I am trying to set up chef-push-jobs client on a macOS 10.13 node.
Here is what I did so far:
Created a configuration file named push-jobs-client.rb that looks something like this:
chef_server_url 'https://chef.XXXXX.com/organizations/XXXXX'
node_name 'default-macos-1013'
client_key '/opt/chef/embedded/ssl/cert.pem'
trusted_certs_dir '/opt/chef/embedded/lib/ruby/gems/2.4.0/gems/chef-13.8.5/spec/data/trusted_certs'
verify_api_cert true
ssl_verify_mode :verify_peer
allow_unencrypted true
log_level :info
log_location STDOUT
whitelist({"chef-client"=>"chef-client"})
Mixlib::Log::Formatter.show_time = false
Ran this command:
/usr/local/bin/pushy-client -c push-jobs-client.rb
Error Message:
/opt/push-jobs-client/embedded/lib/ruby/gems/2.4.0/gems/opscode-pushy-client-2.4.8/lib/pushy_client.rb:236:in `rescue in get_config': Could not download push jobs config (RuntimeError)
Log:
INFO: [jenkins03] Setting reconfigure deadline to 2018-05-04 12:05:31
+0200
INFO: [jenkins03] using config file path: '/opt/push-jobs-client/push-jobs-client.rb'
INFO: [jenkins03] Using node name: jenkins03
INFO: [jenkins03] Using org name: XXXXX
INFO: [jenkins03] Using Chef server: https://chef.XXXXX.com/organizations/XXXXX
INFO: [jenkins03] Using private key: /opt/chef/embedded/ssl/cert.pem
INFO: [jenkins03] Incarnation ID: 633f168d-c8c0-469e-a9c0-8d6658b3b3d5
INFO: [jenkins03] Allowing fallback to unencrypted connection: true
INFO: [jenkins03] Starting client ...
INFO: [jenkins03] Retrieving configuration from https://chef.XXXXX.com/organizations/XXXXX//pushy/config/jenkins03: ...
INFO: Could not download push jobs config
So it looks like the connection and the authentication is successful but for some reason push-jobs-client cannot retrieve the configuration from the server.
I tried to go the URL from the log manually in a browser directly on the node and I see this in the browser window:
{"error":["missing required authentication header(s) 'X-Ops-UserId', 'X-Ops-Timestamp', 'X-Ops-Sign', 'X-Ops-Content-Hash'"]}
So I wonder if I did anything wrong in the configuration? Or maybe it is a bug in the push-jobs-client for macOS?
I found out that the client_key at /opt/chef/embedded/ssl/cert.pem was not a cient_key signed by the chef server. The correct client key was found at /etc/chef/client.pem
Now everything works, but I will leave the answer here in case anyone else has a similar issue.