Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/automate/ha_chef_backend_to_automate_ha.md
Original file line number Diff line number Diff line change
Expand Up @@ -309,7 +309,7 @@ Bootstrap the nodes to update the `chef_server_url` using the following steps:
## Use Automate HA for Chef-Backend User

Download and install [Chef Workstation](https://www.chef.io/downloads) from the bastion host or local machine.
To set up Chef Workstation, see the [Workstation Set Up documentation](/workstation/getting_started/#set-up-your-chef-repo).
To set up Chef Workstation, see the [Workstation Set Up documentation](/workstation/latest/install/).

## Use Existing Private Supermarket with Automate HA

Expand Down
4 changes: 2 additions & 2 deletions content/automate/ha_node_bootstrapping.md
Original file line number Diff line number Diff line change
Expand Up @@ -97,9 +97,9 @@ The Chef Infra Client installer puts everything into a unique directory (/opt/ch
chef -v
```

For additional information, see [Install Workstation](/workstation/install_workstation/) page.
For additional information, see [Install Workstation](/workstation/latest/install/) page.

1. Generate chef-repo using `chef generate repo chef-repo`. For more information, see the [getting station](/workstation/getting_started/) page of Workstation.
1. Generate chef-repo using `chef generate repo chef-repo`. For more information, see the [getting station](/workstation/latest/install/) page of Workstation.

1. Paste `pem` files of user and organization inside `/root/.chef/`. For example: `Eg.: /root/.chef/john_doe.pem , /root/.chef/new_org.pem`

Expand Down
9 changes: 4 additions & 5 deletions content/azure_cwa_cloud_shell.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,11 @@ machine.

Chef Workstation on Azure Cloud Shell lets you use:

- [chef](/ctl_chef/)
- [kitchen](/workstation/ctl_kitchen/)
- [inspec](/inspec/cli/)
- [knife](/workstation/knife/)
- [chef](/workstation/latest/tools/ctl_chef/)
- [kitchen](/workstation/latest/kitchen/ctl_kitchen/)
- [inspec](/inspec/latest/reference/cli/)
- [knife](/workstation/latest/tools/knife/)
- [cookstyle](/workstation/cookstyle/)
- [chef-run](/workstation/chef_run/)

Combine the Chef Workstation command utilities with the other tools
available in Cloud Shell, such as git, az-cli, terraform to write your
Expand Down
11 changes: 3 additions & 8 deletions content/chef_client_overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,15 +16,10 @@ gh_repo = "chef-web-docs"

{{< note >}}

For the `chef-client` command line tool, see
[chef-client(executable)](/ctl_chef_client/).
For the `chef-client` command line tool, see [chef-client(executable)](/ctl_chef_client/).

{{< /note >}}

<!-- markdownlint-disable MD036-->
**New in Chef Infra Client 17**
<!-- markdownlint-enable MD036-->

Chef Infra Client's Compliance Phase lets you automatically execute compliance audits and view the results as part of any Chef Infra Client Run. The Compliance Phase replaces the legacy audit cookbook and works with your existing audit cookbook attributes. You can also set up the Compliance Phase for new cookbooks. See [Compliance Phase]({{< relref "chef_compliance_phase" >}}) documentation to upgrade.

<!-- markdownlint-disable MD033 -->
Expand Down Expand Up @@ -58,5 +53,5 @@ Chef Infra Client's Compliance Phase lets you automatically execute compliance a

## Next Steps

- [Install Chef Workstation](/workstation/install_workstation/)
- [Bootstrap Nodes](/install_bootstrap/)
- [Install Chef Workstation](/workstation/latest/install/)
- [Bootstrap Nodes](/client/latest/install/bootstrap/)
87 changes: 84 additions & 3 deletions content/chef_client_security.md
Original file line number Diff line number Diff line change
Expand Up @@ -130,16 +130,97 @@ Run [`knife ssl check`](/workstation/latest/tools/knife/knife_ssl_check/) to ver

##### Verified

{{< readfile file="content/workstation/reusable/md/knife_ssl_check_verify_server_config.md" >}}
If the SSL certificate can be verified, the response to

```bash
knife ssl check
```

is similar to:

