[Chef] Chef Server Run Recipe

1. Chef Server Run Recipe

• Recipe 작성

[root@ChefWorkstation] $ vi ~/chef-repo/cookbooks/sample/recipes/default.rb
template "/tmp/chef-sample.txt" do
   mode 0644
end
 
:wq

• 템플릿 작성

[root@ChefWorkstation] $ vi ~/chef-repo/cookbooks/sample/templates/default/chef-sample.txt.erb
Platform: <%= node[:platform] %>
Ruby: <%= node[:languages][:ruby][:version] %>
IP Address: <%= node[:ipaddress] %>
 
:wq

• Cookbook 업로드
  • 모든 cookbook을 업로드 하는 경우에는 cookbook명 대신 -a로 대체

[root@ChefWorkstation] $ knife cookbook upload sample
Uploading sample       [0.1.0]
Uploaded 1 cookbook.

• ChefClient의 run_list에 recipe 등록
  • set : 기존 run_list를 초기화하고 recipe 등록
  • add : 기존 run_list를 유지하고 recipe 추가
  • remove : 기존 run_list에서 recipe 제거

[root@ChefWorkstation] $ knife node run_list add 172.16.1.148 recipe[sample]
172.16.1.148 :
run_list : recipe[sample]

• Chef-client를 실행하여 파일내용 확인

[root@ChefClient] $ chef-client
[2015-06-16T06:50:44+00:00] INFO: Forking chef instance to converge...
Starting Chef Client, version 12.4.1
…
[2015-06-16T06:51:01+00:00] INFO: Report handlers complete
Chef Client finished, 1/1 resources updated in 17.228319 seconds
 
[root@ChefClient] $ cat /tmp/chef-sample.txt
Platform: centos
Ruby: 2.1.6
IP Address: 10.1.1.109

1.1. Workstation에서 node 실행

Chef Server에 등록된 노드에 대하여 Workstation에서 knife ssh로 명령을 수행할 수 있다. 이는 주로 설정이 변경된 노드에서 chef-client를 재실행하기 위해 사용한다.

1.1.1. knife ssh를 통한 node 실행

• ChefClient에서 chef-client 실행
  • node의 FQDN이 설정되어있어야 함
  • 모든 노드에서 실행 하는 경우에는 ‘name:*’ 사용

[root@ChefWorkstation] $ knife ssh ‘name:172.16.1.148’ ‘sudo chef-client’
root@ChefClient’s password:
 
ChefClient Starting Chef Client, version 12.4.1
ChefClient resolving cookbooks for run list: ["sample"]
ChefClient Synchronizing Cookbooks:
ChefClient   - sample
…
ChefClient Running handlers:
ChefClient Running handlers complete
ChefClient Chef Client finished, 0/3 resources updated in 57.520341 seconds

 

 

1.1.2. ssh key를 이용한 node 연결

ssh 연결을 위해서는 연결하려는 서버의 패스워드가 필요하다. ssh key를 설정하면 서버의 패스워드 입력 없이 ssh key의 패스워드를 통해 노드에 접속할 수 있다. ssh key의 패스워드를 설정하지 않은 경우에는 바로 접속이 가능하다.(해당 방법은 Server에 비인가자가 침입한 경우, 2차 보안사고를 유발할 수 있어 추천하지 않는다.) ssh key를 이용한 접속은 다음과 같은 과정으로 진행된다.

1. Chef Workstation ssh key 생성
2. 노드에 Chef Workstation ssh 공개키 전송
3. 패스워드 없이 knife ssh 실행

• Workstation에서 ssh-keygen을 이용하여 RSA key를 생성

[root@ChefWorkstation] $ ssh-keygen –t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
0e:b8:2e:c6:b5:75:2d:06:25:82:de:21:4e:03:06:bb root@ChefWorkstation

해당 과정을 수행하면 ~/.ssh/id_rsa(개인키)와 ~/.ssh/id_rsa.pub(공개키)가 생성된다. .ssh 디렉토리는 인증키가 담긴 중요한 디렉토리이다. 따라서 인가된 사용자만 접근이 가능하도록 퍼미션 설정이 필요하다.

