Chef集中管理工具实践

最新推荐文章于 2024-03-07 17:33:10 发布
最新推荐文章于 2024-03-07 17:33:10 发布
阅读量6.3k 收藏 7
点赞数
分类专栏： devops 文章标签： 配置管理 chef


Chef集中管理工具实践之 (0) 什么是Chef


目录结构
Chef集中管理工具实践之 (0) 什么是Chef
Chef集中管理工具实践之 (1) 环境部署
Chef集中管理工具实践之 (2) 服务器配置
Chef集中管理工具实践之 (3) 自定义配置

本文内容
Chef集中管理工具实践之 (0) 什么是Chef

参考资料
http://my.oschina.net/williamherrychina/blog/63576
http://www.rubycc.com/bbs/topic_detail/91
http://gigix.thoughtworkers.org/2011/2/19/chef-1

Chef社区站点
http://community.opscode.com/

1.1 初识Chef
初识Chef，我们可以先了解一下DevOps运动 http://zh.wikipedia.org/wiki/DevOps，简单点说，就是传统的软件组织将开发、IT运营和质量保障设为各自分离的部门，而DevOps运动的出现是由于软件行业日益清晰地认识到：为了按时交付软件产品和服务，开发和运营工作必须紧密合作。
所以Chef简单点说，就是DevOps运动中的一项重要工具成员，是一个同时面向开发与运维的集中管理工具。

想像一下我们现在需要搭建一台MySQL Database Slave服务器，安装过程我们手动操作了没过多久，又需要第二台，这时候我们会想，如果之后安装第一台的时候把操作过程执行的命令写成脚本，现在安装第二台，运行一下脚本就行了，节约时间而且不容易出错。

Chef就相当于这样的一个脚本管理工具，但功能要强大得多，可定制性强，Chef将脚本命令代码化，定制时只需要修改代码，安装的过程就是执行代码的过程。
打个比方，Chef就像一个制作玩具的工厂，它可以把一些原材料做成漂亮的玩具， 它有一些模板，你把原材料放进去，选择一个模板(比如怪物史莱克)，它就会制造出这个玩具，服务器的配置也是这样，一台还没有配置的服务器，你给它指定一个模板(role或recipe)， Chef就会把它配置成你想要的线上服务器。

1.2 Chef和Puppet比较
就服务器的集中管理工具而言，知名度与Chef平分天下的是叫“Puppet”的工具，它们是OSS知名度排名最前的2个。

让我们来比较下它们的不同：

比较PuppetChef
历史有一些还年轻
用户多，有名的公司也在用还比较少，有一些公司如37signals在使用
开发的活跃度中等活跃（感觉正在旺季）
文档多也足够了
设定文件用专用的文法书写（外部DSL）用Ruby书写（内部DSL）
设定的构成有点难懂相对容易理解，命名等很合适
依存关系的处理运行次序状况由系统端决定像Makefile，基本上是书写顺序，相比Puppet更具脚本风格
必要的中间软件没有服务端需要有CouchDB、RabbitMQ
安装简单，用gem的安装就可以服务端安装比较麻烦。客户端简单，只需要gem就可以了
和其他系统的协作感觉基本上没有因为使用RESTful的服务API，用JSON可以取值，能做许多事

1.3 Chef结构
这是Chef的结构图，对图做一点解释:

有一个中心服务器(运行chef-server)
Chef将数据存储在CouchDB数据库里面
RabbitMQ和chef-solo等提供搜索的功能
Chef还提供了个图形的用户界面(cher-server-webui)
Workstation上有一个pem文件，knift(对Chef进行配置)利用它作为认证来和chef-server通过REST API进行通信
Workstation将配置(利用Recipe等描述各Client应该如何配置自己)上传到服务器
Client上有一个pem文件，chef-client利用它作为认证来和chef-server通过REST API进行通信
当新加一个Client的时候，需要从中心服务器上拷贝validator.pem到新加的Client
它利用这个pem进行注册得到自己的client.pem进行以后的认证
Client连到Chef服务器查看如何配置自己，然后进行自我配置

1.4 Chef的三种管理模式
Chef-Solo
由一台普通电脑控制所有的服务器，不需要专设一台chef-server

Client-Server
所有的服务器作为chef-client，统一由chef-server进行管理，管理包括安装、配置等工作 chef-server可以自建，但安装的东西较多，由于使用solr作为全文搜索引擎，还需要安装java

Opscode Platform
类似于Client-Server，只是Server端不需要自建，而是采用http://www.opscode.com提供的chef-server服务

而上面三种管理模式，无疑Client-Server模式是最好，也是最复杂的，因为这样可以在本地环境中搭建一个私有的Chef集中管理环境而无需依赖任何第三方的平台。

1.5 Chef能做什么
Chef能做什么，答案的Anything，这个实际上很好理解，只要你可以对一台服务执行命令，你就可以对这台服务做任何配置(不是有那句话嘛:Where there is a SHELL， there is a way)
这里大家可能对Chef有一些误解，由于Chef使用类似模板的方法对服务进行配置， 大家可能认识它只适合于一些配置比较类似的服务， 这里完全小看Chef了，就拿官方的mysql cookbook来说，它可以同时支持众多OS平台：
debian ubuntu centos suse fedora redhat scientific amazon freebsd windows，当你对Chef有了更深的了解后你就不会感到惊讶了。

1.6 Chef是怎么工作的
如果忽略所有的细节，Chef是这样工作的：
在Workstation上定义各个Client应该如何配置自己，然后将这些信息上传到中心服务器
每个Client连到中心服务器查看如何配置自己，然后进行自我配置
因此，在Chef的环境搭建完成以后，绝大部分工作是在Workstation上进行的，只有在工作完成以后，决定应用到Client的时候，才会操作Server与Client。

1.7 对Chef中各个名词的形象解释
Chef 大厨
我就是个新手大厨，我想要烹调一桌服务器大餐，也就是一台体面的、可以用来满足某种用途的服务器。

Cookbook 菜谱
别人写好的一本书，书上写着一堆相关菜色的做法（比如“家常川菜”）。一些出色的服务器大厨已经写了 很多菜谱 ，这些是我要学习和抄袭的。

Recipe 菜谱里的一道菜色（比如“麻婆豆腐”）
服务器大餐里的某一部分该怎么做，都在菜色里写着呢。

所以，整个故事就是：
作为一个新手大厨（Chef），我想要从现成的很多菜谱（Cookbook）里挑选几道合适的菜色（Recipe），组合成一道大餐（服务器）来款待我的客人。
等我的手艺熟练之后我还会写我自己的菜色和菜谱，来创造属于我自己的大餐。

Chef的主要目标就是：把服务器配置变成源代码。
这样做的好处有两个：
自动化
我可以很轻松地把一台服务器大餐的做法直接照搬到另一台服务器上，于是我就得到了另一台大餐。

配置管理
服务器的配置信息能够很好的通过Git来管理，可以分享，可以多人协作，可以跟踪变化历史。

Chef使用服务器—客户端模式管理所有需要配置的机器，使用Chef涉及至少三台机器：
一台开发机器Workstation，在上面编写大餐的做法；
一台Chef服务器，管理所有要配置的Chef客户端，给它们下发配置信息；
多台Chef客户端（Node），就是我将要烹调出的大餐。

1.8 接着，我们可以开始以下过程
目前，我们对Chef已经有了一个基本的了解，接下来就可以通过以下步骤进行亲身实践，来加深理解。

Chef集中管理工具实践之 (1) 环境部署


目录结构
Chef集中管理工具实践之 (0) 什么是Chef
Chef集中管理工具实践之 (1) 环境部署
Chef集中管理工具实践之 (2) 服务器配置
Chef集中管理工具实践之 (3) 自定义配置

本文内容
Chef集中配置管理工具实践之 (1) 环境部署

参考资料
http://wiki.opscode.com/pages/viewpage.action?pageId=24773429
http://wiki.opscode.com/display/chef/Installing+Chef+Server+on+Debian+or+Ubuntu+using+Packages
http://wiki.opscode.com/display/chef/Workstation+Setup+for+Debian+and+Ubuntu
http://wiki.opscode.com/display/chef/Knife+Bootstrap

环境介绍
OS: Ubuntu 10.10 Server 64-bit //经过验证在12.04.1以及12.10上也成功实现部署。
Servers:
chef-server:10.6.1.170
chef-workstation:10.6.1.171
chef-client-1:10.6.1.172
chef-client-2:10.6.1.173

1. 安装配置Chef Server
编辑hosts
ubuntu@chef-server:~$ sudo vim /etc/hosts

view source
print ?
1127.0.0.1   localhost
2 
310.6.1.170 chef-server
410.6.1.171 chef-workstation
510.6.1.172 chef-client-1
610.6.1.173 chef-client-2

注意：
将本机的hostname在/etc/hosts中添加一条IP解析记录，这一点非常重要。
因为后面在安装chef-server的过程中，会首先安装rabbitmq-server，缺少该解析记录的话，会导致rabbitma-server启动失败，进而影响到所有其它chef-server软件包的正常安装，如果不清楚这一点的话，会给问题的排查带来很大的不便。

创建 /etc/apt/sources.list.d/opscode.list
ubuntu@chef-server:~$ sudo echo "deb http://apt.opscode.com/ `lsb_release -cs`-0.10 main" | sudo tee /etc/apt/sources.list.d/opscode.list

添加GPG Key
ubuntu@chef-server:~$ sudo mkdir -p /etc/apt/trusted.gpg.d
ubuntu@chef-server:~$ sudo gpg --keyserver keys.gnupg.net --recv-keys 83EF826A
ubuntu@chef-server:~$ sudo gpg --export packages@opscode.com | sudo tee /etc/apt/trusted.gpg.d/opscode-keyring.gpg > /dev/null

ubuntu@chef-server:~$ sudo apt-get update
ubuntu@chef-server:~$ sudo apt-get install opscode-keyring

安装NTP时间服务器，Chef需要确保workstation与所有client与server的时钟一致
ubuntu@chef-server:~$ sudo apt-get install ntp

