facebook / chef-utils

Utilities related to Chef

Facebook Chef Utilities

Description

This is repository holds various Chef utilities and documents written and maintained by Facebook.

License

These files are available under the Apache license unless otherwise specified.

chef-utils's Issues

postgres "chef" user does not exist in defualt open source chef

With open source chef 11.4.0 there is no "chef" user. Using opscode_chef_ro appears to work. I'm not sure if this is a private vs open source difference, or just something that changed along the way

$  sudo su opscode-pgsql -c "cd; /opt/chef-server/embedded/bin/psql -d opscode_chef"psql (9.2.4)
Type "help" for help.

opscode_chef=# SELECT * FROM "pg_user";
     usename     | usesysid | usecreatedb | usesuper | usecatupd | userepl |  passwd  | valuntil | useconfig 
-----------------+----------+-------------+----------+-----------+---------+----------+----------+-----------
 opscode-pgsql   |       10 | t           | t        | t         | t       | ******** |          | 
 opscode_chef    |    16549 | f           | t        | t         | f       | ******** |          | 
 opscode_chef_ro |    16550 | f           | t        | t         | f       | ******** |          | 
(3 rows)

folsom-stats doesn't work with Chef Server Core 12

@oferrigni - you have any input on this?

We get this error with the latest CS12

escript: exception error: {function_clause,
                     [{local,fetch_metric,
                          [{<<"pooler.oc_chef_authz_http.free_count">>,
                            [{type,histogram},
                             {tags,
                                 {set,0,16,16,8,80,48,
                                     {[],[],[],[],[],[],[],[],[],[],[],[],[],
                                      [],[],[]},
                                     {{[],[],[],[],[],[],[],[],[],[],[],[],[],
                                       [],[],[]}}}}]}]}]}

chefctl on Chef 16 on macos does not result in colored output

I'm at a loss on this one, but I've noticed that chefctl does not result in colored output when using Chef 16 (Chef Infra Client: 16.1.16)

After attaching some debugging I've confirmed that sudo chefctl -icH is equivalent to sudo /opt/chef/bin/chef-client -l fatal -F doc --no-fork.

The only thing I can come up with is the ruby /opt/chef/embedded/bin/ruby has updated some gems that are prohibiting this behavior or have simply changed.

add rspec to CI workflow for chefctl.rb

chefctl-config.rb or chefctl_config.rb?

I'm confused, the chefctl code says
"DEFAULT_CONFIG = '/etc/chefctl-config.rb'.freeze" but the README and sample config have "chefctl_config.rb". This looks like a bug, should be an underscore in chefctl?

Doesn't seem to detect changes/additions to cookbooks via git.

I have got it all installed and have now gotten to the point where I believe I found a big. Again, as posted in my first bug, I am not a ruby guy...

I can upload new roles, delete roles, and even delete cookbooks. But for some reason when I either update or add a new cookbook, the Grocery-Delivery doesn't seem to see it and does not upload anything.

./grocery-delivery.rb 
WARN: Attempting to acquire lock
WARN: Lock acquired
WARN: Updating repo
WARN: Determing changes... from  to 7ecf0f85a9afe23e40c8d97213d554ec824dd876
WARN: Added cookbooks: []
WARN: Deleted cookbooks: []
WARN: Added roles: []
WARN: Deleted roles: []
WARN: Added databags: []
WARN: Deleted databags: []
WARN: Success at 7ecf0f85a9afe23e40c8d97213d554ec824dd876

Thoughts? Ideas? Since I can delete a cookbook, I feel my config should be correct.

Swap-out "blacklist" verbiage in `chefctl`

Given all that is going on in the world, I think it would be a good time to reconsider the use of "blacklist" in chefctl and perhaps swap it out for "denylist" (or some equivalent noun/verb).

