Hey, guys, we are recording the session and we are starting today with discussions and exercises using Chef Server. Let me give you some brief background on this exercise. The point of this exercise is that we will be using the other variation of using Chef, which is not just Chef solo, but with a server. That user scenario is slightly different. In here, what we do is, for example, let me grab my pen, working, okay, it's working. What we do here in this case is that this is the user, you and me and people like us, we have a workstation, we work here and we think and we write down our desire. The desire is basically a design for whatever you want to create and the desired state that you would like to have your cloud to take shape of, so it needs to transition from nothing or I should say initial state to the desired state configuration. That transition needs to happen. You need to write that down in here, in a Git repo and that's the beginning point. You need to basically think and then write down your ideas in a Git repository. This repository will store your ideas in a desired state configuration of this final result and this is going to serve your customer and the customer, I hope, becomes happy. That's the plan. That's where you work and then you want to not be dealing with the idea of actually implementing stuff because all the implementation should be automated. All you do is think. That's the primary motivation that you need to be able to doing is thinking and action happens itself, automated. Implementation happens by itself, automated. Customer becomes happy and you keep focus on what the customer needs and that's what you think is to make the customer really happy. That's the primary reason why you exist. You exist in a business is to make the customer happy. You define your scenario would be like your employer will be a customer, your internal teams, the other team that you work with is your customer. You need to understand who your customer is and make them happy is the ultimate goal. By the way, you should not be doing the action. You should be thinking and writing and understanding, carefully evaluating and defining desired state and you have the option to change it and change it again and change it again. You can keep iterating on your new designs and that's okay and that's what you do. You get a new idea, you add it and you make a git commit. Any implementation, automated. You're not doing the implementation part because you shouldn't be. You have tools for that, so you don't. That's the plan. Your ideas that you have, which is in a git repository, you need to send that idea to a central location. This central location is what that chef server is. This chef server is nothing. It doesn't do much, does nothing much. All it does is it stores your idea here, and whenever the chef runs here, chef running here on this machine and then the chef needs that idea, so it will give that idea, hey, you take this and make things happen. That's what this chef server does. Nothing much. It basically is a database. Think of it like a database. That's how at least I think. It does a little bit more, but not too much. All the work, the real work is done by this chef client running on the machine, the node as they call it, nodes, multiple nodes, so this is just one node. That's the point of a chef server, which means in a typical project, some project P, you will have one chef server. In that project, you will have multiple machines, maybe multiple clouds, so this project should be P. In that project, you have multiple clouds, multiple machines like that. You will configure whatever you want and you will put that idea in a Git repo and you send your idea to the chef server so it stores it. This is typically done for a project. You have multiple projects, maybe you can segregate and have separate chef servers or just have one chef server store multiple, depending on how big the project is and things of that nature. That's the concept of using chef server. Now, we want to create our own chef server, so we will do that. Chef server is open source, so we can absolutely build ourselves, but right now, I want to just ready-made use this manage.chef.io is a chef server that they give for free. We just use it for now. I'm assuming that you have an account already. If not, create one, please. It takes like a two-minute operation. Just give them an email address and they will let you have an access to their free chef server. That account is available here and I'm logged in already and that's what I plan to begin using and the plan is written down here. Let's go start. I think I need to readjust my machine goes this side. I think I like it that way. Machine goes this side and the browser goes the other side and a little bit bigger font. This font should also be a little bigger if it is not already. I think it should be good size already. Having seen that, let's go begin using this exercise. We have a manage.chef.io as an account available to you in that location and I have somehow managed to log in to that manage.chef.io on a browser outside the VM. There's nothing wrong with it to use this browser. This is totally fine, like outside browser, whatever you have, but avoid that to make your life simple. It's a good idea to avoid that browser. This one, close. Instead, by the way, when you create an account and all that, go use your external browser, but when you have a login name ready, it's a good idea at least for a few minutes to use this browser. I know it sucks. I know it is slow, but bear with me, it'll make sense as to why I say that. I know it is slow, so manage.chef.io. It