更新现有系统
ubuntu@chef-server:~$ sudo apt-get upgrade

安装chef-server软件包
ubuntu@chef-server:~$ sudo apt-get install chef chef-server

输入URL: http://chef-server:4000

输入密码: chef-server

该过程执行了如下过程：
安装Chef Server以及所依赖的软件包如Merb,CouchDB,RabbitMQ等共300多个软件包
启动CouchDB,RabbitMQ
启动chef-server-api并运行在4000端口
启动chef-server-webui并运行在4040端口
启动chef-solr-indexer并自动连接到rabbitmq-server
启动chef-solr,chef-client
在目录/etc/chef中创建相关的配置文件

安装完成后检查并确认以下端口：
Chef Server - 4000
Chef Server WebUI - 4040
CouchDB - 5984
RabbitMQ - 5672
Chef Solr - 8983

ubuntu@chef-server:~$ sudo netstat -lntp

view source
print ?
01Active Internet connections (only servers)
02Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
03tcp   0   0 0.0.0.0:22          0.0.0.0:*          LISTEN      11402/sshd              
04tcp   0   0 0.0.0.0:4000        0.0.0.0:*          LISTEN      31998/merb : chef-s 
05tcp   0   0 0.0.0.0:4040        0.0.0.0:*          LISTEN      32168/merb : chef-s
06tcp   0   0 0.0.0.0:5672        0.0.0.0:*          LISTEN      30470/beam
07tcp   0   0 127.0.0.1:5984      0.0.0.0:*          LISTEN      30518/beam     
08tcp   0   0 0.0.0.0:41891       0.0.0.0:*          LISTEN      30128/beam       
09tcp6  0   0 :::22               :::*               LISTEN      11402/sshd     
10tcp6  0   0 127.0.0.1:8983      :::*               LISTEN      31760/java
11...

登陆Web UI

地址：http://chef-server:4040 （正常访问需要在本地电脑的hosts中添加“10.6.1.170 chef-server”）
账号：admin
密码：chef-server

安装配置knife命令行工具
ubuntu@chef-server:~$ mkdir -p ~/.chef
ubuntu@chef-server:~$ sudo cp /etc/chef/validation.pem /etc/chef/webui.pem ~/.chef
ubuntu@chef-server:~$ sudo chown -R $USER ~/.chef

ubuntu@chef-server:~$ knife configure -i

view source
print ?
01WARNING: No knife configuration file found
02Where should I put the config file? [/home/ubuntu/.chef/knife.rb]
03Please enter the chef server URL: [http://chef-server:4000] http://chef-server:4000
04Please enter a clientname for the new client: [ubuntu]
05Please enter the existing admin clientname: [chef-webui]
06Please enter the location of the existing admin client's private key: [/etc/chef/webui.pem] .chef/webui.pem
07Please enter the validation clientname: [chef-validator]
08Please enter the location of the validation key: [/etc/chef/validation.pem] .chef/validation.pem
09Please enter the path to a chef repository (or leave blank):
10Creating initial API user...
11Created client[ubuntu]
12Configuration file written to /home/ubuntu/.chef/knife.rb

执行knife命令，检查是否能连接到指定的Chef Server
ubuntu@chef-server:~$ knife client list

view source
print ?
1chef-validator
2chef-webui
3ubuntu

ubuntu@chef-server:~$ knife cookbook list

ubuntu@chef-server:~$ sudo apt-get install ntp

为工作站安装并配置Knife Client
ubuntu@chef-server:~$ knife client create chef-workstation -d -a -f /home/ubuntu/.chef/chef-workstation.pem

view source
print ?
1Created client[chef-workstation]

ubuntu@chef-server:~$ knife client show chef-workstation

view source
print ?
01_rev:        1-2a52b9416bad08b697e9c644a0aea4cc
02admin:       true
03chef_type:   client
04json_class:  Chef::ApiClient
05name:        chef-workstation
06public_key:  -----BEGIN RSA PUBLIC KEY-----
07             MIIBCgKCAQEA1RAa+jf733FtoTv64msykO3/SEe8G/YhPgA2S3NfWdgh+LbuhCdT
08             9IjX3Hio3U/rj6VGeICJkCfWZy7NM9pTaPzH+gJdFbkLrLW1GSoEKMJ/f9IkxRcS
09             7vdySU05IrPOF9PqcMvrME4xYzsFzIXDz1CbWBs08SuMfjP9qHfeStfBQaoQ8rLp
10             mOGI0VMOU/CrlfNsAPLbUgVVylKfcmop1dCO6My53xW/qogfg/8Af0qtk7tyjVFi
11             K+umCjmHmtW09qg5467p7xf4WSUYh076pb3ofbTi0o3VJi8Dz+qGISjvAVf3Y1As
12             mwkam0IBM5sK41r/Suki9UQanKWsiDm0CQIDAQAB
13             -----END RSA PUBLIC KEY-----

2. 安装配置chef-workstation
编辑hosts
ubuntu@chef-workstation:~$ vim /etc/hosts

view source
print ?
1127.0.0.1   localhost
2 
310.6.1.170 chef-server
410.6.1.171 chef-workstation
510.6.1.172 chef-client-1
610.6.1.173 chef-client-2

安装Ruby与其它依赖包
ubuntu@chef-workstation:~$ sudo apt-get install ruby ruby-dev libopenssl-ruby rdoc ri irb build-essential wget ssl-cert curl

安装RubyGems
ubuntu@chef-workstation:~$ cd /tmp
ubuntu@chef-workstation:~$ curl -O http://production.cf.rubygems.org/rubygems/rubygems-1.8.10.tgz
ubuntu@chef-workstation:~$ tar zxf rubygems-1.8.10.tgz
ubuntu@chef-workstation:~$ cd rubygems-1.8.10
ubuntu@chef-workstation:/tmp/rubygems-1.8.10$ sudo ruby setup.rb --no-format-executable

安装Chef Gem
ubuntu@chef-workstation:/tmp/rubygems-1.8.10$ sudo gem install chef --no-ri --no-rdoc

view source
print ?
01Fetching: mixlib-config-1.1.2.gem (100%)
02Fetching: mixlib-cli-1.2.2.gem (100%)
03Fetching: mixlib-log-1.4.1.gem (100%)
04Fetching: mixlib-authentication-1.3.0.gem (100%)
05Fetching: mixlib-shellout-1.1.0.gem (100%)
06Fetching: systemu-2.5.2.gem (100%)
07Fetching: yajl-ruby-1.1.0.gem (100%)
08Building native extensions.  This could take a while...
09Fetching: ipaddress-0.8.0.gem (100%)
10Fetching: ohai-6.14.0.gem (100%)
11Fetching: mime-types-1.19.gem (100%)
12Fetching: rest-client-1.6.7.gem (100%)
13Fetching: bunny-0.7.9.gem (100%)
14[Version 0.7.8] test suite cleanup (eliminated some race conditions related to queue.message_count)
15Fetching: json-1.6.1.gem (100%)
16Building native extensions.  This could take a while...
17Fetching: polyglot-0.3.3.gem (100%)
18Fetching: treetop-1.4.12.gem (100%)
19Fetching: net-ssh-2.2.2.gem (100%)
20Fetching: net-ssh-gateway-1.1.0.gem (100%)
21Fetching: net-ssh-multi-1.1.gem (100%)
22Fetching: highline-1.6.15.gem (100%)
23Fetching: erubis-2.7.0.gem (100%)
24Fetching: moneta-0.6.0.gem (100%)
25Fetching: uuidtools-2.1.3.gem (100%)
26Fetching: chef-10.16.2.gem (100%)
27Successfully installed mixlib-config-1.1.2
28Successfully installed mixlib-cli-1.2.2
29Successfully installed mixlib-log-1.4.1
30Successfully installed mixlib-authentication-1.3.0
31Successfully installed mixlib-shellout-1.1.0
32Successfully installed systemu-2.5.2
33Successfully installed yajl-ruby-1.1.0
34Successfully installed ipaddress-0.8.0
35Successfully installed ohai-6.14.0
36Successfully installed mime-types-1.19
37Successfully installed rest-client-1.6.7
38Successfully installed bunny-0.7.9
39Successfully installed json-1.6.1
40Successfully installed polyglot-0.3.3
41Successfully installed treetop-1.4.12
42Successfully installed net-ssh-2.2.2
43Successfully installed net-ssh-gateway-1.1.0
44Successfully installed net-ssh-multi-1.1
45Successfully installed highline-1.6.15
46Successfully installed erubis-2.7.0
47Successfully installed moneta-0.6.0
48Successfully installed uuidtools-2.1.3
49Successfully installed chef-10.16.2
5023 gems installed

安装Git
ubuntu@chef-workstation:~$ sudo apt-get -y install git-core
ubuntu@chef-workstation:~$ git --version
git version 1.7.1

创建Chef Repository
备注：Chef的大部分配置工作都是在Workstaion中的Chef Repository中完成的，不同的Chef Repository可以管理不同的Chef Server。
ubuntu@chef-workstation:~$ sudo git clone git://github.com/opscode/chef-repo.git /opt/chef-local

view source
print ?
1Initialized empty Git repository in /opt/chef-local/.git/
2remote: Counting objects: 199, done.
3remote: Compressing objects: 100% (117/117), done.
4remote: Total 199 (delta 72), reused 162 (delta 49)
5Receiving objects: 100% (199/199), 30.34 KiB | 10 KiB/s, done.
6Resolving deltas: 100% (72/72), done.

ubuntu@chef-workstation:~$ cd /opt/chef-local/
ubuntu@chef-workstation:/opt/chef-local$ ls
README.md Rakefile certificates chefignore config cookbooks data_bags environments roles

