/openssh/CHANGELOG.md in the cache.
    INFO: Storing updated cookbooks/openssh/metadata.json in the cache.
    INFO: Storing updated cookbooks/openssh/Gemfile in the cache.
    INFO: Storing updated cookbooks/openssh/CONTRIBUTING in the cache.
    INFO: Storing updated cookbooks/user/resources/account.rb in the cache.
    INFO: Storing updated cookbooks/user/providers/account.rb in the cache.
    INFO: Storing updated cookbooks/user/recipes/data_bag.rb in the cache.
    INFO: Storing updated cookbooks/user/recipes/default.rb in the cache.
    INFO: Storing updated cookbooks/user/attributes/default.rb in the cache.
    INFO: Storing updated cookbooks/user/Rakefile in the cache.
    INFO: Storing updated cookbooks/user/CHANGELOG.md in the cache.
    INFO: Storing updated cookbooks/user/README.md in the cache.
    INFO: Storing updated cookbooks/user/metadata.rb in the cache.
    INFO: Storing updated cookbooks/user/metadata.json in the cache.
    INFO: Storing updated cookbooks/mycookbook/recipes/build_nginx.rb in the cache.
    INFO: Storing updated cookbooks/mycookbook/recipes/conf_group.rb in the cache.
    INFO: Storing updated cookbooks/mycookbook/recipes/conf_sources.list.rb in the cache.
    INFO: Storing updated cookbooks/mycookbook/recipes/default.rb in the cache.
    INFO: Storing updated cookbooks/mycookbook/recipes/install_build-essential.rb in the cache.
    INFO: Storing updated cookbooks/mycookbook/recipes/build_pcre.rb in the cache.
    INFO: Storing updated cookbooks/mycookbook/README.md in the cache.
    INFO: Storing updated cookbooks/mycookbook/metadata.rb in the cache.
    INFO: Storing updated cookbooks/mycookbook/CHANGELOG.md in the cache.
    INFO: Processing user_account[ubuntu] action create (user::data_bag line 36)
    INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
    INFO: user[ubuntu] created
    INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: directory[/home/ubuntu/.ssh] created directory /home/ubuntu/.ssh
    INFO: directory[/home/ubuntu/.ssh] owner changed to 1001
    INFO: directory[/home/ubuntu/.ssh] group changed to 109
    INFO: directory[/home/ubuntu/.ssh] mode changed to 700
    INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: directory[/home/ubuntu] mode changed to 2755
    INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
    INFO: template[/home/ubuntu/.ssh/authorized_keys] updated content
    INFO: template[/home/ubuntu/.ssh/authorized_keys] owner changed to 1001
    INFO: template[/home/ubuntu/.ssh/authorized_keys] group changed to 109
    INFO: template[/home/ubuntu/.ssh/authorized_keys] mode changed to 600
    INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
    INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
    INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
    INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148)
    INFO: Processing package[openssh-client] action install (openssh::default line 27)
    INFO: Processing package[openssh-server] action install (openssh::default line 27)
    INFO: Processing service[ssh] action enable (openssh::default line 30)
    INFO: service[ssh] enabled
    INFO: Processing service[ssh] action start (openssh::default line 30)
    INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 48)
    INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20130106190629
    INFO: template[/etc/ssh/ssh_config] updated content
    INFO: template[/etc/ssh/ssh_config] owner changed to 0
    INFO: template[/etc/ssh/ssh_config] group changed to 0
    INFO: template[/etc/ssh/ssh_config] mode changed to 644
    INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 66)
    INFO: template[/etc/ssh/sshd_config] backed up to /var/chef/backup/etc/ssh/sshd_config.chef-20130106190629
    INFO: template[/etc/ssh/sshd_config] updated content
    INFO: template[/etc/ssh/sshd_config] owner changed to 0
    INFO: template[/etc/ssh/sshd_config] group changed to 0
    INFO: template[/etc/ssh/sshd_config] mode changed to 644
    INFO: Processing group[project] action create (mycookbook::conf_group line 1)
    INFO: group[project] created
    INFO: Processing execute[update] action nothing (mycookbook::conf_sources.list line 1)
    INFO: Processing template[/etc/apt/sources.list] action create (mycookbook::conf_sources.list line 6)
    INFO: template[/etc/apt/sources.list] backed up to /var/chef/backup/etc/apt/sources.list.chef-20130106190629
    INFO: template[/etc/apt/sources.list] updated content
    INFO: template[/etc/apt/sources.list] owner changed to 0
    INFO: template[/etc/apt/sources.list] group changed to 0
    INFO: template[/etc/apt/sources.list] mode changed to 644
    INFO: template[/etc/apt/sources.list] sending run action to execute[update] (immediate)
    INFO: Processing execute[update] action run (mycookbook::conf_sources.list line 1)
    INFO: execute[update] ran successfully
    INFO: Processing package[build-essential] action install (mycookbook::install_build-essential line 1)
    INFO: Processing script[build_pcre] action run (mycookbook::build_pcre line 1)
    INFO: script[build_pcre] ran successfully
    INFO: template[/etc/ssh/sshd_config] sending restart action to service[ssh] (delayed)
    INFO: Processing service[ssh] action restart (openssh::default line 30)
    INFO: service[ssh] restarted
    INFO: Chef Run complete in 448.775004685 seconds
    INFO: Running report handlers
    INFO: Report handlers complete