is slow because it needs memory and you may not have been giving enough memory because your total memory is limited, so you cannot share too much memory with the VM and all that. That's the tweak that you can do. If you have more memory on the real machine, maybe give 4GB RAM to this guy, 4GB RAM to the VM. He will be happy, but if you have total RAM, 4GB, you cannot give 4GB to the VM. That's a challenge. Just saying, if you have it, give some RAM, give some love, so the machine will reciprocate. It is starving for memory. That's why it is slow. It is thrashing your disk, whatever disk you have. Here I'm going to log into this ChefManage for a specific reason on the VM. I'm using the VM browser for a very specific reason because I want to download a bunch of stuff. Of course, you can download on a real machine and transport it over to the other machine and all that, but it's a hassle. What I'm saying is just go directly to there and there you should be able to go to a location like mentioned here. By the way, when you create a Chef server account, it must have asked you to create what is called this. This is called an organization and this is you. Hold on, what just happened? This is you, meaning this is your login, this is an individual and this is a group that you belong. This is a project that you want to build using this thing so that the project name, organization name, group name, company name, whatever you call it, that name is different than you. That is what is used here. An organization named ABCXYZ, it must have forced you to create an organization by now. When you create an account, this is an organization that gets created at least. It will make you create one. When you first time create a login and all that, it might give you something to download and that's okay. Totally fine. You can take it and discard it. You may have used the real computer for that and so discard it. I will now tell you what these things are and why do they matter. This organization that we have, at least I have called Classroom, I have several organizations, but they are all pointless. The only organization I want to use today is this. You can ignore all these things. They're not useful. I have them. I use some of them, but not all of them. Today, I will be using this organization, Classroom, and here is my name and my name is my login name, whatever login name I have used. That's the login name I have. This is me, the person, and this is the team called Classroom, and that is an organization. We need to put the organization name here in the URL and then go to that URL and you open it here. When you go there, you will find, they'll give you a starter kit, starter kit. This kit is basically a Chef repo. It is a ready-made package. You want to get that package from there. That's what we want to get to. We are going to grab it from that website, and you will do that inside your VM, so it becomes easier to play along. I will go to administration and then focus on my organization of choice, which is, you probably have only one, so this one, Classroom, and then go to starter kit. That's the page you land on when you go to replace this phrase with the name of your organization and getting started. That's the URL I have here. I just reach there by administration and then selecting the organization and then starter kit. That is the kit I want to download. There is a whole host of exercises here that you can do separately. They are very different from my exercise. This is the approach that the company wants you to take. The Chef company, this chef.io company, they used to be called OpsCode before. They have their own training program. You can use that if you like. It is very different than what I am talking about because this is open source. You can choose to use the way you want to use it. My way of using is very different. My way of using this thing is focus on open source and it basically applies some of the techniques that I like as opposed to other people like. You will see variations of how I deal with it versus how they deal with it. This is a good training. I'm just telling you that it is different, not this. This is my training. That is their training. It is also good. You should follow along if you like. If you are really into Chef and you end up liking this tool, go do that also. Then form your own perspective as to how you want to do this Chef business because it may be different. Your usage may be different than their usage than my usage. Everybody has their own ways of doing things. I'm just giving you my way. They are telling you their way and you need to formulate your OpsLite. There was a blip which I hope did not disconnect the conference. I hope I'm still... Wow, hold on, let me just see if something happened. Let me switch and check whether you are still there with me or not. I am going to change my audio device because I think my audio system is not functioning for some reason. Let me switch. Something happened, electrical blip right now. Okay, come on. Board goes to internal speakers. Yeah, they are working. Hey guys, can you just say something so I can make sure that you are with me and that I didn't lose you? Hello. Hello. Hi. Maybe not. Not yet. How about there? Yeah. Please say something and check that you are there with me. This is a test. Yes, yes. I hear you. I hear you. That's good. I am assuming that you are hearing me because that's how you responded, so that's good. We can proceed forward. Apparently, something went wrong. Electrical blip in one of my audio systems went down, so I switched my audio to another and we will resume. I hope if something goes