vinyar

redbug Debugging on a live EC11 or Chef 12 Server

https://github.com/massemanet/eper/blob/master/doc/redbug.txt

Attach to the running erlang process on running EC11x or Chef 12 systems

/opt/opscode/embedded/bin/erl -name [email protected] -remsh [email protected] -setcookie erchef

Debug LDAP

vinyar

Why?

There is a long standing issue in Ruby where the net/http library by default does not check the validity of an SSL certificate during a TLS handshake. Rather than deal with the underlying problem (a missing certificate authority, a self-signed certificate, etc.) one tends to see bad hacks everywhere. This can lead to problems down the road.

From what I can see the OpenSSL library that Rails Installer delivers has no certificate authorities defined. So, let's go fetch some from the curl website. And since this is for ruby, why don't we download and install the file with a ruby script?

Installation

The Ruby Way! (Fun)

vinyar

12.5 style custom resources

This is by far the most recommended way of writing resources for all users. There are two gotchas which we're working through:

1. For helper functions that you used to write in your provider code or used to mixin to your provider code, you have to use an action_class do ... end block.
2. The 12.5 resources allow for a shorthand notation in provider code where you can refer to properties by their bare name my_property and it works most of the time. Since it does not work all the time (because of the way ruby scopes things), its recommended to stick to referring to properties by new_resource.my_property.

You cannot subclass, and must use mixins for code-sharing (which is really a best practice anyway -- e.g. see languages like rust which do not support subclassing).

in resources/whatever.rb:

vinyar

How do I set up compliance checks for an application or cookbook pipeline in delivery?

Delivery version: 0.4.109 or higher
Inspec version: 0.16.0 or higher

1) Create a compliance pipeline of a profile you are interested in, or use an existing one.

2) Configure the application or cookbook to depend on that profile.

vinyar

# Chef Bootstrap with Chef Vaults
# Required chef version: 12

# Single Vault Item
$ knife bootstrap node1 -N node1 --sudo -r 'recipe[cookbook::default]' --bootstrap-vault-item 'vault:item'

# Multiple Vault through JSON
$ knife bootstrap node1 -N node1 --sudo -r 'recipe[cookbook::default]' --bootstrap-vault-json {"vault1":"item1","vault2":"item2"}

# Multiple Vault through File

vinyar

bash -c '
<%= "export http_proxy=\"#{knife_config[:bootstrap_proxy]}\"" if knife_config[:bootstrap_proxy] -%>

yum install -y wget
wget <%= "--proxy=on " if knife_config[:bootstrap_proxy] %>http://rbel.co/rbel5
rpm -Uvh rbel5

yum install -y rubygem-chef
'

vinyar

If you want to check whether a node run_list includes a specific role (upon expansion), then you could use role? method on the Node object:

node.role?('name')

Alternatively, you can see whether either would work for you:

node.roles.include?('name')

node.run_list?('role[name]')

vinyar

{"ssl": {"verify": false}}

vinyar

### Method 1 ###
$ knife role from file roles/windows_web.rb \
  --key .chef-test_user/test_user.pem \
  --user test_user

Benefits:
 * Uses standard knife subcomands
 * Out of the box
Caveats: 
 * Requires the users private keys on the jenkins machine. 

vinyar

# Knife Configuration File.
#
# This is a Ruby DSL to set configuration parameters for Knife's
# general options. The default location for this file is
# ~/.chef/knife.rb. If multiple Chef repositories are used,
# per-repository configuration files can be created. A per repository
# configuration file must be .chef/knife.rb in the base directory of
# the Chef repository. For example,
#
#     ~/Development/chef-repo/.chef/knife.rb