Blog Archives

Getting started with Chef on Microsoft Azure

You can find an initial set of blog posts to help you get started with Chef on Microsoft Azure here. If you are new to Chef, I recommend you to go through some of the Chef tutorials https://learn.chef.io/. Objective of these posts are not to go deep into Chef, but to help you setup your whole set of machines (Chef Workstation, Chef Server, Chef Node) on Microsoft Azure.

https://manesh.me/2015/10/17/setup-chef-workstation-on-microsoft-azure/

  • Create a virtual machine for workstation
  • Install Chef Development Kit
  • Learn Chef Basics on Ubuntu

https://manesh.me/2015/10/19/setup-chef-server-on-microsoft-azure/

  • Create Virtual Machine
  • Set DNS Name Label for virtual machine
  • Configure Chef Server
  • Create Organization
  • Establish Connectivity from Workstation

https://manesh.me/2015/10/20/setup-chef-node-on-microsoft-azure/

  • Install Azure CLI & Login
  • Create Virtual Machine for Node
  • Bootstrap & Verify Node

https://manesh.me/2015/10/23/writing-cookbook-on-microsoft-azure/

  • Create cookbook on workstation
  • Upload cookbook to server
  • Add cookbook to run list of node
  • Run chef-client on node
  • Enable endpoint using Azure CLI

In the next set of blogs, I will walk you through in detail on various Azure Knife commands as well as using Chef along with Azure Resource Manger templates.

If you have feedback or questions, write a comment for the blog.

Writing cookbook on Microsoft Azure

This is the fourth post in the Chef and Microsoft Azure blog series. You can read the previous ones at:

  1. https://manesh.me/2015/10/17/setup-chef-workstation-on-microsoft-azure/
  2. https://manesh.me/2015/10/19/setup-chef-server-on-microsoft-azure/
  3. https://manesh.me/2015/10/20/setup-chef-node-on-microsoft-azure/

Writing cookbook is similar to how you would write it on other infrastructure. To get started with cookbook on Azure, I am exploring a cookbook to setup apache web server and show home page. Also, this will show you how to upload cookbook to the Chef Server, and set the run list for Chef Node via knife. This blog focus on getting your first cookbook on Azure. This do not go into details of cookbook components, if you would like to learn more about that refer https://docs.chef.io/cookbooks.html and https://learn.chef.io/manage-a-web-app/ubuntu/

Prerequisites

  • Microsoft Azure Subscription
  • Have gone through previous three posts in the series

Setup Sequence

  • Create cookbook on workstation
  • Upload cookbook to server
  • Add cookbook to run list of node
  • Run chef-client on node
  • Enable endpoint using Azure CLI

Create cookbook on Workstation

Execute the following commands from the workstation.

# move to home directory

cd

# move to chef-repo directory in home

cd chef-repo

# create new cookbook named webserver

knife cookbook create webserver

Edit the default recipe for webserver and update content of the file to following. vim editor comes default in the instance, so you could use that. To start inserting text in vim, press the ‘i’ key to enter insert mode. When you have finished editing, press ESC to exit insert mode, then type ‘:wq’ to save and exit the editor.

# edit the default recipe

vim cookbooks/webserver/recipes/default.rb

Add index.html file to cookbook’s files/default directory and edit the content.

edit the default index file

vim cookbooks/webserver/files/default/index.html

Upload cookbook to Server

Execute the following commands from the workstation.

# move to home directory

cd

# move to chef-repo directory in home

cd chef-repo

# upload the cookbook to Chef Server

knife cookbook upload webserver

Add cookbook to run list of node

Execute the following commands from the workstation.

# move to home directory

cd

# move to chef-repo directory in home

cd chef-repo

# Add cookbook to the run list of node

knife node run_list add mme-chef-node1 “recipe[webserver]”

Run chef-client on node

Execute the following commands from the Chef Node.

# running chef-client on mme-chef-node1

sudo chef-client

# Ensure that webserver is available on port 80

curl http://localhost/

We have created and executed our first runbook on Azure now. You can learn more about cookbooks from http://learn.chef.io/

Enable endpoint using Azure CLI

We have tested and ensured that web server is running and default index file is returned correctly. However, if you try out http://mme-chef-node1.cloudapp.net/ , the public endpoint 80 of the webserver, you will not get any contents. This is because we only have port 22 in the endpoints of Azure VM. To enable port 80 using Azure CLI, follow the below commands from workstation node.

Login to Azure CLI using your preferred option (Microsoft Account, Organizational Account or Service Principal), following the blog https://manesh.me/2015/10/15/options-for-azure-cli-logins-step-by-step-guidance/

Once you are logged into Azure CLI, execute the following command to check the current details of the virtual machine. Check endpoint information from the result.

