From 470dcb82eea2c8dac6eb223356631da907592705 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Sun, 1 Nov 2026 18:28:44 +0400 Subject: [PATCH] Migrate the Chef repo to Cinc Workstation Cinc Workstation replaces Chef Workstation for driving knife-zero and Test Kitchen; nodes run (or are moving to) Cinc Client. - Pin .ruby-version to cinc-workstation - Move knife config from .chef/ to .cinc/ (Cinc's USER_CONF_DIR) and update .gitignore, README, AGENTS and docs accordingly. On-node config now lives in /etc/cinc - Drop the Gemfile/Gemfile.lock; install knife-zero into Cinc Workstation's user gem dir with `cinc gem install knife-zero` - README: rewrite setup/usage for Cinc Workstation - scripts/postgresql/switch_primary.sh: drop `bundle exec` --- {.chef => .cinc}/config.rb.example | 7 +- .gitignore | 11 +- .ruby-version | 2 +- AGENTS.md | 7 +- Gemfile | 3 - Gemfile.lock | 440 --------------------------- README.md | 63 ++-- doc/ldap.md | 2 +- environments/development.json | 2 +- scripts/postgresql/switch_primary.sh | 8 +- 10 files changed, 57 insertions(+), 488 deletions(-) rename {.chef => .cinc}/config.rb.example (74%) delete mode 100644 Gemfile delete mode 100644 Gemfile.lock diff --git a/.chef/config.rb.example b/.cinc/config.rb.example similarity index 74% rename from .chef/config.rb.example rename to .cinc/config.rb.example index 3a28aee..22fa53a 100644 --- a/.chef/config.rb.example +++ b/.cinc/config.rb.example @@ -8,11 +8,10 @@ data_bag_path "data_bags" encrypted_data_bag_secret "#{current_dir}/encrypted_data_bag_secret" local_mode true # Chef local mode, replacing Solo -# Added to /etc/chef/client.rb on node bootstrap +# Added to /etc/cinc/client.rb on node bootstrap # https://docs.chef.io/attribute_persistence/ # Source of truth: site-cookbooks/kosmos-base/files/default/chef_attributes.rb client_d_dir(File.expand_path("../site-cookbooks/kosmos-base/files/default/chef_attributes.rb")) -# Chef binaries on packages.chef.io are license-gated (HTTP 402); use the -# community Cinc build for bootstraps and converged nodes. -knife[:alter_project] = "cinc" +# Cinc Workstation's knife already installs Cinc Client from omnitruck.cinc.sh +# by default, so no `knife[:alter_project]` is needed here. diff --git a/.gitignore b/.gitignore index 5116904..fc6911f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,4 @@ -/.chef/encrypted_data_bag_secret -/.chef/chef_guid -/.chef/config.rb -/.bundle/ -/.vagrant/ -/.kitchen -/nodes/vagrant-node.json +/.cinc/encrypted_data_bag_secret +/.cinc/chef_guid +/.cinc/config.rb +.kitchen diff --git a/.ruby-version b/.ruby-version index 214e092..b29eabe 100644 --- a/.ruby-version +++ b/.ruby-version @@ -1 +1 @@ -chef-workstation +cinc-workstation diff --git a/AGENTS.md b/AGENTS.md index a9d2989..fa3d152 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -5,7 +5,7 @@ Welcome, AI Agent! This file contains essential context and rules for interactin ## 🏢 Project Overview This repository contains the infrastructure automation code used by Kosmos to provision and configure bare metal servers (KVM hosts) and Ubuntu virtual machines (KVM guests). -We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and **Berkshelf** for dependency management. +We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and **Berkshelf** for dependency management. Nodes run the community **Cinc Client** distribution (the license-free Chef Infra Client) instead of Chef Infra Client, and everything is driven by **Cinc Workstation** (the community fork of Chef Workstation). On-node configuration lives in `/etc/cinc`, and the repo's knife config lives in `.cinc/`. ## 📂 Directory Structure & Rules @@ -13,10 +13,11 @@ We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and * **`cookbooks/`**: 🔴 **DO NOT EDIT.