```bash
Connecting to host chef-server.example.com:443
Successfully verified certificates from 'chef-server.example.com'
```

##### Unverified

{{< readfile file="content/workstation/reusable/md/knife_ssl_check_bad_ssl_certificate.md" >}}
If the SSL certificate can't be verified, the response to

```bash
knife ssl check
```

is similar to:

```bash
Connecting to host chef-server.example.com:443
ERROR: The SSL certificate of chef-server.example.com could not be verified
Certificate issuer data:
/C=US/ST=WA/L=S/O=Corp/OU=Ops/CN=chef-server.example.com/emailAddress=you@example.com

Configuration Info:

OpenSSL Configuration:
* Version: OpenSSL 1.0.2u 20 Dec 2019
* Certificate file: /opt/chef-workstation/embedded/ssl/cert.pem
* Certificate directory: /opt/chef-workstation/embedded/ssl/certs
Chef SSL Configuration:
* ssl_ca_path: nil
* ssl_ca_file: nil
* trusted_certs_dir: "/Users/grantmc/Downloads/chef-repo/.chef/trusted_certs"

TO FIX THIS ERROR:

If the server you are connecting to uses a self-signed certificate,
you must configure chef to trust that certificate.

By default, the certificate is stored in the following location on the
host where your Chef Infra Server runs:

/var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt

Copy that file to your trusted_certs_dir (currently:

/Users/grantmc/Downloads/chef-repo/.chef/trusted_certs)

using SSH/SCP or some other secure method, then re-run this command to
confirm that the certificate is now trusted.
```

#### knife ssl fetch

Run [`knife ssl fetch`](/workstation/latest/tools/knife/knife_ssl_fetch/) to download the self-signed certificate from the Chef Infra Server to the `/.chef/trusted_certs` directory on a workstation.

##### Verify checksums

{{< readfile file="content/workstation/reusable/md/knife_ssl_fetch_verify_certificate.md" >}}
The SSL certificate that's downloaded to the `/.chef/trusted_certs`
directory should be verified to ensure that it's, in fact, the same
certificate as the one located on the Chef Infra Server. This can be
done by comparing the SHA-256 checksums.

1. View the checksum on the Chef Infra Server:

```bash
ssh ubuntu@chef-server.example.com sudo sha256sum /var/opt/opscode/nginx/ca/chef-server.example.com.crt
```

The response is similar to:

```bash
<ABC123checksum> /var/opt/opscode/nginx/ca/chef-server.example.com.crt
```

2. View the checksum on the workstation:

```bash
gsha256sum .chef/trusted_certs/chef-server.example.com.crt
```

The response is similar to:

