Douglas Garstang | 24 Nov 21:45 2014

Automatic Node Configuration - "Failed to authenticate"

I'm trying to automate the addition of chef nodes to the chef server. Cloud-init is running a script that downloads an admin user's pem file from an S3 bucket, generates a new node's json file and adds the node with the knife command, ie:

knife node from file /tmp/somenewnode.json -c /tmp/knife.rb

That works fine. I can see the new node on the chef server. After that, another script downloaded from S3 is creating /etc/chef/client.rb file for the new node, like so:

ssl_verify_mode         :verify_peer
log_level               :info
log_location            STDOUT
chef_server_url         ''
validation_client_name  'chef-validator'
validation_key          '/etc/chef/validation_keys/'

When I run the chef-client I get a message:

Authentication Error:
Failed to authenticate to the chef server (http 401).

Server Response:
Invalid signature for user or client 'chef-validator'

What am I missing here? I've confirmed the validator key is correct. I'm making sure to remove both the node and the client from the chef server before running (as I know that having an existing client cert on the server will break it). Is this something to do with the trusted_certs thing? How is that supposed to work?



Douglas Garstang
Email: doug.garstang <at>
Cell: +1-805-340-5627
Phil Mocek | 24 Nov 20:47 2014

What is a simple method to arrange e-mail notification of failed convergence?

What is a simple method of arranging to receive e-mail notification
whenever chef-client attempts and fails to converge a node?

I know Chef provides a [flexible framework for various handlers][1],
including exception handlers.  At this time, I don't need flexibility; I
need simplicity.  I just want to say, "For any of these nodes, when
convergence fails, send a message to ops-notifications <at>"  I
hoped I could override in a Chef environment definition a node attribute
used by the [chef-client cookbook][2] so that it would configure nodes
as described, but after various searches of the Chef docs, the whole
Web, and this list, I've yet to find indication that such is a possibility.


 [1]: <>
 [2]: <>


Phil Mocek

Gareth Allen | 24 Nov 10:29 2014

execute bash command

Hi all,

I've written my first custom resource to remove an omd site,  I'm
trying to include an echo in my execute statement as the application
requires user input.  My provider looks like this:

action :remove do
  execute "remove-site" do
    command "echo -e 'yes' | /usr/bin/omd rm #{new_resource.site_name}"
    only_if {"/opt/omd/sites/#{new_resource.site_name}") }

Then my recipe:

omd_site 'test' do
  action :remove

The chef-client shows the following and succeeds, but the site is
never removed.

- execute echo -e 'yes' | /usr/bin/omd rm test

If I run the command manually everything works as expected.  Below is
the output.

PLEASE NOTE: This action removes all configuration files
             and variable data of the site.

In detail the following steps will be done:
- Stop all processes of the site
- Unmount tmpfs of the site
- Remove tmpfs of the site from fstab
- Remove the system user <SITENAME>
- Remove the system group <SITENAME>
- Remove the site home directory
- Restart the system wide apache daemon
 (yes/NO): Removing Crontab...
no crontab for test
Stopping dedicated Apache for site test...(not running)...OK
Stopping nagios...not running...OK
npcd was not running... could not stop
Stopping rrdcached...not running.
Unmounting temporary filesystem...OK
Removing /omd/sites/test/tmp from /etc/fstab...OK
Deleting user and group test...OK
Restarting Apache...[Mon Nov 24 11:26:25.553556 2014]
[proxy_html:notice] [pid 25995:tid 140261059786624] AH01425: I18n
support in mod_proxy_html requires mod_xml2enc. Without it, non-ASCII
characters in proxied pages are likely to display incorrectly.
AH00558: apache2: Could not reliably determine the server's fully
qualified domain name, using Set the 'ServerName' directive
globally to suppress this message

I assume the problem is with the echo statement.  Any ideas?


Bryan Baugher | 21 Nov 22:37 2014

Printing command output

Hi everyone,

Whats the easiest way to print command output while its running? I've found older mailing list questions about this and things on SO but they mostly point to setting chef logging to debug which is not what I want. I would like to always print the output for this particular command as it often takes awhile to run and has valuable information.

Jeff Blaine | 21 Nov 22:33 2014

Point of service resource *_command attrs?

I can't figure out what the *_command attributes are actually for.

Setting init_command, start_command ... etc... to a value seems
pointless when the chosen underlying provider has all of its hardcoded
information that it uses.

  service 'foo' do
    init_command '/bin/true'
    start_command '/bin/true'
    action [:enable, :start]

  ==> "unable to locate the init.d script!"