wrong, I just want you to know that I have a phone to call. If something goes wrong and I keep talking to myself, I would like you to know that my phone number is at the bottom of the website, so right there, somewhere here. That is my phone number. If something goes wrong, just call me. If I keep talking to myself and you get disconnected because there is an electrical fluctuation happening. You will find that number right there. That's my phone number. Well, let's keep going, keep going. What I was talking about, I completely lost train. This thing is what I want to download, which I am assuming that you can download very easily. I click on it and there we go. That's how it is. Simple. But then there is a catch. The catch is it is telling you something. User key will be do what? What user key are we talking about? Why are you resetting it? That resetting it because they are going to create a new public-private key pair for you to use your Chef server or their Chef server and they are permitting you. They are going to create a key pair for you so that you can hook up to the Chef server. That's the key pair they're talking about. I want you to actually reset. Yes, go say yes. Please proceed. That's the idea is yes, proceed and they reset your key, give you a new key and give you a new package containing the entire Chef repo for using with this Chef server. That's the idea. We'll do that. We'll now begin with say yes, proceed. When I download the starter kit, it actually downloads very quickly right there. I have it now here. You can see that the download opens up in your download folder somewhere in here. There is the starter.zip file. That zip file is what we want. We want to use that zip file because that is going to be our Chef repo. They have given it to us. They have prepared everything needed just for us to get started. That is the way to download it efficiently directly inside your VM and then we are mostly done with the browser. You can close it. You don't need it anymore. I have the Chef starter zip file here and I want to put that in the right location. What is the right location? It is really up to you. What you think is right, but you do want to unzip it and extract it somewhere. I extracted it here and when I expand it, it got renamed from Chef starter to Chef repo, which is the name that we will use. Basically, this is the extraction. Now I want to really put this folder in the right location. Currently, it is sitting in the downloads folder and my preference is the home folder. I will just move it here. That is my preference. It is really up to you as to what you want to do with and where you want to work with. My preference happens to be home, so move it there. It is really you need to remember where you are and where your repo is and you need to go to the right location like that and drop it in. Now I have my Chef repo in the location of my preference, which happens to be download. My preferences keep changing. Today, my preference happens to be home. It is really up to you. With that Chef repo in my home folder, right there, I can go back to my terminal because I can see it now, right there. I see it. Where do I find it? Right there. That thing came today, right now. It downloaded. It contains a bunch of things. We will go and examine it. First of all, we go inside it and then open it up in Atom Editor. It is opening up right now. We will see what it contains. It contains a whole lot of things that we needed, at least for the first exercise, for this exercise, which is just to get started with using Chef Server. The goal of this exercise is to understand and by understanding, what do we do with Chef Server? How do we begin using it? This readme file that they have, it doesn't apply to my exercise, so I'm going to delete it. It might confuse you, so don't look at it. Delete it. It's gone. There is a git ignore, which we'll look at later. I'm not doing git particularly in this exercise. We'll do git in the next one. I'm going to ignore git ignore. Just leave it alone, or you can delete if you don't like. Our focus is to understand what these exercises are for, and we'll just take a look at each of these files, what they have given us, and so let's go look. We have the usual.chef hidden folder inside our Chef repo. This is a critical hidden folder containing critical files. One of them is the knife configuration, which stores our secrets and other details about the whole kitchen or Chef repo, or you can call it whatever you like, but that thing, it stores information about this whole thing. There is my personal private key. This private key is different than our regular private keys that you have used, and they are stored in your tilde slash dot SSH folder. That's where you keep your ID underscore RSA private key. This is your creation, and you put the corresponding public key, you give that to the cloud companies, and then you use your private key to connect to them and all that good stuff like that here, here. This is your stuff. This is Chef server connection key, Chef server that you have signed up for, signed up with. They gave you this key right now. This key has a specific purpose to allow you, this is your name here, this is my name, and it allows me to connect to my Chef server. Each one of us now have our own Chef server individual, like a separate company, separate team will be dealing with our own Chef server individually. They have given it to each one of you, and you now have access through your private key. We'll go detail inside this file just a minute. Now, they have given us this cookbooks folder in which there is only one cookbook