# Knife configure (chef 12)

**URL:** <https://discourse.chef.io/t/knife-configure-chef-12/5884>\
**Category:** Chef Infra (archive)\
**Created:** [October 7, 2014, 4:15am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884 "2014-10-07T04:15:47Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![idzzy](https://avatars.discourse-cdn.com/v4/letter/i/d6d6ee/32.png) [@idzzy](https://discourse.chef.io/u/idzzy)\
**Post date:** [October 7, 2014, 4:15am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/1 "2014-10-07T04:15:47Z")

</div>

Hello,

In chef 11, when I executed “knife configure —initial” on workstation,  
copied from below pem files from chef server.

- /etc/chef-server/admin.pm
- /etc/chef-server/chef-validator.pem

But In chef 12, there are not these pem files.  
Which pem file can I use when I execute “knife configure —initial” on workstation?

[Chef Workstation]# knife configure --initial  
WARNING: No knife configuration file found  
Where should I put the config file? [/root/.chef/knife.rb]  
Please enter the chef server URL: [[https://xxx:443](https://xxx:443)] [https://x.x.x.x:443](https://x.x.x.x:443)  
Please enter a name for the new user: [root]  
Please enter the existing admin name: [admin]  
Please enter the location of the existing admin’s private key: [/etc/chef-server/admin.pem]  
Please enter the validation clientname: [chef-validator]  
Please enter the location of the validation key: [/etc/chef-server/chef-validator.pem]  
Please enter the path to a chef repository (or leave blank): /root/chef-repo  
Creating initial API user…  
Please enter a password for the new user:  
ERROR: Your private key could not be loaded from /etc/chef-server/admin.pem  
Check your configuration file and ensure that your private key is readable

[Chef Workstation]# find /opt/chefdk -name “\*.pem” | egrep “admin|valid”  
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/test-kitchen-1.2.1/support/dummy-validation.pem  
/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/berkshelf-3.1.5/spec/config/validator.pem  
/opt/chefdk/embedded/apps/test-kitchen/support/dummy-validation.pem  
/opt/chefdk/embedded/apps/berkshelf/spec/config/validator.pem

[Chef Server]# find /etc/{chef,opscode} -name “\*.pem”  
/etc/opscode/worker-private.pem  
/etc/opscode/worker-public.pem  
/etc/opscode/webui\_priv.pem  
/etc/opscode/webui\_pub.pem  
/etc/opscode/pivotal.pem

I installed knife-solo by following command on workstation.

# chef gem install knife-solo

Version:

- chef-server-core-12.0.0\_rc.4-1.el5.x86\_64
- chefdk-0.3.0-1.x86\_64
- knife-solo (0.4.2)

Thank you.

–  
idzzy

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [October 7, 2014, 4:25am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/2 "2014-10-07T04:25:34Z")

</div>

On Monday, October 6, 2014 at 9:15 PM, idzzy wrote:

> Hello,
> 
> In chef 11, when I executed “knife configure —initial” on workstation,  
> copied from below pem files from chef server.
> 
> - /etc/chef-server/admin.pm
> - /etc/chef-server/chef-validator.pem
> 
> But In chef 12, there are not these pem files.  
> Which pem file can I use when I execute “knife configure —initial” on workstation?

A similar issue just came up on the list: [chef - [chef] Chef Open Source Sever 12 RC](http://lists.opscode.com/sympa/arc/chef/2014-10/msg00048.html)

With Chef 12 server, users can be admins (or not) in multiple organizations independently, so you need to create an organization and a user to be admin of it first, then you can add new users.

--  
Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![idzzy](https://avatars.discourse-cdn.com/v4/letter/i/d6d6ee/32.png) [@idzzy](https://discourse.chef.io/u/idzzy)\
**Post date:** [October 7, 2014, 5:39am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/3 "2014-10-07T05:39:03Z")

</div>

Hello,

Thank you Daniel.

I’ve already created organization and user and could login to Chef-Manage.

I got knife.rb by executing “Generate Knife Config in Organizations Menu”.  
I’ll put this file in ~/.chef/ on workstation.  
But where can I get user.pem and organization-validator.pem?

* * *

## current\_dir = File.dirname( **FILE** ) log\_level :info log\_location STDOUT node\_name "idey" client\_key "#{current\_dir}/user.pem" validation\_client\_name “organization-validator" validation\_key "#{current\_dir}/organization-validator.pem" chef\_server\_url "[https://host/organizations/organization](https://host/organizations/organization)" cache\_type 'BasicFile' cache\_options( :path =\> "#{ENV['HOME']}/.chef/checksums" ) cookbook\_path ["#{current\_dir}/../cookbooks"]

I can see public file of user by this command. but this is just public key.

