pburkholder

# launch powershell with admin privileges 
# run:

# install chocolately
iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))
# update to WMF 5 & powershell version 5
choco upgrade powershell -pre 
# reboot machine

# launch powershell with admin privileges 

pburkholder

launch powershell with admin privileges 
run:

Install-Package -name git -provider chocolatey
Install-Package -name chefdk -minimumVersion 0.6.0.1 -provider chocolatey
Install-Package -name atom -provider chocolatey

Open powershell window as user

apm install linter

pburkholder

chef-server-ctl install opscode-manage fails with undefined method uri' for LWRP resource apt_repository from cookbook apt`

chef-server 12.0.7 updated to 12.1.1 ubuntu 14.04

pburkholder

openssl s_client -connect chefserver.com:443 -showcerts 2>/dev/null </dev/null | openssl x509 -outform PEM > /etc/chef/chef_server.pem

chmod 444 /etc/chef_server.pem

cat <<END>>/etc/chef/client.rb
ssl_ca_file '/etc/chef/cheef_server.pem'
END

pburkholder

Here's some of my thinking attributes:

• use default levels, except when you can't

• think of attributes in two ways

  • as the interface to the cookbook
  • as attributes of the node (not as variable in the cookbook)
    • e.g. node.network.ip - is a fact about the node
    • node.users.sudoers - is an attribute you are setting because you want it to be a fact

• avoid ruby logic in attributes/default.rb

pburkholder

Follow Up Questions/Discussion for whomever (re: Policyfiles)

What's the Current Security Update Worflow Like?

The web side of the company is doing something like the environment cookbook pattern, where each rev of an application has its own environment, and there ~150 apps. If I'm understanding this correctly, that means there are maybe ~500-1000 environments. So how does a heartbleed-type fix get rolled out? Just overwrite the existing cookbook? Iterate over the environments and update them with the new

pburkholder

Create the following folder structure in your cookbook:

test
└── integrationq
    ├── helpers
    │   ├── serverspec
    │   │   ├── shared_serverspec_tests
    │   │   │   └── shared_tests2.rb
    │   │   └── spec_helper.rb

pburkholder

aws ec2 describe-subnets --filter "Name=tag:Name,Values=isa-w2a"

aws ec2 describe-vpcs  --filter "Name=tag:Name,Values=chef_ha_vpc"

aws ec2 describe-internet-gateways --filter "Name=tag:Name,Values=chef_ha_vpc"

aws ec2 detach-internet-gateway --internet-gateway-id igw-bb7daade --vpc-id vpc-4dea4228

aws ec2 delete-internet-gateway --internet-gateway-id igw-bb7daade

pburkholder

Notes

ssl testing

Even with ssl.verify off, berks install or berks vendor will fail when supermarket is using a self-signed certificate. So, how do we get around that?

Note: I hacked my /etc/hosts to resolve supermarket-0.c.cheffian-supermarket.internal

Get the CERT

pburkholder

Manual install

GCE project cheffian-supermarket

chefserver

Install and configure api_fqdn:

apt-get update

curl https://packagecloud.io/install/repositories/chef/stable/script.deb | bash