called starter. That's the cookbook, only one. There is a folder called roles, which has a role here called starter role. That role is what we'll also be using. There are some ignore files, like Chef ignore and get ignore, and I'll ignore those two files for now. Let's go inside. In the starter cookbook, what do we have? We have some attributes and then some files and some default and sample and recipes and default and template and default and sample metadata and Chef ignore. I told you to ignore the Chef ignore, so I'm going to delete it. Here we go. Just to not confuse people and getting rid of the get ignore file also, deleting it, not using it, because I don't want to cause confusion, so I'll focus on strictly the minimum things necessary. That understanding, we'll understand that this whole segment is just one cookbook called the starter cookbook and this is the starter role. Those are the two things that they gave us just to get us started. They also gave us the private key. Now we look at this critical file. By the way, you may notice that I occasionally ignore what I have on the left side, which is the browser, and I tend to ignore that because this website is a later creation. I've been doing these exercises on the fly without having a website to begin with. The reason I need to look at the website is because people have told me to follow what you have in the website. Don't go on your own. I occasionally just go on my own direction. Nothing wrong as such, but what I have found, what people tell me is that what you did here is different from what is written down. For example, I just noticed something which is different. I'm just pointing it out right now. The thing I noticed different is that I am putting my Chef repo in the download folder here. Hey, are you calling or somebody calling? Are you calling with a disconnection or something? I'm going to see if you are. Hello? Hi, my name is Danielle. I'm calling on behalf of Paul Davis, Paul Irving. Bad. Wrong number. I thought you were calling me for a disconnection or something. I'm going to put this on, do not disturb. So if that happens, please, yeah, we'll figure. I'll open the do not disturb if that happens. And so I just told you to call in case of a disaster, and disaster is happening apparently some electrical fluctuations going on. And so I thought I lost you, but no, I didn't. So what I just noticed is that my folder location, which is like a tiny little thing I'm saying, but I have chosen to put this in the home location in my computer here versus in this exercise I have written down as if I'm putting in the downloads folder. That's a slight deviation. I hope these deviations don't matter too much to you guys, but to some, if it matters, please tell me and I'll strictly stick to what I have in the website and I'll do exactly what you see in the documentation. If that is not an issue, that's okay. I'm assuming that's not a big issue, but people have told me in the past to just strictly follow what you have on the website. But I think this is, you will, I think people are smart. They will understand what's going on. So with that, with that explanation, I will actually do what I have in mind because I flow much better without having to read something. If I'm reading that, I sound dumb. I'm just telling you, honestly, if I read something and do it, I actually sound stupid. Stupid as if he doesn't know what he's doing, kind of stupid. And so I don't want to be like that. And so I know what I'm doing and I hope you think like that. So having said a couple of things that I'm doing here is just reviewing. So we have got the starter kit. We have to review the NaiveRB file. We will do that soon. We have to also have proper security settings in our AWS configuration. This exercise will apply on the AWS cloud. So we'll have to go open up AWS browser. So on our console, console.aws. Yeah. In that site, I would like you to pick one region of your choice. It's really up to you, which region do you tick and take a choice, make that choice right here. And so I'm going to choose some region, for example, Virginia or Oregon is a good choice for me. So Oregon, I go with Oregon and just remember that you have chosen Oregon. So that's the choice of me. So now with that chosen, I need to do certain things. What do I want to do? I want to set proper security settings in the default security group in your default VPC. We want to have these ports open. So let's go to the default VPC. By the way, this is this time we are using the default VPC. So that's one of the reasons why I wanted you to not disturb your default VPC. So here is your VPC. And we want to go inside there. Look at our default VPC. How many VPCs do I have? Only one. And that VPC default VPC is what I need to go look at the default security group. So in that VPC, I have some security groups and I have, let's see what do I have. So I have a security group here called launch wizard, which I need to get rid of. So I delete that. And now I have only one security group called the default VPC security group. And that's the default VPC group, sorry, the security group for that VPC. And in that security group, what I want to do is set these rules. And those rules are to allow inbound traffic. And I want to open port number 22 for SSH, port number 80 for HTTP, port number 443 for HTTPS. Now, what I'm telling you in your examples that you will see in the Amazon website for your default chosen region and your default VPC, your default security group may not have these open already. And so please open it up. How do you do that? Let's see if I have it open already to begin