** This directory contains third-party/community cookbooks that are vendored. These are managed by Berkshelf. Modifying them directly will result in lost changes. * **`roles/`**: 🟢 **EDITABLE.** Contains Chef roles written in Ruby (e.g., `base.rb`, `kvm_guest.rb`, `postgresql_primary.rb`). These define run-lists and role-specific default attributes for servers. * **`environments/`**: Contains Chef environment definitions (like `production.rb`). -* **`data_bags/`**: Contains data bag configurations, often encrypted. Be cautious and do not expose secrets. (Note: Agents should not manage data bag secrets directly unless provided the `.chef/encrypted_data_bag_secret`). +* **`data_bags/`**: Contains data bag configurations, often encrypted. Be cautious and do not expose secrets. (Note: Agents should not manage data bag secrets directly unless provided the `.cinc/encrypted_data_bag_secret`). * **`nodes/`**: Contains JSON state files for bootstrapped nodes. *Agents typically do not edit these directly unless cleaning up a deleted node.* * **`Berksfile`**: Defines community cookbook dependencies. -* **`Vagrantfile` / `.kitchen/`**: Used for local virtualization and integration testing. +* **`.cinc/`**: Local knife configuration (`config.rb`, `encrypted_data_bag_secret`). Untracked; `.cinc/config.rb.example` is the template. +* **`kitchen.yml` / `.kitchen/`**: Test Kitchen integration suites. They run against Cinc Client via Cinc Workstation's `kitchen-dokken` plugin, so invoke them with `kitchen` (see `README.md`). ## 🛠️ Tooling & Workflows diff --git a/Gemfile b/Gemfile deleted file mode 100644 index 2c04ace..0000000 --- a/Gemfile +++ /dev/null @@ -1,3 +0,0 @@ -source 'https://rubygems.org' - -gem 'knife-zero', '~> 2.6.0' diff --git a/Gemfile.lock b/Gemfile.lock deleted file mode 100644 index 9cba0c0..0000000 --- a/Gemfile.lock +++ /dev/null @@ -1,440 +0,0 @@ -GEM - remote: https://rubygems.org/ - specs: - abbrev (0.1.2) - addressable (2.9.0) - public_suffix (>= 2.0.2, < 8.0) - ast (2.4.3) - aws-eventstream (1.4.0) - aws-partitions (1.1263.0) - aws-sdk-core (3.252.0) - aws-eventstream (~> 1, >= 1.3.0) - aws-partitions (~> 1, >= 1.992.0) - aws-sigv4 (~> 1.9) - base64 - bigdecimal - jmespath (~> 1, >= 1.6.1) - logger - aws-sdk-kms (1.129.0) - aws-sdk-core (~> 3, >= 3.248.0) - aws-sigv4 (~> 1.5) - aws-sdk-s3 (1.226.0) - aws-sdk-core (~> 3, >= 3.248.0) - aws-sdk-kms (~> 1) - aws-sigv4 (~> 1.5) - aws-sdk-secretsmanager (1.133.0) - aws-sdk-core (~> 3, >= 3.248.0) - aws-sigv4 (~> 1.5) - aws-sigv4 (1.12.1) - aws-eventstream (~> 1, >= 1.0.2) - base64 (0.3.0) - bcrypt_pbkdf (1.1.2) - bcrypt_pbkdf (1.1.2-arm64-darwin) - bcrypt_pbkdf (1.1.2-x86_64-darwin) - benchmark (0.5.0) - bigdecimal (4.1.2) - builder (3.3.0) - chef (19.3.15) - addressable - aws-sdk-s3 (~> 1.91) - aws-sdk-secretsmanager (~> 1.46) - bcrypt_pbkdf (~> 