chef 14.15.6 → 15.0.293

data/lib/chef/json_compat.rb

@@ -18,7 +18,7 @@
 # Wrapper class for interacting with JSON.
 
 require "ffi_yajl"
-require "chef/exceptions"
+require_relative "exceptions"
 # We're requiring this to prevent breaking consumers using Hash.to_json
 require "json"
 

data/lib/chef/key.rb

@@ -16,10 +16,10 @@
 # limitations under the License.
 #
 
-require "chef/json_compat"
-require "chef/mixin/params_validate"
-require "chef/exceptions"
-require "chef/server_api"
+require_relative "json_compat"
+require_relative "mixin/params_validate"
+require_relative "exceptions"
+require_relative "server_api"
 
 class Chef
   # Class for interacting with a chef key object. Can be used to create new keys,

data/lib/chef/knife.rb

@@ -18,24 +18,25 @@
 #
 
 require "forwardable"
-require "chef/version"
+require_relative "version"
 require "mixlib/cli"
-require "chef/workstation_config_loader"
-require "chef/mixin/convert_to_class_name"
-require "chef/mixin/path_sanity"
-require "chef/knife/core/subcommand_loader"
-require "chef/knife/core/ui"
-require "chef/local_mode"
-require "chef/server_api"
-require "chef/http/authenticator"
-require "chef/http/http_request"
-require "chef/http"
+require_relative "workstation_config_loader"
+require_relative "mixin/convert_to_class_name"
+require_relative "mixin/path_sanity"
+require_relative "knife/core/subcommand_loader"
+require_relative "knife/core/ui"
+require_relative "local_mode"
+require_relative "server_api"
+require_relative "http/authenticator"
+require_relative "http/http_request"
+require_relative "http"
 require "pp"
+require_relative "dist"
 
 class Chef
   class Knife
 
-    Chef::HTTP::HTTPRequest.user_agent = "Chef Knife#{Chef::HTTP::HTTPRequest::UA_COMMON}"
+    Chef::HTTP::HTTPRequest.user_agent = "#{Chef::Dist::PRODUCT} Knife#{Chef::HTTP::HTTPRequest::UA_COMMON}"
 
     include Mixlib::CLI
     include Chef::Mixin::PathSanity
@@ -63,12 +64,6 @@ class Chef
     attr_accessor :name_args
     attr_accessor :ui
 
-    # knife acl subcommands are grouped in this category using this constant to verify.
-    OPSCODE_HOSTED_CHEF_ACCESS_CONTROL = %w{acl group user}.freeze
-
-    # knife opc subcommands are grouped in this category using this constant to verify.
-    CHEF_ORGANIZATION_MANAGEMENT = %w{opc}.freeze
-
     # Configure mixlib-cli to always separate defaults from user-supplied CLI options
     def self.use_separate_defaults?
       true
@@ -275,14 +270,10 @@ class Chef
           ui.info("If this is a recently installed plugin, please run 'knife rehash' to update the subcommands cache.")
         end
 
-        if CHEF_ORGANIZATION_MANAGEMENT.include?(args[0])
-          list_commands("CHEF ORGANIZATION MANAGEMENT")
-        elsif OPSCODE_HOSTED_CHEF_ACCESS_CONTROL.include?(args[0])
-          list_commands("OPSCODE HOSTED CHEF ACCESS CONTROL")
-        elsif category_commands = guess_category(args)
+        if category_commands = guess_category(args)
           list_commands(category_commands)
         elsif OFFICIAL_PLUGINS.include?(args[0]) # command was an uninstalled official chef knife plugin
-          ui.info("Use `chef gem install knife-#{args[0]}` to install the plugin into ChefDK")
+          ui.info("Use `#{Chef::Dist::EXEC} gem install knife-#{args[0]}` to install the plugin into ChefDK")
         else
           list_commands
         end
@@ -326,6 +317,10 @@ class Chef
         exit 1
       end
 
+      # Grab a copy before config merge occurs, so that we can later identify
+      # whare a given config value is sourced from.
+      @original_config = config.dup
+
       # copy Mixlib::CLI over so that it can be configured in config.rb/knife.rb
       # config file
       Chef::Config[:verbosity] = config[:verbosity] if config[:verbosity]
@@ -354,7 +349,9 @@ class Chef
     # overwrite.
     def config_file_settings
       cli_keys.each_with_object({}) do |key, memo|
-        memo[key] = Chef::Config[:knife][key] if Chef::Config[:knife].key?(key)
+        if Chef::Config[:knife].key?(key)
+          memo[key] = Chef::Config[:knife][key]
+        end
       end
     end
 
@@ -363,11 +360,32 @@ class Chef
     #  config_file_settings - Chef::Config[:knife] sub-hash
     #  config               - mixlib-cli settings (accessor from the mixin)
     def merge_configs
+      # Update our original_config - if someone has created a knife command
+      # instance directly, they are likely ot have set cmd.config values directly
+      # as well, at which point our saved original config is no longer up to date.
+      @original_config = config.dup
       # other code may have a handle to the config object, so use Hash#replace to deliberately
       # update-in-place.
-      config.replace(
-        default_config.merge(config_file_settings).merge(config)
-      )
+      config.replace(default_config.merge(config_file_settings).merge(config))
+    end
+
+    #
+    # Determine the source of a given configuration key
+    #
+    # @argument key [Symbol] a configuration key
+    # @return [Symbol,NilClass] return the source of the config key,
+    # one of:
+    #   - :cli - this was explicitly provided on the CLI
+    #   - :config - this came from Chef::Config[:knife]
+    #   - :cli_default - came from a declared CLI `option`'s `default` value.
+    #   - nil - if the key could not be found in any source.
+    #           This can happen when it is invalid, or has been
+    #           set directly into #config without then calling #merge_config
+    def config_source(key)
+      return :cli if @original_config.include? key
+      return :config if config_file_settings.key? key
+      return :cli_default if default_config.include? key
+      nil
     end
 