# chef-server-ctl user-show user

Is there manual/document somewhere which is described this kind of procedure?  
I still cannot find it...

Thank you.

—  
idzzy

On October 7, 2014 at 1:25:57 PM, Daniel DeLeo ([dan@kallistec.com](mailto:dan@kallistec.com)) wrote:

On Monday, October 6, 2014 at 9:15 PM, idzzy wrote:

> Hello,
> 
> In chef 11, when I executed “knife configure —initial” on workstation,  
> copied from below pem files from chef server.
> 
> - /etc/chef-server/admin.pm
> - /etc/chef-server/chef-validator.pem
> 
> But In chef 12, there are not these pem files.  
> Which pem file can I use when I execute “knife configure —initial” on workstation?

A similar issue just came up on the list: [http://lists.opscode.com/sympa/arc/chef/2014-10/msg00048.html](http://lists.opscode.com/sympa/arc/chef/2014-10/msg00048.html)

With Chef 12 server, users can be admins (or not) in multiple organizations independently, so you need to create an organization and a user to be admin of it first, then you can add new users.

--  
Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![jdunn](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jdunn/32/1800_2.png) [@jdunn](https://discourse.chef.io/u/jdunn)\
**Post date:** [October 7, 2014, 8:53pm UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/4 "2014-10-07T20:53:16Z")

</div>

From the "manage" interface, if you click "download starter kit", you  
get a zipfile containing a .chef directory that has the keys you need.

Also, to update the info from yesterday: there is a workaround if you  
don't want to install the webui and are doing all operations from the  
server prompt. You just create the org first and then the user (see  
the conversation on the bug at  
[https://github.com/opscode/opscode-omnibus/issues/534#issuecomment-58186003](https://github.com/opscode/opscode-omnibus/issues/534#issuecomment-58186003))

In that situation, the org and user keys are printed on stdout when  
you create them.

- Julian

On Tue, Oct 7, 2014 at 1:39 AM, idzzy [idezebi@gmail.com](mailto:idezebi@gmail.com) wrote:

> Hello,
> 
> Thank you Daniel.
> 
> I’ve already created organization and user and could login to Chef-Manage.
> 
> I got knife.rb by executing “Generate Knife Config in Organizations Menu”.  
> I’ll put this file in ~/.chef/ on workstation.  
> But where can I get user.pem and organization-validator.pem?
> 
> * * *
> 
> ## current\_dir = File.dirname( **FILE** ) log\_level :info log\_location STDOUT node\_name "idey" client\_key "#{current\_dir}/user.pem" validation\_client\_name “organization-validator" validation\_key "#{current\_dir}/organization-validator.pem" chef\_server\_url "[https://host/organizations/organization](https://host/organizations/organization)" cache\_type 'BasicFile' cache\_options( :path =\> "#{ENV['HOME']}/.chef/checksums" ) cookbook\_path ["#{current\_dir}/../cookbooks"]
> 
> I can see public file of user by this command. but this is just public key.
> 
> # chef-server-ctl user-show user
> 
> Is there manual/document somewhere which is described this kind of  
> procedure?  
> I still cannot find it...
> 
> Thank you.
> 
> —  
> idzzy
> 
> On October 7, 2014 at 1:25:57 PM, Daniel DeLeo ([dan@kallistec.com](mailto:dan@kallistec.com)) wrote:
> 
> On Monday, October 6, 2014 at 9:15 PM, idzzy wrote:
> 
> > Hello,
> > 
> > In chef 11, when I executed “knife configure —initial” on workstation,  
> > copied from below pem files from chef server.
> > 
> > - /etc/chef-server/admin.pm
> > - /etc/chef-server/chef-validator.pem
> > 
> > But In chef 12, there are not these pem files.  
> > Which pem file can I use when I execute “knife configure —initial” on  
> > workstation?
> 
> A similar issue just came up on the list:  
> [http://lists.opscode.com/sympa/arc/chef/2014-10/msg00048.html](http://lists.opscode.com/sympa/arc/chef/2014-10/msg00048.html)
> 
> With Chef 12 server, users can be admins (or not) in multiple organizations  
> independently, so you need to create an organization and a user to be admin  
> of it first, then you can add new users.
> 
> --  
> Daniel DeLeo

--  
[Julian C. Dunn [jdunn@aquezada.com](mailto:jdunn@aquezada.com) \* Sorry, I'm ]  
[WWW: [http://www.aquezada.com/staff/julian](http://www.aquezada.com/staff/julian) \* only Web 1.0 ]  
[gopher://sdf.org/1/users/keymaker/ \* compliant!]  
[PGP: 91B3 7A9D 683C 7C16 715F 442C 6065 D533 FDC2 05B9]

---

<div class="post-metadata">

**Author:** ![idzzy](https://avatars.discourse-cdn.com/v4/letter/i/d6d6ee/32.png) [@idzzy](https://discourse.chef.io/u/idzzy)\
**Post date:** [October 8, 2014, 2:30am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/5 "2014-10-08T02:30:36Z")

</div>

Hello,

Thank you Julian.