创建配置文件夹
ubuntu@chef-workstation:/opt/chef-local$ sudo mkdir -p .chef

传输pem认证文件到Workstation
ubuntu@chef-workstation:/opt/chef-local$ sudo scp ubuntu@chef-server:/home/ubuntu/.chef/chef-workstation.pem .chef/
ubuntu@chef-workstation:/opt/chef-local$ sudo scp ubuntu@chef-server:/home/ubuntu/.chef/validation.pem .chef/

ubuntu@chef-workstation:/opt/chef-local$ ls .chef/
chef-workstation.pem validation.pem

ubuntu@chef-workstation:/opt/chef-local$ sudo knife configure

view source
print ?
01WARNING: No knife configuration file found
02Where should I put the config file? [/home/ubuntu/.chef/knife.rb] .chef/knife.rb
03Please enter the chef server URL: [http://chef-workstation:4000] http://chef-server:4000
04Please enter an existing username or clientname for the API: [ubuntu] chef-workstation
05Please enter the validation clientname: [chef-validator]
06Please enter the location of the validation key: [/etc/chef/validation.pem] .chef/validation.pem
07Please enter the path to a chef repository (or leave blank): /opt/chef-local
08*****
09 
10You must place your client key in:
11  /opt/chef-local/.chef/chef-workstation.pem
12Before running commands with Knife!
13 
14*****
15 
16You must place your validation key in:
17  /opt/chef-local/.chef/validation.pem
18Before generating instance data with Knife!
19 
20*****
21Configuration file written to /opt/chef-local/.chef/knife.rb

验证配置是否正确
ubuntu@chef-workstation:~$ sudo ntpdate chef-server

确认Knife工具能否连接到Chef Server
ubuntu@chef-workstation:~$ knife client list

view source
print ?
1chef-server
2chef-validator
3chef-webui
4chef-workstation
5ubuntu

ubuntu@chef-workstation:~$ knife client show chef-validator

view source
print ?
01_rev:        1-96959e21dfdb3f232a3ce8bae835475b
02admin:       false
03chef_type:   client
04json_class:  Chef::ApiClient
05name:        chef-validator
06public_key:  -----BEGIN RSA PUBLIC KEY-----
07             MIIBCgKCAQEA00/AWJL5mThj+pSXEB2gMKdTdHFm0pGi2hXAoBwm4/ZlnO4p2iwI
08             /skfZMepVm8SAkSMIhz7ZC+jN/+Kqas7es0E+iv9ei0BF4Q41Y5kKMFctuElYbPH
09             ImRCVTcQJ6m7BPS0Tczhy87jk6QlhsDsrnhNyUEgM5XRVNO+NzqeqZ+UMOWd9k2q
10             KTJhbtHdx7ILdjZ5SBsiIMBhBNni2D0Y34BDtddsXCn1eyTWwGZxZTRZuDDXnls+
11             aZaqogKoZ40d6h6ZVGh6nmmpdPDi9YdCIqFtWe5LF5bwIy7K6qBVgiOqU0x3Xek3
12             d1eZG/8C+4FWjAm1h856npvmMOpVip9w8QIDAQAB
13             -----END RSA PUBLIC KEY-----

3. 安装配置chef-client
编辑hosts
ubuntu@chef-client-1:~$ vim /etc/hosts

view source
print ?
1127.0.0.1   localhost
2 
310.6.1.170 chef-server
410.6.1.171 chef-workstation
510.6.1.172 chef-client-1
610.6.1.173 chef-client-2

与chef-server同步时间
ubuntu@chef-client-1:~$ sudo ntpdate chef-server

Boostrap可以用来将目标节点初始化为一个Client
ubuntu@chef-workstation:~$ knife bootstrap --help

view source
print ?
01knife bootstrap FQDN (options)
02        --bootstrap-proxy PROXY_URL  The proxy server for the node being bootstrapped
03        --bootstrap-version VERSION  The version of Chef to install
04    -N, --node-name NAME             The Chef node name for your new node
05    -s, --server-url URL             Chef Server URL
06    -k, --key KEY                    API Client Key
07        --[no-]color                 Use colored output, defaults to enabled
08    -c, --config CONFIG              The configuration file to use
09        --defaults                   Accept default values for all questions
10        --disable-editing            Do not open EDITOR, just accept the data as is
11    -d, --distro DISTRO              Bootstrap a distro using a template
12    -e, --editor EDITOR              Set the editor to use for interactive commands
13    -E, --environment ENVIRONMENT    Set the Chef environment
14    -j JSON_ATTRIBS                  A JSON string to be added to the first run of chef-client
15        --json-attributes
16    -F, --format FORMAT              Which format to use for output
17        --hint HINT_NAME[=HINT_FILE] Specify Ohai Hint to be set on the bootstrap target.  Use multiple --hint options to specify multiple hints.
18        --[no-]host-key-verify       Verify host key, enabled by default.
19    -i IDENTITY_FILE                 The SSH identity file used for authentication
20        --identity-file
21    -u, --user USER                  API Client Username
22        --prerelease                 Install the pre-release chef gems
23        --print-after                Show the data after a destructive operation
24    -r, --run-list RUN_LIST          Comma separated list of roles/recipes to apply
25    -G, --ssh-gateway GATEWAY        The ssh gateway
26    -P, --ssh-password PASSWORD      The ssh password
27    -p, --ssh-port PORT              The ssh port
28    -x, --ssh-user USERNAME          The ssh username
29        --template-file TEMPLATE     Full path to location of template to use
30        --sudo                       Execute the bootstrap via sudo
31    -V, --verbose                    More verbose output. Use twice for max verbosity
32    -v, --version                    Show chef version
33    -y, --yes                        Say yes to all prompts for confirmation
34    -h, --help                       Show this message

下面我们对chef-client-1进行初始化
ubuntu@chef-workstation:~$ sudo knife bootstrap 10.6.1.172 -x ubuntu -P password --sudo

view source
print ?
01Bootstrapping Chef on 10.6.1.172
0210.6.1.172 --2012-11-09 03:34:40--  http://opscode.com/chef/install.sh
0310.6.1.172 Resolving opscode.com...
0410.6.1.172 184.106.28.83
0510.6.1.172 Connecting to opscode.com|184.106.28.83|:80...
0610.6.1.172 connected.
0710.6.1.172 HTTP request sent, awaiting response...
0810.6.1.172 301 Moved Permanently
0910.6.1.172 Location: http://www.opscode.com/chef/install.sh [following]
1010.6.1.172 --2012-11-09 03:34:41--  http://www.opscode.com/chef/install.sh
1110.6.1.172 Resolving www.opscode.com...
1210.6.1.172 184.106.28.83
1310.6.1.172 Reusing existing connection to opscode.com:80.
1410.6.1.172 HTTP request sent, awaiting response...
1510.6.1.172 200 OK
1610.6.1.172 Length: 6396 (6.2K) [application/x-sh]
1710.6.1.172 Saving to: `STDOUT'
1810.6.1.172
19 0% [                                       ] 0           --.-K/s             
2010.6.1.172 Downloading Chef 10.16.2 for ubuntu...
21100%[======================================>] 6,396       18.7K/s   in 0.3s   
2210.6.1.172
2310.6.1.172 2012-11-09 03:34:42 (18.7 KB/s) - written to stdout [6396/6396]
2410.6.1.172
2510.6.1.172 Installing Chef 10.16.2
2610.6.1.172 Selecting previously deselected package chef.
2710.6.1.172 (Reading database ...
28(Reading database ... 60%
29(Reading database ... 65%
30(Reading database ... 70%
31(Reading database ... 75%
32(Reading database ... 80%
33(Reading database ... 85%
34(Reading database ... 90%
35(Reading database ... 95%
36(Reading database ... 41378 files and directories currently installed.)
3710.6.1.172 Unpacking chef (from .../chef_10.16.2_amd64.deb) ...
3810.6.1.172 Setting up chef (10.16.2-1.ubuntu.10.04) ...
3910.6.1.172 Thank you for installing Chef!
4010.6.1.172 [2012-11-09T03:57:46+08:00] INFO: *** Chef 10.16.2 ***
4110.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Client key /etc/chef/client.pem is not present - registering
4210.6.1.172 [2012-11-09T03:57:47+08:00] INFO: HTTP Request Returned 404 Not Found: Cannot load node chef-client-1
4310.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Setting the run_list to [] from JSON
4410.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Run List is []
4510.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Run List expands to []
4610.6.1.172 [2012-11-09T03:57:47+08:00] INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
4710.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Starting Chef Run for chef-client-1
4810.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Running start handlers
4910.6.1.172 [2012-11-09T03:57:47+08:00] INFO: Start handlers complete.
5010.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Loading cookbooks []
5110.6.1.172 [2012-11-09T03:57:48+08:00] WARN: Node chef-client-1 has an empty run list.
5210.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Chef Run complete in 0.438462677 seconds
5310.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Running report handlers
5410.6.1.172 [2012-11-09T03:57:48+08:00] INFO: Report handlers complete

验证chef-client-1是否已经注册
ubuntu@chef-workstation:~$ knife client list

view source
print ?
1chef-client-1
2chef-server
3chef-validator
4chef-webui
5chef-workstation
6ubuntu

从上面可以看出chef-client-1已经成功注册到了chef-server中，整个环境 chef-workstation => chef-server => chef-client-1 已经搭建成功。

4. 接着，我们可以开始以下过程

Chef集中管理工具实践之 (2) 服务器配置


目录结构
Chef集中管理工具实践之 (0) 什么是Chef
Chef集中管理工具实践之 (1) 环境部署
Chef集中管理工具实践之 (2) 服务器配置
Chef集中管理工具实践之 (3) 自定义配置

本文内容
Chef集中配置管理工具实践之 (2) 服务器配置

参考资料
http://wiki.opscode.com/display/ChefCN/Just+Enough+Ruby+for+Chef
http://wiki.opscode.com/display/chef/Fast+Start+Guide
http://gigix.thoughtworkers.org/2011/1/30/devops
http://gigix.thoughtworkers.org/2011/2/20/chef-2-rails-server
http://gigix.thoughtworkers.org/2011/3/2/chef-3-first-cookbook
http://gigix.thoughtworkers.org/2011/3/12/devops-readings