     # Catch-all method that does any massaging needed for various config
@@ -456,7 +474,7 @@ class Chef
         run
       end
     rescue Exception => e
-      raise if raise_exception || ( Chef::Config[:verbosity] && Chef::Config[:verbosity] >= 2 )
+      raise if raise_exception || Chef::Config[:verbosity] == 2
       humanize_exception(e)
       exit 100
     end
@@ -470,7 +488,7 @@ class Chef
       when OpenSSL::SSL::SSLError
         ui.error "Could not establish a secure connection to the server."
         ui.info "Use `knife ssl check` to troubleshoot your SSL configuration."
-        ui.info "If your Chef Server uses a self-signed certificate, you can use"
+        ui.info "If your server uses a self-signed certificate, you can use"
         ui.info "`knife ssl fetch` to make knife trust the server's certificates."
         ui.info ""
         ui.info  "Original Exception: #{e.class.name}: #{e.message}"
@@ -503,7 +521,7 @@ class Chef
         ui.error "You authenticated successfully to #{server_url} as #{username} but you are not authorized for this action."
         proxy_env_vars = ENV.to_hash.keys.map(&:downcase) & %w{http_proxy https_proxy ftp_proxy socks_proxy no_proxy}
         unless proxy_env_vars.empty?
-          ui.error "There are proxy servers configured, your Chef server may need to be added to NO_PROXY."
+          ui.error "There are proxy servers configured, your server url may need to be added to NO_PROXY."
         end
         ui.info "Response:  #{format_rest_error(response)}"
       when Net::HTTPBadRequest
@@ -526,10 +544,10 @@ class Chef
         client_api_version = version_header["request_version"]
         min_server_version = version_header["min_version"]
         max_server_version = version_header["max_version"]
-        ui.error "The version of Chef that Knife is using is not supported by the Chef server you sent this request to"
-        ui.info "The request that Knife sent was using API version #{client_api_version}"
-        ui.info "The Chef server you sent the request to supports a min API verson of #{min_server_version} and a max API version of #{max_server_version}"
-        ui.info "Please either update your Chef client or server to be a compatible set"
+        ui.error "The API version that Knife is using is not supported by the server you sent this request to."
+        ui.info "The request that Knife sent was using API version #{client_api_version}."
+        ui.info "The server you sent the request to supports a min API verson of #{min_server_version} and a max API version of #{max_server_version}."
+        ui.info "Please either update your #{Chef::Dist::PRODUCT} or the server to be a compatible set."
       else
         ui.error response.message
         ui.info "Response: #{format_rest_error(response)}"
@@ -604,14 +622,14 @@ class Chef
 
     def rest
       @rest ||= begin
-        require "chef/server_api"
+        require_relative "server_api"
         Chef::ServerAPI.new(Chef::Config[:chef_server_url])
       end
     end
 
     def noauth_rest
       @rest ||= begin
-        require "chef/http/simple_json"
+        require_relative "http/simple_json"
         Chef::HTTP::SimpleJSON.new(Chef::Config[:chef_server_url])
       end
     end

data/lib/chef/knife/bootstrap.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
-# Copyright:: Copyright 2010-2016, Chef Software Inc.
+# Copyright:: Copyright 2010-2019, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,233 +16,330 @@
 # limitations under the License.
 #
 
-require "chef/knife"
-require "chef/knife/data_bag_secret_options"
-require "erubis"
-require "chef/knife/bootstrap/chef_vault_handler"
-require "chef/knife/bootstrap/client_builder"
-require "chef/util/path_helper"
-require_relative "../version_string"
+require_relative "../knife"
+require_relative "data_bag_secret_options"
+require_relative "../dist"
+require "license_acceptance/cli_flags/mixlib_cli"
+require "license_acceptance/acceptor"
 
 class Chef
   class Knife
     class Bootstrap < Knife
       include DataBagSecretOptions
+      include LicenseAcceptance::CLIFlags::MixlibCLI
 
-      attr_accessor :client_builder
-      attr_accessor :chef_vault_handler
+      SUPPORTED_CONNECTION_PROTOCOLS = %w{ssh winrm}.freeze
+      WINRM_AUTH_PROTOCOL_LIST = %w{plaintext kerberos ssl negotiate}.freeze
 
-      deps do
-        require "chef/knife/core/bootstrap_context"
-        require "chef/json_compat"
-        require "tempfile"
-        require "highline"
-        require "net/ssh"
-        require "net/ssh/multi"
-        require "chef/knife/ssh"
-        Chef::Knife::Ssh.load_deps
-      end
+      # Common connectivity options
+      option :connection_user,
+        short: "-U USERNAME",
+        long: "--connection-user USERNAME",
+        description: "Authenticate to the target host with this user account."
 
-      banner "knife bootstrap [SSH_USER@]FQDN (options)"
-
-      option :ssh_user,
-        short: "-x USERNAME",
-        long: "--ssh-user USERNAME",
-        description: "The ssh username",
-        default: "root"
-
-      option :ssh_password,
+      option :connection_password,
         short: "-P PASSWORD",
-        long: "--ssh-password PASSWORD",
-        description: "The ssh password"
+        long: "--connection-password PASSWORD",
+        description: "Authenticate to the target host with this password."
 
-      option :ssh_port,
+      option :connection_port,
         short: "-p PORT",
-        long: "--ssh-port PORT",
-        description: "The ssh port",
-        proc: Proc.new { |key| Chef::Config[:knife][:ssh_port] = key }
+        long: "--connection-port PORT",
+        description: "The port on the target node to connect to."
+
+      option :connection_protocol,
+        short: "-o PROTOCOL",
+        long: "--connection-protocol PROTOCOL",
+        description: "The protocol to use to connect to the target node.",
+        in: SUPPORTED_CONNECTION_PROTOCOLS
+
+      option :max_wait,
+        short: "-W SECONDS",
+        long: "--max-wait SECONDS",
+        description: "The maximum time to wait for the initial connection to be established."
+
+      option :session_timeout,
+        long: "--session-timeout SECONDS",
+        description: "The number of seconds to wait for each connection operation to be acknowledged while running bootstrap.",
+        proc: Proc.new { |protocol| Chef::Config[:knife][:session_timeout] = protocol },
+        default: 60
+
+      # WinRM Authentication
+      option :winrm_ssl_peer_fingerprint,
+        long: "--winrm-ssl-peer-fingerprint FINGERPRINT",
+        description: "SSL certificate fingerprint expected from the target."
+
+      option :ca_trust_file,
+        short: "-f CA_TRUST_PATH",
+        long: "--ca-trust-file CA_TRUST_PATH",
+        description: "The Certificate Authority (CA) trust file used for SSL transport."
+
+      option :winrm_no_verify_cert,
+        long: "--winrm-no-verify-cert",
+        description: "Do not verify the SSL certificate of the target node for WinRM.",
+        boolean: true
 
+      option :winrm_ssl,
+        long: "--winrm-ssl",
+        description: "Use SSL in the WinRM connection."
+
+      option :winrm_auth_method,
+        short: "-w AUTH-METHOD",
+        long: "--winrm-auth-method AUTH-METHOD",
+        description: "The WinRM authentication method to use.",
+        proc: Proc.new { |protocol| Chef::Config[:knife][:winrm_auth_method] = protocol },
+        in: WINRM_AUTH_PROTOCOL_LIST
+
+      option :winrm_basic_auth_only,
+        long: "--winrm-basic-auth-only",
+        description: "For WinRM basic authentication when using the 'ssl' auth method.",
+        boolean: true
+
+        # This option was provided in knife bootstrap windows winrm,
+        # but it is ignored  in knife-windows/WinrmSession, and so remains unimplemeneted here.
+        # option :kerberos_keytab_file,
+        #   :short => "-T KEYTAB_FILE",
+        #   :long => "--keytab-file KEYTAB_FILE",
+        #   :description => "The Kerberos keytab file used for authentication",
+        #   :proc => Proc.new { |keytab| Chef::Config[:knife][:kerberos_keytab_file] = keytab }
+
+      option :kerberos_realm,
+        short: "-R KERBEROS_REALM",
+        long: "--kerberos-realm KERBEROS_REALM",
+        description: "The Kerberos realm used for authentication.",
+        proc: Proc.new { |protocol| Chef::Config[:knife][:kerberos_realm] = protocol }
+
+      option :kerberos_service,
+        short: "-S KERBEROS_SERVICE",
+        long: "--kerberos-service KERBEROS_SERVICE",
+        description: "The Kerberos service used for authentication.",
+        proc: Proc.new { |protocol| Chef::Config[:knife][:kerberos_service] = protocol }
+
+      ## SSH Authentication
       option :ssh_gateway,
         short: "-G GATEWAY",
         long: "--ssh-gateway GATEWAY",
-        description: "The ssh gateway",
+        description: "The SSH gateway.",
         proc: Proc.new { |key| Chef::Config[:knife][:ssh_gateway] = key }
 
