chef-provisioning-aws 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 65f9f308947f0072cece284f7076915d3c9bcf7a
-  data.tar.gz: f82b4f9da20bf9e1291c16f4f1e2bb0048f68757
+  metadata.gz: 12e94cfacfbbc92d49c27bdc107bc6599246b39a
+  data.tar.gz: ff395cba379a2881516696815943869c783a6ba1
 SHA512:
-  metadata.gz: 6a19df6b025b7f52a9dd56dc3a3eecd0118be180973ad61ea080d1ac2b89b16545f5f5fc6e98ab69d4a6ced864826c6a942c0c3bfc8156ad1a50e164fe97b175
-  data.tar.gz: 7dbaba9a6d916005c3cb71b237fbf436037b5713e2754505933ca5b53f68eb5fdf775caccabfa97630e33f387c3c8ac1459a9791d5fb9cd0af37a4e29dac5d56
+  metadata.gz: 1897e28e1eafdf789a7b6bd46a396816d92c54bcd21731f5c1cc9e55698ae9b39fa095f6c1afa420c6a1b9ea059f7948c4c274e0e8ac2e8b7ea9fa00e212dfba
+  data.tar.gz: 50418578ad1dc043236e1dbffe4d15cff384103e0a9295920ce8787986caee96f9705cbf7782a2bb0eeb0a2c920befc4dc66413fd3b5a002cd92d984b44715f6

data/Gemfile

@@ -1,6 +1,13 @@
 source "https://rubygems.org"
 gemspec
 
+gem "chef"
+
+gem "chef-zero", ">= 4.0"
+gem "rspec", "~> 3.0"
+gem "rake"
+gem "pry"
+gem "pry-byebug"
+gem "pry-stack_explorer"
+gem "github_changelog_generator"
 gem "simplecov"
-gem "chef", git: "https://github.com/chef/chef" # until Chef 12.14 is released
-gem "chef-provisioning", git: "https://github.com/chef/chef-provisioning", branch: "jk/bump" # until chef-provisioning 2.0 is released

data/README.md

@@ -1,6 +1,7 @@
 # Chef Provisioning AWS
+[![Build Status](https://travis-ci.org/chef/chef-provisioning-aws.svg?branch=master)](https://travis-ci.org/chef/chef-provisioning-aws)[![Gem Version](https://badge.fury.io/rb/chef-provisioning-aws.svg)](https://badge.fury.io/rb/chef-provisioning-aws)
 
-This README is a work in progress.  Please add to it!
+This README is a work in progress.  Feel free to open PRs expanding it!
 
 # Prerequisites
 
@@ -405,6 +406,41 @@ perform [lookup_options](https://github.com/chef/chef-provisioning-aws/blob/mast
 This tries to turn elements with names like `vpc`, `security_group_ids`, `machines`, `launch_configurations`,
 `load_balancers`, etc. to the correct AWS object.
 
+# How to update Security Groups for EC2-VPC instances
+The behavior of the `machine` resource is that once a machine has been allocated,
+the `bootstrap_options` can not be modified. This currently reflects AWS's
+restrictions on EC2-Classic instances, but AWS *does* allow users to modify the
+security groups associated with EC2-VPC instances. This is because the security
+groups for EC2-VPC instances are _actually_ associated with that instance's
+Network Interface. This means that if you wish to modify the security groups
+associated with an EC2-VPC instance, you'll want to use the `aws_network_interface`
+resource.
+
+The first step is to find the Network Interface ID (`eni-XXXXXXX`) associated
+with your machine. You can do this by inspecting the instance details in the AWS
+Console or by using the AWS CLI. If you want to use the AWS CLI, you can use
+this command replacing `MACHINE_NAME` with the name of the `machine` resource
+you wish to update.
+
+```shell
+aws ec2 describe-instances --filter "Name=tag:Name,Values=MACHINE_NAME" | grep NetworkInterfaceId
+```
+
+Once you have the Network Interface ID, in a chef-provisioning recipe you can
+specify the following resource:
+
+```ruby
+require 'chef/provisioning/aws_driver'
+with_driver 'aws' # specify the profile / region as appropriate
+
+aws_network_interface 'eni-XXXXXXXX' do
+  security_groups ['sg-XXXXXXXX', 'sg-YYYYYYYY']
+end
+```
+
+This resource can be in the same chef-provisioning recipe as the corresponding
+machine resource, or it can be in a different one.
+
 # Running Integration Tests
 