1.0) - chef-config (= 19.3.15) - chef-licensing (~> 1.3) - chef-utils (= 19.3.15) - chef-vault - chef-zero (~> 15.1.0) - corefoundation (~> 0.3.4) - csv (~> 3.3.5) - diff-lcs (~> 1.6.0) - ed25519 (~> 1.2) - erubis (~> 2.7) - ffi (>= 1.15.5, < 1.18.0) - ffi-libarchive (~> 1.0, >= 1.0.3) - ffi-yajl (>= 2.2, < 4.0) - iniparse (~> 1.4) - inspec-core (~> 7.0.107) - license-acceptance (>= 1.0.5, < 3) - mixlib-archive (>= 0.4, < 2.0) - mixlib-authentication (>= 2.1, < 4) - mixlib-cli (>= 2.1.1, < 3.0) - mixlib-log (>= 2.0.3, < 4.0) - mixlib-shellout (>= 3.3.8, < 3.5.0) - net-ftp - net-sftp (>= 2.1.2, < 5.0) - ohai (~> 19.0) - plist (~> 3.2) - proxifier2 (~> 1.1) - syslog - syslog-logger (~> 1.6) - train-core (~> 3.13, >= 3.13.4) - train-rest (>= 0.4.1) - train-winrm (>= 0.2.17) - unf_ext (~> 0.0.9.1) - uri (>= 1.0.4, < 1.2.0) - vault (>= 0.18.2, < 0.21.0) - chef-config (19.3.15) - addressable - chef-utils (= 19.3.15) - fuzzyurl - mixlib-config (>= 2.2.12, < 4.0) - mixlib-shellout (>= 2.0, < 4.0) - racc - tomlrb (>= 1.2, < 3.0) - chef-gyoku (1.5.0) - builder (>= 2.1.2) - rexml (~> 3.4) - chef-licensing (1.4.1) - chef-config (>= 15) - faraday (>= 1, < 3) - faraday-http-cache - mixlib-log (~> 3.0) - ostruct (~> 0.6.0) - pstore (~> 0.1.1) - tty-prompt (~> 0.23) - tty-spinner (~> 0.9.3) - chef-telemetry (1.1.1) - chef-config - concurrent-ruby (~> 1.0) - chef-utils (19.3.15) - concurrent-ruby - chef-vault (4.2.12) - syslog (~> 0.3) - chef-winrm (2.5.0) - builder (>= 2.1.2) - chef-gyoku (~> 1.5) - erubi (~> 1.8) - gssapi (~> 1.2) - httpclient (~> 2.2, >= 2.2.0.2) - logging (>= 1.6.1, < 3.0) - nori (~> 2.7) - rexml (>= 3.4.2, < 4.0) - rubyntlm (~> 0.6.0, >= 0.6.3) - chef-winrm-elevated (1.2.5) - chef-winrm (>= 2.3.11) - chef-winrm-fs (>= 1.3.7) - erubi (~> 1.8) - chef-winrm-fs (1.4.2) - benchmark (~> 0.5.0) - chef-winrm (~> 2.4) - csv (~> 3.3) - erubi (>= 1.7) - logging (>= 1.6.1, < 3.0) - rubyzip (~> 2.0) - chef-zero (15.1.11) - ffi-yajl (>= 2.2, < 4.0) - hashie (>= 2.0, < 6.0) - mixlib-log (>= 2.0, < 4.0) - rack (~> 3.2, >= 3.2.6) - rackup (~> 2.3, >= 2.3.1) - uuidtools (>= 2.1, < 4.0) - webrick - coderay (1.1.3) - concurrent-ruby (1.3.7) - connection_pool (2.5.5) - cookstyle (8.7.6) - rubocop (= 1.86.1) - corefoundation (0.3.19) - ffi (>= 1.15.0) - csv (3.3.5) - date (3.5.1) - diff-lcs (1.6.2) - domain_name (0.6.20240107) - ed25519 (1.4.0) - erubi (1.13.1) - erubis (2.7.0) - faraday (2.14.3) - faraday-net_http (>= 2.0, < 3.5) - json - logger - faraday-follow_redirects (0.5.0) - faraday (>= 1, < 3) - faraday-http-cache (2.5.1) - faraday (>= 0.8) - faraday-net_http (3.4.4) - net-http (~> 0.5) - ffi (1.17.4-arm64-darwin) - ffi (1.17.4-x86_64-darwin) - ffi (1.17.4-x86_64-linux-gnu) - ffi-libarchive (1.1.14) - ffi (~> 1.0) - ffi-yajl (2.7.11) - libyajl2 (>= 2.1) - fuzzyurl (0.9.0) - gssapi (1.3.1) - ffi (>= 1.0.1) - hashie (5.1.0) - logger - highline (3.1.2) - reline - http-accept (1.7.0) - http-cookie (1.1.6) - domain_name (~> 0.5) - httpclient (2.9.0) - mutex_m - iniparse (1.5.0) - inspec-core (7.0.107) - addressable (~> 2.4) - chef-licensing (>= 1.2.0) - chef-telemetry (~> 1.0, >= 1.0.8) - cookstyle - csv (~> 3.0) - faraday (>= 1, < 3) - faraday-follow_redirects (~> 0.3) - hashie (>= 3.4, < 6.0) - license-acceptance (>= 0.2.13, < 3.0) - method_source (>= 0.8, < 