       option :ssh_gateway_identity,
         long: "--ssh-gateway-identity SSH_GATEWAY_IDENTITY",
-        description: "The SSH identity file used for gateway authentication",
+        description: "The SSH identity file used for gateway authentication.",
         proc: Proc.new { |key| Chef::Config[:knife][:ssh_gateway_identity] = key }
 
-      option :forward_agent,
+      option :ssh_forward_agent,
         short: "-A",
-        long: "--forward-agent",
-        description: "Enable SSH agent forwarding",
+        long: "--ssh-forward-agent",
+        description: "Enable SSH agent forwarding.",
         boolean: true
 
-      option :identity_file,
-        long: "--identity-file IDENTITY_FILE",
-        description: "The SSH identity file used for authentication. [DEPRECATED] Use --ssh-identity-file instead."
-
       option :ssh_identity_file,
         short: "-i IDENTITY_FILE",
         long: "--ssh-identity-file IDENTITY_FILE",
-        description: "The SSH identity file used for authentication"
+        description: "The SSH identity file used for authentication."
 
-      option :chef_node_name,
-        short: "-N NAME",
-        long: "--node-name NAME",
-        description: "The Chef node name for your new node"
+      option :ssh_verify_host_key,
+        long: "--ssh-verify-host-key VALUE",
+        description: "Verify host key. Default is 'always'.",
+        in: %w{always accept_new accept_new_or_local_tunnel never}
 
-      option :prerelease,
-        long: "--prerelease",
-        description: "Install the pre-release chef gems"
+      #
+      # bootstrap options
+      #
 
+      # client.rb content via chef-full/bootstrap_context
       option :bootstrap_version,
         long: "--bootstrap-version VERSION",
-        description: "The version of Chef to install",
+        description: "The version of #{Chef::Dist::PRODUCT} to install.",
         proc: lambda { |v| Chef::Config[:knife][:bootstrap_version] = v }
 
+      option :channel,
+        long: "--channel CHANNEL",
+        description: "Install from the given channel. Default is 'stable'.",
+        default: "stable",
+        in: %w{stable current unstable}
+
+      # client.rb content via chef-full/bootstrap_context
       option :bootstrap_proxy,
         long: "--bootstrap-proxy PROXY_URL",
-        description: "The proxy server for the node being bootstrapped",
+        description: "The proxy server for the node being bootstrapped.",
         proc: Proc.new { |p| Chef::Config[:knife][:bootstrap_proxy] = p }
 
+      # client.rb content via bootstrap_context
       option :bootstrap_proxy_user,
         long: "--bootstrap-proxy-user PROXY_USER",
-        description: "The proxy authentication username for the node being bootstrapped"
+        description: "The proxy authentication username for the node being bootstrapped."
 
+      # client.rb content via bootstrap_context
       option :bootstrap_proxy_pass,
         long: "--bootstrap-proxy-pass PROXY_PASS",
-        description: "The proxy authentication password for the node being bootstrapped"
+        description: "The proxy authentication password for the node being bootstrapped."
 
+      # client.rb content via bootstrap_context
       option :bootstrap_no_proxy,
         long: "--bootstrap-no-proxy [NO_PROXY_URL|NO_PROXY_IP]",
-        description: "Do not proxy locations for the node being bootstrapped; this option is used internally by Opscode",
+        description: "Do not proxy locations for the node being bootstrapped; this option is used internally by Chef.",
         proc: Proc.new { |np| Chef::Config[:knife][:bootstrap_no_proxy] = np }
 
+      # client.rb content via bootstrap_context
       option :bootstrap_template,
         short: "-t TEMPLATE",
         long: "--bootstrap-template TEMPLATE",
-        description: "Bootstrap Chef using a built-in or custom template. Set to the full path of an erb template or use one of the built-in templates."
+        description: "Bootstrap #{Chef::Dist::PRODUCT} using a built-in or custom template. Set to the full path of an erb template or use one of the built-in templates."
 
+      # client.rb content via bootstrap_context
+      option :node_ssl_verify_mode,
+        long: "--node-ssl-verify-mode [peer|none]",
+        description: "Whether or not to verify the SSL cert for all HTTPS requests.",
+        proc: Proc.new { |v|
+          valid_values = %w{none peer}
+          unless valid_values.include?(v)
+            raise "Invalid value '#{v}' for --node-ssl-verify-mode. Valid values are: #{valid_values.join(", ")}"
+          end
+          v
+        }
+
+      # bootstrap_context - client.rb
+      option :node_verify_api_cert,
+        long: "--[no-]node-verify-api-cert",
+        description: "Verify the SSL cert for HTTPS requests to the #{Chef::Dist::SERVER_PRODUCT} API.",
+        boolean: true
+
+      # runtime - sudo settings (train handles sudo)
       option :use_sudo,
         long: "--sudo",
-        description: "Execute the bootstrap via sudo",
+        description: "Execute the bootstrap via sudo.",
         boolean: true
 
+      # runtime - sudo settings (train handles sudo)
       option :preserve_home,
         long: "--sudo-preserve-home",
-        description: "Preserve non-root user HOME environment variable with sudo",
+        description: "Preserve non-root user HOME environment variable with sudo.",
         boolean: true
 
+      # runtime - sudo settings (train handles sudo)
       option :use_sudo_password,
         long: "--use-sudo-password",
-        description: "Execute the bootstrap via sudo with password",
+        description: "Execute the bootstrap via sudo with password.",
         boolean: false
 
+      # runtime - client_builder
+      option :chef_node_name,
+        short: "-N NAME",
+        long: "--node-name NAME",
+        description: "The node name for your new node."
+
+      # runtime - client_builder - set runlist when creating node
       option :run_list,
         short: "-r RUN_LIST",
         long: "--run-list RUN_LIST",
-        description: "Comma separated list of roles/recipes to apply",
+        description: "Comma separated list of roles/recipes to apply.",
         proc: lambda { |o| o.split(/[\s,]+/) },
         default: []
 
+      # runtime - client_builder - set policy name when creating node
       option :policy_name,
         long: "--policy-name POLICY_NAME",
-        description: "Policyfile name to use (--policy-group must also be given)",
+        description: "Policyfile name to use (--policy-group must also be given).",
         default: nil
 
