# Migrating chef servers

**URL:** <https://discourse.chef.io/t/migrating-chef-servers/2931>\
**Category:** Chef Infra (archive)\
**Created:** [July 3, 2012, 5:05pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931 "2012-07-03T17:05:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kendrick\_Martin](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kendrick_martin/32/668_2.png) [@Kendrick\_Martin](https://discourse.chef.io/u/Kendrick_Martin)\
**Post date:** [July 3, 2012, 5:05pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/1 "2012-07-03T17:05:05Z")

</div>

Is there an easy way to migrate chef servers without having to re-gen the client keys for every node and copy a new validation.pem file?

Kendrick Martin

Install Engineer

O: +1 503.553.2462

webtrends[http://www.webtrends.com/](http://www.webtrends.com/)

Real -Time Relevance. Remarkable ROI.™

London | Portland | San Francisco | Melbourne | Tokyo

---

<div class="post-metadata">

**Author:** ![Ranjib\_Dey](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@Ranjib\_Dey](https://discourse.chef.io/u/Ranjib_Dey)\
**Post date:** [July 3, 2012, 5:53pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/2 "2012-07-03T17:53:04Z")

</div>

replicate the couchdb

On Tue, Jul 3, 2012 at 10:35 PM, Kendrick Martin \<  
[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:

> Is there an easy way to migrate chef servers without having to re-gen  
> the client keys for every node and copy a new validation.pem file? \*\*\*\*
> 
> * * *
> 
> _Kendrick Martin_\*\*\*\*
> 
> _Install Engineer_\*\*\*\*
> 
> _O:_ +1 503.553.2462\*\*\*\*
> 
> * * *
> 
> _webtrends_ [http://www.webtrends.com/](http://www.webtrends.com/)\*\*\*\*
> 
> * * *
> 
> Real -Time Relevance. Remarkable ROI.™\*\*\*\*
> 
> * * *
> 
> London | Portland | San Francisco | Melbourne | Tokyo\*\*\*\*
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *

---

<div class="post-metadata">

**Author:** ![Ranjib\_Dey](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@Ranjib\_Dey](https://discourse.chef.io/u/Ranjib_Dey)\
**Post date:** [July 3, 2012, 5:55pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/3 "2012-07-03T17:55:35Z")

</div>

you can actually use the chef api to do this in irb, should just garb the  
client objects, change couchdb and invoke save on them.  
by default the couchdb binds on loclhost, u need to change the second  
couchdb's binding port to 0.0.0.0 to do this.

On Tue, Jul 3, 2012 at 11:23 PM, Ranjib Dey [ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)wrote:

> replicate the couchdb
> 
> On Tue, Jul 3, 2012 at 10:35 PM, Kendrick Martin \<  
> [Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:
> 
> > Is there an easy way to migrate chef servers without having to re-gen  
> > the client keys for every node and copy a new validation.pem file? \*\*\*\*
> > 
> > * * *
> > 
> > _Kendrick Martin_\*\*\*\*
> > 
> > _Install Engineer_\*\*\*\*
> > 
> > _O:_ +1 503.553.2462\*\*\*\*
> > 
> > * * *
> > 
> > _webtrends_ [http://www.webtrends.com/](http://www.webtrends.com/)\*\*\*\*
> > 
> > * * *
> > 
> > Real -Time Relevance. Remarkable ROI.™\*\*\*\*
> > 
> > * * *
> > 
> > London | Portland | San Francisco | Melbourne | Tokyo\*\*\*\*
> > 
> > * * *
> > 
> > * * *
> > 
> > * * *
> > 
> > * * *
> > 
> > * * *
> > 
> > * * *
> > 
> > * * *

---

<div class="post-metadata">

**Author:** ![Kendrick\_Martin](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kendrick_martin/32/668_2.png) [@Kendrick\_Martin](https://discourse.chef.io/u/Kendrick_Martin)\
**Post date:** [July 3, 2012, 6:04pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/4 "2012-07-03T18:04:26Z")

</div>

I tried tarring the /var/lib/chef, /etc/chef, /etc/couchdb, and /var/lib/couchdb directories on my old server, and replacing them on my new server, but I’m getting failed to authenticate errors when using knife against the new server.

From: Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
Sent: Tuesday, July 03, 2012 10:53 AM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: [chef] Re: Migrating chef servers

replicate the couchdb  
On Tue, Jul 3, 2012 at 10:35 PM, Kendrick Martin \<[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)[mailto:Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:  
Is there an easy way to migrate chef servers without having to re-gen the client keys for every node and copy a new validation.pem file?

