chef 12.0.3 → 12.1.0.rc.0

data/lib/chef/formatters/doc.rb

@@ -8,7 +8,9 @@ class Chef
     # "specdoc"
     class Doc < Formatters::Base
 
-      attr_reader :start_time, :end_time
+      attr_reader :start_time, :end_time, :successful_audits, :failed_audits
+      private :successful_audits, :failed_audits
+
       cli_name(:doc)
 
       def initialize(out, err)
@@ -16,6 +18,8 @@ class Chef
 
         @updated_resources = 0
         @up_to_date_resources = 0
+        @successful_audits = 0
+        @failed_audits = 0
         @start_time = Time.now
         @end_time = @start_time
       end
@@ -32,12 +36,19 @@ class Chef
         @up_to_date_resources + @updated_resources
       end
 
+      def total_audits
+        successful_audits + failed_audits
+      end
+
       def run_completed(node)
         @end_time = Time.now
         if Chef::Config[:why_run]
           puts_line "Chef Client finished, #{@updated_resources}/#{total_resources} resources would have been updated"
         else
           puts_line "Chef Client finished, #{@updated_resources}/#{total_resources} resources updated in #{elapsed_time} seconds"
+          if total_audits > 0
+            puts_line "  #{successful_audits}/#{total_audits} Audits succeeded"
+          end
         end
       end
 
@@ -47,6 +58,9 @@ class Chef
           puts_line "Chef Client failed. #{@updated_resources} resources would have been updated"
         else
           puts_line "Chef Client failed. #{@updated_resources} resources updated in #{elapsed_time} seconds"
+          if total_audits > 0
+            puts_line "  #{successful_audits} Audits succeeded"
+          end
         end
       end
 
@@ -151,6 +165,38 @@ class Chef
         unindent if @current_recipe
       end
 
+      def converge_failed(e)
+        # Currently a failed converge is handled the same way as a successful converge
+        converge_complete
+      end
+
+      # Called before audit phase starts
+      def audit_phase_start(run_status)
+        puts_line "Starting audit phase"
+      end
+
+      def audit_phase_complete
+        puts_line "Auditing complete"
+      end
+
+      def audit_phase_failed(error)
+        puts_line ""
+        puts_line "Audit phase exception:"
+        indent
+        puts_line "#{error.message}"
+        error.backtrace.each do |l|
+          puts_line l
+        end
+      end
+
+      def control_example_success(control_group_name, example_data)
+        @successful_audits += 1
+      end
+
+      def control_example_failure(control_group_name, example_data, error)
+        @failed_audits += 1
+      end
+
       # Called before action is executed on a resource.
       def resource_action_start(resource, action, notification_type=nil, notifier=nil)
         if resource.cookbook_name && resource.recipe_name

data/{spec/unit/monkey_patches/string_spec.rb → lib/chef/guard_interpreter.rb}

@@ -1,6 +1,6 @@
 #
-# Author:: Devin Ben-Hur <dbenhur@whitepages.com>
-# Copyright:: Copyright (c) 2008, 2011 Opscode, Inc.
+# Author:: Steven Danna (<steve@chef.io>)
+# Copyright:: Copyright (c) 2015 Chef Software, Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,22 +16,17 @@
 # limitations under the License.
 #
 
-require 'spec_helper'
-require 'chef/monkey_patches/string'
+require 'chef/guard_interpreter/default_guard_interpreter'
+require 'chef/guard_interpreter/resource_guard_interpreter'
 
-describe String do
-
-  describe "#ord" do
-    it "converts each ASCII-8BIT character to corresponding positive Fixnum" do
-      (0..0xff).each do |num|
-        ch = num.chr
-        ch.force_encoding('ASCII-8BIT') if ch.respond_to? :force_encoding
-
-        ch.ord.should be_a_kind_of(Fixnum)
-        ch.ord.should == num
+class Chef
+  class GuardInterpreter
+    def self.for_resource(resource, command, command_opts)
+      if resource.guard_interpreter == :default
+        Chef::GuardInterpreter::DefaultGuardInterpreter.new(command, command_opts)
+      else
+        Chef::GuardInterpreter::ResourceGuardInterpreter.new(resource, command, command_opts)
       end
     end
-
   end
-
 end

data/lib/chef/guard_interpreter/resource_guard_interpreter.rb

@@ -16,7 +16,7 @@
 # limitations under the License.
 #
 
-require 'chef/guard_interpreter/default_guard_interpreter'
+require 'chef/guard_interpreter'
 