+      # runtime - client_builder - set policy group when creating node
       option :policy_group,
         long: "--policy-group POLICY_GROUP",
-        description: "Policy group name to use (--policy-name must also be given)",
+        description: "Policy group name to use (--policy-name must also be given).",
         default: nil
 
+      # runtime - client_builder -  node tags
       option :tags,
         long: "--tags TAGS",
-        description: "Comma separated list of tags to apply to the node",
+        description: "Comma separated list of tags to apply to the node.",
         proc: lambda { |o| o.split(/[\s,]+/) },
         default: []
 
+      # bootstrap template
       option :first_boot_attributes,
         short: "-j JSON_ATTRIBS",
         long: "--json-attributes",
-        description: "A JSON string to be added to the first run of chef-client",
+        description: "A JSON string to be added to the first run of #{Chef::Dist::CLIENT}.",
         proc: lambda { |o| Chef::JSONCompat.parse(o) },
         default: nil
 
+      # bootstrap template
       option :first_boot_attributes_from_file,
         long: "--json-attribute-file FILE",
-        description: "A JSON file to be used to the first run of chef-client",
+        description: "A JSON file to be used to the first run of #{Chef::Dist::CLIENT}.",
         proc: lambda { |o| Chef::JSONCompat.parse(File.read(o)) },
         default: nil
 
-      option :host_key_verify,
-        long: "--[no-]host-key-verify",
-        description: "Verify host key, enabled by default.",
-        boolean: true,
-        default: true
+      # Note that several of the below options are used by bootstrap template,
+      # but only from the passed-in knife config; it does not use the
+      # config from the CLI for those values.  We cannot always used the merged
+      # config, because in some cases the knife keys thIn those cases, the option
+      # will have a proc that assigns the value into Chef::Config[:knife]
 
+      # bootstrap template
+      # Create ohai hints in /etc/chef/ohai/hints, fname=hintname, content=value
       option :hint,
         long: "--hint HINT_NAME[=HINT_FILE]",
-        description: "Specify Ohai Hint to be set on the bootstrap target. Use multiple --hint options to specify multiple hints.",
+        description: "Specify an Ohai hint to be set on the bootstrap target. Use multiple --hint options to specify multiple hints.",
         proc: Proc.new { |h|
           Chef::Config[:knife][:hints] ||= Hash.new
           name, path = h.split("=")
           Chef::Config[:knife][:hints][name] = path ? Chef::JSONCompat.parse(::File.read(path)) : Hash.new
         }
 
+      # bootstrap override: url of a an installer shell script touse in place of omnitruck
+      # Note that the bootstrap template _only_ references this out of Chef::Config, and not from
+      # the provided options to knife bootstrap, so we set the Chef::Config option here.
       option :bootstrap_url,
         long: "--bootstrap-url URL",
-        description: "URL to a custom installation script",
+        description: "URL to a custom installation script.",
         proc: Proc.new { |u| Chef::Config[:knife][:bootstrap_url] = u }
 
+      option :msi_url, # Windows target only
+        short: "-m URL",
+        long: "--msi-url URL",
+        description: "Location of the #{Chef::Dist::PRODUCT} MSI. The default templates will prefer to download from this location. The MSI will be downloaded from #{Chef::Dist::WEBSITE} if not provided (Windows).",
+        default: ""
+
+      # bootstrap override: Do this instead of our own setup.sh from omnitruck. Causes bootstrap_url to be ignored.
       option :bootstrap_install_command,
         long: "--bootstrap-install-command COMMANDS",
-        description: "Custom command to install chef-client",
+        description: "Custom command to install #{Chef::Dist::PRODUCT}.",
         proc: Proc.new { |ic| Chef::Config[:knife][:bootstrap_install_command] = ic }
 
+      # bootstrap template: Run this command first in the bootstrap script
       option :bootstrap_preinstall_command,
-             long: "--bootstrap-preinstall-command COMMANDS",
-             description: "Custom commands to run before installing chef-client",
-             proc: Proc.new { |preic| Chef::Config[:knife][:bootstrap_preinstall_command] = preic }
+        long: "--bootstrap-preinstall-command COMMANDS",
+        description: "Custom commands to run before installing #{Chef::Dist::PRODUCT}.",
+        proc: Proc.new { |preic| Chef::Config[:knife][:bootstrap_preinstall_command] = preic }
 
+      # bootstrap template
       option :bootstrap_wget_options,
         long: "--bootstrap-wget-options OPTIONS",
-        description: "Add options to wget when installing chef-client",
+        description: "Add options to wget when installing #{Chef::Dist::PRODUCT}.",
         proc: Proc.new { |wo| Chef::Config[:knife][:bootstrap_wget_options] = wo }
 
+      # bootstrap template
       option :bootstrap_curl_options,
         long: "--bootstrap-curl-options OPTIONS",
-        description: "Add options to curl when install chef-client",
+        description: "Add options to curl when install #{Chef::Dist::PRODUCT}.",
         proc: Proc.new { |co| Chef::Config[:knife][:bootstrap_curl_options] = co }
 
-      option :node_ssl_verify_mode,
-        long: "--node-ssl-verify-mode [peer|none]",
-        description: "Whether or not to verify the SSL cert for all HTTPS requests.",
-        proc: Proc.new { |v|
-          valid_values = %w{none peer}
-          unless valid_values.include?(v)
-            raise "Invalid value '#{v}' for --node-ssl-verify-mode. Valid values are: #{valid_values.join(", ")}"
-          end
-          v
-        }
-
-      option :node_verify_api_cert,
-        long: "--[no-]node-verify-api-cert",
-        description: "Verify the SSL cert for HTTPS requests to the Chef server API.",
-        boolean: true
-
+      # chef_vault_handler
       option :bootstrap_vault_file,
         long: "--bootstrap-vault-file VAULT_FILE",
-        description: "A JSON file with a list of vault(s) and item(s) to be updated"
+        description: "A JSON file with a list of vault(s) and item(s) to be updated."
 
+      # chef_vault_handler
       option :bootstrap_vault_json,
         long: "--bootstrap-vault-json VAULT_JSON",
-        description: "A JSON string with the vault(s) and item(s) to be updated"
+        description: "A JSON string with the vault(s) and item(s) to be updated."
 
