# One client key on multiple nodes

**URL:** <https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144>\
**Category:** Chef Infra (archive)\
**Created:** [July 7, 2017, 10:19am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144 "2017-07-07T10:19:56Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 7, 2017, 10:19am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/1 "2017-07-07T10:19:56Z")

</div>

Hello all,

In Policy -\>Clients-\>create

I created a key to use for several nodes?

Can I use the same pem file to bootstrap multiple nodes

---

<div class="post-metadata">

**Author:** ![nic\_chef](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@nic\_chef](https://discourse.chef.io/u/nic_chef)\
**Post date:** [July 7, 2017, 10:30am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/2 "2017-07-07T10:30:10Z")

</div>

Yes but make sure you delete it after the bootstrap by adding “recipe[chef-client::delete\_validation]”, in the node run\_list.

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 7, 2017, 10:38am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/3 "2017-07-07T10:38:41Z")

</div>

thanks for the quic reponse , how do you use it actually while bootstrap or after installing the client.

thanks

---

<div class="post-metadata">

**Author:** ![nic\_chef](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@nic\_chef](https://discourse.chef.io/u/nic_chef)\
**Post date:** [July 7, 2017, 10:43am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/4 "2017-07-07T10:43:04Z")

</div>

You can added it during the bootstrap or after but make sure it gets deleted for security reason.  
Note: the chef-client cookbook [https://supermarket.chef.io/cookbooks/chef-client/versions/0.99.1](https://supermarket.chef.io/cookbooks/chef-client/versions/0.99.1) has to be uploaded on the chef server.

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 7, 2017, 11:58am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/5 "2017-07-07T11:58:38Z")

</div>

still not working

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 7, 2017, 11:59am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/6 "2017-07-07T11:59:29Z")

</div>

knife bootstrap x.x.x.x root -P --identity-file /data/chef-keys/mru-esx.pem --node-name dumburtle

---

<div class="post-metadata">

**Author:** ![nic\_chef](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@nic\_chef](https://discourse.chef.io/u/nic_chef)\
**Post date:** [July 7, 2017, 12:43pm UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/7 "2017-07-07T12:43:20Z")

</div>

Missing the -x before the root  
knife bootstrap x.x.x.x -x root -P --identity-file /data/chef-keys/mru-esx.pem --node-name dumburtle

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 7, 2017, 12:44pm UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/8 "2017-07-07T12:44:12Z")

</div>

yes but the .pem file doesnt seems to go on the server?

---

<div class="post-metadata">

**Author:** ![nic\_chef](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@nic\_chef](https://discourse.chef.io/u/nic_chef)\
**Post date:** [July 7, 2017, 1:00pm UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/9 "2017-07-07T13:00:12Z")

</div>

Mmm i am not sure if you can do it this way… i usually do it on our azure machines using the “Unattended Installs” [https://docs.chef.io/install\_bootstrap.html](https://docs.chef.io/install_bootstrap.html)  
This link might help [https://stackoverflow.com/questions/24788920/chef-clients-and-validators](https://stackoverflow.com/questions/24788920/chef-clients-and-validators)

---

<div class="post-metadata">

**Author:** ![nic\_chef](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@nic\_chef](https://discourse.chef.io/u/nic_chef)\
**Post date:** [July 7, 2017, 1:08pm UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/10 "2017-07-07T13:08:44Z")

</div>

try to follow these steps: [https://serverfault.com/questions/761167/how-to-manually-set-up-a-chef-node](https://serverfault.com/questions/761167/how-to-manually-set-up-a-chef-node)

1. Install chef-client

Either use the [https://www.chef.io/chef/install.sh](https://www.chef.io/chef/install.sh) script or download and install the correct chef-client package for your OS.

1. Create /etc/chef/client.rb

Perhaps you can use one of your bootstrapped nodes as a reference. The important bit is that you have chef\_server\_url pointing at your Chef server.

Example:

/etc/chef/client.rb

chef\_server\_url "[https://mychefserver.myorg.com/organizations/myorg](https://mychefserver.myorg.com/organizations/myorg)"  
validation\_client\_name "myorg-validator"  
validation\_key "/etc/chef/myorg-validator.pem"  
log\_level :info  
3. Copy validation key

The key you got after running chef-server-ctl org-create. If lost you can generate a new one from Chef Manage.