See:

chef-utils/chefctl/src/chefctl.rb

Lines 454 to 458 in 214e6a7

	# `blacklist` should be an Array of Regexp.
	# If blacklist is provided, commands that match any of the entries are
	# not included in the output.
	# Returns an Array of Hashes with keys: `:pid`, `:command`, `:nsid`
	def list_processes(command, blacklist = nil, parents = false,

chef_server_stats doesn't collapse folsom_stats into useful key/vals

It should collapse the heap of histograms into useful values to be fed into a tsdb.

Grocery-delivery - Missing methods?

I am not a ruby dev by any means.

Working on setting up grocery-delivery via ruby version to work with our git repo, it seems to be missing a few methods.

$ ./grocery-delivery.rb 
Attempting to acquire lock
Lock acquired
Updating repo
./grocery-delivery.rb:199:in `<main>': undefined method `update' for #<BetweenMeals::Repo::Git:0x000000014794a0> (NoMethodError)

So I went in an added an update method

index 9ccf4d8..76d586a 100755
--- a/between-meals/repo/git.rb
+++ b/between-meals/repo/git.rb
@@ -46,6 +46,11 @@ module BetweenMeals
         s = Mixlib::ShellOut.new("#{@bin} clone #{url} #{@repo}").run_command
         s.error!
       end
+ 
+      def update
+        s = Mixlib::ShellOut.new("#{@bin} pull").run_command
+        s.error!
+      end

       # libgit turns out to be *very* slow at this. Using /usr/bin/git
       # for now, we'll circle back to this.

And then ran into this error.

$ ./grocery-delivery.rb 
Attempting to acquire lock
Lock acquired
Updating repo
DEBUG: Reading 
/grocery-delivery/gd_revision
./grocery-delivery.rb:223:in `<main>': undefined method `head' for #<BetweenMeals::Repo::Git:0x0000000219a440> (NoMethodError)

Are these methods really missing? Or am I just missing something obvious?

chefctl on windows: retry lock on permission denied

On windows, via remote ssh, the workflow is a bit different.

If a timer is running chef, it's likely as SYSTEM. If you login as admin1 and run chefctl, it crashes with:

C:/chef/bin/chefctl.rb:787:in `read': Permission denied @ io_fread - C:\\Windows\\Temp\\chefctl.lock (Errno::EACCES)

instead of realizing a run is in progress and doing it's usual wait routine. But it should catch this and do it's usual wait routine.

chefctl on windows doesn't produce logs in /var/chef/outputs

When using chefctl on windows, I cannot get it to write out the log to C:\chef\outputs like it does on Linux/macOS.

This occurs on chef-client 14.10.9.
Here is the config:

lock_file 'C:/chef/chefctl.lock'
plugin_path 'C:/chef/chefctl_hooks.rb'
log_dir 'C:/chef/outputs'
default_chef_options ["--fatal-windows-admin-check"]
chef_options ["-c C:/chef/solo/solo.rb"]
chef_client 'C:/opscode/chef/bin/chef-client.bat'
lock_time 1800
max_retries 1
windows_subshell true

Here is the command:

C:\opscode\chef\embedded\bin\ruby.exe c:\chef\chefctl.rb -C C:\chef\chefctl-config.rb

And here is what ends up in C:\chef\outputs:

PS C:\chef\outputs> Get-Content chef.20190207.1115.1549556120.out
[2019-02-07 11:15:21 -0500] WARN chefctl: Deprecated: windows_subshell shouldn't be used

I get stdout when running this and can see the changes, but it doesn't land in the outputs for some reason.

typo grocery-delivery.rb constant name results in failure to log if repourl is missing on initial checkout

grocery-delivery.rb:208:in `

': uninitialized constant GroceryDeliver (NameError)

Line 208 should be GroceryDelivery::Log.error instead of GroceryDeliver::Log.error

Notice the missing y.

We disable v6 SLAAC in fb_sysctl

note to self: we set 'net.ipv6.conf.eth0.autoconf' => 0, in fb_sysctl. While I agree internet servers should have static addresses, this is a change to a default that may be surprising to people who blindly trust our cookbooks (it got me and took quite a while to figure out what happened) and there's nothing calling it out.