+      # chef_vault_handler
       option :bootstrap_vault_item,
         long: "--bootstrap-vault-item VAULT_ITEM",
-        description: 'A single vault and item to update as "vault:item"',
+        description: 'A single vault and item to update as "vault:item".',
         proc: Proc.new { |i|
           (vault, item) = i.split(/:/)
           Chef::Config[:knife][:bootstrap_vault_item] ||= {}
@@ -251,30 +348,104 @@ class Chef
           Chef::Config[:knife][:bootstrap_vault_item]
         }
 
-      option :chef_license,
-        long: "--chef-license ACCEPTANCE",
-        description: "Placeholder option for Chef license acceptance to provide compatibility with Chef Infra 15+ command line options.",
-        required: false
+      DEPRECATED_FLAGS = {
+        # deprecated_key: [new_key, deprecated_long]
+        # optional third element: replacement_value - if converting from bool
+        #   (--bool-option) to valued flag (--new-option VALUE)
+        #   this will be the value that is assigned the new flag when the old flag is used.
+        auth_timeout: [:max_wait, "--max-wait SECONDS" ],
+        host_key_verify:
+          [:ssh_verify_host_key, "--[no-]host-key-verify"],
+        prerelease:
+          [:channel, "--prerelease", "current"],
+        ssh_user:
+          [:connection_user, "--ssh-user USER"],
+        ssh_password:
+          [:connection_password, "--ssh-password PASSWORD"],
+        ssh_port:
+          [:connection_port, "-ssh-port" ],
+        ssl_peer_fingerprint:
+          [:winrm_ssl_peer_fingerprint, "--ssl-peer-fingerprint FINGERPRINT"],
+        winrm_user:
+          [:connection_user, "--winrm-user USER"],
+        winrm_password:
+          [:connection_password, "--winrm-password"],
+        winrm_port:
+          [:connection_port, "--winrm-port"],
+        winrm_authentication_protocol:
+          [:winrm_auth_method, "--winrm-authentication-protocol PROTOCOL"],
+        winrm_session_timeout:
+          [:session_timeout, "--winrm-session-timeout MINUTES"],
+      }.freeze
+
+      DEPRECATED_FLAGS.each do |deprecated_key, deprecation_entry|
+        new_key, deprecated_long, replacement_value = deprecation_entry
+        new_long = options[new_key][:long]
+        new_long_desc = if replacement_value.nil?
+                          new_long
+                        else
+                          "#{new_long.split(" ").first} #{replacement_value}"
+                        end
+        option(deprecated_key, long: deprecated_long,
+                               description: "This flag is deprecated. Please use '#{new_long_desc}' instead.",
+                               boolean: options[new_key][:boolean] || !replacement_value.nil?,
+                               # Put deprecated options at the end of the options list
+                               on: :tail)
+      end
+
+      attr_reader :connection
+
+      deps do
+        require "erubis"
+
+        require_relative "../json_compat"
+        require_relative "../util/path_helper"
+        require_relative "bootstrap/chef_vault_handler"
+        require_relative "bootstrap/client_builder"
+        require_relative "bootstrap/train_connector"
+      end
+
+      banner "knife bootstrap [PROTOCOL://][USER@]FQDN (options)"
 
-      def initialize(argv = [])
-        super
-        @client_builder = Chef::Knife::Bootstrap::ClientBuilder.new(
+      def client_builder
+        @client_builder ||= Chef::Knife::Bootstrap::ClientBuilder.new(
           chef_config: Chef::Config,
           knife_config: config,
           ui: ui
         )
-        @chef_vault_handler = Chef::Knife::Bootstrap::ChefVaultHandler.new(
+      end
+
+      def chef_vault_handler
+        @chef_vault_handler ||= Chef::Knife::Bootstrap::ChefVaultHandler.new(
           knife_config: config,
           ui: ui
         )
       end
 
-      # The default bootstrap template to use to bootstrap a server This is a public API hook
-      # which knife plugins use or inherit and override.
+      # Determine if we need to accept the Chef Infra license locally in order to successfully bootstrap
+      # the remote node. Remote 'chef-client' run will fail if it is >= 15 and the license is not accepted locally.
+      def check_license
+        Chef::Log.debug("Checking if we need to accept Chef license to bootstrap node")
+        version = config[:bootstrap_version] || Chef::VERSION.split(".").first
+        acceptor = LicenseAcceptance::Acceptor.new(logger: Chef::Log, provided: Chef::Config[:chef_license])
+        if acceptor.license_required?("chef", version)
+          Chef::Log.debug("License acceptance required for chef version: #{version}")
+          license_id = acceptor.id_from_mixlib("chef")
+          acceptor.check_and_persist(license_id, version)
+          Chef::Config[:chef_license] ||= acceptor.acceptance_value
+        end
+      end
+
+      # The default bootstrap template to use to bootstrap a server.
+      # This is a public API hook which knife plugins use or inherit and override.
       #
       # @return [String] Default bootstrap template
       def default_bootstrap_template
-        "chef-full"
+        if connection.windows?
+          "windows-#{Chef::Dist::CLIENT}-msi"
+        else
+          "chef-full"
+        end
       end
 
       def host_descriptor
@@ -292,15 +463,9 @@ class Chef
         end
       end
 
-      def user_name
-        if host_descriptor
-          @user_name ||= host_descriptor.split("@").reverse[1]
-        end
-      end
-
+      # @return [String] The CLI specific bootstrap template or the default
       def bootstrap_template
         # Allow passing a bootstrap template or use the default
-        # @return [String] The CLI specific bootstrap template or the default
         config[:bootstrap_template] || default_bootstrap_template
       end
 
@@ -331,7 +496,7 @@ class Chef
           raise Errno::ENOENT
         end
 
-        Chef::Log.trace("Found bootstrap template: #{template_file}")
+        Chef::Log.trace("Found bootstrap template in #{File.dirname(template_file)}")
 
         template_file
       end
@@ -340,13 +505,18 @@ class Chef
         @secret ||= encryption_secret_provided_ignore_encrypt_flag? ? read_secret : nil
       end
 
+      # Establish bootstrap context for template rendering.
+      # Requires connection to be a live connection in order to determine
+      # the correct platform.
       def bootstrap_context
-        @bootstrap_context ||= Knife::Core::BootstrapContext.new(
-          config,
-          config[:run_list],
-          Chef::Config,
-          secret
-        )
+        @bootstrap_context ||=
+          if connection.windows?
+            require_relative "core/windows_bootstrap_context"
+            Knife::Core::WindowsBootstrapContext.new(config, config[:run_list], Chef::Config, secret)
+          else
+            require_relative "core/bootstrap_context"
+            Knife::Core::BootstrapContext.new(config, config[:run_list], Chef::Config, secret)
+          end
       end
 
       def first_boot_attributes
@@ -361,58 +531,189 @@ class Chef
       end
 
       def run
-        if @config[:first_boot_attributes] && @config[:first_boot_attributes_from_file]
-          raise Chef::Exceptions::BootstrapCommandInputError
-        end
+        check_license
+        verify_deprecated_flags!
 
         validate_name_args!
-        validate_options!
-        validate_bootstrap_version_options!
+        validate_protocol!
+        validate_first_boot_attributes!
+        validate_winrm_transport_opts!
+        validate_policy_options!
+
+        winrm_warn_no_ssl_verification
+        warn_on_short_session_timeout
 
         $stdout.sync = true
+        register_client
+        connect!
+
+        unless client_builder.client_path.nil?
+          bootstrap_context.client_pem = client_builder.client_path
+        end
+        content = render_template
+        bootstrap_path = upload_bootstrap(content)
+        perform_bootstrap(bootstrap_path)
+      ensure
+        connection.del_file!(bootstrap_path) if connection && bootstrap_path
+      end
 