ubuntu@chef-client-1:/etc$

通过以上输出，我们可以很清晰的看到每个recipe的执行过程，并且全部都成功执行了。

我们通过以下方式来一一校验:  
ubuntu@chef-client-1:~$ id ubuntu

uid=1001(ubuntu) gid=109(admin) groups=109(admin),999(project)

ubuntu@chef-client-1:~$ cat /etc/apt/sources.list

# Generated by Chef for chef-client-1
    deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
    deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
    deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse

ubuntu@chef-client-1:~$ dpkg -l | grep build-essential

ii  build-essential                 11.5                              Informational list of build-essential packages

ubuntu@chef-client-1:~$ which pcregrep

/usr/local/bin/pcregrep

通过以上校验，再次证明所有的任务都已经执行了。  
我们成功的完成了cookbook的自定义配置。

**4. 更多深入的功能**  
至此，我们已经具备了一定的编写cookbook的能力了。  
下面我分享一些比较有价值的经验：

**4.1 安装官方社区的cookbook chef-client 可以实现客户端的定时自动拉取服务端配置，默认30分钟一次，具体时间可配置**  
Tips:  
\---  
$ sudo knife cookbook site install chef-client

通过以下方式引用：

"recipe[chef-client::delete_validation]",
        "recipe[chef-client::config]",
        "recipe[chef-client::service]",

**4.2 改造cookbook openssh**  
Tips:  
\---  
直接将系统的/etc/ssh/sshd\_config 复制成为模板文件sshd\_config.erb  
然后仅将需要自定义的参数修改为从attributes中读取，如：

PasswordAuthentication <%= node['openssh']['server']['password_authentication'] %>
    UseDNS <%= node['openssh']['server']['use_dns'] %>

同样，我们也可以自己来写attributes文件，实现参数的功能。

**4.3 在role文件中重新定义参数值**  
Tips:  
\---  
通过override\_attributes可以直接定义参数的值，实现不同role采用不同的参数。  
例如，针对官方社区的sudo的配置，可以通过以下方式重新定义参数的值：

默认的参数值：

default['authorization']['sudo']['groups'] = Array.new
    default['authorization']['sudo']['users'] = Array.new
    default['authorization']['sudo']['passwordless'] = false
    default['authorization']['sudo']['include_sudoers_d'] = false
    default['authorization']['sudo']['agent_forwarding'] = false