I’ve already installed chef-manage and using UI.  
I could access chef-server from knife-solo by using the “starter kit”.

When I pushed the button [Download Starter Kit], following messages was displayed.  
So I could not make sure wether the keys should be RESET or not.

"Your user and organization keys will be reset. Are you sure you want to do this?"

Thanks for giving me the advice about such kind of basic question.

—  
idzzy

On October 8, 2014 at 5:53:36 AM, Julian C. Dunn ([jdunn@aquezada.com](mailto:jdunn@aquezada.com)) wrote:

From the "manage" interface, if you click "download starter kit", you  
get a zipfile containing a .chef directory that has the keys you need.

Also, to update the info from yesterday: there is a workaround if you  
don't want to install the webui and are doing all operations from the  
server prompt. You just create the org first and then the user (see  
the conversation on the bug at  
[https://github.com/opscode/opscode-omnibus/issues/534#issuecomment-58186003](https://github.com/opscode/opscode-omnibus/issues/534#issuecomment-58186003))

In that situation, the org and user keys are printed on stdout when  
you create them.

- Julian

On Tue, Oct 7, 2014 at 1:39 AM, idzzy [idezebi@gmail.com](mailto:idezebi@gmail.com) wrote:

> Hello,
> 
> Thank you Daniel.
> 
> I’ve already created organization and user and could login to Chef-Manage.
> 
> I got knife.rb by executing “Generate Knife Config in Organizations Menu”.  
> I’ll put this file in ~/.chef/ on workstation.  
> But where can I get user.pem and organization-validator.pem?
> 
> * * *
> 
> ## current\_dir = File.dirname( **FILE** ) log\_level :info log\_location STDOUT node\_name "idey" client\_key "#{current\_dir}/user.pem" validation\_client\_name “organization-validator" validation\_key "#{current\_dir}/organization-validator.pem" chef\_server\_url "[https://host/organizations/organization](https://host/organizations/organization)" cache\_type 'BasicFile' cache\_options( :path =\> "#{ENV['HOME']}/.chef/checksums" ) cookbook\_path ["#{current\_dir}/../cookbooks"]
> 
> I can see public file of user by this command. but this is just public key.
> 
> # chef-server-ctl user-show user
> 
> Is there manual/document somewhere which is described this kind of  
> procedure?  
> I still cannot find it...
> 
> Thank you.
> 
> —  
> idzzy
> 
> On October 7, 2014 at 1:25:57 PM, Daniel DeLeo ([dan@kallistec.com](mailto:dan@kallistec.com)) wrote:
> 
> On Monday, October 6, 2014 at 9:15 PM, idzzy wrote:
> 
> > Hello,
> > 
> > In chef 11, when I executed “knife configure —initial” on workstation,  
> > copied from below pem files from chef server.
> > 
> > - /etc/chef-server/admin.pm
> > - /etc/chef-server/chef-validator.pem
> > 
> > But In chef 12, there are not these pem files.  
> > Which pem file can I use when I execute “knife configure —initial” on  
> > workstation?
> 
> A similar issue just came up on the list:  
> [chef - [chef] Chef Open Source Sever 12 RC](http://lists.opscode.com/sympa/arc/chef/2014-10/msg00048.html)
> 
> With Chef 12 server, users can be admins (or not) in multiple organizations  
> independently, so you need to create an organization and a user to be admin  
> of it first, then you can add new users.
> 
> --  
> Daniel DeLeo

--  
[Julian C. Dunn [jdunn@aquezada.com](mailto:jdunn@aquezada.com) \* Sorry, I'm ]  
[WWW: [http://www.aquezada.com/staff/julian](http://www.aquezada.com/staff/julian) \* only Web 1.0 ]  
[gopher://sdf.org/1/users/keymaker/ \* compliant!]  
[PGP: 91B3 7A9D 683C 7C16 715F 442C 6065 D533 FDC2 05B9]

---

<div class="post-metadata">

**Author:** ![jdunn](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jdunn/32/1800_2.png) [@jdunn](https://discourse.chef.io/u/jdunn)\
**Post date:** [October 8, 2014, 4:28am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/6 "2014-10-08T04:28:34Z")

</div>

On Tue, Oct 7, 2014 at 10:30 PM, idzzy [idezebi@gmail.com](mailto:idezebi@gmail.com) wrote:

> Hello,
> 
> Thank you Julian.
> 
> I’ve already installed chef-manage and using UI.  
> I could access chef-server from knife-solo by using the “starter kit”.
> 
> When I pushed the button [Download Starter Kit], following messages was  
> displayed.  
> So I could not make sure wether the keys should be RESET or not.
> 
> "Your user and organization keys will be reset. Are you sure you want to do  
> this?"
> 
> Thanks for giving me the advice about such kind of basic question.

