pburkholder

Join the DevOpsDC planning sessions!

• Two weeks after each DevOpsDC meeting
• Google Hangout (Time TBD based on availability)
• What do you see for 2015 & DevOpsDC?
• Tweet #planning to @devopsdc or leave a message at MeetUp

-- Accompanying text: Nathen and Peter have found the offers for help w/ DevOpsDC to be really heartening and we recognize that more participation will be a good thing

pburkholder

Manual install

GCE project cheffian-supermarket

chefserver

Install and configure api_fqdn:

apt-get update

curl https://packagecloud.io/install/repositories/chef/stable/script.deb | bash

pburkholder

Notes

ssl testing

Even with ssl.verify off, berks install or berks vendor will fail when supermarket is using a self-signed certificate. So, how do we get around that?

Note: I hacked my /etc/hosts to resolve supermarket-0.c.cheffian-supermarket.internal

Get the CERT

pburkholder

aws ec2 describe-subnets --filter "Name=tag:Name,Values=isa-w2a"

aws ec2 describe-vpcs  --filter "Name=tag:Name,Values=chef_ha_vpc"

aws ec2 describe-internet-gateways --filter "Name=tag:Name,Values=chef_ha_vpc"

aws ec2 detach-internet-gateway --internet-gateway-id igw-bb7daade --vpc-id vpc-4dea4228

aws ec2 delete-internet-gateway --internet-gateway-id igw-bb7daade

pburkholder

Create the following folder structure in your cookbook:

test
└── integrationq
    ├── helpers
    │   ├── serverspec
    │   │   ├── shared_serverspec_tests
    │   │   │   └── shared_tests2.rb
    │   │   └── spec_helper.rb

pburkholder

Follow Up Questions/Discussion for whomever (re: Policyfiles)

What's the Current Security Update Worflow Like?

The web side of the company is doing something like the environment cookbook pattern, where each rev of an application has its own environment, and there ~150 apps. If I'm understanding this correctly, that means there are maybe ~500-1000 environments. So how does a heartbleed-type fix get rolled out? Just overwrite the existing cookbook? Iterate over the environments and update them with the new

pburkholder

Here's some of my thinking attributes:

• use default levels, except when you can't

• think of attributes in two ways

  • as the interface to the cookbook
  • as attributes of the node (not as variable in the cookbook)
    • e.g. node.network.ip - is a fact about the node
    • node.users.sudoers - is an attribute you are setting because you want it to be a fact

• avoid ruby logic in attributes/default.rb

pburkholder

openssl s_client -connect chefserver.com:443 -showcerts 2>/dev/null </dev/null | openssl x509 -outform PEM > /etc/chef/chef_server.pem

chmod 444 /etc/chef_server.pem

cat <<END>>/etc/chef/client.rb
ssl_ca_file '/etc/chef/cheef_server.pem'
END

pburkholder

chef-server-ctl install opscode-manage fails with undefined method uri' for LWRP resource apt_repository from cookbook apt`

chef-server 12.0.7 updated to 12.1.1 ubuntu 14.04

pburkholder

launch powershell with admin privileges 
run:

Install-Package -name git -provider chocolatey
Install-Package -name chefdk -minimumVersion 0.6.0.1 -provider chocolatey
Install-Package -name atom -provider chocolatey

Open powershell window as user

apm install linter