环境介绍
OS: Ubuntu 10.10 Server 64-bit
Servers:
chef-server:10.6.1.170
chef-workstation:10.6.1.171
chef-client-1:10.6.1.172

1. 从这里开始
通过前面的两个章节，我们认识了什么是Chef，并成功的部署好了整个环境。但目前Chef具体能做什么，能实现什么具体的功能，其实还是一头雾水的。
在这一个章节，我们会通过使用Chef完成对用户账号和SSH Server的集中管理来加深理解。

前面，我们在提到Cookbook 菜谱的时候，提到 “一些出色的大厨已经写了很多菜谱，这些是我要学习和抄袭的。”真实的意思就是，Chef社区已经有了许多官方的cookbook以及优秀的社区成员所编写的cookbook提供下载使用，我们只需要阅读它们的README文件，就可以很快速方便的使用了。这就是我在这一个章节所讲的内容。

而“等我的手艺熟练之后我还会写我自己的菜色和菜谱，来创造属于我自己的大餐。”真实的意思就是，在我熟悉了如何使用别人的cookbook以后，便可以尝试借鉴并编写适合自己的cookbook，用来对自己的服务器进行一些自定义的，特有的管理，而这些管理可能在其它环境里并不适用。这是我在下一个章节要讲的内容。

2. 如何开始
首先，我们来明确一下马上要进行的任务，就是“使用Chef完成对用户账号和SSH Server的配置”。

接着，我们可以登录到Chef的官方社区http://community.opscode.com/cookbooks，搜索是否已经存在有相关的cookbook提供使用。
通过搜索之后，我们可以确定有如下cookbook能够帮助我们完成任务：
1) 用户账号: user
2) SSH Server: openssh

ubuntu@chef-workstation:~$ cd /opt/chef-local/
查看knife配置
ubuntu@chef-workstation:/opt/chef-local$ cat .chef/knife.rb

 
log_level                :info
log_location             STDOUT
node_name                'chef-workstation'
client_key               '/opt/chef-local/.chef/chef-workstation.pem'
validation_client_name   'chef-validator'
validation_key           '/opt/chef-local/chef/validation.pem'
chef_server_url          'http://chef-server:4000'
cache_type               'BasicFile'
cache_options( :path => '/opt/chef-local/.chef/checksums' )
cookbook_path [ '/opt/chef-local/cookbooks' ]

2.1 首先，让我们来部署并使用user来管理用户
下载cookbook
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook site install user

 
Installing user to /opt/chef-local/cookbooks
Checking out the master branch.
Creating pristine copy branch chef-vendor-user
Downloading user from the cookbooks site at version 0.3.0 to /opt/chef-local/cookbooks/user.tar.gz
Cookbook saved: /opt/chef-local/cookbooks/user.tar.gz
Removing pre-existing version.
Uncompressing user version 0.3.0.
removing downloaded tarball
1 files updated, committing changes
Creating tag cookbook-site-imported-user-0.3.0
Checking out the master branch.
Updating a3bec38..f06cc56
Fast-forward
 cookbooks/user/.gitignore                          |    2 +
 cookbooks/user/.travis.yml                         |    6 +
 cookbooks/user/CHANGELOG.md                        |   95 +++++
 cookbooks/user/README.md                           |  391 ++++++++++++++++++++
 cookbooks/user/Rakefile                            |   33 ++
 cookbooks/user/attributes/default.rb               |   42 ++
 cookbooks/user/metadata.json                       |   35 ++
 cookbooks/user/metadata.rb                         |   14 +
 cookbooks/user/providers/account.rb                |  173 +++++++++
 cookbooks/user/recipes/data_bag.rb                 |   52 +++
 cookbooks/user/recipes/default.rb                  |   18 +
 cookbooks/user/resources/account.rb                |   40 ++
 .../user/templates/default/authorized_keys.erb     |    7 +
 13 files changed, 908 insertions(+), 0 deletions(-)
 create mode 100644 cookbooks/user/.gitignore
 create mode 100644 cookbooks/user/.travis.yml
 create mode 100644 cookbooks/user/CHANGELOG.md
 create mode 100644 cookbooks/user/README.md
 create mode 100644 cookbooks/user/Rakefile
 create mode 100644 cookbooks/user/attributes/default.rb
 create mode 100644 cookbooks/user/metadata.json
 create mode 100644 cookbooks/user/metadata.rb
 create mode 100644 cookbooks/user/providers/account.rb
 create mode 100644 cookbooks/user/recipes/data_bag.rb
 create mode 100644 cookbooks/user/recipes/default.rb
 create mode 100644 cookbooks/user/resources/account.rb
 create mode 100644 cookbooks/user/templates/default/authorized_keys.erb
Cookbook user version 0.3.0 successfully installed

ubuntu@chef-workstation:/opt/chef-local$ cd cookbooks/
ubuntu@chef-workstation:/opt/chef-local/cookbooks$ ls

README.md  user

每个模块下面的README.md文件非常有用，讲解了该模块的配置方法以及与chef-server如何通信。
比如，我们通过阅读了user的README.md之后，就会知道我们需要建立一个名为users的data bag，将用户的信息写成一个个json文件放在下面，再通过override_attributes在role的配置文件中指定需要配置的用户。

ubuntu@chef-workstation:/opt/chef-local/cookbooks$ cd user/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/user$ ll

total 76
drwxr-xr-x 7 root root  4096 Nov 15 20:31 ./
drwxr-xr-x 3 root root  4096 Nov 15 20:31 ../
-rw-r--r-- 1 root root    18 Nov 15 20:31 .gitignore
-rw-r--r-- 1 root root   141 Nov 15 20:31 .travis.yml
-rw-r--r-- 1 root root  2705 Nov 15 20:31 CHANGELOG.md
-rw-r--r-- 1 root root 11753 Nov 15 20:31 README.md
-rw-r--r-- 1 root root   813 Nov 15 20:31 Rakefile
drwxr-xr-x 2 root root  4096 Nov 15 20:31 attributes/
-rw-r--r-- 1 root root 13048 Nov 15 20:31 metadata.json
-rw-r--r-- 1 root root   538 Nov 15 20:31 metadata.rb
drwxr-xr-x 2 root root  4096 Nov 15 20:31 providers/
drwxr-xr-x 2 root root  4096 Nov 15 20:31 recipes/
drwxr-xr-x 2 root root  4096 Nov 15 20:31 resources/
drwxr-xr-x 3 root root  4096 Nov 15 20:31 templates/

ubuntu@chef-workstation:/opt/chef-local/cookbooks/user$ cd recipes/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/user/recipes$ ls

data_bag.rb  default.rb

dongguo@chef-workstation:/opt/chef-local/cookbooks/user/attributes$ ls

default.rb

上传cookbook到chef-server
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook upload user

Uploading user         [0.3.0]
Uploaded 1 cookbook.

创建role
ubuntu@chef-workstation:/opt/chef-local$ cd roles/
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu_servers.rb 

name "ubuntu_servers"
description "The base role applied to all nodes."
run_list(
    "recipe[user]",
    "recipe[user::data_bag]"
)
override_attributes(
    "users" => [ "ubuntu" ]
)

上传role到chef-server
ubuntu@chef-workstation:/opt/chef-local$ sudo knife role from file roles/ubuntu_servers.rb 

Updated Role ubuntu_servers!

为user这个cookbook创建data_bag
ubuntu@chef-workstation:/opt/chef-local$ cd data_bags/
ubuntu@chef-workstation:/opt/chef-local/data_bags$ sudo mkdir users
ubuntu@chef-workstation:/opt/chef-local/data_bags$ sudo vim users/ubuntu.json

 
{
    "id"       : "ubuntu",
    "gid": "admin",
    "comment"  : "ubuntu",
    "home"     : "/home/ubuntu",
    "create_user_group":"false",
    "ssh_keygen": "false",
    "ssh_keys" : "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+upV++0vIM2PuD2XvH+zOUF6JsfofPCvCdqZ/Wg0GaRvcuPpKs7Ua2APSs
vtvEz9ohQvexS1DO4G1ZjIO20dsc82BHTFxd3DmZyQ8g/CLoIKIdkDImSffQxBYM//8URvtk16HTmuYVY9poalbVh
lErhg0xSbyx/DQfOChfc34T8481iWPZ0pnJLj7z5AUvYR8fcWGtbMhveoyKuB4VocsQvKfgVUauS1jIGGac7kC8XG
Vc6fEVzzTycS7dTypzHDJp3I9wHWoiMF4SD5MRb0sEhlvaOtryHGVdcfFj4Mrdiu8NepL7yyCb9qGdB7QbT1+hNCn
ZukWP4Iz6yzATLzS"
}

上传data_bag到chef-server
ubuntu@chef-workstation:/opt/chef-local/data_bags$ sudo knife data bag create users

Created data_bag[users]

ubuntu@chef-workstation:/opt/chef-local/data_bags$ sudo knife data bag from file users users/ubuntu.json 

Updated data_bag_item[users::ubuntu]

为节点增加run_list，即将ubuntu_servers这个角色赋给chef-client-1
ubuntu@chef-workstation:/opt/chef-local$ sudo knife node run_list add chef-client-1 "role[ubuntu_servers]"

run_list:  role[ubuntu_servers]

在chef-client-1上执行chef-client拉取配置
ubuntu@chef-client-1:~$ sudo chef-client 

INFO: *** Chef 10.16.2 ***
INFO: Run List is [role[ubuntu_servers]]
INFO: Run List expands to [user, user::data_bag]
INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
INFO: Starting Chef Run for chef-client-1
INFO: Running start handlers
INFO: Start handlers complete.
INFO: Loading cookbooks [user]
INFO: Processing user_account[ubuntu] action create (user::data_bag line 36)
INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
INFO: user[ubuntu] altered
INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: directory[/home/ubuntu/.ssh] created directory /home/ubuntu/.ssh
INFO: directory[/home/ubuntu/.ssh] owner changed to 1000
INFO: directory[/home/ubuntu/.ssh] group changed to 109
INFO: directory[/home/ubuntu/.ssh] mode changed to 700
INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: directory[/home/ubuntu] group changed to 109
INFO: directory[/home/ubuntu] mode changed to 2755
INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
INFO: template[/home/ubuntu/.ssh/authorized_keys] updated content
INFO: template[/home/ubuntu/.ssh/authorized_keys] owner changed to 1000
INFO: template[/home/ubuntu/.ssh/authorized_keys] group changed to 109
INFO: template[/home/ubuntu/.ssh/authorized_keys] mode changed to 600
INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148)
INFO: Chef Run complete in 0.766601698 seconds
INFO: Running report handlers
INFO: Report handlers complete

