Chef Policy Provisioner Terraform Module

This module allows you to provision/bootstrap any number of nodes with Chef Policyfiles with just a few lines of code, completely automatically. No Chef Server Required!

What you will need

A Policyfile which contains your desired machine configuration
A machine (or machines) to provision.
- These could be DigitalOcean Droplets, EC2 instances, or even a server on your home network
- As long as you are able to authenticate to the server (either via ssh, or password), this module can provision it

That's it!

System Requirements

Chef Workstation
- On macs, this can be installed with brew install --cask chef-workstation
Terraform >= 0.14
- tfenv is a great way to install/manage your terraform cli
- On macs, brew install tfenv

Example

Let's say you have a relatively simple Policyfile which provisions your machine with mongodb:

name 'mongodb'
default_source :supermarket
cookbook 'sc-mongodb', '~> 4.1.0', :supermarket
run_list 'sc-mongodb::default'

and you would like to apply this policy to a VM. For this example let's assume use a DigitalOcean Droplet.

Also, for the sake of this example, let's assume your local private key, ~/.ssh/id_rsa corresponds to an ssh key you have added to your DigitalOcean profile as "my-ssh-key".

resource "digitalocean_droplet" "chef-node" {
  image    = "ubuntu-18-04-x64"
  name     = "chef_mongodb_policy_droplet"
  region   = "nyc2"
  size     = "s-1vcpu-1gb"
  ssh_keys = ["my-ssh-key"]
}


module "policy-provisioner" {
  source     = "stavxyz/policy-provisioner/chef"
  policyfile = "./Policyfile.rb"
  connection = {
    host        = digitalocean_droplet.chef-node.ipv4_address
    private_key = "~/.ssh/id_rsa"
  }
}

Now you are ready to terraform apply.

How does this work? What happens when I run `terraform apply` using this module?

All of the client-side steps are run in an isolated build directory created by this module. First, the chef policy defined by your Policyfile is built using chef install (or chef update on subsequent runs). This module determines which of those commands to run automatically. One this is complete, a policyfile archive is built from this using chef export --archive. This tarball is then pushed to your target machine(s) over ssh to a predetermined path on the target system. By default, this is /var/chef/policy/<policy_name/.... Once the transfer of this chef policy archive is complete, it is unpacked (un-tarred) on the target system. The installation of chef-client is always verified, and if needed, this module will install chef-client for you. Finally, chef-client is executed with --local-mode against the archive to finishing provisioning your system.

Features

Automatically installs chef-client of your desired version on your target system(s). This allows you to quickly and easily swap out the version of chef-client being used to converge your nodes. By default, the latest stable version of chef-client will be used, but you are also able to explicitly specify your desired version of chef-client by supplying a value for the chef_client_version variable to this module.
Instead of providing the path to a Policyfile, you can optionally supply a path to an existing policyfile archive. This skips the chef update and chef export steps.
Supports the delivery/use of data_bags
- By specifying a path to your data_bags directory as variable data_bags
Supports the delivery/use of attributes that are specified outside of your Policyfile.rb
- By specifying a json file of attributes as variable attributes_file
No Chef Server Required

Variables

Variable Name	Description	Default
`policyfile`	Path to your Policyfile	`./Policyfile.rb`
`chef_client_version`	The specified chef-client version to use.	`16.10.x`
`policy_name`	The name of the chef policy. If not supplied here, it is read from your Policyfile.	null
`policyfile_archive`	If not supplying `policyfile`, this is the path to your policyfile archive (.tgz)	null
`chef_client_log_level`	Log level for chef-client. [auto, trace, debug, info, warn, error, fatal]	`info`
`chef_client_logfile`	Log file location (on target machine).	`./chef-client.log`
`attributes_file`	Path to JSON file containing chef attributes.	null
`data_bags`	Path to your `data_bags` directory.	null
`install_dir`	The directory to untar within and where to install the policy archive on the target system.	`/var/chef/policy`
`skip`	Beta feature. If `true`, do not perform provisioning.	`false`
`skip_archive_push`	Beta feature. To force skip pushing the archive set this to `true`. This is a temporary workaround until we have better code in place to determine whether the archive has changed since last push/apply.	`false`
`skip_data_bags_push`	Beta feature. To force skip pushing `data_bags` set this to `true`. This is a temporary workaround until we have better code in place to determine whether the `data_bags` content has changed since last push/apply.	`false`
`connection`	`object` variable containing all pertinent `ssh` connection info. Requires `host` key. See below, and https://www.terraform.io/docs/language/resources/provisioners/connection.html for more details.	null

`connection` variable

The following attributes are supported by the connection object variable:

Key	Description	Default
`user`	The user that we should use for the connection.	`root`
`password`	The password we should use for the connection.	null
`host`	(Required) The address of the resource to connect to.	null
`port`	The port to connect to.	`22`
`timeout`	The timeout to wait for the connection to become available. Should be provided as a string like 30s or 5m.	`5m`
`script_path`	The path used to copy scripts meant for remote execution.	null
`private_key`	The path to, or contents of, an SSH key to use for the connection. This takes preference over the password if provided.	null
`certificate`	The contents of a signed CA Certificate. The certificate argument must be used in conjunction with a private_key. These can be loaded from a file on disk using the the `file` function.	null
`agent`	Set to `false` to disable using ssh-agent to authenticate.	`true`
`agent_identity`	The preferred identity from the ssh agent for authentication.	null (auto)
`host_key`	The public key from the remote host or the signing CA, used to verify the connection.	null
`bastion_host`	Setting this enables the bastion Host connection. This host will be connected to first, and then the `host` connection will be made from there.	null
`bastion_host_key`	The public key from the remote host or the signing CA, used to verify the host connection.	null
`bastion_port`	The port to use connect to the bastion host. Defaults to the value of the `port` field.	null
`bastion_user`	The user for the connection to the bastion host. Defaults to the value of the `user` field.	null
`bastion_password`	The password we should use for the bastion host. Defaults to the value of the `password` field.	null
`bastion_private_key`	The path to, or contents of, an SSH key file to use for the bastion host. Defaults to the value of the `private_key` field.	null
`bastion_certificate`	The contents of a signed CA Certificate. The certificate argument must be used in conjunction with a `bastion_private_key`. These can be loaded from a file on disk using the the `file()` function.	null

Terraform Registry

https://registry.terraform.io/modules/stavxyz/policy-provisioner/chef

stavxyz/terraform-chef-policy-provisioner