2.0) - mixlib-log (~> 3.0) - multipart-post (~> 2.0) - ostruct (>= 0.1, < 0.7) - parallel (~> 1.9) - parslet (>= 1.5, < 3.0) - pry (~> 0.13) - rspec (>= 3.9, <= 3.14) - rspec-its (>= 1.2, < 3.0) - rubyzip (>= 1.2.2, < 4.0) - semverse (~> 3.0) - sslshake (~> 1.2) - syslog (~> 0.1) - thor (>= 0.20, < 1.5.0) - tomlrb (>= 1.3, < 2.1) - train-core (~> 3.16, >= 3.16.1) - tty-prompt (~> 0.17) - tty-table (~> 0.10) - io-console (0.8.2) - ipaddress (0.8.3) - jmespath (1.6.2) - json (2.20.0) - knife (19.0.134) - abbrev - bcrypt_pbkdf (~> 1.1) - chef-licensing (~> 1.2) - chef-vault - ed25519 (>= 1.2, < 2.0) - erubis (~> 2.7) - ffi (>= 1.15, < 1.18.0) - ffi-yajl (>= 2.2, < 3.0) - highline (>= 1.6.9, < 4) - license-acceptance (>= 1.0.5, < 3) - mixlib-archive (>= 0.4, < 2.0) - mixlib-cli (>= 2.1.1, < 3.0) - net-ssh (>= 5.1, < 8) - net-ssh-multi (~> 1.2, >= 1.2.1) - pastel - proxifier2 (~> 1.1) - train-core (~> 3.13, >= 3.13.4) - train-winrm (>= 0.2.17) - tty-prompt (~> 0.21) - tty-screen (~> 0.6) - tty-table (~> 0.11) - knife-zero (2.6.0) - chef (>= 16.6) - knife (>= 17.0) - language_server-protocol (3.17.0.5) - libyajl2 (2.1.0) - license-acceptance (2.1.13) - pastel (~> 0.7) - tomlrb (>= 1.2, < 3.0) - tty-box (~> 0.6) - tty-prompt (~> 0.20) - lint_roller (1.1.0) - little-plugger (1.1.4) - logger (1.7.0) - logging (2.4.0) - little-plugger (~> 1.1) - multi_json (~> 1.14) - method_source (1.1.0) - mime-types (3.7.0) - logger - mime-types-data (~> 3.2025, >= 3.2025.0507) - mime-types-data (3.2026.0701) - mixlib-archive (1.3.3) - mixlib-log - mixlib-authentication (3.0.10) - mixlib-cli (2.1.8) - mixlib-config (3.0.27) - tomlrb - mixlib-log (3.2.3) - ffi (>= 1.15.5) - mixlib-shellout (3.4.10) - chef-utils - multi_json (1.19.1) - multipart-post (2.4.1) - mutex_m (0.3.0) - net-ftp (0.3.9) - net-protocol - time - net-http (0.9.1) - uri (>= 0.11.1) - net-http-persistent (4.0.8) - connection_pool (>= 2.2.4, < 4) - net-protocol (0.2.2) - timeout - net-scp (4.1.0) - net-ssh (>= 2.6.5, < 8.0.0) - net-sftp (4.0.0) - net-ssh (>= 5.0.0, < 8.0.0) - net-ssh (7.3.3) - net-ssh-gateway (2.0.0) - net-ssh (>= 4.0.0) - net-ssh-multi (1.2.1) - net-ssh (>= 2.6.5) - net-ssh-gateway (>= 1.2.0) - netrc (0.11.0) - nori (2.7.1) - bigdecimal - ohai (19.1.40) - base64 - chef-config (>= 14.12, < 20) - chef-utils (>= 16.0, < 20) - ffi (>= 1.15.5) - ffi-yajl (>= 2.2, < 3.0) - ipaddress - mixlib-cli (>= 1.7.0) - mixlib-config (>= 2.0, < 4.0) - mixlib-log (>= 2.0.1, < 4.0) - mixlib-shellout (>= 3.3.6, < 3.5.0) - plist (~> 3.1) - train-core - wmi-lite (~> 1.0) - ostruct (0.6.3) - parallel (1.28.0) - parser (3.3.11.1) - ast (~> 2.4.1) - racc - parslet (2.0.0) - pastel (0.8.0) - tty-color (~> 0.5) - plist (3.7.2) - prism (1.9.0) - proxifier2 (1.1.0) - pry (0.16.0) - coderay (~> 1.1) - method_source (~> 1.0) - reline (>= 0.6.0) - pstore (0.1.4) - public_suffix (6.0.2) - racc (1.8.1) - rack (3.2.6) - rackup (2.3.1) - rack (>= 3) - rainbow (3.1.1) - regexp_parser (2.12.0) - reline (0.6.3) - io-console (~> 0.5) - rest-client (2.1.0) - http-accept (>= 1.7.0, < 2.0) - http-cookie (>= 1.0.2, < 2.0) - mime-types (>= 1.16, < 4.0) - netrc (~> 0.8) - rexml (3.4.4) - rspec (3.13.2) - rspec-core (~> 3.13.0) - rspec-expectations (~> 3.13.0) - rspec-mocks (~> 3.13.0) - rspec-core (3.13.6) - rspec-support (~> 3.13.0) - rspec-expectations (3.13.5) - diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.13.0) - rspec-its (2.0.0) - rspec-core (>= 3.13.0) - rspec-expectations (>= 3.13.0) - rspec-mocks (3.13.8) - diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.13.0) - rspec-support (3.13.7) - rubocop (1.86.1) - json (~> 2.3) - language_server-protocol (~> 3.17.0.2) - lint_roller (~> 1.1.0) - parallel (>= 1.10) - parser (>= 3.3.0.2) - rainbow (>= 2.2.2, < 4.0) - regexp_parser (>= 2.9.3, < 3.0) - rubocop-ast (>= 1.49.0, < 2.0) - ruby-progressbar (~> 1.7) - unicode-display_width (>= 2.4.0, < 4.0) - rubocop-ast (1.49.1) - parser (>= 3.3.7.2) - prism (~> 1.7) - ruby-progressbar (1.13.0) - rubyntlm (0.6.5) - base64 - rubyzip (2.4.1) - semverse (3.0.2) - socksify (1.8.1) - sslshake (1.3.1) - strings (0.2.1) - strings-ansi (~> 0.2) - unicode-display_width (>= 1.5, < 3.0) - unicode_utils (~> 1.4) - strings-ansi (0.2.0) - syslog (0.4.0) - logger - syslog-logger (1.6.8) - thor (1.4.0) - time (0.4.2) - date - timeout (0.6.1) - tomlrb (2.0.4) - train-core (3.16.5) - addressable (~> 2.5) - ffi (>= 1.16.0, < 1.18) - json (>= 2.19.2, < 3.0) - mixlib-shellout (>= 2.0, < 4.0) - net-scp (>= 1.2, < 5.0) - net-ssh (>= 2.9, < 8.0) - train-rest (0.5.0) - aws-sigv4 (~> 1.5) - rest-client (~> 2.1) - train-core (~> 3.0) - train-winrm (0.4.3) - chef-winrm (>= 2.4.4, < 3.0) - chef-winrm-elevated (>= 1.2.5, < 2.0) - chef-winrm-fs (>= 1.4.1, < 2.0) - socksify (~> 1.8) - tty-box (0.7.0) - pastel (~> 0.8) - strings (~> 0.2.0) - tty-cursor (~> 0.7) - tty-color (0.6.0) - tty-cursor (0.7.1) - tty-prompt (0.23.1) - pastel (~> 0.8) - tty-reader (~> 0.8) - tty-reader (0.9.0) - tty-cursor (~> 0.7) - tty-screen (~> 0.8) - wisper (~> 2.0) - tty-screen (0.8.2) - tty-spinner (0.9.3) - tty-cursor (~> 0.7) - tty-table (0.12.0) - pastel (~> 0.8) - strings (~> 0.2.0) - tty-screen (~> 0.8) - unf_ext (0.0.9.1) - unicode-display_width (2.6.0) - unicode_utils (1.4.0) - uri (1.1.1) - uuidtools (3.0.0) - vault (0.20.1) - aws-sigv4 - base64 - net-http-persistent (~> 4.0, >= 4.0.2) - webrick (1.9.2) - wisper (2.0.1) - wmi-lite (1.0.7) - -PLATFORMS - arm64-darwin-22 - x86_64-darwin-18 - x86_64-darwin-19 - x86_64-linux - -DEPENDENCIES - knife-zero (~> 2.6.0) - -BUNDLED WITH - 2.2.15 diff --git a/README.md b/README.md index e7b2df0..1600551 100644 --- a/README.md +++ b/README.md @@ -2,45 +2,61 @@ This repository contains all infrastructure automation code that we use to set up and configure servers, virtual machines, and applications for Kosmos hosted services. -Chef cookbooks are written in Ruby, and based on [Chef Infra +Cookbooks are written in Ruby, and based on [Chef Infra resources](https://docs.chef.io/resources/). Some cookbooks contain integration test suites based on [Test Kitchen](https://docs.chef.io/workstation/kitchen/). +Nodes run the community [Cinc Client](https://cinc.sh/) distribution of Chef +Infra Client instead of the license-gated Chef Infra Client. Everything — the +`knife zero` workflow and the Test Kitchen suites — is driven by +[Cinc Workstation](https://cinc.sh/docs/workstation/), and on-node +configuration lives in `/etc/cinc`. + Note: Manual configuration of servers and applications is highly discouraged, and can be overwritten or lost without notice! ## Setup -### Install Chef Workstation +### Install