 class Chef
   class GuardInterpreter
@@ -41,7 +41,7 @@ class Chef
         # attribute by checking the type of the resources.
         # We need to make sure we check for Script first because any resource
         # that can get to here is an Execute resource.
-        if @parent_resource.is_a? Chef::Resource::Script
+        if @resource.is_a? Chef::Resource::Script
           block_attributes = @command_opts.merge({:code => @command})
         else
           block_attributes = @command_opts.merge({:command => @command})
@@ -95,6 +95,7 @@ class Chef
         empty_events = Chef::EventDispatch::Dispatcher.new
         anonymous_run_context = Chef::RunContext.new(parent_resource.node, {}, empty_events)
         interpreter_resource = resource_class.new('Guard resource', anonymous_run_context)
+        interpreter_resource.is_guard_interpreter = true
 
         interpreter_resource
       end

data/lib/chef/http.rb

@@ -25,7 +25,6 @@ require 'tempfile'
 require 'net/https'
 require 'uri'
 require 'chef/http/basic_client'
-require 'chef/monkey_patches/string'
 require 'chef/monkey_patches/net_http'
 require 'chef/config'
 require 'chef/platform/query_helpers'
@@ -204,7 +203,7 @@ class Chef
 
     def create_url(path)
       return path if path.is_a?(URI)
-      if path =~ /^(http|https):\/\//
+      if path =~ /^(http|https):\/\//i
         URI.parse(path)
       elsif path.nil? or path.empty?
         URI.parse(@url)

data/lib/chef/knife.rb

@@ -53,6 +53,7 @@ class Chef
     def_delegator :@ui, :format_for_display
     def_delegator :@ui, :format_cookbook_list_for_display
     def_delegator :@ui, :edit_data
+    def_delegator :@ui, :edit_hash
     def_delegator :@ui, :edit_object
     def_delegator :@ui, :confirm
 
@@ -260,7 +261,7 @@ class Chef
     OFFICIAL_PLUGINS = %w[ec2 rackspace windows openstack terremark bluebox]
 
     # :nodoc:
-    # Error out and print usage. probably becuase the arguments given by the
+    # Error out and print usage. probably because the arguments given by the
     # user could not be resolved to a subcommand.
     def self.subcommand_not_found!(args)
       ui.fatal("Cannot find sub command for: '#{args.join(' ')}'")
@@ -269,7 +270,8 @@ class Chef
         list_commands(category_commands)
       elsif missing_plugin = ( OFFICIAL_PLUGINS.find {|plugin| plugin == args[0]} )
         ui.info("The #{missing_plugin} commands were moved to plugins in Chef 0.10")
-        ui.info("You can install the plugin with `(sudo) gem install knife-#{missing_plugin}")
+        ui.info("You can install the plugin with `(sudo) gem install knife-#{missing_plugin}`")
+        ui.info("Use `chef gem install knife-#{missing_plugin}` instead if using ChefDK")
       else
         list_commands
       end
@@ -308,7 +310,7 @@ class Chef
         exit 1
       end
 
-      # copy Mixlib::CLI over so that it cab be configured in knife.rb
+      # copy Mixlib::CLI over so that it can be configured in knife.rb
       # config file
       Chef::Config[:verbosity] = config[:verbosity]
     end

data/lib/chef/knife/bootstrap.rb

@@ -19,12 +19,17 @@
 require 'chef/knife'
 require 'chef/knife/data_bag_secret_options'
 require 'erubis'
+require 'chef/knife/bootstrap/chef_vault_handler'
+require 'chef/knife/bootstrap/client_builder'
 
 class Chef
   class Knife
     class Bootstrap < Knife
       include DataBagSecretOptions
 
+      attr_accessor :client_builder
+      attr_accessor :chef_vault_handler
+
       deps do
         require 'chef/knife/core/bootstrap_context'
         require 'chef/json_compat'
@@ -194,10 +199,55 @@ class Chef
         :description => "Verify the SSL cert for HTTPS requests to the Chef server API.",
         :boolean     => true
 
+      option :bootstrap_vault_file,
+        :long        => '--bootstrap-vault-file VAULT_FILE',
+        :description => 'A JSON file with a list of vault(s) and item(s) to be updated'
+
+      option :bootstrap_vault_json,
+        :long        => '--bootstrap-vault-json VAULT_JSON',
+        :description => 'A JSON string with the vault(s) and item(s) to be updated'
+
+      option :bootstrap_vault_item,
+        :long        => '--bootstrap-vault-item VAULT_ITEM',
+        :description => 'A single vault and item to update as "vault:item"',
+        :proc        => Proc.new { |i|
+          (vault, item) = i.split(/:/)
+          Chef::Config[:knife][:bootstrap_vault_item] ||= {}
+          Chef::Config[:knife][:bootstrap_vault_item][vault] ||= []
+          Chef::Config[:knife][:bootstrap_vault_item][vault].push(item)
+          Chef::Config[:knife][:bootstrap_vault_item]
+        }
+
+      def initialize(argv=[])
+        super
+        @client_builder = Chef::Knife::Bootstrap::ClientBuilder.new(
+          chef_config: Chef::Config,
+          knife_config: config,
+          ui: ui,
+        )
+        @chef_vault_handler = Chef::Knife::Bootstrap::ChefVaultHandler.new(
+          knife_config: config,
+          ui: ui
+        )
+      end
+
+      # The default bootstrap template to use to bootstrap a server This is a public API hook
+      # which knife plugins use or inherit and override.
+      #
+      # @return [String] Default bootstrap template
       def default_bootstrap_template
         "chef-full"
       end
 