• .ssh 디렉토리 및 하위 파일 권한 변경

[root@ChefWorkstation] $ chmod 700 ~/.ssh
[root@ChefWorkstation] $ chmod 600 ~/.ssh/id_rsa
[root@ChefWorkstation] $ chmod 644 ~/.ssh/id_rsa.pub

권한 설정을 변경한 이후, 접속하고자 하는 노드에 id_rsa.pub(공개키) 파일을 전송한다.

[root@ChefWorkstation] $ ssh root@172.16.1.148 "mkdir .ssh; chmod 0700 .ssh"
root@172.16.1.148's password:
 
[root@ChefWorkstation] $ scp ~/.ssh/id_rsa.pub root@172.16.1.148:.ssh/authorized_keys
root@172.16.1.148's password:
id_rsa.pub                                  100%  402     0.4KB/s   00:00

해당 과정을 완료한 후에는 ChefClient 노드에 패스워드 입력 없이 ssh 접속이 가능하다.

[root@ChefWorkstation] $ ssh root@172.16.1.148
Last login: Mon Jul 20 09:48:36 2015 from chefworkstation.cs4cloud.internal
[root@ChefClient] $

• knife ssh를 이용하여 chef-client 수행 테스트

[root@ChefWorkstation] $ knife ssh 'name:172.16.1.148' 'sudo chef-client'
ChefClient Starting Chef Client, version 12.4.1
ChefClient resolving cookbooks for run list: ["sample"]
ChefClient Synchronizing Cookbooks:
...
ChefClient Running handlers complete
ChefClient Chef Client finished, 0/1 resources updated in 15.446891 seconds

2. 여러 개의 패키지 한 번에 설치

Ruby의 반복문 설정을 통해 여러 개의 패키지 설치가 가능하다.

• Cookbook 생성

[root@ChefWorkstation] $ knife cookbook create sample2
** Creating cookbook sample in /root/chef-repo/cookbooks
** Creating README for cookbook: sample
** Creating CHANGELOG for cookbook: sample
** Creating metadata for cookbook: sample

• Recipe 작성

[root@ChefWorkstation] $ /root/chef-repo/cookbooks/sample2/recipes/default.rb
%w{zsh gcc make readline-devel}.each do |pkg|
  package pkg do
    action :install
  end
end
 
:wq

• Cookbook 업로드

$ knife cookbook upload sample2
Uploading sample2        [0.1.0]
Uploaded 1 cookbook.

• ChefClient의 run_list에 recipe 등록

[root@ChefWorkstation] $ knife node run_list set 172.16.1.148 recipe[sample2]
172.16.1.148 :
run_list : recipe[sample2]

• Chef Client에 적용

[root@ChefWorkstation] $ knife ssh 'name:172.16.1.148' 'sudo chef-client'
Starting Chef Client, version 12.4.1
resolving cookbooks for run list: ["sample2”]
…
Running handlers complete
Chef Client finished, 3/4 resources updated in 369.023678 seconds
 
// 패키지 설치 확인
[root@ChefWorkstation] $ knife ssh 'name:172.16.1.148' 'rpm –qa zsh gcc make 172.16.1.148 gcc-4.1.2-55.el5'
172.16.1.148 make-3.81-3.el5
172.16.1.148 readline-devel-5.1-3.el5
172.16.1.148 zsh-4.2.6-10.el5_11
172.16.1.148 readline-devel-5.1-3.el5

참 고 문 헌

[1] Joinc, “클라우드 오토메이션”, http://www.joinc.co.kr/modules/moniwiki/wiki.php/Site
/cloud/automation, 2015.

[2] Opscode, “CHEF DOCUMENTS”, http://docs.chef.io/, 2015.

[3] MIMUL’S DEVELOPER WORLD, “가상 환경에서 Chef 훅 돌려보기”, http://mimul.com
/pebble/default/2013/11/15/1384511737191.html, 2015.

[4] 이토 나오야, 박상욱, “인프라스트럭처 자동화 프레임워크 Chef Solo 입문”, 제이펍, 2014.

[5] 마티아스 마샬, 최광민, “Chef, 클라우드 서비스 설정관리 자동화 도구”, 에이콘, 2015.