建站
咨詢
售后
建站咨詢
新聞中心
Chef是一個(gè)IT基礎(chǔ)設(shè)施自動(dòng)化軟件，它可以管理你組織中所有的服務(wù)器和網(wǎng)絡(luò)設(shè)備。當(dāng)我們想與Chef服務(wù)器、任何物理節(jié)點(diǎn)（服務(wù)器、網(wǎng)絡(luò)設(shè)備等）的基礎(chǔ)設(shè)施進(jìn)行交互時(shí)，我們需要一個(gè)Chef工作站。本教程解釋如何安裝和配置Linux服務(wù)器上Chef工作站。
使用以下命令下載ChefDK
在CentOS 7上
cd ~
wget https://packages.chef.io/stable/el/7/chefdk-0.11.2-1.el7.x86_64.rpm
在CentOS 6上
cd ~
wget https://packages.chef.io/stable/el/6/chefdk-0.11.2-1.el6.x86_64.rpm
安裝 ChefDK
使用RPM安裝剛剛下載的ChefDK
# rpm -ivh chefdk-0.11.2-1.el7.x86_64.rpm
Preparing... ################################# [100%]
Updating / installing...
1:chefdk-0.11.2-1.el7 ################################# [100%]
Thank you for installing Chef Development Kit!
ChefDK默認(rèn)安裝到/opt/chefdk目錄下，如下所示
# ls -l /opt/chefdk/
drwxr-xr-x. 2 root root 4096 Mar 3 13:50 bin
drwxr-xr-x. 7 root root 62 Mar 3 13:50 embedded
-rw-r--r--. 1 root root 13249 Feb 22 14:26 version-manifest.json
-rw-r--r--. 1 root root 8233 Feb 22 14:26 version-manifest.txt
驗(yàn)證ChefDK的安裝
執(zhí)行chef verify，驗(yàn)證所有來自ChefDK的不同組件，確保他們都工作正常，沒有任何問題
# chef verify
Running verification for component 'berkshelf'
Running verification for component 'test-kitchen'
Running verification for component 'tk-policyfile-provisioner'
Running verification for component 'chef-client'
Running verification for component 'chef-dk'
Running verification for component 'chef-provisioning'
Running verification for component 'chefspec'
Running verification for component 'generated-cookbooks-pass-chefspec'
Running verification for component 'rubocop'
Running verification for component 'fauxhai'
Running verification for component 'knife-spork'
Running verification for component 'kitchen-vagrant'
Running verification for component 'package installation'
Running verification for component 'openssl'
Running verification for component 'inspec'
.......
---------------------------------------------
Verification of component 'test-kitchen' succeeded.
Verification of component 'chef-dk' succeeded.
Verification of component 'chefspec' succeeded.
Verification of component 'rubocop' succeeded.
Verification of component 'knife-spork' succeeded.
Verification of component 'openssl' succeeded.
Verification of component 'berkshelf' succeeded.
Verification of component 'chef-client' succeeded.
Verification of component 'fauxhai' succeeded.
Verification of component 'inspec' succeeded.
Verification of component 'tk-policyfile-provisioner' succeeded.
Verification of component 'kitchen-vagrant' succeeded.
Verification of component 'chef-provisioning' succeeded.
Verification of component 'package installation' succeeded.
Verification of component 'generated-cookbooks-pass-chefspec' succeeded.
下面是chef verify失敗的案例。注意：Ruby在Chef中是必須的，它被嵌入在了ChefDK中。
# chef verify
..