+      def register_client
         # chef-vault integration must use the new client-side hawtness, otherwise to use the
         # new client-side hawtness, just delete your validation key.
         if chef_vault_handler.doing_chef_vault? ||
-            (Chef::Config[:validation_key] && !File.exist?(File.expand_path(Chef::Config[:validation_key])))
+            (Chef::Config[:validation_key] &&
+             !File.exist?(File.expand_path(Chef::Config[:validation_key])))
 
           unless config[:chef_node_name]
             ui.error("You must pass a node name with -N when bootstrapping with user credentials")
             exit 1
           end
-
           client_builder.run
-
           chef_vault_handler.run(client_builder.client)
-
-          bootstrap_context.client_pem = client_builder.client_path
         else
-          ui.info("Doing old-style registration with the validation key at #{Chef::Config[:validation_key]}...")
-          ui.info("Delete your validation key in order to use your user credentials instead")
-          ui.info("")
+          ui.info <<~EOM
+            Performing legacy client registration with the validation key at #{Chef::Config[:validation_key]}..."
+            Delete your validation key in order to use your user credentials for client registration instead.
+          EOM
+
         end
+      end
+
+      def perform_bootstrap(remote_bootstrap_script_path)
+        ui.info("Bootstrapping #{ui.color(server_name, :bold)}")
+        cmd = bootstrap_command(remote_bootstrap_script_path)
+        r = connection.run_command(cmd) do |data|
+          ui.msg("#{ui.color(" [#{connection.hostname}]", :cyan)} #{data}")
+        end
+        if r.exit_status != 0
+          ui.error("The following error occurred on #{server_name}:")
+          ui.error(r.stderr)
+          exit 1
+        end
+      end
 
+      def connect!
         ui.info("Connecting to #{ui.color(server_name, :bold)}")
+        opts = connection_opts.dup
+        do_connect(opts)
+      rescue Train::Transports::SSHFailed => e
+        if e.message =~ /fingerprint (\S+) is unknown for "(.+)"/
+          fingerprint = $1
+          hostname, ip = $2.split(",")
+          # TODO: convert the SHA256 base64 value to hex with colons
+          # 'ssh' example output:
+          # RSA key fingerprint is e5:cb:c0:e2:21:3b:12:52:f8:ce:cb:00:24:e2:0c:92.
+          # ECDSA key fingerprint is 5d:67:61:08:a9:d7:01:fd:5e:ae:7e:09:40:ef:c0:3c.
+          puts "The authenticity of host '#{hostname} (#{ip})' can't be established."
+          puts "fingerprint is #{fingerprint}."
+          ui.confirm("Are you sure you want to continue connecting") # will exit 3 on N
+          # FIXME: this should save the key to known_hosts but doesn't appear to be
+          config[:ssh_verify_host_key] = :accept_new
+          connection_opts(reset: true)
+          retry
+        end
 
-        begin
-          knife_ssh.run
-        rescue Net::SSH::AuthenticationFailed
-          if config[:ssh_password]
+        raise e
+      rescue Train::Error => e
+        require "net/ssh"
+        if e.cause && e.cause.class == Net::SSH::AuthenticationFailed
+          if connection.password_auth?
             raise
           else
-            ui.info("Failed to authenticate #{knife_ssh.config[:ssh_user]} - trying password auth")
-            knife_ssh_with_password_auth.run
+            ui.warn("Failed to authenticate #{opts[:user]} to #{server_name} - trying password auth")
+            password = ui.ask("Enter password for #{opts[:user]}@#{server_name}.") do |q|
+              q.echo = false
+            end
+          end
+          opts.merge! force_ssh_password_opts(password)
+          do_connect(opts)
+        else
+          raise
+        end
+      end
+
+      # url values override CLI flags, if you provide both
+      # we'll use the one that you gave in the URL.
+      def connection_protocol
+        return @connection_protocol if @connection_protocol
+        from_url = host_descriptor =~ /^(.*):\/\// ? $1 : nil
+        from_cli = config[:connection_protocol]
+        from_knife = Chef::Config[:knife][:connection_protocol]
+        @connection_protocol = from_url || from_cli || from_knife || "ssh"
+      end
+
+      def do_connect(conn_options)
+        @connection = TrainConnector.new(host_descriptor, connection_protocol, conn_options)
+        connection.connect!
+      end
+
+      # Fail if both first_boot_attributes and first_boot_attributes_from_file
+      # are set.
+      def validate_first_boot_attributes!
+        if @config[:first_boot_attributes] && @config[:first_boot_attributes_from_file]
+          raise Chef::Exceptions::BootstrapCommandInputError
+        end
+        true
+      end
+
+      # Fail if using plaintext auth without ssl because
+      # this can expose keys in plaintext on the wire.
+      # TODO test for this method
+      # TODO check that the protoocol is valid.
+      def validate_winrm_transport_opts!
+        return true unless winrm?
+
+        if Chef::Config[:validation_key] && !File.exist?(File.expand_path(Chef::Config[:validation_key]))
+          if config_value(:winrm_auth_method) == "plaintext" &&
+              config_value(:winrm_ssl) != true
+            ui.error <<~EOM
+              Validatorless bootstrap over unsecure winrm channels could expose your
+              key to network sniffing.
+               Please use a 'winrm_auth_method' other than 'plaintext',
+              or enable ssl on #{server_name} then use the --ssl flag
+              to connect.
+            EOM
+
+            exit 1
+          end
+        end
+        true
+      end
+
+      # If any deprecated flags are used, let the user know and
+      # update config[new-key] to the value given to the deprecated flag,
+      # or to the mapped value in case of changing flag type.
+      # If a deprecated flag and its corresponding replacement
+      # are both used, exit
+      def verify_deprecated_flags!
+        DEPRECATED_FLAGS.each do |deprecated_key, deprecation_entry|
+          new_key, deprecated_long, replacement_value = deprecation_entry
+          if config.key?(deprecated_key) && config_source(deprecated_key) == :cli
+            if config.key?(new_key) && config_source(new_key) == :cli
+              new_long = options[new_key][:long].split(" ").first
+              deprecated_long = deprecated_long.split(" ").first
+              ui.error <<~EOM
+                You provided both #{new_long} and #{deprecated_long}.
+
+                Please use one or the other, but note that
+                #{deprecated_long} is deprecated.
+              EOM
+              exit 1
+            else
+              config[new_key] = replacement_value || config[deprecated_key]
+              unless Chef::Config[:silence_deprecation_warnings] == true
+                ui.warn "You provided #{deprecated_long.split(" ").first}. #{options[deprecated_key][:description]}"
+              end
+            end
           end
         end
       end
 
+      # fail if the server_name is nil
       def validate_name_args!
         if server_name.nil?
           ui.error("Must pass an FQDN or ip to bootstrap")
           exit 1
-        elsif server_name == "windows"
-          # catches "knife bootstrap windows" when that command is not installed
-          ui.warn("'knife bootstrap windows' specified, but the knife-windows plugin is not installed. Please install 'knife-windows' if you are attempting to bootstrap a Windows node via WinRM.")
         end
       end
 