Create new endpoint on port 80. Keep both public port and private port to be 80.

Now we can browse to http://mme-chef-node1.cloudapp.net/ and see that index page is available.

Next Blog

With this blog, we have gone through the basics of working with Chef on Microsoft Azure. In the next series of blogs, I will dive deep into using Azure specific knife commands and using Chef along with Azure Resource Manager templates.

Setup Chef Node on Microsoft Azure

This is the third post in the Chef and Microsoft Azure blog series. You can read the previous ones at:

  1. https://manesh.me/2015/10/17/setup-chef-workstation-on-microsoft-azure/
  2. https://manesh.me/2015/10/19/setup-chef-server-on-microsoft-azure/

These blog posts will help you to learn Chef, by going through all the tutorials provided by Chef – https://learn.chef.io/tutorials/ – from Microsoft Azure. In the previous posts, we have gone through the setup of a workstation as well as server. In this post, I am exploring the tutorial https://learn.chef.io/manage-a-node/ubuntu/bootstrap-your-node/

One feedback I received is to automate using script as much as possible, than going through the web user interface. I will try to use scripts to the maximum extent possible.

Prerequisites

  • Microsoft Azure Subscription
  • Have gone through previous two posts in this series

Setup Sequence

  • Install Azure CLI & Login
  • Create Virtual Machine for Node
  • Bootstrap & Verify Node

Install Azure CLI and Login

Let us make sure that we have Azure CLI on the workstation server. Execute the following commands from the workstation (We have an Ubuntu 14.04 image for the workstation).

# https://azure.microsoft.com/en-us/documentation/articles/xplat-cli-install/#install-and-use-nodejs-and-npm

sudo apt-get install nodejs-legacy

sudo apt-get install npm

sudo npm install -g azure-cli

Login to Azure service from CLI. I have written a detailed step by step guidance for the same at https://manesh.me/2015/10/15/options-for-azure-cli-logins-step-by-step-guidance/. If you are looking for complete automation without any user interaction, check out the login option using service principal.

Create Virtual Machine for Node

Next, let us create a new virtual machine to act as the Chef Node. We are executing following commands from the workstation.

# list all azure vm images for Ubuntu 14.04

azure vm image list | grep -i Ubuntu-14_04

# Note that latest image is coming at the end in the list

# Note that image name is second item in the item row

# Get the latest (last) image from the list

imagename=`azure vm image list | grep -i Ubuntu-14_04 |tail -1 | awk ‘{print $2}’`

# Learn about azure vm create options

azure help vm create

# Create a new vm for Chef Node

# vm create [options] <dns-name> <image> [userName] [password]

# SSH port 22 is enabled in endpoints as we use option -e

azure vm create -e -z Small -l “South Central US” mme-chef-node1 $imagename azureuser Demo@Pass1

# Wait for couple of minutes and ensure that Status of vm created is ReadyRole

azure vm list

Bootstrap and Verify Node

From the workstation, execute the bootstrap command remotely to bootstrap the node.

# ensure you are executing these from chef-repo directory

cd

cd chef-repo

# test connection to server, we should see contoso-validator

knife client list

# knife bootstrap ADDRESS -x USER -P PASSWORD –sudo –use-sudo-password –node-name NAME

knife bootstrap mme-chef-node1.cloudapp.net -x azureuser -P Demo@Pass1 –sudo –use-sudo-password –node-name mme-chef-node1

# verify that node is successfully bootstrapped

knife node list

Also, you can see the node listed in the Chef Management Portal.

Next Blog

Next, I will try out authoring some basic cookbooks and applying that policy to the node.

Options for Azure CLI Logins – Step by Step Guidance

Azure CLI supports various login options:

This blog post is a step by step guidance to try out all the above options. You can read more about the supported options here at https://azure.microsoft.com/en-us/blog/azure-cli-supports-microsoft-account-logins/

Prerequisites

  • It is assumed that you have basic knowledge of Microsoft Azure & Azure Management Portal.
  • Valid Microsoft Azure Subscription (Signed up with a Microsoft Account)
  • For this guidance, I am installing and configuring Azure CLI on Windows using node.js.

Setting up Azure CLI

Install node.js from https://nodejs.org/dist/v4.2.1/node-v4.2.1-x64.msi or latest from https://nodejs.org/en/

Open node command prompt

Ensure that node and npm are installed successfully by running ‘npm -v’ command

Install Azure CLI

 

npm install -g azure-cli

 

Ensure that CLI installation is successful by checking out the ‘azure’ command. Ensure that you have version 0.9.10 or later.