Cinc Workstation -* macOS, Windows, RHEL, Ubuntu: https://docs.chef.io/workstation/install_workstation/ -* Arch Linux: https://aur.archlinux.org/packages/chef-workstation +Cinc Workstation replaces Chef Workstation. Install it following +https://cinc.sh/docs/workstation/ — or, on Arch Linux, the `cinc-workstation-bin` +AUR package. It installs to `/opt/cinc-workstation` and reads its user config +from `~/.cinc-workstation`. #### rbenv If you use rbenv to manage Ruby versions on your system, install the -[rbenv-chef-workstation](https://github.com/docwhat/rbenv-chef-workstation) -plugin. +`rbenv-cinc-workstation` plugin (the Cinc port of +[rbenv-chef-workstation](https://github.com/docwhat/rbenv-chef-workstation)), +create an empty `$(rbenv root)/versions/cinc-workstation` directory, and run +`rbenv rehash`. This repository pins the version in `.ruby-version`. -### Install gem dependencies +### Install knife-zero -Clone this repository, `cd` into it, and run: +`knife-zero` is not bundled with Cinc Workstation. Install it into Cinc's user +gem directory: - bundle install + cinc gem install knife-zero + +### Configure knife + +Copy `.cinc/config.rb.example` to `.cinc/config.rb` and adjust +`encrypted_data_bag_secret` if your secret lives elsewhere. ## Common tasks ### Bootstrap a new host server - knife zero bootstrap root@server-name.kosmos.org --run-list "role[base],role[kvm_host]" --secret-file .chef/encrypted_data_bag_secret + knife zero bootstrap root@server-name.kosmos.org --run-list "role[base],role[kvm_host]" --secret-file .cinc/encrypted_data_bag_secret ### Bootstrap a new VM - knife zero bootstrap ubuntu@zerotier-ip-address -x ubuntu --sudo --run-list "role[base],role[kvm_guest]" --secret-file .chef/encrypted_data_bag_secret + knife zero bootstrap ubuntu@zerotier-ip-address -x ubuntu --sudo --run-list "role[base],role[kvm_guest]" --secret-file .cinc/encrypted_data_bag_secret ### Bootstrap a new VM with environment and role/app (postgres replica as example) - knife zero bootstrap ubuntu@10.1.1.134 -x ubuntu --sudo --environment production --run-list "role[base],role[kvm_guest],role[postgresql_replica]" --secret-file .chef/encrypted_data_bag_secret + knife zero bootstrap ubuntu@10.1.1.134 -x ubuntu --sudo --environment production --run-list "role[base],role[kvm_guest],role[postgresql_replica]" --secret-file .cinc/encrypted_data_bag_secret ### Run Chef Zero on a host server @@ -50,13 +66,13 @@ Clone this repository, `cd` into it, and run: knife zero converge -a knife_zero.host name:vm-name-23 -### Update Chef Client on a server: +### Update Cinc Client on a server - knife zero converge name:dev.kosmos.org --client-version 15.3.14 + knife zero converge name:dev.kosmos.org --client-version 18.2.7 -### Upgrade Chef Client on a node: +### Upgrade Cinc Client on a node - knife ssh -a knife_zero.host 'name:foo-1' 'curl -L https://chef.io/chef/install.sh | sudo bash -s -- -v 18.10.17' + knife ssh -a knife_zero.host 'name:foo-1' 'curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -v 19' ## Managing cookbooks @@ -70,13 +86,12 @@ Vendor installed cookbooks to the `cookbooks/` dir: berks vendor cookbooks/ --delete -## "Expired" TLS certificates +## Integration tests -If you encounter expired TLS certificates during a Chef run (e.g. for remote -files), the issue is likely that the certificate has been issued by Let's -Encrypt and Chef is still using its own, outdated CA cert store (see -[here](https://github.com/chef/chef/issues/12126#issuecomment-932067530) for -example). +Some cookbooks contain Test Kitchen suites. They are configured to run against +Cinc Client (`provisioner: product_name: cinc`) and use Cinc Workstation's +bundled `kitchen` (which ships a Cinc-capable `kitchen-dokken`): -As a hotfix, you can manually remove the "DST Root CA X3" cert from -`/opt/chef/embedded/ssl/cert.pem` on the machine you're trying to converge. + kitchen test + +(use `kitchen converge`/`verify` while iterating on a single suite). diff --git a/doc/ldap.md b/doc/ldap.md index 846bf2d..0e62085 100644 --- a/doc/ldap.md +++ b/doc/ldap.md @@ -6,7 +6,7 @@ The admin account is `cn=Directory Manager` with the password stored in the encrypted data bag `admin_password` item ``` -$ knife data bag show credentials dirsrv --secret-file .chef/encrypted_data_bag_secret +$ knife data bag show credentials dirsrv --secret-file .cinc/encrypted_data_bag_secret ``` ## Example search (will prompt for password): diff --git a/environments/development.json b/environments/development.json index b98e9ad..c9b1168 100644 --- a/environments/development.json +++ b/environments/development.json @@ -1,6 +1,6 @@ { "name": "development", - "description": "development environment, for example for Vagrant", + "description": "development environment, for example for local Test Kitchen runs", "json_class": "Chef::Environment", "chef_type": "environment", "default_attributes": { diff --git a/scripts/postgresql/switch_primary.sh b/scripts/postgresql/switch_primary.sh index 30413ba..4841f2b 100755 --- a/scripts/postgresql/switch_primary.sh +++ b/scripts/postgresql/switch_primary.sh @@ -9,14 +9,14 @@ fi old_primary_hostname=$1 new_primary_hostname=$2 -new_primary_ip=`bundle exec knife node show $new_primary_hostname -a knife_zero.host | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" -o` +new_primary_ip=`knife node show $new_primary_hostname -a knife_zero.host | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" -o` echo "Switching primary to $new_primary_hostname ($new_primary_ip)" -bundle exec knife ssh name:$new_primary_hostname -a knife_zero.host "sudo su - postgres -c '/usr/lib/postgresql/12/bin/pg_ctl promote -D /var/lib/postgresql/12/main'" +knife ssh name:$new_primary_hostname -a knife_zero.host "sudo su - postgres -c '/usr/lib/postgresql/12/bin/pg_ctl promote -D /var/lib/postgresql/12/main'" echo "Stopping postgresql on $old_primary_hostname" -bundle exec knife ssh name:$old_primary_hostname -a knife_zero.host "sudo systemctl stop postgresql@12-main.service" +knife ssh name:$old_primary_hostname -a knife_zero.host "sudo systemctl stop postgresql@12-main.service" echo "Replacing pg.kosmos.local host entries with $new_primary_ip" -bundle exec knife ssh roles:postgresql_client -a knife_zero.host "sudo sed -r \"s/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s(pg.kosmos.local)/$new_primary_ip\t\1/\" -i /etc/hosts" +knife ssh roles:postgresql_client -a knife_zero.host "sudo sed -r \"s/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s(pg.kosmos.local)/$new_primary_ip\t\1/\" -i /etc/hosts" # TODO # 1. Change roles in node configs