@@ -423,7 +724,7 @@ class Chef
       #   * Policyfile options are set and --run-list is set as well
       #
       # @return [TrueClass] If options are valid.
-      def validate_options!
+      def validate_policy_options!
         if incomplete_policyfile_options?
           ui.error("--policy-name and --policy-group must be specified together")
           exit 1
@@ -431,67 +732,305 @@ class Chef
           ui.error("Policyfile options and --run-list are exclusive")
           exit 1
         end
-        true
       end
 
-      # Ensure options are valid by checking bootstrap version values.
+      # Ensure a valid protocol is provided for target host connection
       #
       # The method call will cause the program to exit(1) if:
-      #   * Bootstrap version is greater than or equal to 15 for chef 14 or lower
-      #   * Pre-release options is passed for chef 14 or lower
+      #   * Conflicting protocols are given via the target URI and the --protocol option
+      #   * The protocol is not a supported protocol
       #
       # @return [TrueClass] If options are valid.
-      def validate_bootstrap_version_options!
-        if Chef::VERSION.to_i < 15 && bootstrap_version_gte_15?
-          ui.error("You must use Chef Infra Client 15 or later to bootstrap Chef Infra Client 15 nodes")
+      def validate_protocol!
+        from_cli = config[:connection_protocol]
+        if from_cli && connection_protocol != from_cli
+          # Hanging indent to align with the ERROR: prefix
+          ui.error <<~EOM
+            The URL '#{host_descriptor}' indicates protocol is '#{connection_protocol}'
+            while the --protocol flag specifies '#{from_cli}'.  Please include
+            only one or the other.
+          EOM
           exit 1
         end
 
+        unless SUPPORTED_CONNECTION_PROTOCOLS.include?(connection_protocol)
+          ui.error <<~EOM
+            Unsupported protocol '#{connection_protocol}'.
+
+            Supported protocols are: #{SUPPORTED_CONNECTION_PROTOCOLS.join(" ")}
+          EOM
+          exit 1
+        end
         true
       end
 
-      # setup a Chef::Knife::Ssh object using the passed config options
-      #
-      # @return Chef::Knife::Ssh
-      def knife_ssh
-        ssh = Chef::Knife::Ssh.new
-        ssh.ui = ui
-        ssh.name_args = [ server_name, ssh_command ]
-        ssh.config[:ssh_user] = user_name || config[:ssh_user]
-        ssh.config[:ssh_password] = config[:ssh_password]
-        ssh.config[:ssh_port] = config[:ssh_port]
-        ssh.config[:ssh_gateway] = config[:ssh_gateway]
-        ssh.config[:ssh_gateway_identity] = config[:ssh_gateway_identity]
-        ssh.config[:forward_agent] = config[:forward_agent]
-        ssh.config[:ssh_identity_file] = config[:ssh_identity_file] || config[:identity_file]
-        ssh.config[:manual] = true
-        ssh.config[:host_key_verify] = config[:host_key_verify]
-        ssh.config[:on_error] = true
-        ssh
-      end
-
-      # prompt for a password then return a knife ssh object with that password set
-      # and with ssh_identity_file set to nil
+      # If session_timeout is too short, it is likely
+      # a holdover from "--winrm-session-timeout" which used
+      # minutes as its unit, instead of seconds.
+      # Warn the human so that they are not surprised.
       #
-      # @return Chef::Knife::Ssh
-      def knife_ssh_with_password_auth
-        ssh = knife_ssh
-        ssh.config[:ssh_identity_file] = nil
-        ssh.config[:ssh_password] = ssh.get_password
-        ssh
+      # This will also erroneously warn if a string value is given,
+      # but argument type validation is something that needs addressing
+      # more broadly.
+      def warn_on_short_session_timeout
+        timeout = config_value(:session_timeout).to_i
+        if timeout <= 15
+          ui.warn <<~EOM
+            --session-timeout is set to #{config[:session_timeout]} minutes.
+            Did you mean "--session-timeout #{config[:session_timeout] * 60}" seconds?
+          EOM
+        end
       end
 
-      # build the ssh dommand for bootrapping
-      # @return String
-      def ssh_command
-        command = render_template
+      def winrm_warn_no_ssl_verification
+        return unless winrm?
+
+        # REVIEWER NOTE
+        # The original check from knife plugin did not include winrm_ssl_peer_fingerprint
+        # Reference:
+        # https://github.com/chef/knife-windows/blob/92d151298142be4a4750c5b54bb264f8d5b81b8a/lib/chef/knife/winrm_knife_base.rb#L271-L273
+        # TODO Seems like we should also do a similar warning if ssh_verify_host == false
+        if config_value(:ca_trust_file).nil? &&
+            config_value(:winrm_no_verify_cert) &&
+            config_value(:winrm_ssl_peer_fingerprint).nil?
+          ui.warn <<~WARN
+            * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
+            SSL validation of HTTPS requests for the WinRM transport is disabled.
+            HTTPS WinRM connections are still encrypted, but knife is not able
+            to detect forged replies or spoofing attacks.
+
+            To work around this issue you can use the flag `--winrm-no-verify-cert`
+            or add an entry like this to your knife configuration file:
+
+               # Verify all WinRM HTTPS connections
+               knife[:winrm_no_verify_cert] = true
+
+            You can also specify a ca_trust_file via --ca-trust-file,
+            or the expected fingerprint of the target host's certificate
+            via --winrm-ssl-peer-fingerprint.
+          WARN
+        end
+      end
 
