Table of Contents:
Table of Contents |
---|
...
Introduction
Chef is a configuration management tool (like Puppet, Ansible, SaltStack, CFEngine). It is a tool which manages the configuration of centrally managed Linux servers, compute clusters, and desktops at SLAC. Examples of configuration items Chef manages include: sudo privileges, login access privileges, logging, software repositories, cronjobs, baseline security configuration. Chef is the configuration management tool for CentOS 7 and later, Red Hat Enterprise Linux (RHEL) 7 and later, and Ubuntu 16.04 and later. Operating systems earlier than those (RHEL 5 and 6, Solaris) are centrally managed using Taylor (a locally written configuration management tool).
Installing Chef
To get Chef installed on a SLAC owned Linux server, contact unix-admin@slac.stanford.edu . To get Chef installed on a SLAC owned Linux desktop, contact ithelp@slac.stanford.edu .
...
Code Block | ||
---|---|---|
| ||
ssh loghost grep -w chef-client /u2/today/SYSLOG/daemon |
Directories with Chef information, and some useful Chef commands:
/var/chef/cache/cookbooks/ | This directory contains the cookbooks downloaded from the chef server. |
/var/chef/cache/backup/ | This directory contains backup files of any changes made by chef. |
sudo -i /root/knife-node-show | This script will show configuration details for the current host. |
/afs/slac/g/scs/systems/report/chef/system.info/ | This directory contains information about each host managed by chef |
Common configuration options
(this is a work in progress....)
Configuration Item | Chef attribute name for this item | Notes | How to enable it |
---|---|---|---|
sudo access | authorization.sudo.users | Request sudo access using this form: https://www.slac.stanford.edu/comp/unix/auth/superuser-req.shtml | |
restrict local login access | limit_login | ||
do not update the default boot kernel | kernel_updatedefault | ||
home directory location | override_homedir | The default home directory location is /home (local to the host). The home directory listed in the LDAP directory service can be enabled instead. Be sure the directory services home directory location is actually available on this host first. | |
Steps to provide an OCIO admin full access to Chef
These are the steps to grant an OCIO admin full access to the Chef Infrastructure.
Note: for minimal access (eg, to create GitHub Pull Requests and GitHub Issues), just steps 1a and 1b are needed.
Everyone in unix-admin should have steps 1a and 1b done, and optionally all steps for full access.
- GitHub: Grant access to https://github.com/orgs/SLAC-CHEF organization
- Log into github as the admin for the SLAC-CHEF organization
- escrow -c systems display slac-chef-admin
- Invite the person using their github account on this page
- The default permission level for members of SLAC-CHEF is read-only
- this is so we can invite any SLAC user to be a member so they can collaborate with us
- add the unix-admin user to the scs-unix team on this page so they have write access to repos
- The unix-admin person should create an ssh key pair for github use if necessary
- Log into github as the admin for the SLAC-CHEF organization
- Chef Server: create account on Chef Server
- Log into https://chef01.slac.stanford.edu
- ...
- Automate Server: create account on Chef Automate 2 Server
- Log into https://chef-automate2.slac.stanford.edu
- ...
- Jenkins Server: create account on Jenkins Server
- escrow -c systems display chef-jenkins
- Log into http://chef-build01.slac.stanford.edu:8080
- ...
- Provide instructions on how to do the following:
- clone an existing cookbook, make a change, push changes to github, press the "approve" button on Jenkins
- create a new cookbook, with Jenkinsfile
- new github repo, with scs-unix team write access
- new jenkins project
- verify cookbook permissions on chef server (write access for jenkins user only)
- add cookbook to a role, if appropriate
- how to test changes on cookbook before pushing to production
- how to bypass Jenkins pipeline for emergencies (eg, Jenkins server is down)