+      # The server_name is the DNS or IP we are going to connect to, it is not necessarily
+      # the node name, the fqdn, or the hostname of the server.  This is a public API hook
+      # which knife plugins use or inherit and override.
+      #
+      # @return [String] The DNS or IP that bootstrap will connect to
+      def server_name
+        Array(@name_args).first
+      end
+
       def bootstrap_template
         # The order here is important. We want to check if we have the new Chef 12 option is set first.
         # Knife cloud plugins unfortunately all set a default option for the :distro so it should be at
@@ -216,7 +266,7 @@ class Chef
 
         # Otherwise search the template directories until we find the right one
         bootstrap_files = []
-        bootstrap_files << File.join(File.dirname(__FILE__), 'bootstrap', "#{template}.erb")
+        bootstrap_files << File.join(File.dirname(__FILE__), 'bootstrap/templates', "#{template}.erb")
         bootstrap_files << File.join(Knife.chef_config_dir, "bootstrap", "#{template}.erb") if Chef::Knife.chef_config_dir
         bootstrap_files << File.join(ENV['HOME'], '.chef', 'bootstrap', "#{template}.erb") if ENV['HOME']
         bootstrap_files << Gem.find_files(File.join("chef","knife","bootstrap","#{template}.erb"))
@@ -237,20 +287,45 @@ class Chef
         template_file
       end
 
+      def secret
+        @secret ||= encryption_secret_provided_ignore_encrypt_flag? ? read_secret : nil
+      end
+
+      def bootstrap_context
+        @bootstrap_context ||= Knife::Core::BootstrapContext.new(
+          config,
+          config[:run_list],
+          Chef::Config,
+          secret
+        )
+      end
+
       def render_template
         template_file = find_template
         template = IO.read(template_file).chomp
-        secret = encryption_secret_provided_ignore_encrypt_flag? ? read_secret : nil
-        context = Knife::Core::BootstrapContext.new(config, config[:run_list], Chef::Config, secret)
-        Erubis::Eruby.new(template).evaluate(context)
+        Erubis::Eruby.new(template).evaluate(bootstrap_context)
       end
 
       def run
         validate_name_args!
-        @node_name = Array(@name_args).first
 
         $stdout.sync = true
-        ui.info("Connecting to #{ui.color(@node_name, :bold)}")
+
+        # chef-vault integration must use the new client-side hawtness, otherwise to use the
+        # new client-side hawtness, just delete your validation key.
+        if chef_vault_handler.doing_chef_vault? || !File.exist?(File.expand_path(Chef::Config[:validation_key]))
+          client_builder.run
+
+          chef_vault_handler.run(node_name: config[:chef_node_name])
+
+          bootstrap_context.client_pem = client_builder.client_path
+        else
+          ui.info("Doing old-style registration with the validation key at #{Chef::Config[:validation_key]}...")
+          ui.info("Delete your validation key in order to use your user credentials instead")
+          ui.info("")
+        end
+
+        ui.info("Connecting to #{ui.color(server_name, :bold)}")
 
         begin
           knife_ssh.run
@@ -265,24 +340,19 @@ class Chef
       end
 
       def validate_name_args!
-        if Array(@name_args).first.nil?
+        if server_name.nil?
           ui.error("Must pass an FQDN or ip to bootstrap")
           exit 1
-        elsif Array(@name_args).first == "windows"
+        elsif server_name == "windows"
+          # catches "knife bootstrap windows" when that command is not installed
           ui.warn("Hostname containing 'windows' specified. Please install 'knife-windows' if you are attempting to bootstrap a Windows node via WinRM.")
         end
       end
 
-      def server_name
-        Array(@name_args).first
-      end
-
       def knife_ssh
         ssh = Chef::Knife::Ssh.new
         ssh.ui = ui
         ssh.name_args = [ server_name, ssh_command ]
-
-        # command line arguments and config file values are now merged into config in Chef::Knife#merge_configs
         ssh.config[:ssh_user] = config[:ssh_user]
         ssh.config[:ssh_password] = config[:ssh_password]
         ssh.config[:ssh_port] = config[:ssh_port]
@@ -311,7 +381,6 @@ class Chef
 