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/mixlib-shellout-2.2.6/lib/mixlib/shellout.rb:289:in `invalid!': Expected process to exit with [0], but received '1' (Mixlib::ShellOut::ShellCommandFailed) ---- Begin output of /usr/bin/ohai -v ---- STDOUT: STDERR: /opt/chefdk/embedded/lib/ruby/site_ruby/2.1.0/rubygems/dependency.rb:319:in `to_specs': Could not find 'chef-config' (= 12.8.0) - did find: [chef-config-12.7.2] (Gem::LoadError)
以上錯(cuò)誤信息顯示：“Could not find ‘chef-config’ (= 12.8.0) – did find: [chef-config-12.7.2] (Gem::LoadError)”，在安裝的ChefDK中chef-config的版本是12.7.2的舊版本，在手動(dòng)安裝chef-confg 12.8.0版本后再執(zhí)行chef verify，顯示驗(yàn)證成功。
驗(yàn)證ChefDK版本
執(zhí)行 chef -version命令，顯示ChefDK的版本號以及所有附帶組件
# chef --version
Chef Development Kit Version: 0.11.2
chef-client version: 12.7.2
berks version: 4.2.0
kitchen version: 1.5.0
設(shè)置Chef 環(huán)境變量
設(shè)置Chef相關(guān)的環(huán)境變量，如：GEM_ROOT GEM_HOME GEM_PATH。
export GEM_ROOT="/opt/chefdk/embedded/lib/ruby/gems/2.1.0"
export GEM_HOME="/root/.chefdk/gem/ruby/2.1.0"
export GEM_PATH="/root/.chefdk/gem/ruby/2.1.0:/opt/chefdk/embedded/lib/ruby/gems/2.1.0"
此外，如果你的系統(tǒng)上已經(jīng)安裝了ruby，你需要更新與ruby相關(guān)的PATH變量，如下所示
export PATH="/opt/chefdk/bin:/root/.chefdk/gem/ruby/2.1.0/bin:/opt/chefdk/embedded/bin:/opt/chefdk/bin:/root/.chefdk/gem/ruby/2.1.0/bin:/opt/chefdk/embedded/bin:/opt/chefdk/bin:/root/.chefdk/gem/ruby/2.1.0/bin:/opt/chefdk/embedded/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin"
顯示所有Chef設(shè)置的環(huán)境變量。
chef shell-init bash
想要快速設(shè)置這些環(huán)境變量，可以將其添加到bash_profile文件中，如下所示。
echo 'eval "$(chef shell-init bash)"' >> ~/.bash_profile
訪問Chef的Firewalld規(guī)則
為了訪問Chef服務(wù)器上的Chef Manage GUI，添加以下firewalld規(guī)則，開放Chef服務(wù)器上的相應(yīng)端口。
firewall-cmd --direct --add-rule ipv4 \
filter INPUT_direct 0 -i eth0 -p tcp \
--dport 443 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 \
filter INPUT_direct 0 -i eth0 -p tcp \
--dport 80 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 \
filter INPUT_direct 0 -i eth0 -p tcp \
--dport 9683 -j ACCEPT
firewall-cmd --reload
從Chef Manage GUI下載Starter Kit
登錄到Chef Manage GUI，單擊“Administration”選項(xiàng)，從列表中選擇“organization”。此例中，“organization”為“example”，選中organization之后，點(diǎn)擊左側(cè)菜單中的“Starter Kit”。
按下“Download（下載）”按鈕之后，會(huì)跳出一個(gè)警告信息，按下“Proceed”，它會(huì)將chef-starter.zip文件下載到本地機(jī)器。
解壓縮 Starter Kit
將chef-starter.zip文件傳輸?shù)紺hef工作站并解壓到root的home目錄下
# cd ~
# unzip chef-starter.zip
Archive: chef-starter.zip
creating: chef-repo/cookbooks/
creating: chef-repo/cookbooks/starter/
creating: chef-repo/cookbooks/starter/templates/
creating: chef-repo/cookbooks/starter/templates/default/
inflating: chef-repo/cookbooks/starter/templates/default/sample.erb
creating: chef-repo/cookbooks/starter/files/
creating: chef-repo/cookbooks/starter/files/default/
inflating: chef-repo/cookbooks/starter/files/default/sample.txt