我们可以看到，chef-client已经成功拉取到了ubuntu这个用户的信息，并自动的进行了一系列的配置。
至此，我们就成功的使用Chef的user这个cookbook完成一次服务器的自动化部署。

2.2 接着，让我们来通过Chef完成OpenSSH的配置
在本地提交刚刚的一系列修改，因为我们使用了git来管理Chef的配置。
ubuntu@chef-workstation:/opt/chef-local$ sudo git commit -a -m "update"

安装openssh的cookbook
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook site install openssh

Installing openssh to /opt/chef-local/cookbooks
Checking out the master branch.
Creating pristine copy branch chef-vendor-openssh
Downloading openssh from the cookbooks site at version 1.1.2 to /opt/chef-local/cookbooks/openssh.tar.gz
Cookbook saved: /opt/chef-local/cookbooks/openssh.tar.gz
Removing pre-existing version.
Uncompressing openssh version 1.1.2.
removing downloaded tarball
1 files updated, committing changes
Creating tag cookbook-site-imported-openssh-1.1.2
Checking out the master branch.
Updating 8945cc6..ea9f570
Fast-forward
 cookbooks/openssh/.gitignore                       |    4 +
 cookbooks/openssh/CHANGELOG.md                     |   19 ++
 cookbooks/openssh/CONTRIBUTING                     |   29 +++
 cookbooks/openssh/Gemfile                          |    3 +
 cookbooks/openssh/LICENSE                          |  201 ++++++++++++++++++++
 cookbooks/openssh/README.md                        |  122 ++++++++++++
 cookbooks/openssh/attributes/default.rb            |  125 ++++++++++++
 .../files/default/tests/minitest/config_test.rb    |   38 ++++
 .../files/default/tests/minitest/default_test.rb   |   13 ++
 .../default/tests/minitest/support/helpers.rb      |   13 ++
 cookbooks/openssh/metadata.json                    |   37 ++++
 cookbooks/openssh/metadata.rb                      |   12 ++
 cookbooks/openssh/recipes/default.rb               |   73 +++++++
 cookbooks/openssh/templates/default/port_ssh.erb   |    2 +
 cookbooks/openssh/templates/default/ssh_config.erb |   11 +
 .../openssh/templates/default/sshd_config.erb      |   11 +
 16 files changed, 713 insertions(+), 0 deletions(-)
 create mode 100644 cookbooks/openssh/.gitignore
 create mode 100644 cookbooks/openssh/CHANGELOG.md
 create mode 100644 cookbooks/openssh/CONTRIBUTING
 create mode 100644 cookbooks/openssh/Gemfile
 create mode 100644 cookbooks/openssh/LICENSE
 create mode 100644 cookbooks/openssh/README.md
 create mode 100644 cookbooks/openssh/attributes/default.rb
 create mode 100644 cookbooks/openssh/files/default/tests/minitest/config_test.rb
 create mode 100644 cookbooks/openssh/files/default/tests/minitest/default_test.rb
 create mode 100644 cookbooks/openssh/files/default/tests/minitest/support/helpers.rb
 create mode 100644 cookbooks/openssh/metadata.json
 create mode 100644 cookbooks/openssh/metadata.rb
 create mode 100644 cookbooks/openssh/recipes/default.rb
 create mode 100644 cookbooks/openssh/templates/default/port_ssh.erb
 create mode 100644 cookbooks/openssh/templates/default/ssh_config.erb
 create mode 100644 cookbooks/openssh/templates/default/sshd_config.erb
Cookbook openssh version 1.1.2 successfully installed

我们可以看到openssh的cookbook已经被安装了
ubuntu@chef-workstation:/opt/chef-local/cookbooks$ ls

README.md  openssh  user

同样，通过仔细阅读README.md，我们可以了解这个cookbook的用法，就是通过在attributes中修改对应的参数，然后再通过添加到role的配置文件中即可。
ubuntu@chef-workstation:/opt/chef-local/cookbooks$ cd openssh/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh$ ls

CHANGELOG.md  CONTRIBUTING  Gemfile  LICENSE  README.md  attributes  files  metadata.json  metadata.rb  recipes  templates

ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ ls

default.rb

打开attributes中的default参数配置文件，我们可以看到有很多的选项都已经被定义好了。
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ sudo vim default.rb

 
#
# Cookbook Name:: openssh
# Attributes:: default
#
# Author:: Ernie Brodeur 
# Copyright 2008-2012, Opscode, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Attributes are commented out using the default config file values.
# Uncomment the ones you need, or set attributes in a role.
#

default['openssh']['package_name'] = case node['platform_family']
                                     when "rhel", "fedora"
                                       %w{openssh-clients openssh}
                                     when "arch"
                                       %w{openssh}
                                     else
                                       %w{openssh-client openssh-server}
                                     end

default['openssh']['service_name'] = case node['platform_family']
                                     when "rhel", "fedora"
                                       "sshd"
                                     else
                                       "ssh"
                                     end

# ssh config group
default['openssh']['client']['host'] = "*"
# default['openssh']['client']['forward_agent'] = "no"
# default['openssh']['client']['forward_x11'] = "no"
# default['openssh']['client']['rhosts_rsa_authentication'] = "no"
# default['openssh']['client']['rsa_authentication'] = "yes"
# default['openssh']['client']['password_authentication'] = "yes"
# default['openssh']['client']['host_based_authentication'] = "no"
# default['openssh']['client']['gssapi_authentication'] = "no"
# default['openssh']['client']['gssapi_delegate_credentials'] = "no"
# default['openssh']['client']['batch_mode'] = "no"
# default['openssh']['client']['check_host_ip'] = "yes"
# default['openssh']['client']['address_family'] = "any"
# default['openssh']['client']['connect_timeout'] = "0"
# default['openssh']['client']['strict_host_key_checking'] = "ask"
# default['openssh']['client']['identity_file'] = "~/.ssh/identity"
# default['openssh']['client']['identity_file_rsa'] = "~/.ssh/id_rsa"
# default['openssh']['client']['identity_file_dsa'] = "~/.ssh/id_dsa"
# default['openssh']['client']['port'] = "22"
# default['openssh']['client']['protocol'] = [ "2 1" ]
# default['openssh']['client']['cipher'] = "3des"
# default['openssh']['client']['ciphers'] = [ "aes128-ctr aes192-ctr aes256-ctr arcfour256 arcfour128 aes128-cbc 3des-cbc" ]
# default['openssh']['client']['macs'] = [ "hmac-md5 hmac-sha1 umac-64@openssh.com hmac-ripemd160" ]
# default['openssh']['client']['escape_char'] = "~"
# default['openssh']['client']['tunnel'] = "no"
# default['openssh']['client']['tunnel_device'] = "any:any"
# default['openssh']['client']['permit_local_command'] = "no"
# default['openssh']['client']['visual_host_key'] = "no"
# default['openssh']['client']['proxy_command'] = "ssh -q -W %h:%p gateway.example.com"
# sshd config group
# default['openssh']['server']['port'] = "22"
# default['openssh']['server']['address_family'] = "any"
# default['openssh']['server']['listen_address'] = [ "0.0.0.0 ::" ]
# default['openssh']['server']['protocol'] = "2"
# default['openssh']['server']['host_key_v1'] = "/etc/ssh/ssh_host_key"
# default['openssh']['server']['host_key_rsa'] = "/etc/ssh/ssh_host_rsa_key"
# default['openssh']['server']['host_key_dsa'] = "/etc/ssh/ssh_host_dsa_key"
# default['openssh']['server']['host_key_ecdsa'] = "/etc/ssh/ssh_host_ecdsa_key"
# default['openssh']['server']['key_regeneration_interval'] = "1h"
# default['openssh']['server']['server_key_bits'] = "1024"
# default['openssh']['server']['syslog_facility'] = "AUTH"
# default['openssh']['server']['log_level'] = "INFO"
# default['openssh']['server']['login_grace_time'] = "2m"
# default['openssh']['server']['permit_root_login'] = "yes"
# default['openssh']['server']['strict_modes'] = "yes"
# default['openssh']['server']['max_auth_tries'] = "6"
# default['openssh']['server']['max_sessions'] = "10"
# default['openssh']['server']['rsa_authentication'] = "yes"
# default['openssh']['server']['pub_key_authentication'] = "yes"
default['openssh']['server']['authorized_keys_file'] = "%h/.ssh/authorized_keys"
# default['openssh']['server']['rhosts_rsa_authentication'] = "no"
# default['openssh']['server']['host_based_authentication'] = "no"
# default['openssh']['server']['ignore_user_known_hosts'] = "no"
# default['openssh']['server']['ignore_rhosts'] = "yes"
# default['openssh']['server']['password_authentication'] = "yes"
# default['openssh']['server']['permit_empty_passwords'] = "no"
default['openssh']['server']['challenge_response_authentication'] = "no"
# default['openssh']['server']['kerberos_authentication'] = "no"
# default['openssh']['server']['kerberos_or_localpasswd'] = "yes"
# default['openssh']['server']['kerberos_ticket_cleanup'] = "yes"
# default['openssh']['server']['kerberos_get_afs_token'] = "no"
# default['openssh']['server']['gssapi_authentication'] = "no"
# default['openssh']['server']['gssapi_clean_up_credentials'] = "yes"
default['openssh']['server']['use_p_a_m'] = "yes"
# default['openssh']['server']['allow_agent_forwarding'] = "yes"
# default['openssh']['server']['allow_tcp_forwarding'] = "yes"
# default['openssh']['server']['gateway_ports'] = "no"
# default['openssh']['server']['x11_forwarding'] = "no"
# default['openssh']['server']['x11_display_offset'] = "10"
# default['openssh']['server']['x11_use_localhost'] = "yes"
# default['openssh']['server']['print_motd'] = "yes"
# default['openssh']['server']['print_lastlog'] = "yes"
# default['openssh']['server']['t_c_p_keep_alive'] = "yes"
# default['openssh']['server']['use_login'] = "no"
# default['openssh']['server']['use_privilege_separation'] = "yes"
# default['openssh']['server']['permit_user_environment'] = "no"
# default['openssh']['server']['compression'] = "delayed"
# default['openssh']['server']['client_alive_interval'] = "0"
# default['openssh']['server']['client_alive_count_max'] = "3"
# default['openssh']['server']['use_dns'] = "yes"
# default['openssh']['server']['pid_file'] = "/var/run/sshd.pid"
# default['openssh']['server']['max_startups'] = "10"
# default['openssh']['server']['permit_tunnel'] = "no"
# default['openssh']['server']['chroot_directory'] = "none"
# default['openssh']['server']['banner'] = "none"
# default['openssh']['server']['subsystem'] =   "sftp   /usr/libexec/sftp-server"