 To run the integration tests execute `bundle exec rspec`.  If you have not set it up,

data/chef-provisioning-aws.gemspec

@@ -8,29 +8,19 @@ Gem::Specification.new do |s|
   s.extra_rdoc_files = ['README.md', 'LICENSE' ]
   s.summary = 'Provisioner for creating aws containers in Chef Provisioning.'
   s.description = s.summary
-  s.author = 'John Ewart'
-  s.email = 'jewart@getchef.com'
-  s.homepage = 'https://github.com/opscode/chef-provisioning-aws'
+  s.author = 'Tyler Ball'
+  s.email = 'tball@chef.io'
+  s.homepage = 'https://github.com/chef/chef-provisioning-aws'
 
-  s.required_ruby_version = ">= 2.2.2"
+  s.required_ruby_version = ">= 2.1.9"
 
-  s.add_dependency 'chef-provisioning', '~> 2.0'
+  s.add_dependency 'chef-provisioning', '>= 1.0', '< 3.0'
 
   s.add_dependency 'aws-sdk-v1', '>= 1.59.0'
   s.add_dependency 'aws-sdk', ['>= 2.1.26', '< 3.0']
   s.add_dependency 'retryable', '~> 2.0', '>= 2.0.1'
   s.add_dependency 'ubuntu_ami', '~> 0.4', '>= 0.4.1'
 
-  # chef-zero is only a development dependency because we leverage its RSpec support
-  s.add_development_dependency 'chef-zero', '~> 5.0'
-  s.add_development_dependency 'chef', '~> 12.4'
-  s.add_development_dependency 'rspec', '~> 3.0'
-  s.add_development_dependency 'rake'
-  s.add_development_dependency 'pry'
-  s.add_development_dependency 'pry-byebug'
-  s.add_development_dependency 'pry-stack_explorer'
-  s.add_development_dependency 'github_changelog_generator'
-
   s.bindir       = "bin"
   s.executables  = %w( )
 

data/lib/chef/provider/aws_route_table.rb

@@ -72,6 +72,7 @@ class Chef::Provider::AwsRouteTable < Chef::Provisioning::AWSDriver::AWSProvider
     current_routes = {}
     route_table.routes.each do |route|
       # Ignore the automatic local route
+      next if route.nil?
       route_target = route.gateway_id || route.nat_gateway_id || route.instance_id || route.network_interface_id || route.vpc_peering_connection_id
       next if route_target == 'local'
       next if ignore_route_targets.find { |target| route_target.match(/#{target}/) }

data/lib/chef/provisioning/aws_driver/driver.rb

@@ -937,6 +937,14 @@ EOD
       'ubuntu'
     end
 
+    def default_winrm_username
+      'Administrator'
+    end
+
+    def default_winrm_transport
+      'http'
+    end
+
     def keypair_for(bootstrap_options)
       if bootstrap_options[:key_name]
         keypair_name = bootstrap_options[:key_name]
@@ -1036,52 +1044,59 @@ EOD
 
     def create_winrm_transport(machine_spec, machine_options, instance)
       remote_host = determine_remote_host(machine_spec, instance)
-      username = machine_options[:winrm_username] || 'Administrator'
+      username = machine_spec.reference['winrm_username'] ||
+                 machine_options[:winrm_username] ||
+                 default_winrm_username
       # default to http for now, should upgrade to https when knife support self-signed
-      transport_type = machine_options[:winrm_transport] || 'http'
+      transport_type = machine_spec.reference['winrm_transport'] ||
+                       machine_options[:winrm_transport] ||
+                       default_winrm_transport
       type = case transport_type
              when 'http'
                :plaintext
              when 'https'
                :ssl
              end
-      if machine_spec.reference[:winrm_port]
-        port = machine_spec.reference[:winrm_port]
-      else #default port
-        port = case transport_type
-               when 'http'
-                 '5985'
-               when 'https'
-                 '5986'
-               end
-      end
+      port = machine_spec.reference['winrm_port'] ||
+             machine_options[:winrm_port] ||
+             case transport_type
+             when 'http'
+               '5985'
+             when 'https'
+               '5986'
+             end
       endpoint = "#{transport_type}://#{remote_host}:#{port}/wsman"
 
       pem_bytes = get_private_key(instance.key_name)
 
