0

For reasons I won't go into I have some chef recipes that need to edit the contents of a data bag. Thus, I believe, the node user profile needs to be "admin: true". So when I bootstrap a node (knife bootstrap) the first pass fails with a http 403 error (unable to edit contents of the data bag) and I have to go in and manually set that user to admin.

Is there a way to do that on by default with the knife bootstrap command? I suppose I could create the users beforehand, but I would rather just let chef to all the bootstrapping for me.

Note: I'm using chef 10 and open source chef server

clh
  • 839
  • 8
  • 11

1 Answers1

2

The knife bootstrap operation passes the chef validation key to new node so that it can create a new "client" registration. This is the credential used by chef-client.

There is a subtle difference between "users" and "clients" in Chef. The former is generally what is used to with knife. I don't think it's possible to create admin clients and to be honest I'm not aware of a use case that requires it. Could be considered a risk as clients should not be allowed to make changes that might impact other nodes.

Please read 'Create and Edit' section at https://docs.chef.io/data_bags.html. Which says it is not advisable to do so (for editing data bags with nodes). From security perspective its highly not recommended

To achieve your desired result, perhaps just use the "knife" command configured to use an admin user. chef-client and knife use different configuration files.

sumit pandit
  • 963
  • 7
  • 9
Mark O'Connor
  • 76,015
  • 10
  • 139
  • 185