The Chef agent installs fine but it doesn’t want to bootstrap. I believe it’s down to SSL between the agent and the server. I want to turn this off. How do I do this? I took a stab in the dark and tried:
You were pretty close I think. There’s a bootstrap_option that the VM Extension should recognise called node_ssl_verify_mode. It seems to be documented for ARM templates at https://docs.chef.io/azure_portal.html but not explicitly for the PowerShell cmdlets:
"node_ssl_verify_mode": "none"
Alternatively if you’re building an image for distribution don’t forget you can use knife ssl fetch https://chef-livingston.company.net and then try and pre-load the certificates into the c:\chef\trusted_certs folder within in the image.
Thanks for the response Stuart. We managed to find that by digging into the details of the VM after installing the extension through the GUI. Unfortunately it's still not working. I've just tried this:
Unfortunately it doesn’t look like that is actually a bootstrap_option and is more of a directive to the extension, and it looks like it’s only settable using ARM, rather than being exposed as a parameter to the cmdlet.
One more thought is that you could try setting the ssl_verify_mode by specifying a custom client.rb (using the -client_rb parameter to the PowerShell cmdlet?). You may need to delimit each line with \n.
Thanks Stuart, that was my next thought but wanted to avoid it if possible. I may also try and get a certificate that the clients will trust. Issue is, they aren’t domain joined at this point. So we can’t use our CA.
What’s the process you use to stand up the machines themselves? Do you use an ARM template or some other process. Perhaps you could add the settings by using node_ssl_verify_mode or even specifying chef_server_crt via use of the ARM template deployment? Or if you’re wedded to using PowerShell cmdlets everywhere with no external payload I’ve seen many more creative solutions out there in the field I’d be happy to talk you through directly!
I have a fair bit of PowerShell experience but am new to Azure and Chef, so my aim is to keep things as simple as possible and all in one place. In a nutshell the build process is as follows. An in house website will generate a template file for servers based on the requirements (machine spec, environment etc). This file looks like this:
This is then picked up by a series of scripts which build and configure the server and any of the prerequisites (resource groups, availability sets etc.). The servers are then built using an Azure RM VM Config passed to the New-AzureRMVM cmdlet
The server appears in Chef and gets it’s runlist assigned, but it never runs it. From then on I get:
Error Source/Chef EventID/10003
Failed Chef Client run UNKNOWN in UNKNOWN seconds.
Exception type: Net::HTTPServerException
Exception message: 403 "Forbidden"
Exception backtrace: C:/opscode/chef/embedded/lib/ruby/2.3.0/net/http/response.rb:120:in error!' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/http.rb:150:inrequest’
C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/http.rb:123:in put' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/api_client/registration.rb:102:inupdate’
C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/api_client/registration.rb:92:in rescue in create_or_update' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/api_client/registration.rb:87:increate_or_update’
C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/api_client/registration.rb:58:in run' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/client.rb:621:inregister’
C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/client.rb:267:in run' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/application.rb:277:inrun_with_graceful_exit_option’
C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/application.rb:253:in block in run_chef_client' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/local_mode.rb:44:inwith_server_connectivity’
C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/application.rb:236:in run_chef_client' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/application/client.rb:427:inrun_application’
C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/lib/chef/application.rb:59:in run' C:/opscode/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36-universal-mingw32/bin/chef-client:26:in<top (required)>'
C:/opscode/chef/bin/chef-client:68:in load' C:/opscode/chef/bin/chef-client:68:in’
I removed the runlist and restarted the machine, but I get the same issue. My searching has only turned up suggestions around permissions (which I’ve checked and seem to be okay AFAIK) and timeouts on long running cookbooks (not the issue here).
The first cookbook that runs joins the machine to the domain. This was then breaking the client as the nodename would change. Just before the domain join, I put this line in:
Well, this worked for a while but we now have an issue. The nodes have started registering with .reddog.microsoft.com in their nodename, despite what I have above.
Example build, Dev-TES-App-01
When the machine was provisioned this was fed as the bootstrap options:
This is breaking the client as when the machine joins our domain, it’s nodename changes. We also don’t want them to register with reddog.microsoft.com in the name anyway, as this isn’t our domain.
Does anyone know why the client would be ignoring the options I’m feeding into it?
I don't know if this would help but try to force it use your DNS instead of Azure before applying the name and joining it to the domain.
Azure provides DNS name resolution by default for all virtual machines so i wrote a cookbook for the Linux machine to use the DNS i wanted, I believe its still in the Chef server if no one deleted it