在这里，我们可以修改以下选项使OpenSSH仅支持Key的认证方式，禁用密码登陆。

default['openssh']['server']['password_authentication'] = "yes"
default['openssh']['server']['use_dns'] = "yes"

修改完成以后，更新openssh的cookbook
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ sudo knife cookbook upload openssh

Uploading openssh        [1.1.2]
Uploaded 1 cookbook.

将openssh添加到role中
ubuntu@chef-workstation:/opt/chef-local/cookbooks/openssh/attributes$ cd /opt/chef-local/roles/
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu_servers.rb 

name "ubuntu_servers"
description "The base role applied to all nodes."
run_list(
    "recipe[user]",
    "recipe[user::data_bag]",
    "recipe[openssh]"
)
override_attributes(
    "users" => [ "ubuntu" ]
)

更新role
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife role from file ubuntu_servers.rb 

Updated Role ubuntu_servers!

到chef-client上拉取配置
ubuntu@chef-client-1:~$ sudo chef-client 

[2012-12-17T20:51:40+08:00] INFO: *** Chef 10.16.2 ***
[2012-12-17T20:51:41+08:00] INFO: Run List is [role[ubuntu_servers]]
[2012-12-17T20:51:41+08:00] INFO: Run List expands to [user, user::data_bag, openssh]
[2012-12-17T20:51:41+08:00] INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
[2012-12-17T20:51:41+08:00] INFO: Starting Chef Run for chef-client-1
[2012-12-17T20:51:41+08:00] INFO: Running start handlers
[2012-12-17T20:51:41+08:00] INFO: Start handlers complete.
[2012-12-17T20:51:41+08:00] INFO: Loading cookbooks [openssh, user]
[2012-12-17T20:51:41+08:00] INFO: Processing user_account[ubuntu] action create (user::data_bag line 36)
[2012-12-17T20:51:41+08:00] INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
[2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
[2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
[2012-12-17T20:51:41+08:00] INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
[2012-12-17T20:51:41+08:00] INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
[2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
[2012-12-17T20:51:41+08:00] INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
[2012-12-17T20:51:41+08:00] INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
[2012-12-17T20:51:41+08:00] INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148)
[2012-12-17T20:51:28+08:00] INFO: Processing package[openssh-client] action install (openssh::default line 27)
[2012-12-17T20:51:28+08:00] INFO: Processing package[openssh-server] action install (openssh::default line 27)
[2012-12-17T20:51:28+08:00] INFO: Processing service[ssh] action enable (openssh::default line 30)
[2012-12-17T20:51:28+08:00] INFO: service[ssh] enabled
[2012-12-17T20:51:28+08:00] INFO: Processing service[ssh] action start (openssh::default line 30)
[2012-12-17T20:51:28+08:00] INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 48)
[2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20121217205128
[2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] updated content
[2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] owner changed to 0
[2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] group changed to 0
[2012-12-17T20:51:28+08:00] INFO: template[/etc/ssh/ssh_config] mode changed to 644
[2012-12-17T20:51:28+08:00] INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 66)
[2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] backed up to /var/chef/backup/etc/ssh/sshd_config.chef-20121217205129
[2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] updated content
[2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] owner changed to 0
[2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] group changed to 0
[2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] mode changed to 644
[2012-12-17T20:51:29+08:00] INFO: template[/etc/ssh/sshd_config] sending restart action to service[ssh] (delayed)
[2012-12-17T20:51:29+08:00] INFO: Processing service[ssh] action restart (openssh::default line 30)
[2012-12-17T20:51:29+08:00] INFO: service[ssh] restarted
[2012-12-17T20:51:29+08:00] INFO: Chef Run complete in 1.742643517 seconds
[2012-12-17T20:51:29+08:00] INFO: Running report handlers
[2012-12-17T20:51:29+08:00] INFO: Report handlers complete

可以看到，chef-client-1已经自动的获取到了相应的参数，并更新了OpenSSH的配置文件，并重启了服务。

手动查看OpenSSH的配置文件，可以看到只有我们配置的几行参数内容。不过这里放心，其它的参数都有默认值，所以整个OpenSSH的配置是OK的。
ubuntu@chef-client-1:~$ cat /etc/ssh/sshd_config 

# Generated by Chef for chef-client-1

AuthorizedKeysFile %h/.ssh/authorized_keys
ChallengeResponseAuthentication no
PasswordAuthentication no
UseDns yes
UsePAM yes

至此，我们就已经完成了通过Chef来对用户账号以及OpenSSH的配置管理，对于Chef，也应该有了一些具体的认知。
不过，这仅仅是一个开始，试想如果我们只能通过别人写好的cookbook来修改参数进行服务器的配置，未免也太尴尬了。
所以，接下来，我们将会创建属于自己的cookbook，随心所欲的来配置服务器！

3 接着，我们可以开始以下过程

Chef集中管理工具实践之 (3) 自定义配置


目录结构
Chef集中管理工具实践之 (0) 什么是Chef
Chef集中管理工具实践之 (1) 环境部署
Chef集中管理工具实践之 (2) 服务器配置
Chef集中管理工具实践之 (3) 自定义配置

本文内容
Chef集中管理工具实践之 (3) 自定义配置

参考资料
http://wiki.opscode.com/display/chef/Resources#Resources-Service

环境介绍
OS: Ubuntu 10.10 Server 64-bit
Servers:
chef-server:10.6.1.170
chef-workstation:10.6.1.171
chef-client-1:10.6.1.172

1. 开始创造属于自己的大餐
“等我的手艺熟练之后我还会写我自己的菜色和菜谱，来创造属于我自己的大餐。” 在前面我提到过这句话，并且在上一个章节，也通过使用官方社区提供的cookbook完成了账号与openssh的配置。
在这一章，我们就来编写一个cookbook，将不同的自定义配置任务做成不同的recipe，最后实现对服务器的配置。

2. 如何开始
如何开始呢？使用官方社区的cookbook很简单，只需要修改attributes里面的参数就可以了，如果要自己来写，该怎么写用什么格式呢？
相信你一定有这个疑问存在。不过你可以尽管放心，Chef的官方社区有很完善的在线文档可供参考的。

上面提到的“参考资料”中的URL，就是对应的文档地址：http://wiki.opscode.com/display/chef/Resources#Resources-Service
具体内容很多，我们可以通过右侧的目录结构来理清思绪。

总共有差不多30个模块，每一个都有相应的示例。
最常用的有：
账号管理方面 Group,User
配置文件方面 Template,File,
脚本命令方面 Script,Execute
系统服务方面 Cron,Service,Mount,Package

这些模块的具体用法，都可以在上面的页面中找到，在这里我先就不描述了，接下来我们通过实践来理解它们。

3. 规划接下来要做的事情
以我的实际生产环境中遇到的情况为例，操作系统为Ubuntu,有以下几个任务要完成：
1.新建一个名为project的用户组，并将之前创建的用户ubuntu添加到该组
2.更改系统默认的APT镜像源为http://old-releases.ubuntu.com
3.通过apt-get安装build-essential
4.编译安装pcre 8.10

这一次，我们不再到官方社区去搜寻第三方的cookbook，而是自己来编写一个cookbook。

3.1 首先，来设计这个cookbook
将cookbook命名为mycookbook
然后分别创建4个不同的recipe，分别命名为
conf_group, conf_sources.list, install_build-essential, build_pcre
来实现对以上4个任务的完成

3.2 开始编写cookbook
3.2.1 创建cookbook
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook create mycookbook

 
** Creating cookbook mycookbook
** Creating README for cookbook: mycookbook
** Creating CHANGELOG for cookbook: mycookbook
** Creating metadata for cookbook: mycookbook

ubuntu@chef-workstation:/opt/chef-local$ cd cookbooks/mycookbook/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ ls

 
CHANGELOG.md  README.md  attributes  definitions  files  libraries  metadata.rb  providers  recipes  resources  templates

ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ cd recipes/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ls

 
default.rb

3.2.2 创建recipe conf_group
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_group.rb

 
group "project" do
  gid 999
  members [ 'ubuntu' ]
end

3.2.3 创建recipe conf_sources.list
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_sources.list.rb

 
execute "update" do
  command "sudo apt-get update"
  action :nothing
end

template "/etc/apt/sources.list" do
  source "sources.list.erb"
  mode 0644
  owner "root"
  group "root"
  notifies :run, "execute[update]", :immediately
end

ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../templates/default/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ sudo vim sources.list.erb 

 
# Generated by Chef for <%= node['fqdn'] %>
deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse

3.2.4 创建recipe install_build-essential
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ cd ../../recipes/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim install_build-essential.rb

 
package "build-essential" do
  action :install
end

3.2.5 创建recipe build_pcre
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim build_pcre.rb

 
script "build_pcre" do
  interpreter "bash"
  user "root"
  cwd "/tmp"
  not_if "test -f /usr/local/bin/pcregrep"
  code <<-EOH
  wget http://nchc.dl.sourceforge.net/project/pcre/pcre/8.10/pcre-8.10.tar.gz
  tar zxvf pcre-8.10.tar.gz
  cd pcre-8.10
  ./configure
  make
  make install
  EOH
end

3.3 更新并应用编写的cookbook
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ll

 
total 28
drwxr-xr-x  2 root root 4096 Jan  6 18:30 ./
drwxr-xr-x 10 root root 4096 Jan  6 18:11 ../
-rw-r--r--  1 root root  305 Jan  6 18:30 build_pcre.rb
-rw-r--r--  1 root root   56 Jan  6 18:17 conf_group.rb
-rw-r--r--  1 root root  234 Jan  6 18:19 conf_sources.list.rb
-rw-r--r--  1 root root  136 Jan  6 18:11 default.rb
-rw-r--r--  1 root root   51 Jan  6 18:24 install_build-essential.rb

上传cookbook
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo knife cookbook upload mycookbook

 
Uploading mycookbook     [0.1.0]
Uploaded 1 cookbook.