在role文件中重新定义后的值：

override_attributes(
        "authorization" => {
          "sudo" => {
            "groups" => ["admin"],
            "passwordless" => true,
            "users" => ["zabbix"]
          }
        }
    )

**5. 至此，整个系列的文章可以告一段落了**  
用一句很2的话来说，就是，我只能帮你到这儿了。接下来，通过参考官方文档，以及实践中的更多应用，我们就能够更加熟练的掌握Chef这个强大的集中管理工具，再多的服务器在我们的手里也能管理的井然有序。

原文：[http://heylinux.com/archives/2175.html][Chef_ _0_ _Chef]

[Chef_ _0_ _Chef]: http://heylinux.com/archives/2175.html
[Chef_ _1_]: http://heylinux.com/archives/2208.html
[Chef_ _2_]: http://heylinux.com/archives/2237.html
[Chef_ _3_]: http://heylinux.com/archives/2269.html
[http_my.oschina.net_williamherrychina_blog_63576]: http://my.oschina.net/williamherrychina/blog/63576
[http_www.rubycc.com_bbs_topic_detail_91]: http://www.rubycc.com/bbs/topic_detail/91
[http_gigix.thoughtworkers.org_2011_2_19_chef-1]: http://gigix.thoughtworkers.org/2011/2/19/chef-1
[http_community.opscode.com]: http://community.opscode.com/
[http_zh.wikipedia.org_wiki_DevOps]: http://zh.wikipedia.org/wiki/DevOps
[chef.png]: http://heylinux.com/wp-content/uploads/2012/11/chef.png
[http_wiki.opscode.com_pages_viewpage.action_pageId_24773429]: http://wiki.opscode.com/pages/viewpage.action?pageId=24773429
[http_wiki.opscode.com_display_chef_Installing_Chef_Server_on_Debian_or_Ubuntu_using_Packages]: http://wiki.opscode.com/display/chef/Installing+Chef+Server+on+Debian+or+Ubuntu+using+Packages
[http_wiki.opscode.com_display_chef_Workstation_Setup_for_Debian_and_Ubuntu]: http://wiki.opscode.com/display/chef/Workstation+Setup+for+Debian+and+Ubuntu
[http_wiki.opscode.com_display_chef_Knife_Bootstrap]: http://wiki.opscode.com/display/chef/Knife+Bootstrap
[view source]: http://heylinux.com/archives/2208.html#viewSource
[print]: http://heylinux.com/archives/2208.html#printSource
[Link 1]: http://heylinux.com/archives/2208.html#about
[configuring-chef.png]: http://heylinux.com/wp-content/uploads/2012/11/configuring-chef.png
[configuring-chef-solr.png]: http://heylinux.com/wp-content/uploads/2012/11/configuring-chef-solr.png
[chef-server-ui-login.png]: http://heylinux.com/wp-content/uploads/2012/11/chef-server-ui-login.png
[http_wiki.opscode.com_display_ChefCN_Just_Enough_Ruby_for_Chef]: http://wiki.opscode.com/display/ChefCN/Just+Enough+Ruby+for+Chef
[http_wiki.opscode.com_display_chef_Fast_Start_Guide]: http://wiki.opscode.com/display/chef/Fast+Start+Guide
[http_gigix.thoughtworkers.org_2011_1_30_devops]: http://gigix.thoughtworkers.org/2011/1/30/devops
[http_gigix.thoughtworkers.org_2011_2_20_chef-2-rails-server]: http://gigix.thoughtworkers.org/2011/2/20/chef-2-rails-server
[http_gigix.thoughtworkers.org_2011_3_2_chef-3-first-cookbook]: http://gigix.thoughtworkers.org/2011/3/2/chef-3-first-cookbook
[http_gigix.thoughtworkers.org_2011_3_12_devops-readings]: http://gigix.thoughtworkers.org/2011/3/12/devops-readings
[http_wiki.opscode.com_display_chef_Resources_Resources-Service]: http://wiki.opscode.com/display/chef/Resources#Resources-Service