         command
       end
-
     end
   end
 end

data/lib/chef/knife/bootstrap/chef_vault_handler.rb

@@ -0,0 +1,165 @@
+#
+# Author:: Lamont Granquist (<lamont@chef.io>)
+# Copyright:: Copyright (c) 2015 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+class Chef
+  class Knife
+    class Bootstrap < Knife
+      class ChefVaultHandler
+
+        # @return [Hash] knife merged config, typically @config
+        attr_accessor :knife_config
+
+        # @return [Chef::Knife::UI] ui object for output
+        attr_accessor :ui
+
+        # @return [String] name of the node (technically name of the client)
+        attr_reader :node_name
+
+        # @param knife_config [Hash] knife merged config, typically @config
+        # @param ui [Chef::Knife::UI] ui object for output
+        def initialize(knife_config: {}, ui: nil)
+          @knife_config = knife_config
+          @ui           = ui
+        end
+
+        # Updates the chef vault items for the newly created node.
+        #
+        # @param node_name [String] name of the node (technically name of the client)
+        # @todo: node_name should be mandatory (ruby 2.0 compat)
+        def run(node_name: nil)
+          return unless doing_chef_vault?
+
+          sanity_check
+
+          @node_name = node_name
+
+          ui.info("Updating Chef Vault, waiting for client to be searchable..") while wait_for_client
+
+          update_bootstrap_vault_json!
+        end
+
+        # Iterate through all the vault items to update.  Items may be either a String
+        # or an Array of Strings:
+        #
+        # {
+        #   "vault1":  "item",
+        #   "vault2":  [ "item1", "item2", "item2" ]
+        # }
+        #
+        def update_bootstrap_vault_json!
+          vault_json.each do |vault, items|
+            [ items ].flatten.each do |item|
+              update_vault(vault, item)
+            end
+          end
+        end
+
+        # @return [Boolean] if we've got chef vault options to act on or not
+        def doing_chef_vault?
+          !!(bootstrap_vault_json || bootstrap_vault_file || bootstrap_vault_item)
+        end
+
+        private
+
+        # warn if the user has given mutual conflicting options
+        def sanity_check
+          if bootstrap_vault_item && (bootstrap_vault_json || bootstrap_vault_file)
+            ui.warn "--vault-item given with --vault-list or --vault-file, ignoring the latter"
+          end
+
+          if bootstrap_vault_json && bootstrap_vault_file
+            ui.warn "--vault-list given with --vault-file, ignoring the latter"
+          end
+        end
+
+        # @return [String] string with serialized JSON representing the chef vault items
+        def bootstrap_vault_json
+          knife_config[:bootstrap_vault_json]
+        end
+
+        # @return [String] JSON text in a file representing the chef vault items
+        def bootstrap_vault_file
+          knife_config[:bootstrap_vault_file]
+        end
+
+        # @return [Hash] Ruby object representing the chef vault items to create
+        def bootstrap_vault_item
+          knife_config[:bootstrap_vault_item]
+        end
+
+        # Helper to return a ruby object represeting all the data bags and items
+        # to update via chef-vault.
+        #
+        # @return [Hash] deserialized ruby hash with all the vault items
+        def vault_json
+          @vault_json ||=
+            begin
+              if bootstrap_vault_item
+                bootstrap_vault_item
+              else
+                json = bootstrap_vault_json ? bootstrap_vault_json : File.read(bootstrap_vault_file)
+                Chef::JSONCompat.from_json(json)
+              end
+            end
+        end
+
+        # Update an individual vault item and save it
+        #
+        # @param vault [String] name of the chef-vault encrypted data bag
+        # @param item [String] name of the chef-vault encrypted item
+        def update_vault(vault, item)
+          require_chef_vault!
+          bootstrap_vault_item = load_chef_bootstrap_vault_item(vault, item)
+          bootstrap_vault_item.clients("name:#{node_name}")
+          bootstrap_vault_item.save
+        end
+
+        # Hook to stub out ChefVault
+        #
+        # @param vault [String] name of the chef-vault encrypted data bag
+        # @param item [String] name of the chef-vault encrypted item
+        # @returns [ChefVault::Item] ChefVault::Item object
+        def load_chef_bootstrap_vault_item(vault, item)
+          ChefVault::Item.load(vault, item)
+        end
+
+        public :load_chef_bootstrap_vault_item  # for stubbing
+
+        # Helper used to spin waiting for the client to appear in search.
+        #
+        # @return [Boolean] true if the client is searchable
+        def wait_for_client
+          sleep 1
+          !Chef::Search::Query.new.search(:client, "name:#{node_name}")[0]
+        end
+
+        # Helper to very lazily require the chef-vault gem
+        def require_chef_vault!
+          @require_chef_vault ||=
+            begin
+              require 'chef-vault'
+              true
+            rescue LoadError
+              raise "Knife bootstrap cannot configure chef vault items when the chef-vault gem is not installed"
+            end
+        end
+
+      end
+    end
+  end
+end