+      # @return a configuration hash suitable for connecting to the remote
+      # host via train
+      def connection_opts(reset: false)
+        return @connection_opts unless @connection_opts.nil? || reset == true
+        @connection_opts = {}
+        @connection_opts.merge! base_opts
+        @connection_opts.merge! host_verify_opts
+        @connection_opts.merge! gateway_opts
+        @connection_opts.merge! sudo_opts
+        @connection_opts.merge! winrm_opts
+        @connection_opts.merge! ssh_opts
+        @connection_opts.merge! ssh_identity_opts
+        @connection_opts
+      end
+
+      def winrm?
+        connection_protocol == "winrm"
+      end
+
+      def ssh?
+        connection_protocol == "ssh"
+      end
+
+      # Common configuration for all protocols
+      def base_opts
+        port = config_value(:connection_port,
+                            knife_key_for_protocol(connection_protocol, :port))
+        user = config_value(:connection_user,
+                            knife_key_for_protocol(connection_protocol, :user))
+        {}.tap do |opts|
+          opts[:logger] = Chef::Log
+          # We do not store password in Chef::Config, so only use CLI `config` here
+          opts[:password] = config[:connection_password] if config.key?(:connection_password)
+          opts[:user] = user if user
+          opts[:max_wait_until_ready] = config_value(:max_wait).to_f unless config_value(:max_wait).nil?
+          # TODO - when would we need to provide rdp_port vs port?  Or are they not mutually exclusive?
+          opts[:port] = port if port
+        end
+      end
+
+      def host_verify_opts
+        if winrm?
+          { self_signed: config_value(:winrm_no_verify_cert) === true }
+        elsif ssh?
+          # Fall back to the old knife config key name for back compat.
+          { verify_host_key: config_value(:ssh_verify_host_key, :host_key_verify, "always") }
+        else
+          {}
+        end
+      end
+
+      def ssh_opts
+        opts = {}
+        return opts if winrm?
+        opts[:non_interactive] = true # Prevent password prompts from underlying net/ssh
+        opts[:forward_agent] = (config_value(:ssh_forward_agent) === true)
+        opts[:connection_timeout] = config_value(:session_timeout).to_i
+        opts
+      end
+
+      def ssh_identity_opts
+        opts = {}
+        return opts if winrm?
+        identity_file = config_value(:ssh_identity_file)
+        if identity_file
+          opts[:key_files] = [identity_file]
+          # We only set keys_only based on the explicit ssh_identity_file;
+          # someone may use a gateway key and still expect password auth
+          # on the target.  Similarly, someone may have a default key specified
+          # in knife config, but have provided a password on the CLI.
+
+          # REVIEW NOTE: this is a new behavior. Originally, ssh_identity_file
+          # could only be populated from CLI options, so there was no need to check
+          # for this. We will also set keys_only to false only if there are keys
+          # and no password.
+          # If both are present, train(via net/ssh)  will prefer keys, falling back to password.
+          # Reference: https://github.com/chef/chef/blob/master/lib/chef/knife/ssh.rb#L272
+          opts[:keys_only] = config.key?(:connection_password) == false
+        else
+          opts[:key_files] = []
+          opts[:keys_only] = false
+        end
+
+        gateway_identity_file = config_value(:ssh_gateway) ? config_value(:ssh_gateway_identity) : nil
+        unless gateway_identity_file.nil?
+          opts[:key_files] << gateway_identity_file
+        end
+
+        opts
+      end
+
+      def gateway_opts
+        opts = {}
+        if config_value(:ssh_gateway)
+          split = config_value(:ssh_gateway).split("@", 2)
+          if split.length == 1
+            gw_host = split[0]
+          else
+            gw_user = split[0]
+            gw_host = split[1]
+          end
+          gw_host, gw_port = gw_host.split(":", 2)
+          # TODO - validate convertable port in config validation?
+          gw_port = Integer(gw_port) rescue nil
+          opts[:bastion_host] = gw_host
+          opts[:bastion_user] = gw_user
+          opts[:bastion_port] = gw_port
+        end
+        opts
+      end
+
+      # use_sudo - tells bootstrap to use the sudo command to run bootstrap
+      # use_sudo_password - tells bootstrap to use the sudo command to run bootstrap
+      #                     and to use the password specified with --password
+      # TODO: I'd like to make our sudo options sane:
+      # --sudo (bool) - use sudo
+      # --sudo-password PASSWORD (default:  :password) - use this password for sudo
+      # --sudo-options "opt,opt,opt" to pass into sudo
+      # --sudo-command COMMAND sudo command other than sudo
+      # REVIEW NOTE: knife bootstrap did not pull sudo values from Chef::Config,
+      #              should we change that for consistency?
+      def sudo_opts
+        return {} if winrm?
+        opts = { sudo: false }
         if config[:use_sudo]
-          sudo_prefix = config[:use_sudo_password] ? "echo '#{config[:ssh_password]}' | sudo -S " : "sudo "
-          command = config[:preserve_home] ? "#{sudo_prefix} #{command}" : "#{sudo_prefix} -H #{command}"
+          opts[:sudo] = true
+          if config[:use_sudo_password]
+            opts[:sudo_password] = config[:connection_password]
+          end
+          if config[:preserve_home]
+            opts[:sudo_options] = "-H"
+          end
+        end
+        opts
+      end
+
+      def winrm_opts
+        return {} unless winrm?
+        auth_method = config_value(:winrm_auth_method, :winrm_auth_method, "negotiate")
+        opts = {
+          winrm_transport: auth_method, # winrm gem and train calls auth method 'transport'
+          winrm_basic_auth_only: config_value(:winrm_basic_auth_only) || false,
+          ssl: config_value(:winrm_ssl) === true,
+          ssl_peer_fingerprint: config_value(:winrm_ssl_peer_fingerprint),
+        }
+
+        if auth_method == "kerberos"
+          opts[:kerberos_service] = config_value(:kerberos_service) if config_value(:kerberos_service)
+          opts[:kerberos_realm] = config_value(:kerberos_realm) if config_value(:kerberos_service)
+        end
+
+        if config_value(:ca_trust_file)
+          opts[:ca_trust_file] = config_value(:ca_trust_file)
+        end
+
+        opts[:operation_timeout] = config_value(:session_timeout).to_i
+
+        opts
+      end
+
+      # Config overrides to force password auth.
+      def force_ssh_password_opts(password)
+        {
+          password: password,
+          non_interactive: false,
+          keys_only: false,
+          key_files: [],
+          auth_methods: [:password, :keyboard_interactive],
+        }
+      end
+
+      # Looks up configuration entries, first in the class member
+      # `config` which contains options populated from CLI flags.
+      # If the entry is not found there, Chef::Config[:knife][KEY]
+      # is checked.
+      #
+      # knife_config_key should be specified if the knife config lookup
+      # key is different from the CLI flag lookup key.
+      #
+      def config_value(key, knife_config_key = nil, default = nil)
+        if config.key? key
+          config[key]
+        else
+          lookup_key = knife_config_key || key
+          if Chef::Config[:knife].key?(lookup_key)
+            Chef::Config[:knife][lookup_key]
+          else
+            default
+          end
         end
+      end
+
+      def upload_bootstrap(content)
+        script_name = connection.windows? ? "bootstrap.bat" : "bootstrap.sh"
+        remote_path = connection.normalize_path(File.join(connection.temp_dir, script_name))
+        connection.upload_file_content!(content, remote_path)
+        remote_path
+      end
 
-        command
+      # build the command string for bootrapping
+      # @return String
+      def bootstrap_command(remote_path)
+        if connection.windows?
+          "cmd.exe /C #{remote_path}"
+        else
+          "sh #{remote_path}"
+        end
+      end
+
+      # To avoid cluttering the CLI options, some flags (such as port and user)
+      # are shared between protocols.  However, there is still a need to allow the operator
+      # to specify defaults separately, since they may not be the same values for different
+      # protocols.
+
+      # These keys are available in Chef::Config, and are prefixed with the protocol name.
+      # For example, :user CLI option will map to :winrm_user and :ssh_user Chef::Config keys,
+      # based on the connection protocol in use.
+      def knife_key_for_protocol(protocol, option)
+        "#{connection_protocol}_#{option}".to_sym
       end
 
       private
@@ -513,13 +1052,6 @@ class Chef
       def incomplete_policyfile_options?
         (!!config[:policy_name] ^ config[:policy_group])
       end
-
-      # True if the bootstrap version is greater than or equal to 15 or latest.
-      def bootstrap_version_gte_15?
-        config[:prerelease] ||
-          (!!config[:bootstrap_version] &&
-           (config[:bootstrap_version] == "latest" || Chef::VersionString.new(config[:bootstrap_version]) >= 15.0))
-      end
     end
   end
 end