Copy the key to /etc/chef/myorg-validator.pem (to what is configured as validation\_key in client.rb)

1. Fetch SSL cert

Optionally, if the SSL certificate on your Chef server isn’t signed (it probably isn’t), you must manually fetch it so that knife/chef-client will trust the certificate.

mkdir /etc/chef/trusted\_certs  
knife ssl fetch -c /etc/chef/client.rb  
See also [http://jtimberman.housepub.org/blog/2014/12/11/chef-12-fix-untrusted-self-sign-certs/](http://jtimberman.housepub.org/blog/2014/12/11/chef-12-fix-untrusted-self-sign-certs/)

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 10, 2017, 4:10am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/11 "2017-07-10T04:10:47Z")

</div>

thanks will try soon

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 10, 2017, 10:32am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/12 "2017-07-10T10:32:12Z")

</div>

seems to work but its not like automatic from the server , i have to connect into thenode and type chef-client

---

<div class="post-metadata">

**Author:** ![nic\_chef](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@nic\_chef](https://discourse.chef.io/u/nic_chef)\
**Post date:** [July 10, 2017, 12:13pm UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/13 "2017-07-10T12:13:30Z")

</div>

have a look at this: [https://serverfault.com/questions/410208/is-there-a-more-elegant-way-to-remotely-run-chef-client](https://serverfault.com/questions/410208/is-there-a-more-elegant-way-to-remotely-run-chef-client)

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 10, 2017, 12:15pm UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/14 "2017-07-10T12:15:13Z")

</div>

very interestting let me test and let you know

---

<div class="post-metadata">

**Author:** ![jonathanip](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jonathanip](https://discourse.chef.io/u/jonathanip)\
**Post date:** [July 24, 2017, 7:52am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/15 "2017-07-24T07:52:16Z")

</div>

is there a way to make the client.rb file grab the cookbook on registration to the chef server

---

<div class="post-metadata">

**Author:** ![nic\_chef](https://avatars.discourse-cdn.com/v4/letter/n/fbc32d/32.png) [@nic\_chef](https://discourse.chef.io/u/nic_chef)\
**Post date:** [July 25, 2017, 7:33am UTC](https://discourse.chef.io/t/one-client-key-on-multiple-nodes/11144/16 "2017-07-25T07:33:38Z")

</div>

On Azure you can do it via the Chef extension, or you can use the bash/powershell script provided by chef in here: [https://docs.chef.io/install\_bootstrap.html](https://docs.chef.io/install_bootstrap.html)

* * *

#!/bin/bash -xev

# Do some chef pre-work

/bin/mkdir -p /etc/chef  
/bin/mkdir -p /var/lib/chef  
/bin/mkdir -p /var/log/chef

# Setup hosts file correctly

cat \> “/etc/hosts” \<\< EOF  
10.0.0.5 compliance-server [compliance-server.automate.com](http://compliance-server.automate.com)  
10.0.0.6 chef-server [chef-server.automate.com](http://chef-server.automate.com)  
10.0.0.7 automate-server [automate-server.automate.com](http://automate-server.automate.com)  
EOF

cd /etc/chef/

# Install chef

curl -L [https://omnitruck.chef.io/install.sh](https://omnitruck.chef.io/install.sh) | bash || error\_exit ‘could not install chef’

# Create first-boot.json

cat \> “/etc/chef/first-boot.json” \<\< EOF  
{  
“run\_list” :[  
“role[base]”  
]  
}  
EOF

NODE\_NAME=node-$(cat /dev/urandom | tr -dc ‘a-zA-Z0-9’ | fold -w 4 | head -n 1)

# Create client.rb

/bin/echo ‘log\_location STDOUT’ \>\> /etc/chef/client.rb  
/bin/echo -e “chef\_server\_url “[https://aut-chef-server/organizations/my-org](https://aut-chef-server/organizations/my-org)”” \>\> /etc/chef/client.rb  
/bin/echo -e “validation\_client\_name “my-org-validator”” \>\> /etc/chef/client.rb  
/bin/echo -e “validation\_key “/etc/chef/my\_org\_validator.pem”” \>\> /etc/chef/client.rb  
/bin/echo -e “node\_name “${NODE\_NAME}”” \>\> /etc/chef/client.rb

sudo chef-client -j /etc/chef/first-boot.json

* * *