Login with Microsoft Account (Live ID)

For this login option, I am using the Microsoft Account – manesh_dot_r_at_outlook_dot_com, who is the service administrator for the subscription.

Open Azure Management Portal (https://manage.windowsazure.com/) and navigate to Active Directory

Navigate to Users in the directory and ensure that the account is a valid user in the directory.

Also, navigate to Settings > Administrators and ensure that Microsoft Account is a valid Service Administrator
or Co-administrator. Note that any other Microsoft Account, you add as co-administrator for this page, can also use the same sign-in flow.

From CLI, run the command ‘azure login’

You will see that the command is waiting for you to open a browser, navigate to the specified URL and then enter the code that you see in the command prompt. In this example ES575SSW6 is the code for authentication. I suggest to open a private browser instance and perform the suggested steps.

Now you can login using Microsoft Account or Work / School account with or with-out MFA in this sign in option.

Based on the account you have provided, it will take you to the respective login page. Once you have logged in, you will see a successful message like the following.

Also, at this point, you can see successful login at the CLI window.

Checkout some sample command to make sure that the login is successful and is returning data from services.

Here you can see that the subscription is listed, and you should be able to run commands to interact with Azure services.

Do remember to logout, once you finish interacting with the service

Login with Organizational Account (Interactive using browser)

First let us create an organizational account in the same directory. You can do this by navigating to Active Directory > <your_directory> > Users. Note that in my environment, your_directory is maneshroutlook.

Choose Add User option and choose the option to create a ‘New user in your organization’. You will go through steps similar to following.

Choose the required user role in the second step. You can read more about roles and their privileges at https://azure.microsoft.com/en-us/documentation/articles/active-directory-assign-admin-roles/

Create the user with temporary password.

Note down the temporary password for the user.

Now, login to https://manage.windowsazure.com from a private browser instance and login using the organizational account we just created. During this process, you should reset the password for this account. At the end of this step, you will see a page like following, telling that this account do not have any Azure subscriptions. Yes, that is true, we just created an organizational account and haven’t added co-administrator privilege on the subscription. Let us do it now.

Login to https://manage.windowsazure.com using your primary Microsoft Account and navigate to Settings > Administrators.

Choose Add option and associate the organizational account as a co-administrator for this subscription.

Now, if you refresh the browser instance for your organizational account for URL https://manage.windowsazure.com then you can see that your organizational account have access to the subscription.

So far, we have created an organizational account (this could be enabled with MFA as well). Now you can follow the same sequence of steps in the above login option (Login with Microsoft Account), for an interactive login with organizational account as well. You start with the following step for the sequence.

Login with Organizational Account (Non-interactive, Non Multi-Factor Authentication)

Note that for the non-interactive logins, it only supports organizational account with MFA not enabled. Open CLI, and execute the login command with ‘-u’ option. Note that you will have to press Enter key twice after typing in the password.

Now you are logged in and can execute ‘azure account list –json’ command or other commands to verify that login is successful.

Also, remember to issue the ‘azure logout’ command once you have completed all your interactions with the service.

Login with Service Principals (Automation Accounts in Azure AD)

First, we should create a Service Principal. We do this by creating an application in the Azure AD. Since we are exploring Azure CLI, we will create the service principal also using CLI.

First login to the CLI using Microsoft Account or Organizational Account, using any of the above options.

Step by step instructions for the sequence of actions you should be doing are explained well here at https://azure.microsoft.com/en-us/documentation/articles/resource-group-authenticate-service-principal/#authenticate-service-principal-with-password—azure-cli. I am providing the screen captures for the service principal I have created.

Switch config mode to arm.

I used http://sp.<domainname>/ as the identifier and URI for the application that I created.

Use the application id obtained from previous step, to create a service principal.

Use the object id of the service principal to assign permissions. You need to know the subscription id for performing role assignment, you can get the subscription id using listing the account.

Assign role permission to the service principal on the subscription.

Logout the current organizational user.

Now login with the service principal and check if we are able to read the service properties. You can use the fully qualified domain name for the tenant value. Or you can use the id shown above in ‘azure account list –json’ command.

Now you are successfully logged in and can interact with various commands. Check out the account list command note that the user type is shown as service principal.

Remember to logout once you complete all the operations.

References

hyper-v.nu

My views on technology

yungchou

witnessing a clear cloudy day

Virtualization and some coffee

My views on technology

Thomas Maurer

Cloud and Virtualization

Cloud Administrator

Begin Your Journey to the Cloud with the Cloud Administrator