GeekAustin DevOps

Let’s Get Cooking with Chef
Speaker:

Matt Ray Senior Technical Evangelist
‣ matt@opscode.com
‣ @mattray
Copyright © 2011 Opscode, Inc - All Rights Reserved 1

Agenda

Chef 101
Getting Started
Cooking with Chef


Developer, SysAdmin, Hacker,
Community Manager
Many biz & dev environments
Opscode: Training, Services &
Evangelism

Copyright © 2011 Opscode, Inc - All Rights Reserved
http://www.ﬂickr.com/photos/anotherphotograph/2100904507/sizes/o/ 3

Developers?
Systems Administrators?

http://www.ﬂickr.com/photos/timyates/2854357446/sizes/l/


The Opscode Platform
is our Chef Server
http://www.opscode.com


http://www.brooklynstreetart.com/theBlog/wp-content/uploads/2008/12/swedish_chef_bork-sleeper-cell.jpg

Chef enables infrastructure as code
Manage conﬁguration as idempotent Resources.
Put them together in Recipes.
Track it like Source Code.
Conﬁgure your servers.

package "haproxy" do
action :install
end

template "/etc/haproxy/haproxy.cfg" do
source "haproxy.cfg.erb"
owner "root"
group "root"
mode 0644
notifies :restart, "service[haproxy]"
end

service "haproxy" do
action [:enable, :start]
end


At a High Level...

‣ A library for configuration management
‣ A configuration management system
‣ A systems integration platform
‣ An API for your entire Infrastructure

http://www.flickr.com/photos/asten/2159525309/sizes/l/

Fully automated
Infrastructure


Principles

Idempotent
Data-driven
Sane defaults
Hackability
TMTOWTDI


Multiple applications of
an operation do not
change the result

Copyright © 2011 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/redjar/360111326/ 12

We start with APIs, you
supply data

Copyright © 2011 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/ninjanoodles/153893226/ 13

option :json_attribs,
:short => "-j JSON_ATTRIBS",
:long => "--json-attributes JSON_ATTRIBS",
:description => "Load attributes from a
JSON file or URL",
:proc => nil

option :node_name,
:short => "-N NODE_NAME",
:long => "--node-name NODE_NAME",
:description => "The node name for this
client",
Defaults are sane, but
:proc => nil

easily changed

Open source and
community


Tim Toady is a Perl
motto
Copyright © 2011 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/lidarose/225156612 17

The world moves pretty fast

Primitives
Enable YOU
Know your systems

http://www.ﬂickr.com/photos/gi/518613153/sizes/o/

You better be ready!

Sysadmins are programmers
You need a 3GL

http://www.ﬂickr.com/photos/gi/518613153/sizes/o/

Do I need to know Ruby?

A little
Simple syntax
Complex as you scale


A Tour of Chef


Chef Client runs on your
systems


Chef Client runs on your
systems
ohai!


Clients talk to a Chef
Server


Opscode Platform
the central, highly scalable, multi-tenant
conﬁguration service from Opscode...
a hosted Chef Server

Copyright © 2011 Opscode, Inc. – Conﬁdential – Do Not Redistribute 25

Clients authenticate
with RSA keys

Copyright © 2011 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/debbcollins/3401944550/ 26

Chef Server
Chef Server

API
Client
Interaction
Search
Indexer AMQP SOLR

CouchDB Data
store


RESTful API w/ JSON
responses


Chef can also stand
alone - Chef Solo


We call each system you
conﬁgure a Node
Copyright © 2011 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/peterrosbjerg/3913766224/ 30

Nodes have Attributes

Kernel info!
{
"kernel": {
"machine": "x86_64",
"name": "Darwin",
"os": "Darwin",
"version": "Darwin Kernel Version 10.4.0: Fri Apr 23 18:28:53 PDT 2010;
root:xnu-1504.7.4~1/RELEASE_I386",
"release": "10.4.0"
},
"platform_version": "10.6.4",
"platform": "mac_os_x",
"platform_build": "10F569",
"domain": "local",
Platform info!
"os": "darwin",
"current_user": "mray",
"ohai_time": 1278602661.60043,
"os_version": "10.4.0",
"uptime": "18 days 17 hours 49 minutes 18 seconds",
"ipaddress": "10.13.37.116",
"hostname": "morbo",
"fqdn": "morbomorbo.local",
Hostname and IP!
"uptime_seconds": 1619358
}