查看当前role配置文件
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../../../roles/
ubuntu@chef-workstation:/opt/chef-local/roles$ ls

 
README.md  ubuntu_servers.rb

ubuntu@chef-workstation:/opt/chef-local/roles$ cat ubuntu_servers.rb 

 
name "ubuntu_servers"
description "The base role applied to all nodes."
run_list(
    "recipe[user]",
    "recipe[user::data_bag]",
    "recipe[openssh]"
)
override_attributes(
    "users" => [ "ubuntu" ]
)

更新role配置文件
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu_servers.rb 

 
name "ubuntu_servers"
description "The base role applied to all nodes."
run_list(
    "recipe[user]",
    "recipe[user::data_bag]",
    "recipe[openssh]",
    "recipe[mycookbook::conf_group]",
    "recipe[mycookbook::conf_sources.list]",
    "recipe[mycookbook::install_build-essential]",
    "recipe[mycookbook::build_pcre]"
)
override_attributes(
    "users" => [ "ubuntu" ]
)

上传role配置文件
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife role from file ubuntu_servers.rb 

 
Updated Role ubuntu_servers!

查看节点
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node list

 
  chef-client-1
  chef-server

更新节点run_list
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node run_list add chef-client-1 "role[ubuntu_servers]"

 
run_list:  role[ubuntu_servers]

3.4 在节点上应用新的cookbook
ubuntu@chef-client-1:~$ sudo chef-client

 
INFO: *** Chef 10.16.2 ***
INFO: Run List is [role[ubuntu_servers]]
INFO: Run List expands to [user, user::data_bag, openssh, mycookbook::conf_group, mycookbook::conf_sources.list, mycookbook::install_build-essential, mycookbook::build_pcre]
INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
INFO: Starting Chef Run for chef-client-1
INFO: Running start handlers
INFO: Start handlers complete.
INFO: Loading cookbooks [mycookbook, openssh, user]
INFO: Storing updated cookbooks/openssh/recipes/default.rb in the cache.
INFO: Storing updated cookbooks/openssh/attributes/default.rb in the cache.
INFO: Storing updated cookbooks/openssh/.gitignore in the cache.
INFO: Storing updated cookbooks/openssh/metadata.rb in the cache.
INFO: Storing updated cookbooks/openssh/README.md in the cache.
INFO: Storing updated cookbooks/openssh/LICENSE in the cache.
INFO: Storing updated cookbooks/openssh/CHANGELOG.md in the cache.
INFO: Storing updated cookbooks/openssh/metadata.json in the cache.
INFO: Storing updated cookbooks/openssh/Gemfile in the cache.
INFO: Storing updated cookbooks/openssh/CONTRIBUTING in the cache.
INFO: Storing updated cookbooks/user/resources/account.rb in the cache.
INFO: Storing updated cookbooks/user/providers/account.rb in the cache.
INFO: Storing updated cookbooks/user/recipes/data_bag.rb in the cache.
INFO: Storing updated cookbooks/user/recipes/default.rb in the cache.
INFO: Storing updated cookbooks/user/attributes/default.rb in the cache.
INFO: Storing updated cookbooks/user/Rakefile in the cache.
INFO: Storing updated cookbooks/user/CHANGELOG.md in the cache.
INFO: Storing updated cookbooks/user/README.md in the cache.
INFO: Storing updated cookbooks/user/metadata.rb in the cache.
INFO: Storing updated cookbooks/user/metadata.json in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/build_nginx.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/conf_group.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/conf_sources.list.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/default.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/install_build-essential.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/build_pcre.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/README.md in the cache.
INFO: Storing updated cookbooks/mycookbook/metadata.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/CHANGELOG.md in the cache.
INFO: Processing user_account[ubuntu] action create (user::data_bag line 36)
INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
INFO: user[ubuntu] created
INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: directory[/home/ubuntu/.ssh] created directory /home/ubuntu/.ssh
INFO: directory[/home/ubuntu/.ssh] owner changed to 1001
INFO: directory[/home/ubuntu/.ssh] group changed to 109
INFO: directory[/home/ubuntu/.ssh] mode changed to 700
INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: directory[/home/ubuntu] mode changed to 2755
INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
INFO: template[/home/ubuntu/.ssh/authorized_keys] updated content
INFO: template[/home/ubuntu/.ssh/authorized_keys] owner changed to 1001
INFO: template[/home/ubuntu/.ssh/authorized_keys] group changed to 109
INFO: template[/home/ubuntu/.ssh/authorized_keys] mode changed to 600
INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148)
INFO: Processing package[openssh-client] action install (openssh::default line 27)
INFO: Processing package[openssh-server] action install (openssh::default line 27)
INFO: Processing service[ssh] action enable (openssh::default line 30)
INFO: service[ssh] enabled
INFO: Processing service[ssh] action start (openssh::default line 30)
INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 48)
INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20130106190629
INFO: template[/etc/ssh/ssh_config] updated content
INFO: template[/etc/ssh/ssh_config] owner changed to 0
INFO: template[/etc/ssh/ssh_config] group changed to 0
INFO: template[/etc/ssh/ssh_config] mode changed to 644
INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 66)
INFO: template[/etc/ssh/sshd_config] backed up to /var/chef/backup/etc/ssh/sshd_config.chef-20130106190629
INFO: template[/etc/ssh/sshd_config] updated content
INFO: template[/etc/ssh/sshd_config] owner changed to 0
INFO: template[/etc/ssh/sshd_config] group changed to 0
INFO: template[/etc/ssh/sshd_config] mode changed to 644
INFO: Processing group[project] action create (mycookbook::conf_group line 1)
INFO: group[project] created
INFO: Processing execute[update] action nothing (mycookbook::conf_sources.list line 1)
INFO: Processing template[/etc/apt/sources.list] action create (mycookbook::conf_sources.list line 6)
INFO: template[/etc/apt/sources.list] backed up to /var/chef/backup/etc/apt/sources.list.chef-20130106190629
INFO: template[/etc/apt/sources.list] updated content
INFO: template[/etc/apt/sources.list] owner changed to 0
INFO: template[/etc/apt/sources.list] group changed to 0
INFO: template[/etc/apt/sources.list] mode changed to 644
INFO: template[/etc/apt/sources.list] sending run action to execute[update] (immediate)
INFO: Processing execute[update] action run (mycookbook::conf_sources.list line 1)
INFO: execute[update] ran successfully
INFO: Processing package[build-essential] action install (mycookbook::install_build-essential line 1)
INFO: Processing script[build_pcre] action run (mycookbook::build_pcre line 1)
INFO: script[build_pcre] ran successfully
INFO: template[/etc/ssh/sshd_config] sending restart action to service[ssh] (delayed)
INFO: Processing service[ssh] action restart (openssh::default line 30)
INFO: service[ssh] restarted
INFO: Chef Run complete in 448.775004685 seconds
INFO: Running report handlers
INFO: Report handlers complete

ubuntu@chef-client-1:/etc$

通过以上输出，我们可以很清晰的看到每个recipe的执行过程，并且全部都成功执行了。

我们通过以下方式来一一校验:
ubuntu@chef-client-1:~$ id ubuntu

 
uid=1001(ubuntu) gid=109(admin) groups=109(admin),999(project)

ubuntu@chef-client-1:~$ cat /etc/apt/sources.list

 
# Generated by Chef for chef-client-1
deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse

ubuntu@chef-client-1:~$ dpkg -l | grep build-essential

 
ii  build-essential                 11.5                              Informational list of build-essential packages

ubuntu@chef-client-1:~$ which pcregrep

 
/usr/local/bin/pcregrep

通过以上校验，再次证明所有的任务都已经执行了。
我们成功的完成了cookbook的自定义配置。

4. 更多深入的功能
至此，我们已经具备了一定的编写cookbook的能力了。
下面我分享一些比较有价值的经验：

4.1 安装官方社区的cookbook chef-client 可以实现客户端的定时自动拉取服务端配置，默认30分钟一次，具体时间可配置
Tips:
---
$ sudo knife cookbook site install chef-client

通过以下方式引用：

 
    "recipe[chef-client::delete_validation]",
    "recipe[chef-client::config]",
    "recipe[chef-client::service]",

4.2 改造cookbook openssh
Tips:
---
直接将系统的/etc/ssh/sshd_config 复制成为模板文件sshd_config.erb
然后仅将需要自定义的参数修改为从attributes中读取，如：

 
PasswordAuthentication <%= node['openssh']['server']['password_authentication'] %>
UseDNS <%= node['openssh']['server']['use_dns'] %>