Kendrick Martin

Install Engineer

O: +1 503.553.2462

webtrends[http://www.webtrends.com/](http://www.webtrends.com/)

Real -Time Relevance. Remarkable ROI.™

London | Portland | San Francisco | Melbourne | Tokyo

---

<div class="post-metadata">

**Author:** ![Ranjib\_Dey](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@Ranjib\_Dey](https://discourse.chef.io/u/Ranjib_Dey)\
**Post date:** [July 3, 2012, 6:10pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/5 "2012-07-03T18:10:51Z")

</div>

can u verify if your old and new couch db has the same public key for the  
apiclient you are using in knife.rb?

On Tue, Jul 3, 2012 at 11:34 PM, Kendrick Martin \<  
[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:

> I tried tarring the /var/lib/chef, /etc/chef, /etc/couchdb, and  
> /var/lib/couchdb directories on my old server, and replacing them on my  
> new server, but I’m getting failed to authenticate errors when using knife  
> against the new server.\*\*\*\*
> 
> * * *
> 
> _From:_ Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
> _Sent:_ Tuesday, July 03, 2012 10:53 AM  
> _To:_ [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
> _Subject:_ [chef] Re: Migrating chef servers\*\*\*\*
> 
> * * *
> 
> replicate the couchdb\*\*\*\*
> 
> On Tue, Jul 3, 2012 at 10:35 PM, Kendrick Martin \<  
> [Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:\*\*\*\*
> 
> Is there an easy way to migrate chef servers without having to re-gen the  
> client keys for every node and copy a new validation.pem file? \*\*\*\*
> 
> * * *
> 
> _Kendrick Martin_\*\*\*\*
> 
> _Install Engineer_\*\*\*\*
> 
> _O:_ +1 503.553.2462\*\*\*\*
> 
> * * *
> 
> _webtrends_ [http://www.webtrends.com/](http://www.webtrends.com/)\*\*\*\*
> 
> * * *
> 
> Real -Time Relevance. Remarkable ROI.™\*\*\*\*
> 
> * * *
> 
> London | Portland | San Francisco | Melbourne | Tokyo\*\*\*\*
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *

---

<div class="post-metadata">

**Author:** ![Kendrick\_Martin](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kendrick_martin/32/668_2.png) [@Kendrick\_Martin](https://discourse.chef.io/u/Kendrick_Martin)\
**Post date:** [July 3, 2012, 8:31pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/6 "2012-07-03T20:31:24Z")

</div>

How would I go about retrieving the public key from the db?

From: Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
Sent: Tuesday, July 03, 2012 11:11 AM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: [chef] Re: RE: Re: Migrating chef servers

can u verify if your old and new couch db has the same public key for the apiclient you are using in knife.rb?

On Tue, Jul 3, 2012 at 11:34 PM, Kendrick Martin \<[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)[mailto:Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:  
I tried tarring the /var/lib/chef, /etc/chef, /etc/couchdb, and /var/lib/couchdb directories on my old server, and replacing them on my new server, but I’m getting failed to authenticate errors when using knife against the new server.

From: Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
Sent: Tuesday, July 03, 2012 10:53 AM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)[mailto:chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: [chef] Re: Migrating chef servers

replicate the couchdb  
On Tue, Jul 3, 2012 at 10:35 PM, Kendrick Martin \<[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)[mailto:Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:  
Is there an easy way to migrate chef servers without having to re-gen the client keys for every node and copy a new validation.pem file?

Kendrick Martin

Install Engineer

O: +1 503.553.2462

webtrends[http://www.webtrends.com/](http://www.webtrends.com/)

Real -Time Relevance. Remarkable ROI.™

London | Portland | San Francisco | Melbourne | Tokyo

---

<div class="post-metadata">

**Author:** ![Kallen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallen/32/1049_2.png) [@Kallen](https://discourse.chef.io/u/Kallen)\
**Post date:** [July 3, 2012, 8:56pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/7 "2012-07-03T20:56:43Z")

</div>

fyi, there are previous posts on the chef list on this very topic. i had  
to go thru this myself. i refer you to previous posts, not as an RTFM-jibe,  
but just so you know :\>

let's see... some of my notes:

The chef-server uses an RSA keypair. The private portion of this pair  
is called the chef-validator and is "validation.pem" which all clients  
use. The public portion of the pair is stored as data inside chef-server's  
couchdb. This keypair is generated for the first time the first moment  
the chef-server starts.

To provide this same keypair to a recovered chef-server, the idea is to load  
a dump of the couchdb onto a new server.