Attributes are
Searchable
$ knife search node ‘platform:mac_os_x’
search(:node, ‘platform:mac_os_x’)


Nodes have a Run List
What Roles or Recipes to apply
in Order


Nodes have a Run List
% knife node show web01-prod.example.com -r
{
"run_list": [
"role[production]",
"role[webserver]"
]
}


Nodes have Roles

Copyright © 2011 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/laenulfean/374398044/ 35

Roles

Describe the node
‣ webserver
‣ dbserver
‣ monitoring
‣ ... etc


Roles have a Run List
What Roles or Recipes to apply
in Order


name "webserver"
description "Systems that serve HTTP traffic"

run_list(
"role[base]",
Can include
"recipe[apache2]", other roles!
"recipe[apache2::mod_ssl]"
)

default_attributes(
"apache" => {
"listen_ports" => [ "80", "443" ]
}
)

override_attributes(
"apache" => {
"max_children" => "50"
}
)


% knife role show webserver
{
"name": "webserver",
"default_attributes": {
"apache": {
Uploading roles to
"listen_ports": [ the Chef Server
"80",
"443" converts Ruby DSL
]
} to JSON!
},
"json_class": "Chef::Role",
"run_list": [
"role[base]",
"recipe[apache2]",
"recipe[apache2::mod_ssl]"
],
"description": "Systems that serve HTTP traffic",
"chef_type": "role",
"override_attributes": {
"apache2": {
"max_children": "50"
}
}
}

Roles are Searchable

$ knife search role ‘max_children:50’
search(:role, ‘max_children:50’)


Chef manages
Resources on Nodes


Resources...
Declare a description of the state a part of the node should be in

‣ Have a type package "apache2" do
version "2.2.11-2ubuntu2.6"
action :install
‣ Have a name end

template "/etc/apache2/apache2.conf" do
‣ Have parameters source "apache2.conf.erb"
owner "root"
‣ Take action to put the group "root"
mode 0644
resource in the action :create
declared state end

Resources take action
through Providers


Providers...
Know how to actually perform the actions speciﬁed by a resource.

Apt, Yum, Rubygems,
Multiple providers
per resource type.
Portage, Macports,
FreeBSD Ports, etc.

Can be
overridden with package "apache2" do
provider "Chef::Provider::Package::Dpkg"
the provider action :install
parameter on a end
resource.

http://www.ﬂickr.com/photos/affableslinky/562950216/

Resources

Platform

Provider
http://www.ﬂickr.com/photos/acurbelo/2628837104/sizes/o/

Chef::Platform
:ubuntu => {
:default => {
:package => Chef::Provider::Package::Apt,
:service => Chef::Provider::Service::Debian,
:cron => Chef::Provider::Cron,
:mdadm => Chef::Provider::Mdadm
}
},


Recipes are lists of
Resources

http://www.ﬂickr.com/photos/roadsidepictures/2478953342/sizes/o/

Recipes...
Apply resources in the order they are speciﬁed

package "apache2" do
version "2.2.11-2ubuntu2.6"
action :install
1
‣ Evaluates resources in [
end
1
the order they appear "package[apache2]",
"template[/etc/apache2/apache2.conf]"
template "/etc/apache2/apache2.conf" do
2
] source "apache2.conf.erb"
‣ Adds each resource to owner "root"
the Resource Collection group "root"
mode 0644
action :create
2
end

http://www.ﬂickr.com/photos/roadsidepictures/2478953342/sizes/o/

Order Matters


Recipes are just Ruby!
extra_packages = case node[:platform]
when "ubuntu","debian"
%w{
ruby1.8
ruby1.8-dev
rdoc1.8
ri1.8
libopenssl-ruby
}
end

extra_packages.each do |pkg|
package pkg do
action :install
end
end


Cookbooks are
packages for Recipes


Cookbooks

Distributable
Infrastructure as Code
Version control repository


Common Cookbook Components

Recipes
Assets (ﬁles/templates)
Attributes
Metadata


Cookbook assets

Files
‣ Static assets
‣ Downloaded via cookbook_file
‣ File specificity

Templates
‣ Dynamic assets
‣ ERB (erubis)
‣ File specificity


Cookbooks

Attributes
‣ Node attributes
‣ default, normal, override

default[:apache][:listen_ports] = [ "80","443" ]
default[:apache][:keepalive] = "On"
default[:apache][:contact] = "ops@example.com"
default[:apache][:timeout] = 300

set[:apache][:log_dir] = "/var/log/apache2"
set[:apache][:user] = "www-data"

override[:apache][:dir] = "/etc/apache2"