with. I'm going to read my security group settings right now. And for SSH, I am allowing port number 22 from my location. This is let me in just for me. And that is this condition met. Let's see other conditions. By the way, having said this, a couple of you have such settings like, you know, it's very, very strict, only limited to you. And then this is limited, let me in from my home. And then you go to Starbucks. And then you try to connect and things don't work. So you need to go and expand this number to include Starbucks because right now this is just your home. And so if you want to go Starbucks, you need to add another rule and put Starbucks IP address and that IP address might change on you. And that might happen to your home also, because these are dynamic IP addresses. So if that changes, you need to go back and change, otherwise things will not work. So if you want to avoid these problems, you have to expand the scope, which is a bad idea. You can put 0000 slash zero, which is a bad idea. And it is too wide open. That's not a good idea. So don't do it that way. But just remember what you're doing so that you will know what you're what you're talking or dealing with. Having said that, the second number is port number 80. Is that open for HTTP? And apparently so. And it is open for all traffic. HTTP port number 80 is open for all traffic in IPv6, this is IPv4. And now 443, 443 is open for all traffic on the internet. And also open for HTTPS 443 is open to all traffic on the internet, IPv6. So yes, those rules are properly set. You should check these things before you proceed forward. Next what I would like to do is make sure that I have a key pair. This key pair business, I somehow forget. And at the very last time, I will then remember that, oops, I don't have a key pair in place. So I need to now that I have a good website that tells me to do these things, I need to go to my AWS EC2 and make sure that they have my key pair, like these guys, these two keys. I don't know if they're right or not. So as a good practice, I will just delete the key and grab my key pair from here, here, and say cat my key pair and dump it into Amazon. So here is my key and hey, Amazon, I am going to let you import my bootcamp key pair import. So now that there is a key right there, it imported this key. So I did that providing my key to Amazon. That's one approach. Now the approach written down on the website is different. And this approach uses this button and then download a key pair, which is totally fine. It's a different approach. What I did just now is I created this key pair by using this button, different approach. Both approaches are valid, but I just chose a different approach. Having said, let's go forward. The next idea I want you to do is to grab credentials from Amazon Web Services. Now when you go to the management console, I told you the last time that you can go and grab your credentials from your name at the top, and then go to security credentials, and then you create an access key and secret key and all that. And I have absolutely all the keys that have been ever created. They have all been deleted because I need to delete these things left and right because these keys get recorded in a video and the videos go public. That's a bad idea to let these keys go. So I'm going to create an access key and secret key and I'm going to show it to you, but never share these things with people, anybody whatsoever. Don't. So I have this key and I've shared it with a video recording, so I had to delete it. Remember to delete that one. So this is the approach which is considered not best practice. And that is something that a couple of you have run into that you actually did not use this approach, which is actually a good thing. So I am going to now not use this key, but instead tell you the other approach, which is supposed to be a better approach to managing keys. So this key that I have created, I will actually not use it and I will delete it. Delete that. So say, yes, delete that. Go ahead and delete. So key got deleted 11th of February today, deleted. I created one and deleted you to tell you that this approach is considered not a best practice. The best practice recommendation is this approach. That's an important change that you need to take note of that Amazon tells you to don't go here and drop down and go to security and then grab your keys by don't do that, don't do not. This is okay. It works. This is called root keys. Root keys are fine. They're okay, but not the best when it is not the best. We would like to actually understand and use the best practice and not this root key business. So what's wrong with root keys? Nothing is wrong. It's just that it is not a good practice, not a bad practice, it's just not the best. Root key is pretty much like using the root login, which is okay, it works, but then it gives you super user control all the time, which is a bad thing because you can accidentally make a mistake and that's the challenge is that you have root keys in your control and then you can accidentally make a mistake. You don't want to do that. That's why this is not the best practice. So don't use root keys. That is what Amazon is telling you here and so some of you read this and you went ahead and followed the other approach, which is this approach. You followed that approach and you created keys and then you tried other exercises before like the earlier exercises and it did not work for you and I'll tell you why it did not work because you did not actually fully understand and create this IAM user correctly and that's why it did not get the right set of