-      if machine_options[:winrm_password]
-        password = machine_options[:winrm_password]
-      else # pull from ec2 and store in reference
-        if machine_spec.reference['winrm_encrypted_password']
-          decoded = Base64.decode64(machine_spec.reference['winrm_encrypted_password'])
-        else
-          encrypted_admin_password = instance.password_data.password_data
-          if encrypted_admin_password.nil? || encrypted_admin_password.empty?
-            raise "You did not specify winrm_password in the machine options and no encrytpted password could be fetched from the instance"
-          end
-
-          machine_spec.reference['winrm_encrypted_password']||=encrypted_admin_password
-          # ^^ saves encrypted password to the machine_spec
-          decoded = Base64.decode64(encrypted_admin_password)
-        end
-        # decrypt so we can utilize
-        private_key = OpenSSL::PKey::RSA.new(get_private_key(instance.key_name))
-        password = private_key.private_decrypt decoded
-      end
-
-      disable_sspi =  machine_options[:winrm_disable_sspi] || false # default to Negotiate
-      basic_auth_only = machine_options[:winrm_basic_auth_only] || false # disallow Basic auth by default
-      no_ssl_peer_verification = machine_options[:winrm_no_ssl_peer_verification] || false #disallow MITM potential by default
+      password = machine_spec.reference['winrm_password'] ||
+                 machine_options[:winrm_password] ||
+                 begin
+                   if machine_spec.reference['winrm_encrypted_password']
+                     decoded = Base64.decode64(machine_spec.reference['winrm_encrypted_password'])
+                   else
+                     encrypted_admin_password = instance.password_data.password_data
+                     if encrypted_admin_password.nil? || encrypted_admin_password.empty?
+                       raise "You did not specify winrm_password in the machine options and no encrytpted password could be fetched from the instance"
+                     end
+                     machine_spec.reference['winrm_encrypted_password']||=encrypted_admin_password
+                     # ^^ saves encrypted password to the machine_spec
+                     decoded = Base64.decode64(encrypted_admin_password)
+                   end
+                   # decrypt so we can utilize
+                   private_key = OpenSSL::PKey::RSA.new(get_private_key(instance.key_name))
+                   private_key.private_decrypt decoded
+                 end
+
+      disable_sspi =  machine_spec.reference['winrm_disable_sspi'] ||
+                      machine_options[:winrm_disable_sspi] ||
+                      false # default to Negotiate
+      basic_auth_only = machine_spec.reference['winrm_basic_auth_only'] ||
+                        machine_options[:winrm_basic_auth_only] ||
+                        false # disallow Basic auth by default
+      no_ssl_peer_verification = machine_spec.reference['winrm_no_ssl_peer_verification'] ||
+                                 machine_options[:winrm_no_ssl_peer_verification] ||
+                                 false #disallow MITM potential by default
 
       winrm_options = {
         user: username,
@@ -1195,37 +1210,44 @@ EOD
       end
     end
 
-    def ssh_options_for(machine_spec, machine_options, instance)
-      result = {
-        # TODO create a user known hosts file
-        #          :user_known_hosts_file => vagrant_ssh_config['UserKnownHostsFile'],
-        #          :paranoid => true,
-        :auth_methods => [ 'publickey' ],
-        :keys_only => true,
-        :host_key_alias => "#{instance.id}.AWS"
-      }.merge(machine_options[:ssh_options] || {})
+    def private_key_for(machine_spec, machine_options, instance)
       if instance.respond_to?(:private_key) && instance.private_key
-        result[:key_data] = [ instance.private_key ]
+        instance.private_key
       elsif instance.respond_to?(:key_name) && instance.key_name
         key = get_private_key(instance.key_name)
         unless key
           raise "Server has key name '#{instance.key_name}', but the corresponding private key was not found locally.  Check if the key is in Chef::Config.private_key_paths: #{Chef::Config.private_key_paths.join(', ')}"
         end
-        result[:key_data] = [ key ]
+        key
       elsif machine_spec.reference['key_name']
         key = get_private_key(machine_spec.reference['key_name'])
         unless key
           raise "Server was created with key name '#{machine_spec.reference['key_name']}', but the corresponding private key was not found locally.  Check if the key is in Chef::Config.private_key_paths: #{Chef::Config.private_key_paths.join(', ')}"
         end
-        result[:key_data] = [ key ]
+        key
       elsif machine_options[:bootstrap_options] && machine_options[:bootstrap_options][:key_path]
-        result[:key_data] = [ IO.read(machine_options[:bootstrap_options][:key_path]) ]
+        IO.read(machine_options[:bootstrap_options][:key_path])
       elsif machine_options[:bootstrap_options] && machine_options[:bootstrap_options][:key_name]
-        result[:key_data] = [ get_private_key(machine_options[:bootstrap_options][:key_name]) ]
+        get_private_key(machine_options[:bootstrap_options][:key_name])
       else
         # TODO make a way to suggest other keys to try ...
         raise "No key found to connect to #{machine_spec.name} (#{machine_spec.reference.inspect})!"
       end
+    end
+
+    def ssh_options_for(machine_spec, machine_options, instance)
+      result = {
+        # TODO create a user known hosts file
+        #          :user_known_hosts_file => vagrant_ssh_config['UserKnownHostsFile'],
+        #          :paranoid => true,
+        :auth_methods => [ 'publickey' ],
+        :keys_only => true,
+        :host_key_alias => "#{instance.id}.AWS"
+      }.merge(machine_options[:ssh_options] || {})
+      unless result.has_key?(:key_data)
+        result[:keys_only] = true
+        result[:key_data] = [ private_key_for(machine_spec, machine_options, instance) ]
+      end
       result
     end
 