1. you must dump the couchdb from the old chef server.
2. you must load that dump on the new chef server AFTER you have deleted  
the brand new chef server's couchdb. like so:

new-chef# curl -XDELETE [http://127.0.0.1:5984/chef](http://127.0.0.1:5984/chef)  
new-chef# curl -XPUT [http://127.0.0.1:5984/chef](http://127.0.0.1:5984/chef)  
new-chef# couchdb-load --input=chef\_couchdb\_dump [http://127.0.0.1:5984/chef](http://127.0.0.1:5984/chef) --ignore-errors 1\>couchdb-load.stdout 2\>couchdb-load.stderr

give that a whirl?

kallen

On Tue, 03 Jul 2012, Kendrick Martin wrote:

> How would I go about retrieving the public key from the db?
> 
> From: Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
> Sent: Tuesday, July 03, 2012 11:11 AM  
> To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
> Subject: [chef] Re: RE: Re: Migrating chef servers
> 
> can u verify if your old and new couch db has the same public key for the apiclient you are using in knife.rb?
> 
> On Tue, Jul 3, 2012 at 11:34 PM, Kendrick Martin \<[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)[mailto:Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:  
> I tried tarring the /var/lib/chef, /etc/chef, /etc/couchdb, and /var/lib/couchdb directories on my old server, and replacing them on my new server, but I'm getting failed to authenticate errors when using knife against the new server.
> 
> From: Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
> Sent: Tuesday, July 03, 2012 10:53 AM  
> To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)[mailto:chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
> Subject: [chef] Re: Migrating chef servers
> 
> replicate the couchdb  
> On Tue, Jul 3, 2012 at 10:35 PM, Kendrick Martin \<[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)[mailto:Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:  
> Is there an easy way to migrate chef servers without having to re-gen the client keys for every node and copy a new validation.pem file?
> 
> Kendrick Martin
> 
> Install Engineer
> 
> O: +1 503.553.2462
> 
> webtrends[http://www.webtrends.com/](http://www.webtrends.com/)
> 
> Real -Time Relevance. Remarkable ROI.(tm)
> 
> London | Portland | San Francisco | Melbourne | Tokyo

---

<div class="post-metadata">

**Author:** ![Ranjib\_Dey](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@Ranjib\_Dey](https://discourse.chef.io/u/Ranjib_Dey)\
**Post date:** [July 3, 2012, 9:00pm UTC](https://discourse.chef.io/t/migrating-chef-servers/2931/8 "2012-07-03T21:00:41Z")

</div>

irb\>  
require "chef"  
Chef::Config.from\_file('your knife.rb')  
Chef::ApiClient.list.keys.each do |ac\_name|  
ac=Chef::ApiClient.load(ac\_name)  
p ac.public\_key  
end

On Wed, Jul 4, 2012 at 2:01 AM, Kendrick Martin \<  
[Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:

> How would I go about retrieving the public key from the db?\*\*\*\*
> 
> * * *
> 
> _From:_ Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
> _Sent:_ Tuesday, July 03, 2012 11:11 AM  
> _To:_ [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
> _Subject:_ [chef] Re: RE: Re: Migrating chef servers\*\*\*\*
> 
> * * *
> 
> can u verify if your old and new couch db has the same public key for the  
> apiclient you are using in knife.rb?\*\*\*\*
> 
> * * *
> 
> On Tue, Jul 3, 2012 at 11:34 PM, Kendrick Martin \<  
> [Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:\*\*\*\*
> 
> I tried tarring the /var/lib/chef, /etc/chef, /etc/couchdb, and  
> /var/lib/couchdb directories on my old server, and replacing them on my  
> new server, but I’m getting failed to authenticate errors when using knife  
> against the new server.\*\*\*\*
> 
> * * *
> 
> _From:_ Ranjib Dey [[mailto:ranjibd@thoughtworks.com](mailto:ranjibd@thoughtworks.com)]  
> _Sent:_ Tuesday, July 03, 2012 10:53 AM  
> _To:_ [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
> _Subject:_ [chef] Re: Migrating chef servers\*\*\*\*
> 
> * * *
> 
> replicate the couchdb\*\*\*\*
> 
> On Tue, Jul 3, 2012 at 10:35 PM, Kendrick Martin \<  
> [Kendrick.Martin@webtrends.com](mailto:Kendrick.Martin@webtrends.com)\> wrote:\*\*\*\*
> 
> Is there an easy way to migrate chef servers without having to re-gen the  
> client keys for every node and copy a new validation.pem file? \*\*\*\*
> 
> * * *
> 
> _Kendrick Martin_\*\*\*\*
> 
> _Install Engineer_\*\*\*\*
> 
> _O:_ +1 503.553.2462\*\*\*\*
> 
> * * *
> 
> _webtrends_ [http://www.webtrends.com/](http://www.webtrends.com/)\*\*\*\*
> 
> * * *
> 
> Real -Time Relevance. Remarkable ROI.™\*\*\*\*
> 
> * * *
> 
> London | Portland | San Francisco | Melbourne | Tokyo\*\*\*\*
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *
> 
> * * *