同样，我们也可以自己来写attributes文件，实现参数的功能。

4.3 在role文件中重新定义参数值
Tips:
---
通过override_attributes可以直接定义参数的值，实现不同role采用不同的参数。
例如，针对官方社区的sudo的配置，可以通过以下方式重新定义参数的值：

默认的参数值：

 
default['authorization']['sudo']['groups'] = Array.new
default['authorization']['sudo']['users'] = Array.new
default['authorization']['sudo']['passwordless'] = false
default['authorization']['sudo']['include_sudoers_d'] = false
default['authorization']['sudo']['agent_forwarding'] = false

在role文件中重新定义后的值：

 
override_attributes(
    "authorization" => {
      "sudo" => {
        "groups" => ["admin"],
        "passwordless" => true,
        "users" => ["zabbix"]
      }
    }
)

5. 至此，整个系列的文章可以告一段落了
用一句很2的话来说，就是，我只能帮你到这儿了。接下来，通过参考官方文档，以及实践中的更多应用，我们就能够更加熟练的掌握Chef这个强大的集中管理工具，再多的服务器在我们的手里也能管理的井然有序。


原文：http://heylinux.com/archives/2175.html

翟海飞
关注
  • 0
    点赞
  • 踩
  • 7
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
开发小工具集
11-08
8. **自动化工具**：例如Ansible用于配置管理和部署，Puppet或Chef也有类似功能，它们可以自动化服务器的设置和维护。 9. **包管理器**：npm（Node.js）、pip（Python）、Composer（PHP）等，方便安装、升级和管理...
节点管理(1).zip
09-21
配置管理工具如Ansible、Chef或Puppet允许集中化管理和更新节点的配置，确保一致性。 3. **状态监控**：监控节点的资源利用率（CPU、内存、磁盘、网络）、性能指标和错误日志，有助于及时发现和解决问题。工具如...
自动化运维工具比较：Ansible vs. Puppet vs. Chef
禅与计算机程序设计艺术
01-07 844
1.背景介绍 自动化运维工具是现代软件开发和运维中不可或缺的一部分。随着云计算和大数据技术的发展，自动化运维工具的需求也不断增加。Ansible、Puppet和Chef是三种流行的自动化运维工具，它们各自具有不同的优势和局限性。在本文中，我们将对这三种工具进行详细比较，以帮助读者更好地理解它们的特点和适用场景。 2.核心概念与联系 2.1 Ansible Ansible是一种基于Pytho...
44学习自动化运维工具 Chef 的基本用法，包括厨师编写、节点管理
玩机科技社的博客
04-02 4164
Chef是一种自动化运维工具，它允许您定义基础设施的状态，并根据需要管理这些状态。在这里，我们将学习Chef的基本用法，包括如何编写和管理Cookbook和Node。
Chef - 自动化基础设施管理工具
最新发布
gitblog_00007的博客
03-07 384
Chef - 自动化基础设施管理工具 Chef 是一个开源的自动化平台，用于简化 DevOps 流程中的各种任务。它帮助您将基础设施视为代码，并使用简洁的 DSL（领域特定语言）进行部署、配置和管理。 Chef 的功能与用途 Chef 提供了一种声明式的模型，使您可以轻松地描述期望的状态。通过使用 Chef，您可以： 自动化跨多个云和本地环境的应用程序部署 配置服务器并保持其在最佳状态 管理庞大...
Chef是什么
SYC20110120的博客
10-06 101
Chef是一种基于Ruby编程语言的自动化配置管理工具，用于自动化部署、管理和配置服务器和应用程序。它采用“基础设施即代码”的理念，将服务器配置和管理视为代码，使用代码自动化工具进行部署和管理，从而提高效率、可靠性和一致性。Chef主要包括三个组件：Chef Server、Chef Client和Chef Workstation。Chef Server是管理节点，用于管理节点和Chef Client的配置信息；Chef Client是被管理节点，用于执行Chef Server发送的指令；
使用 Chef 自动化部署一个 Web 服务器
drcwr的专栏
08-02 2993
http://www.ibm.com/developerworks/cn/cloud/library/1506_wangqf_chefforweb/index.html “这是一个最好的时代，也是一个最坏的时代。他们都在直奔天堂，而我们都在直奔相反的方向。” “90 后霸道总裁”的超级课程表融资千万美元、WhatsApp 被 Facebook 以 190 亿美元收购……这个时代仿佛
自动化运维建设实践.pptx
10-13
Puppet注重声明式配置管理，Chef强调编程式配置，Ansible则以简洁的YAML语法和无需代理的特性受到欢迎，而Saltstack以其高速的执行效率和灵活的架构脱颖而出。除此之外，定制化工具如bash、sed、awk等在特定场景下也...
运维自动化工具
05-09
自动化运维离不开各种配置管理工具的支持，这些工具可以帮助运维人员实现对服务器配置的集中管理和自动化部署。 - **配管工具的选择**：在选择配管工具时，需要考虑的因素包括工具的灵活性、易用性以及是否支持特定...
code_chef：CodeChef问题的解决方案
02-12
- **C风格字符串**：char数组，使用注意事项包括长度管理和内存管理。 8. **模板**： 在解决CodeChef问题时，可以编写通用的模板代码，例如输入输出模板，以便快速适应不同问题的需求。 9. **预处理指令**： - ...
IT团队自动化端点管理解决方案—基于虹科Chef工具
hongcloudtech的博客
12-18 707
如何自动化管理工作流？如何减轻IT工作者的负担？如何让IT人员集中精力处理难度更大的问题？答案是从企业自动化工具入手！
Chef是一个什么样的工具
无锋剑
01-11 236
Chef是一个什么样的工具想像一下我们现在需要搭建一台mysql  database  slave服务器，安装过程我们手动操作了没过多久，我们需要第二台，这时候我们会想，如果之后安装第一台的时候把操作过程执行的命令写成脚本现在安装第二台，运行一下脚本就行了，节约时间而且不容易出错chef就相当于这样的一个脚本管理工具，但功能要强大得多，可定制性强chef将脚本命令代码化，定制时只需要修改代码，安装...
Chef 环境的安装及使用
yine的专栏
08-20 3320
官方地址 (http://docs.getchef.com/install_server.html) Chef 环境的安装步骤一般是：先安装 Chef Server，然后配置 Chef Workstation, 最后根据需要在客户端机器上安装 Chef Client 并将其注册成 Chef Node。Chef Server 和 Chef Workstation 可以配在一台机器上，也可以分开
运维管理工具的对比Puppet、Chef、Ansible和SaltStack、Fabric
热门推荐
直到世界的尽头
04-29 4万+
我们发现分布式是一个发展的趋势，无论是大型网站的负载均衡架构还是大数据框架部署，以及云存储计算系统搭建都离不开多台服务器的连续部署和环境搭建。 当我们的基础架构是分散式或者基于云的，并且我们经常需要处理在大部分相同的服务器上频繁部署大致相同的服务时，我们就应该考虑自动化配置和维护了。 让用户极容易配置和维护数十台、数百台、乃至数千台服务器。 幸运的是，现在有很多运维管理工具是为此目的而设计的...
[1] DevOps 自动化运维工具Chef----入门
超越梦想，一起飞！！！
09-16 7667
最近在学习Chef， Chef 就是现在比较热门的自动化运维工具之一，其他的工具还有Ansible, Puppet, SaltStack. 为什么选择Chef，是因为Chef对Window的支持非常的好。 Chef的官方网站，https://www.chef.io/. 其当前最新的版本信息如下， Chef Server版本是chef-server-core_12.8.0 Chef client的版本chef-client-12.13.37 chef 管理台的版本是chef-manage_2.4.3 ch
[13] DevOps 自动化运维工具Chef----用chef-apply命令单机运行Chef配方（Receipt）
超越梦想，一起飞！！！
06-14 2914
前面的12篇文章唠唠叨叨了如何安装Chef，如何查看Chef的数据库的密码，就是没有分享如何跑一个简单的Chef的配方去完成一项任务。这篇文章的目的就是让大家见识一下如何用Chef执行一个简单的任务。安装好Chef客户端之后，就会有一个chef-apply的命令行工具。Chef-apply是在Chef-solo的工具的基础之上建立的一个小工具。而Chef-solo可以让我们在没有Chef服务器的情况下本地运行Chef代码。Chef-apply基于Chef-solo并被设计为可以很方便的应用.rb文件中的Ch
[15] DevOps 自动化运维工具Chef----chef-apply, chef-client,chef-zero,chef-solo区别
超越梦想，一起飞！！！
06-19 3067
在使用Chef的时候，经常会遇到下面这些比较容易混淆的概念和命令：chef-apply, chef-client,chef-zero,chef-solo； 那么这四个命令到底有什么区别呢？
[7]DevOps 自动化运维工具Chef---如何安装Chef的Report？
超越梦想，一起飞！！！
09-22 2143
Chef Report是一个非常有用的功能，它能检测所有的chef节点的任务执行情况： 成功，失败，终止。 而且能记录客户端节点的执行情况。Chef report的最低执行版本如下： Chef server 12 chef-client version 11.6.0 (or later)
简单写写Chef的安装配置和使用
qq_44370158的博客
06-26 255
Chef使用自定义的DSL（Domain Specific Language）编写代码，可以使用Chef的IDE或其他编辑器编写Chef代码。Chef是一款开源的配置管理工具，可以自动化管理和部署服务器上的软件和配置。在进行Chef的安装之前，需要确保系统已安装Ruby和RubyGems。需要注意的是，在使用Chef进行自动化管理时，需要仔细考虑安全性和可靠性，并进行适当的测试和验证。注册完成后，Chef服务器将自动管理和更新Chef节点上的软件和配置。是Chef代码文件的路径。是Chef服务器的主机名，
Ansible、Chef、Puppet和SaltStack：配置管理工具全面比较
Chef同样是一款集中式的配置管理工具，它使用Ruby编写，提供模块化和可重复使用的资源，支持多种操作系统。它的架构设计允许灵活地定义和管理基础设施配置，包括自动安装软件包、配置服务和数据包。与Puppet类似，...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值