Cookbooks
Metadata
cookbooks/django/metadata.rb
maintainer "Opscode, Inc."
maintainer_email "cookbooks@opscode.com"
license "Apache 2.0"
description "Installs DJango"
long_description IO.read(File.join(File.dirname(__FILE__),
'README.rdoc'))
version "0.8.0"

recipe "django", "Installs django and apache2 with mod_python"

%w{ ubuntu debian }.each do |os|
supports os
end

%w{ apache2 python }.each do |cb|
depends cb
end


Cookbooks are
shareable!

cookbooks.opscode.com

Data bags store
arbitrary data


A user data bag item...
% knife data bag show users mray
{
"comment": "Matt Ray",
"groups": "sysadmin",
"ssh_keys": "ssh-rsa SUPERSEKRATS mray@morbo",
"files": {
".bashrc": {
"mode": "0644",
"source": "dot-bashrc"
},
".emacs": {
"mode": "0644",
"source": "dot-emacs"
}
},
"id": "mray",
"uid": 7004,
"shell": "/usr/bin/bash"
}

Copyright © 2011 Opscode, Inc - All Rights Reserved

Data Bags are
Searchable
$ knife search users ‘shell:/bin/bash’
search(:users, ‘/bin/bash’)


bash_users = search(:users, 'shell:/bin/bash')

bash_users.each do |u|
user u['id'] do
uid u['id']
shell "/usr/bin/zsh"
comment u['comment']
supports :manage_home => true

Data bags make recipes
home "/home/#{u['id']}"
end

awesome-r (that’s
directory "/home/#{u['id']}/.ssh" do
owner u['id']
group u['id']
mode 0700

totally a word)
end

template "/home/#{u['id']}/.ssh/authorized_keys" do
source "authorized_keys.erb"
owner u['id']
group u['id']
mode 0600
variables :ssh_keys => u['ssh_keys']
end
end

Environments manage
versioned infrastructure


JSON or Ruby DSL and
Versioned

name "dev"
description "The development environment"
cookbook_versions "couchdb" => "11.0.0"
attributes "apache2" => { "listen_ports" => [ "80", "443" ] }


Command-line API
utility, Knife

http://www.ﬂickr.com/photos/myklroventine/3474391066/

Nodes, Roles, Data
Bags are Searchable

% knife search node “role:webserver”

search(:users, “group:sysadmins”)


http://www.ﬂickr.com/photos/38299630@N05/3635356091/

Getting Started

Copyright © 2011 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/rowens27/3163470179/ 67

Debian Mac OS X
SuSE
CentOS
Gentoo
Solaris
ArchLinux
OpenBSD
Platforms
Windows FreeBSD
Ubuntu
Red Hat
Fedora
Scientiﬁc


Today’s Examples

Opscode Platform
Mac OS X 10.6.6
Ubuntu 10.04
RubyGems


The Opscode Platform
is our Chef Server
http://www.opscode.com


RubyGems Installation
cd /tmp
wget http://production.cf.rubygems.org/
rubygems/rubygems-1.3.7.tgz -O- | tar zxf -
cd rubygems-1.3.7 && sudo ruby setup.rb
ln -svf /usr/bin/gem1.8 /usr/bin/gem

sudo gem install chef


apt.opscode.com


ELFF Yum Repo


Create Chef Repository
% git clone git://github.com/opscode/chef-repo.git
% cd chef-repo
% ls -la
drwxr-xr-x 13 mray staff 442 Jul 7 16:48 ./
drwxr-xr-x 3 mray staff 102 Jul 7 15:54 ../
drwxr-xr-x 5 mray staff 170 Jul 7 17:55 .chef/
drwxr-xr-x 12 mray staff 408 Jul 7 16:48 .git/
-rw-r--r-- 1 mray staff 23 Jul 7 16:48 .gitignore
-rw-r--r-- 1 mray staff 269 Jul 7 15:54 README
-rw-r--r-- 1 mray staff 2171 Jul 7 15:54 Rakefile
drwxr-xr-x 3 mray staff 102 Jul 7 15:54 certificates/
drwxr-xr-x 7 mray staff 238 Jul 7 17:03 config/
drwxr-xr-x 3 mray staff 102 Jul 7 15:54 cookbooks/
drwxr-xr-x 3 mray staff 102 Jul 7 15:54 data_bags/
drwxr-xr-x 3 mray staff 102 Jul 7 15:54 roles/
drwxr-xr-x 3 mray staff 102 Jul 7 15:54 site-cookbooks/