permissions for you to operate on your own account and so it did not work. So we will talk about these things. We will not use these keys because they are supposed to be root keys like using a root user. So that's why it is a bad idea. I should not say bad idea, I should say it is not the best idea. So let's now understand what's a better idea and again, all of these things that I am talking about right now is not written on the website. I'm just saying it's not there, not in this exercise. Maybe it's somewhere else, but not in this sequence. So it's a deviation, but it's a very important one for you to understand the idea behind this recent change in Amazon. It tells you important change and as a best practice, we recommend whatever that thing is. So we'll follow that thing and use it that way, not the root key way. So let's go there, IAM user, what does it do? So it just takes us to the documentation. Now I'm not reading that, I'm going straight to the IAM settings and I'll just show you. It's not super difficult. You can always read the doc, but I go straight to the IAM settings. Where is that? IAM right there and here it is. It's in security, identity, and compliance. And the very first thing you see is IAM, click on that, that's where you want to go. And here, there are a couple of things for us to understand before we start creating users and keys and all that. So here we go. I'll now describe some of these things. That is a deviation from what is written down here. I'm just taking a digression because this is an important change. So the concepts now. Concepts are, first thing, not using root keys. You got that already. Second thing, the idea behind root key is that it is omnipotent, meaning it can delete, it can create, it can do whatever, it can create havoc. It can create mess. It can create things like pseudo RM-RF slash bin slash laden. That was a joke, but you can do such things like that's super user power, omnipotent. You can go shoot RM-RF slash so the machine gets destroyed. You don't want to have such privileges given to every user, even to yourself. You don't want to run like this. It is omnipotent. You don't want to get omnipotent keys for every action, especially when it comes to Chef. You want to give toolings like Chef or Ansible or Docker or this or that. Any other tool that you want, that tool should get just enough permissions to do its work. I think that's the best way to think about this idea, which is here, is give these tools just enough permissions to do its job, just enough permissions. That is the crux of the idea behind all these things, this whole thing. Just enough permissions so that the tool cannot create havoc. You don't want havoc, but you still want to make the tool do your work for you. You want to give them least privilege. This thing, just enough permissions, is also known as least privilege, principle of least privilege. You may have read about it. You probably know this by that name already. The thing is called, what is it called, principle of least privilege. That's what it's officially known as. I just call it just enough privilege, but this is the formal name for it and POLP, also known as the principle of minimal privilege, principle of least authority. You read that article, by the way. I'm going to give you a link, or you can search it. That's the concept under the hood. What are we dealing with here? What we have to do is for every tool, every employee in your company, I'm thinking of each one of you as a separate company right now. Any employee in your company, any team member in your team needs to have a very clearly identified role. The team member should have a very clearly identified purpose in their work. What's the purpose in the work? What about their doing? If they're a test team member, maybe they should get permission to access the test resources. If they're a development team member, they should get access to the development resources. If they're PM people, they should get access to the program, whatever. That's the purpose in their work. That's their role. What do they do? Are they the CEO and owner of the company? Well, then in that case, they should get root keys. I'm just kidding. Even the CEO and owner should not use root keys because it's a bad idea. When the owner or the business owner of the entire project, when that person is using a key, they should understand what role they are trying to play and get only that role allocated to that particular entity or the tool that wants to behave like a CEO. You can have a proxy to CEO running with CEO permissions, but essentially, nobody should be using root keys. We have to understand roles very clearly. What is the role of this particular entity? I am deliberately using this phrase entity as opposed to a person because what I am actually going to be doing is assigning roles to entities as opposed to people. I want people to think. I want machines to do work. The machine that I have, or rather I should say tools, I want tools to do work. This entity becomes this, is also an entity. You need to provide a role to the tool and then define the scope of damage it can do. Scope of damage or rather scope of permissions it will have. Every tool that you want to run in a cloud, you need to assign a scope. How much damage can it cause? What's the worst case? Then accordingly, you reduce its permissions. The principle of least privileges or just enough permissions, whatever name you like. Just reduce the level of capability that you want to add to the bare minimum so it can still get the job done without causing damage. You don't want damage to happen even when tools