creating: chef-repo/cookbooks/starter/recipes/
inflating: chef-repo/cookbooks/starter/recipes/default.rb
creating: chef-repo/cookbooks/starter/attributes/
inflating: chef-repo/cookbooks/starter/attributes/default.rb
inflating: chef-repo/cookbooks/starter/metadata.rb
inflating: chef-repo/cookbooks/chefignore
inflating: chef-repo/README.md
inflating: chef-repo/.gitignore
creating: chef-repo/.chef/
creating: chef-repo/roles/
inflating: chef-repo/.chef/knife.rb
inflating: chef-repo/roles/starter.rb
inflating: chef-repo/.chef/ramesh.pem
inflating: chef-repo/.chef/example-validator.pem
如果你手動(dòng)創(chuàng)建了chef-repo文件夾，那你就需要手動(dòng)創(chuàng)建上述的子目錄，復(fù)制knife.rb文件、organization-validator.pem文件（如：example-validator.pem）、username.pem文件（如：ramesh.pem）到上面顯示的目錄中。
Chef服務(wù)器的SSL證書
在這個(gè)階段如果執(zhí)行knife client list會(huì)得到以下錯(cuò)誤信息
# cd ~/chef-repo
# knife client list
ERROR: SSL Validation failure connecting to host: centos.example.com - SSL_connect returned=1 errno=0 state=error: certificate verify failed
ERROR: Could not establish a secure connection to the server.
Use `knife ssl check` to troubleshoot your SSL configuration.
If your Chef Server uses a self-signed certificate, you can use
`knife ssl fetch` to make knife trust the server's certificates. Original Exception: OpenSSL::SSL::SSLError: SSL Error connecting to https://centos.example.com/organizations/example/clients - SSL_connect returned=1 errno=0 state=error: certificate verify failed 證書驗(yàn)證失敗，因?yàn)槲覀儧]有從Chef服務(wù)器下載SSL證書，此時(shí)可以執(zhí)行以下“knife ssl fetch”。
# cd ~/chef-repo
# knife ssl fetch
WARNING: Certificates from centos.example.com will be fetched and placed in your trusted_cert
directory (/root/chef-repo/.chef/trusted_certs).
Knife has no means to verify these are the correct certificates. You should
verify the authenticity of these certificates after downloading.
證書將會(huì)下載到以下truster_certs目錄中
# ls -l /root/chef-repo/.chef/trusted_certs
-rw-r--r--. 1 root root 1379 Mar 20 20:17 centos_example_com.crt
# cat /root/chef-repo/.chef/trusted_certs/centos_example_com.crt
-----BEGIN CERTIFICATE-----
MIIDzDCCArSgAwIBAgIBADANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJVUzEQ
MA4GA1UECgwHWW91Q29ycDETMBEGA1UECwwKT3BlcmF0aW9uczEbMBkGA1UEAwwS
ZXJhdGlvbnMxGzAZBgNVBAMMEmNlbnRvcy5leGFtcGxlLmNvbTCCASIwDQYJKoZI
..
..
WLyr2ORLMcck/OGsubabO/koMNTqhl2JJPECNiDJh06MeZ/2+BOwGZSpXDbw+vFE
NJAsLfsTzihGWZ58einMFA==
-----END CERTIFICATE-----
Chef工作站的最終確認(rèn)
如果Chef工作站工作正常，當(dāng)你執(zhí)行“knife client list”時(shí)，它會(huì)顯示所有連接工作站的客戶端。由于我們剛剛安裝它，因此只能看到剛剛我們創(chuàng)建的組織（organization）
# cd ~/chef-repo
# knife client list
example-validator
如果你現(xiàn)有的Chef工作站機(jī)器上已經(jīng)有5個(gè)服務(wù)器連接到它了，你會(huì)看到以下信息
# knife client list
example-validator
node1
node2
node3
node4
node5
網(wǎng)頁名稱：CentOS中安裝Cheff工作站
本文地址：http://www.dlmjj.cn/article/djegepc.html