Setup User Environment

cp USERNAME.pem ~/chef-repo/.chef
cp ORG-validator.pem ~/chef-repo/.chef
cp knife.rb ~/chef-repo/.chef


Conﬁgure Knife
% cat .chef/knife.rb
current_dir = File.dirname(__FILE__)
log_level :info
log_location STDOUT
node_name "oscon"
client_key "#{current_dir}/oscon.pem"
validation_client_name "oscon-validator"
validation_key "#{current_dir}/oscon-validator.pem"
chef_server_url "https://api.opscode.com/organizations/oscon"
cache_type 'BasicFile'
cache_options( :path => "#{ENV['HOME']}/.chef/checksums" )
cookbook_path ["#{current_dir}/../cookbooks"]

Per-directory conﬁguration!


Explore Knife’s sub-
commands


Knife Sub-commands
knife NOUN verb NOUN (options)

knife client list
knife node show morbo.local
knife role show webserver
knife search node “*:*” -i
knife --help


Conﬁgure Chef on
workstation
% knife configure client /etc/chef
INFO: Creating client configuration
INFO: Writing client.rb
INFO: Writing validation.pem

% ls -l /etc/chef/
total 24
-rw-r--r-- 1 mray staff 151 Jul 8 21:29 client.rb
-rw-r--r--@ 1 mray staff 1679 Jul 8 21:29 validation.pem


Chef::Conﬁg
log_level :info
log_location STDOUT
chef_server_url 'https://api.opscode.com/
organizations/oscon'
validation_client_name 'oscon-validator'

http://wiki.opscode.com/display/chef/Chef+Conﬁguration+Settings


Download getting-
started cookbook
% knife cookbook site vendor getting-started
INFO: Downloading getting-started from the cookbooks site at version
0.2.0
...
INFO: Cookbook getting-started version 0.2.0 successfully vendored!


git checkout -b
chef-vendor-#{name_args[0]}


Upload getting-started
to Chef Server
% knife cookbook upload getting-started
INFO: Saving getting-started
INFO: Validating ruby files
INFO: Validating templates
INFO: Syntax OK
INFO: Generating Metadata
INFO: Uploading files
...
INFO: Upload complete!

Apply getting-started
Recipe to workstation

% knife node run list add morbo.local "recipe[getting-started]"
{
"run_list": [
"recipe[getting-started]"
]
}


Run chef-client!

% sudo chef-client
[Thu, 08 Jul 2010 21:35:49 -0600] INFO: Starting Chef Run
[Thu, 08 Jul 2010 21:35:55 -0600] INFO: Writing updated content for
template[/tmp/chef-getting-started.txt] to /tmp/chef-getting-
started.txt
[Thu, 08 Jul 2010 21:35:56 -0600] INFO: Chef Run complete in 6.650602
seconds

% cat /tmp/chef-getting-started.txt
Welcome to Chef!

This is Chef version 0.9.14.beta.1
Running on mac_os_x.
Version 10.6.6.


Inside the getting-
started cookbook


http://www.ﬂickr.com/photos/38299630@N05/3635356091/

remote_file
link
cookbook_file
service
ruby_block
template

Chef Resources in
execute
Depth user

bash git
package log
deploy
http_request

Resources have
parameters and actions


Resource Parameters and Actions

Most resources have defaults
Defaults are sane
‣ http://wiki.opscode.com/display/chef/Resources


packages

package "apache2" do
action :install
end

Actions: install, upgrade, remove, purge

Package shortcuts

Map to providers
gem_package
dpkg_package
rpm_package
And more!


services

service "apache2" do
action [ :enable, :start ]
end

Actions: enable, disable, start, stop, restart, reload

init script capabilities
service "apache2" do
supports(
:status => true,
:restart => true,
:reload => true
)
action [ :enable, :start ]
end


ﬁles
file "/etc/chef/client.rb" do
owner "root"
group "root"
mode 0644
action :create
end

Actions: create, delete, touch

ﬁle content!
file "/tmp/example" do
content "This is a file!"
end

file "/tmp/example2" do
content IO.read("/etc/hosts")
end

Content is a string

GeekAustin DevOps

More Related Content

What's hot

Viewers also liked

Similar to GeekAustin DevOps

More from Matt Ray

Recently uploaded

GeekAustin DevOps