Any ideas?


Jeff Blaine
PGP/GnuPG Key ID: 0x0C8EDD02

Bryan Baugher | 21 Nov 20:39 2014

Push Jobs Questions

Hello everyone,

Is the push jobs code available on github anywhere? Also are there any plans to add a kind of concurrency option (i.e. don't run command X on all nodes at the same time)?

Brad Knowles | 21 Nov 06:53 2014

Windows system standard program for unzip-ing archives?


So, I've been trying to write some cross-platform Chef code for a customer, and one of the things we need to do
is to take a zip archive of a package written in Java, and deploy that.  The zip archive is completely
self-contained, we don't need to install it as an OS-level package or anything -- we just need to un-zip it
into an appropriate directory structure, and then run the appropriate included .sh or .BAT files.

This worked fine on RHEL5.  But I was astonished to find that there is apparently no standard tool to handle
this kind of thing on Win2k3 or Win2k8.

Am I missing something obvious here?  I mean, I can install a package easily enough, but this is a ...
sensitive ... customer, and there might have to be a lengthy delay in getting that approved through the
change control board.

Any and all ideas or thoughts would be appreciated.  Thanks!

Brad Knowles <brad <at>>
LinkedIn Profile: <>

vinod_patil | 21 Nov 06:42 2014

IBM Biginsights 3.0 silent installation using Chef is failing

I am doing silent installation of Biginsights 3.0 using Chef. Strange thing is
that if I invoke the installation without Chef recipe i.e manually
"./ install.xml" it works fine. But when I invoke it through
Chef recipe , it fails. It does not install bigsql1,sheets and due that it
fails. I am pasting the error. It is not getting required files as bigsql1
installation is not completing successfully.

[ERROR] DeployManager - bigsql1 failed initialize failed because
/opt/ibm/biginsights/hdm/components/bigsql1/binary/bigsql1-dist.tar.gz is not

Any help will be appreciated. I am sure somewhere Chef is failing to invoke
bigsql1 install script and most probably it is terminal issue.

Here is my recipe code 

bash "BI3.0" do
user "biadmin"
group "biadmin"
code <<-EOH
sh BI30.xml 2>&1 >> /tmp/console.out

John de la Garza | 20 Nov 21:36 2014


If anyone could make sense of my last post and has a similar issue, I have found
a possible solution:

This has helped me get the knife.rb info into my Vagrant file, without
relying on
a static env variable.  The knife.rb is dynamically changed when I run
chefvm.  This was what I needed.

John de la Garza | 20 Nov 21:15 2014


In my .basrc I have this:  export KNIFE_CHEF_SERVER=,
which is a local chef-zero server

in my .chefvm/configurations/chef-east/knife.rb I have this:
chef_server_url  "", which our production chef

Vagrant seems to rely on KNIFE_CHEF_SERVER from the environment here:
chef.chef_server_url = ENV['KNIFE_CHEF_SERVER']

So when I run 'chefvm use <some other server>' it sets up the chef_server_url
from the .chefvm/configurations/chef-east/knife.rb correctly but the
env var: KNIFE_CHEF_SERVER, stays the same

Am I doing something wrong here?  I would have thought vagrant would have
used the chef_server_url setting  in the

Right now when I run chefvm use <some_server>, I have to manually change
the KNIFE_CHEF_SERVER env var.

Simon Detheridge | 20 Nov 18:08 2014

How do I change 'interval' and 'splay' using chef-dk on Windows

So, I'm bootstrapping a Windows node with 'knife bootstrap windows' using chef-dk

Chef is using the windows_service init recipe. I've set chef_client/interval and chef_client/splay as
default attributes.

I can't find how to apply these to the Windows service. As far as I can tell, the service is looking at
c:\chef\client.rb for its settings. However, if I ensure these are written into a file in client.d, Bad
Things happen when I run chef-client::config because my bootstrapping chef decides it's going to act
like a daemon and never terminates once the chef run finishes.

If I skip running the config recipe, the setting is ignored because a client.rb isn't written that includes
stuff in client.d. If I manually write out a new client.rb using a different cookbook (probably not
recommended) there's no way to restart the chef service to reload it. (It doesn't support restart. Can't
use net stop/start as it waits for the bootstrapping chef to exit before stopping, so there's no way to
restart it again.)

Am I missing a trick, somewhere?



Simon Detheridge - CTO, Widgit Software
26 Queen Street, Cubbington, CV32 7NA - Tel: +44 (0)1926 333680