Assuming you've just installed the server & nobody else is using it,  
yes, it's safe to reset those keys in order to get the starter kit.

Unsure why you've installed knife-solo; you don't need it if you're  
interacting with a server.

- Julian

--  
[Julian C. Dunn [jdunn@aquezada.com](mailto:jdunn@aquezada.com) \* Sorry, I'm ]  
[WWW: [http://www.aquezada.com/staff/julian](http://www.aquezada.com/staff/julian) \* only Web 1.0 ]  
[gopher://sdf.org/1/users/keymaker/ \* compliant!]  
[PGP: 91B3 7A9D 683C 7C16 715F 442C 6065 D533 FDC2 05B9]

---

<div class="post-metadata">

**Author:** ![idzzy](https://avatars.discourse-cdn.com/v4/letter/i/d6d6ee/32.png) [@idzzy](https://discourse.chef.io/u/idzzy)\
**Post date:** [October 8, 2014, 5:06am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/7 "2014-10-08T05:06:44Z")

</div>

Hello,

Thank you Julian for the reply.  
On October 8, 2014 at 1:28:55 PM, Julian C. Dunn ([jdunn@aquezada.com](mailto:jdunn@aquezada.com)) wrote:

Assuming you’ve just installed the server & nobody else is using it,  
yes, it’s safe to reset those keys in order to get the starter kit.

Understood.

Unsure why you’ve installed knife-solo; you don’t need it if you’re  
interacting with a server.

It’s for adding node to chef-server and apply recipes from workstation remotely by CLI.  
chef-manage is for checking and confining current state on web browser.  
I’m not familiar with this procedure of chef12.

Thank you.

—  
idzzy

---

<div class="post-metadata">

**Author:** ![jdunn](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jdunn/32/1800_2.png) [@jdunn](https://discourse.chef.io/u/jdunn)\
**Post date:** [October 8, 2014, 5:13am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/8 "2014-10-08T05:13:43Z")

</div>

On Wed, Oct 8, 2014 at 1:06 AM, idzzy [idezebi@gmail.com](mailto:idezebi@gmail.com) wrote:

> > On October 8, 2014 at 1:28:55 PM, Julian C. Dunn ([jdunn@aquezada.com](mailto:jdunn@aquezada.com)) wrote:
> > 
> > Unsure why you've installed knife-solo; you don't need it if you're  
> > interacting with a server.
> 
> It’s for adding node to chef-server and apply recipes from workstation  
> remotely by CLI.  
> chef-manage is for checking and confining current state on web browser.  
> I’m not familiar with this procedure of chef12.

You can just bootstrap a machine directly with knife and don't need  
"knife-solo" to do this, if you are interacting with a Chef server.

[http://learn.getchef.com/rhel/bootstrap-your-node/](http://learn.getchef.com/rhel/bootstrap-your-node/) will teach you how  
to do this (there are also variants on that site for Windows and  
Ubuntu if you use those OSes)

- Julian

--  
[Julian C. Dunn [jdunn@aquezada.com](mailto:jdunn@aquezada.com) \* Sorry, I'm ]  
[WWW: [http://www.aquezada.com/staff/julian](http://www.aquezada.com/staff/julian) \* only Web 1.0 ]  
[gopher://sdf.org/1/users/keymaker/ \* compliant!]  
[PGP: 91B3 7A9D 683C 7C16 715F 442C 6065 D533 FDC2 05B9]

---

<div class="post-metadata">

**Author:** ![idzzy](https://avatars.discourse-cdn.com/v4/letter/i/d6d6ee/32.png) [@idzzy](https://discourse.chef.io/u/idzzy)\
**Post date:** [October 8, 2014, 5:34am UTC](https://discourse.chef.io/t/knife-configure-chef-12/5884/9 "2014-10-08T05:34:55Z")

</div>

Hi,

On October 8, 2014 at 2:14:06 PM, Julian C. Dunn ([jdunn@aquezada.com](mailto:jdunn@aquezada.com)) wrote:

You can just bootstrap a machine directly with knife and don’t need  
"knife-solo" to do this, if you are interacting with a Chef server.

[http://learn.getchef.com/rhel/bootstrap-your-node/](http://learn.getchef.com/rhel/bootstrap-your-node/) will teach you how  
to do this (there are also variants on that site for Windows and  
Ubuntu if you use those OSes)

My description in previous mail was a little bit wrong.  
Yes, I’ll do “knife solo cook {host}” after bootstrap.

Anyway Thanks a lot;)

—  
idzzy