data/lib/chef/provisioning/aws_driver/version.rb

@@ -1,7 +1,7 @@
 class Chef
 module Provisioning
 module AWSDriver
-  VERSION = '2.0.0'
+  VERSION = '2.1.0'
 end
 end
 end

data/spec/integration/machine_spec.rb

@@ -407,7 +407,6 @@ describe Chef::Resource::Machine do
         expect(r).to destroy_an_aws_instance('test_machine2')
       end
 
-      # https://github.com/chef/chef-provisioning-aws/pull/295
       context "with a custom key" do
         let(:private_key) {
           k = OpenSSL::PKey::RSA.new(2048)
@@ -415,10 +414,13 @@ describe Chef::Resource::Machine do
           f.write(k.to_pem)
           k
         }
-        let(:public_key) {private_key.public_key}
+        let(:private_key_pem) {
+          private_key.to_pem
+        }
         let(:private_key_path) {
           Pathname.new(ENV['HOME']).join(".ssh", key_pair_name).expand_path
         }
+        let(:public_key) {private_key.public_key}
         let(:key_pair_name) { "test_key_pair_#{Random.rand(100)}" }
 
         before do
@@ -439,10 +441,29 @@ describe Chef::Resource::Machine do
           expect_recipe {
             machine 'test_machine' do
               machine_options bootstrap_options: {
+                instance_type: 't2.medium',
                 key_name: key_pair_name,
                 key_path: private_key_path
               }
-              action :allocate
+              action :ready
+            end
+          }.to create_an_aws_instance('test_machine'
+          ).and be_idempotent
+        end
+
+        it "uses key_data from the ssh_options", :super_slow do
+          expect_recipe {
+            machine 'test_machine' do
+              machine_options(
+                bootstrap_options: {
+                  instance_type: 't2.medium',
+                  key_name: key_pair_name
+                },
+                ssh_options: {
+                  key_data: [private_key_pem]
+                }
+              )
+              action :ready
             end
           }.to create_an_aws_instance('test_machine'
           ).and be_idempotent

metadata

@@ -1,29 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: chef-provisioning-aws
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
-- John Ewart
+- Tyler Ball
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-08-25 00:00:00.000000000 Z
+date: 2016-11-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-provisioning
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-v1
   requirement: !ruby/object:Gem::Requirement
@@ -98,120 +104,8 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.4.1
-- !ruby/object:Gem::Dependency
-  name: chef-zero
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: chef
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '12.4'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '12.4'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: pry-byebug
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: pry-stack_explorer
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: github_changelog_generator
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 description: Provisioner for creating aws containers in Chef Provisioning.
-email: jewart@getchef.com
+email: tball@chef.io
 executables: []
 extensions: []
 extra_rdoc_files:
@@ -312,7 +206,6 @@ files:
 - lib/chef/resource/aws_subnet.rb
 - lib/chef/resource/aws_vpc.rb
 - lib/chef/resource/aws_vpc_peering_connection.rb
-- spec/acceptance/aws_ebs_volume/nodes/ettores-mbp.lan.json
 - spec/aws_support.rb
 - spec/aws_support/aws_resource_run_wrapper.rb
 - spec/aws_support/deep_matcher.rb
@@ -361,7 +254,7 @@ files:
 - spec/unit/chef/provisioning/aws_driver/credentials_spec.rb
 - spec/unit/chef/provisioning/aws_driver/driver_spec.rb
 - spec/unit/chef/provisioning/aws_driver/route53_spec.rb
-homepage: https://github.com/opscode/chef-provisioning-aws
+homepage: https://github.com/chef/chef-provisioning-aws
 licenses: []
 metadata: {}
 post_install_message: 
@@ -372,7 +265,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.2.2
+      version: 2.1.9
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -380,7 +273,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.6
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Provisioner for creating aws containers in Chef Provisioning.

data/spec/acceptance/aws_ebs_volume/nodes/ettores-mbp.lan.json

@@ -1,3 +0,0 @@
-{
-  "name": "ettores-mbp.lan"
-}