I'm using Vagrant to create a chef node, and it spins up the image and then the initial chef-client run fails. When I ssh into the machine, delete /etc/chef/client.pem, and run sudo chef-client again, it succeeds, but without the run_list that I passed in from vagrant. This is what the failure looks like:
$ vagrant up
Bringing machine 'default' up with 'vsphere' provider...
==> default: Calling vSphere CloneVM with the following settings:
==> default: -- Template VM: myOrg/vm/myFolder/vagrantchefnode
==> default: -- Target VM: myOrg/vm/myFolder/test2
==> default: Waiting for SSH to become available...
==> default: New virtual machine successfully cloned and started
==> default: Rsyncing folder: /home/user/.vagrant.d/boxes/test2/ => /vagrant
==> default: Running provisioner: chef_client...
==> default: Creating folder to hold client key...
==> default: Uploading chef client validation key...
Generating chef JSON and uploading...
==> default: Running chef-client...
==> default: stdin: is not a tty
==> default: [2014-10-02T16:11:19-05:00] INFO: Forking chef instance to converge...
==> default: [2014-10-02T16:11:19-05:00] INFO: *** Chef 11.16.2 ***
==> default: [2014-10-02T16:11:19-05:00] INFO: Chef-client pid: 6080
==> default: [2014-10-02T16:11:21-05:00] INFO: HTTP Request Returned 401 Unauthorized: error
==> default: Failed to authenticate to the chef server (http 401).
==> default: Failed to authenticate as 'test2'. Ensure that your node_name and client key are correct.
==> default: chef_server_url "https://server.myorg.com"
==> default: node_name "test2"
==> default: client_key "/etc/chef/client.pem"
These are my Vagrantfiles:
1) The Vagrantfile packaged with the box:
# -*- mode: ruby -*-
# vi: set ft=ruby :
Vagrant.configure("2") do |config|
config.vm.provider :vsphere do |vsphere|
vsphere.host = 'vsphereserver.myorg.com'
vsphere.compute_resource_name = 'TestDev'
vsphere.user = 'vagrantadmin'
vsphere.password = 'password'
vsphere.insecure = true
end
config.ssh.username = 'auto'
config.ssh.private_key_path = '~/.vagrant.d/id_rsa'
end
2) The Vagrantfile in my home directory (~/.vagrant.d):
# -*- mode: ruby -*-
# vi: set ft=ruby :
Vagrant.configure("2") do |config|
config.vm.box = 'vsphere'
config.vm.provider :vsphere do |vsphere|
vsphere.template_name = 'vagrantchefnode'
end
config.vm.provision "chef_client", id: "chef" do |chef|
chef.provisioning_path = "/etc/chef"
chef.chef_server_url = "https://chefserver.myorg.com"
chef.validation_key_path = "/home/user/.vagrant.d/chef/validation.pem"
# chef.client_key_path = "/etc/chef/client.pem"
chef.validation_client_name = "chef-validator"
chef.custom_config_path = "/home/user/.vagrant.d/Vagrantfile.chef"
chef.delete_node = true
chef.delete_client = true
chef.add_role "base"
end
end
3) Vagrantfile from the project directory (~/.vagrant.d/boxes/chefnode1):
# -*- mode: ruby -*-
# vi: set ft=ruby :
Vagrant.configure("2") do |config|
config.vm.provider :vsphere do |vsphere|
# vsphere.template_name = 'chefnode'
vsphere.customization_spec_name = 'test2'
vsphere.name = 'test2'
end
config.vm.provision "chef_client", id: "chef" do |chef|
chef.node_name = "test2"
chef.add_role "dev"
end
end
I've tried uncommenting out the chef.client_key_path in the second Vagrantfile, with no effect. This seemed to work just fine when I had it all in one Vagrantfile, but I want to run multiple machines without copying all the settings into each Vagrantfile.
I have a full log with the --debug tag, if anybody wants it.
You have two issues going on
It sounds like your base image has a /etc/chef/client.pem file already in place, which will fail to authenticate. You need to remove this from your base image so that a new node/client is created with chef on first run.
Alternately (but I don't suggest it), you can use a shell provisioner, before you chef-client provisioner, and just delete it with that. The downside is that every call to vagrant provision will result in a new attempt to create the client with chef-server.
As for the run-list changing, when a new chef node is created, its runlist is only saved if the chef run succeeds. Since it failed, your chef-server didn't store the runlist. When you then login directly and run chef-client, it asked the server for your runlist, which didn't exist, so you ran an empty runlist.