Target Mode with Chef Server and Chef Automate
It is not sufficient to provision remote devices via Target Mode but we also want an overview of node attributes, run history and changed resources.
In this post we have a look at how to connect agentless resources with central servers to give us the much-needed visibility.
After our quick run down of the new Chef Target Mode, we know how to use it with a local workstation only, but have no connection to Chef Server/Automate, which would be a major benefit to most environments.
The Chef Runner
Currently, Chef does not include a way to schedule Chef runs in target mode on itself. The pattern we use for now is not unlike the way Ansible works as well: a workstation to schedule and run all our tasks… I mean runlists.
For each device you want to remotely manage, you need to create a new node in Chef - for example inside the Chef Server itself. You should safely store the private key of that new device, because we will need it lateron. You might as well set a runlist for that node, if you already have uploaded a Target Mode-compatible cookbook to your server.
First, we will add the client credentials to our system-wide
/etc/chef/credentials file with its nodename being the section heading. If you don’t know how that file is structured, check the first post in the Target Mode series.
To authenticate against the server, we then add the private key of the new device under
/etc/chef/nodename/client.pem, so the Chef client can easily find it.
And, of course, we might configure some things to reach our Chef server (or switch backend protocols) in our
/etc/chef/client.rb. Just specifying the
chef_server_url property might be enough, though.
Without a Target Mode runner inside the Chef server we are stuck with good old cron jobs. Runs of your Target nodes can be scheduled easy enough with a file in
cat > /etc/cron.d/nodename.cron <<EOF PATH="/opt/chefdk/bin:/opt/chefdk/embedded/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" GEM_ROOT="/opt/chefdk/embedded/lib/ruby/gems/2.6.0" 0,30 * * * * * chef-runner /usr/bin/chef-client -t nodename EOF
If you want to randomly offset the runs, like with the chef-client
splay attribute, you might either use the
RANDOM_DELAY variable (if your cron implementation features it) or have a random offset command like
sleep $(numrandom 0..30)m (from ubuntu’s
num-utils package) as a prefix to your command.
Afterwards, you will see your node pop up in Chef Server/Chef Automate just like a regular node.
As already stated, most resources do not yet have target mode implemented. In addition, there still is no “Remote OHAI” for getting more than basic platform data via Train. That feature is on Chef’s roadmap though, so it should not be too long until it lands. Until then, you won’t even see a Chef Client version in your node attributes.