3

So I've set up my EC2 chef node in several ways (bootstrapping with knife or through client-chef parameters from my node), and every time I try to access the node through knife ssh I get the following error:

WARNING: Failed to connect to *node's FQDN* -- SocketError: getaddrinfo: nodename nor servname provided, or not known

I use knife ssh mainly to update to node and just run sudo client-chef

From this error I assume that I have no access to the FQDN as its an internal address, isn't the chef server supposed to do that for me? I will soon have a private VPC on AWS so on any occasion I won't be able to access the internal address from my workstation.

Is there a way to make the chef server run this ssh command, or run it any other way?

AmirS
  • 31
  • 2

2 Answers2

0

What I've discovered is basically my misunderstanding of how chef works, I was looking for some sort of push mechanism, and chef does not support push out of the box.

There are 2 workarounds to this:

1) Chef's push jobs - as I'm writing this post, chef push jobs do not work on Ubuntu 14, and I'm not too keen on letting this service dictate the OS of my choice

2) Not recommended anywhere, but installing knife on my chef server worked. Since the chef server is within the VPC, he's my only point of access and from there I'll run knife ssh to all my other nodes.

If anyone is looking for more of a push-based service I'd recommend to look at SaltStack

AmirS
  • 31
  • 2
0

Since your node does not have an external IP, you should use an ssh gateway. Please refer to this thread: Using knife ec2 plugin to create VM in VPC private subnet

As you mentioned in your answer, the chef doesn't provide push capability, instead it uses a pull. And knife ssh does exactly that - it ssh to the nodes and allows you to run chef-client command which would pull the configuration from the chef server.

Please note, that in your 2nd solution, any node within the VPC with knife would do. This doesn't have to be a Chef server, or should I say the Chef server doesn't have to be in this VPC at all. However, a solution like this compromises security since your authentication with the chef server and your ssh private key would be both located somewhere outside your workstation.

There is also one more way to mention, which is to add chef-client runs to cron if your strategy is well tested.

Community
  • 1
  • 1
taleodor
  • 1,849
  • 1
  • 13
  • 15