```bash
<ABC123checksum> .chef/trusted_certs/chef-server.example.com.crt
```

3. Verify that the checksum values are identical.
98 changes: 46 additions & 52 deletions content/chef_overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ product = ["client", "server", "workstation"]
- **Chef Workstation** is the location where users interact with Chef
Infra. With Chef Workstation, users can author and test
[cookbooks](/cookbooks/) using tools such as [Test
Kitchen](/workstation/kitchen/) and interact with the Chef Infra Server
using the [knife](/workstation/knife/) and [chef](/ctl_chef/) command
Kitchen](/workstation/latest/tools/kitchen/) and interact with the Chef Infra Server
using the [knife](/workstation/latest/tools/knife/) and [chef](/ctl_chef/) command
line tools.
- **Chef Infra Client** Chef Infra Client runs on systems that are managed by
Chef Infra. The Chef Infra Client executes on a schedule to configure a system to
Expand Down Expand Up @@ -110,59 +110,53 @@ The workstation is where users do most of their work, including:
- Configuring organizational policy by including defining roles and applying Policyfiles or policy groups
- Interacting with nodes, as (or when) required, such as performing a bootstrap operation

### Chef Workstation Components and Tools
### Chef Workstation components and tools

Some important tools and components of Chef Workstation include:

<table>
<colgroup>
<col style="width: 19%" />
<col style="width: 80%" />
</colgroup>
<thead>
<tr class="header">
<th>Component</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><p><img src="/images/icon_workstation.svg" class="align-center" width="130" alt="" /></p></td>
<td>{{< readfile file="content/workstation/reusable/md/chef_workstation.md" >}}</td>
</tr>
<tr>
<td><p><img src="/images/icon_ctl_chef.svg" class="align-center" width="130" alt="" /></p>
<p><img src="/images/icon_ctl_knife.svg" class="align-center" width="130" alt="" /></p></td>
<td><p>Chef Workstation includes important command-line tools:</p>
<ul>
<li>Chef Infra: Use the chef command-line tool to work with items in a chef-repo, which is the primary location in which cookbooks are authored, tested, and maintained, and from which policy is uploaded to the Chef Infra Server</li>
<li>Knife: Use the knife command-line tool to interact with nodes or work with objects on the Chef Infra Server</li>
<li>Chef Infra Client: an agent that configures your nodes</li>
<li>Test Kitchen: a testing harness for rapid validation of Chef code</li>
<li>Chef InSpec: Chef's open source security &amp; compliance automation framework</li>
<li>chef-run: a tool for running ad-hoc tasks</li>
<li>Chef Workstation App: for updating and managing your chef tools</li>
</ul></td>
</tr>
<tr>
<td><p><img src="/images/icon_repository.svg" class="align-center" width="130" alt="" /></p></td>
<td><p>The chef-repo is the repository structure in which cookbooks are authored, tested, and maintained:</p>
<ul>
<li>Cookbooks contain recipes, attributes, custom resources, libraries, files, templates, tests, and metadata</li>
<li>The chef-repo should be synchronized with a version control system (such as git), and then managed as if it were source code</li>
</ul>
<p>The directory structure within the chef-repo varies. Some organizations prefer to keep all of their cookbooks in a single chef-repo, while other organizations prefer to use a chef-repo for every cookbook.</p></td>
</tr>
<tr>
<td><p><img src="/images/icon_kitchen.svg" class="align-center" width="130" alt="" /></p></td>
<td>{{< readfile file="content/workstation/reusable/md/test_kitchen.md" >}}</td>
</tr>
<tr>
<td><p><img src="/images/icon_chefspec.svg" class="align-center" width="130" alt="" /></p></td>
<td>{{< readfile file="content/reusable/md/chefspec_summary.md" >}}</td>
</tr>
</tbody>
</table>
#### Chef Workstation

Start your infrastructure automation with [Chef Workstation](/workstation/latest/). Chef Workstation gives you everything you need to get started with Chef - ad hoc remote execution, remote scanning, configuration tasks, cookbook creation tools as well as robust dependency and testing software - all in one easy-to-install package.

Chef Workstation includes:

- Chef Infra Client
- Chef InSpec
- Chef Habitat
- chef and knife command line tools
- Testing tools such as Test Kitchen and Cookstyle
- Everything else needed to author cookbooks and upload them to the Chef Infra Server

#### Command-line tools

Chef Workstation includes important command-line tools:

- Chef Infra: Use the chef command-line tool to work with items in a chef-repo, which is the primary location in which cookbooks are authored, tested, and maintained, and from which policy is uploaded to the Chef Infra Server
- Knife: Use the knife command-line tool to interact with nodes or work with objects on the Chef Infra Server
- Chef Infra Client: an agent that configures your nodes
- Test Kitchen: a testing harness for rapid validation of Chef code
- Chef InSpec: Chef's open source security and compliance automation framework

#### Chef repository

The chef-repo is the repository structure in which cookbooks are authored, tested, and maintained:

- Cookbooks contain recipes, attributes, custom resources, libraries, files, templates, tests, and metadata
- The chef-repo should be synchronized with a version control system (such as git), and then managed as if it were source code

The directory structure within the chef-repo varies. Some organizations prefer to keep all of their cookbooks in a single chef-repo, while other organizations prefer to use a chef-repo for every cookbook.

#### Test Kitchen

Use [Test Kitchen Enterprise](/workstation/latest/tools/kitchen) to automatically test cookbooks across any combination of platforms and test suites:

- Test suites are defined in a kitchen.yml file. See the [configuration](/workstation/latest/tools/kitchen/config_yml_kitchen/) documentation for options and syntax information.
- Supports cookbook testing across many cloud providers and virtualization technologies.
- Uses a comprehensive set of operating system base images from Chef's [Bento](https://github.com/chef/bento) project.

#### ChefSpec

{{< readfile file="content/reusable/md/chefspec_summary.md" >}}

## Cookbooks

Expand Down
Loading
Loading