run. They can also cause damage. You want to minimize damage, so you want to really carefully understand role. Having said that, the next idea to discuss is you want to put these entities like a tool or a person or whatever you have that will do stuff. These things, entities, they do stuff. You want to understand their role and they can have multiple roles. Then multiple entities like entity one, entity two, you can put them together in a group. That's another idea that I will be now discussing, which is groups. A group of two entities, this phrase entity is directly correlated to this idea, user. I already talked about role, which is the capability or extent of damage or extent of permissions that you have granted. This is basically a list of permissions. List of permissions. What can it do? Can it create a bucket? Can it create a machine? Can it destroy a machine? Can it destroy a file? Can it get rid of my account? Can it pay for my credit card? Can it instantiate new VPC? Can you do this? Can you do that? Permissions, capabilities. So in a role, and roles are here. So that is the three key things to discuss, which are roles, entity, also known as users by Amazon calls it user. So that's user, and then put users in groups. That's the three key things to understand before we talk about these things. So you already understand what I mean by entity, which is indicated by the phrase user. Entity is what I like to call because I would like to include people and tools and sometimes machines. And user doesn't actually nicely communicate the idea. Therefore, I like to use the word entity. So this is entity number one. This is entity number two. This is entity number three, like that you can have any number of them. These entities will need to get a role or more, one or more. So one or more role they need to have. You can put entities together in a group and in another group, like that. And you can create groups. And each of these groups can have roles, like that. So that's the concept. Now this was very abstract. So I'll now talk specifics. So let's begin by creating a user or an entity. In this example, they call it user. So I'm going to go to users and then add a user. So by the way, whatever I have here, you can just ignore that they're actually used occasionally. I actually most of the times I don't use this cloud anymore too much, but I still use it. That's why you see that there are keys active and last activity was today and 82 days, 72 days, none. So there are some activity happening, but I have switched over to the Google cloud. So you don't see much activity here, but I still don't want to delete them. So please ignore all this. Assume that you don't have it. Then I will add a user and I'll add, let's see who's online right now. So yeah, we have six people. So let's go begin with the top person on the list is Greg. So I'll create a user called Greg. So here is Greg. And then what I'm doing is thinking of Greg as an entity, not necessarily a person. It can be a person, tool, machines, other things, wherever, whatever they can do. So this is just a person right now, Greg, and they can get programmatic access or a console access. So they can be like a human being with a login and password. And they can actually visit this Amazon website and login on behalf of me because I am the owner of this. So I can actually create a user and give them access to my management console here and they will see exactly what I see. That's this user person. They can get programmatic access here and also get console access, browser access. This is boring, but available, boring as in, I never used it because I don't need it. I need this, I need programmatic access and I need to give access to not Greg, but I call these things, basically whatever name I come up with. So I can name it like this, like this. That's a good name for a machine. And so I give that machine programmatic access so that machine can then operate on my behalf to do certain things for me while I go on vacation. So that's the permission. So I'm going to create a user, but for sake of sanity, I'm just using the name Greg, just saying. So now I'm giving Greg programmatic access, which means I create next and then I can add Greg to a group, but this gets a little bit convoluted in its thinking. So what I am going to do, begin describing is not create a user right now, but instead begin creating a group first. So the way to begin using this tool is to actually formulate groups first, but what you want to do is create groups and then create new users, entities, and then allocate this to this group, this guy goes to this group, this guy gets to this group. That's my plan. That's easier way to think about it. So first create groups and give them the ability to manage S3 buckets. This group gets the ability to manage buckets and this group gets the ability to manage EC2 console and all the EC2 resources like machine resources, this and that, so get that group. So I'm going to create two groups and then have three people or three entities and these two will go deal with buckets and these guys will go deal with machines. So that's how I like to think about this using this particular tool is first create groups. And so I'll create, by the way, there are some groups already created one, two, three, so all these guys, I'm going to ignore them as if they don't exist. So just ignore all that. I'm going to create a new group and I'll call this bucket management. That's the name of the group because this group is supposed to be managing bucket. So I search for a policy and I give this AWS S3 full access. So it gives access to Amazon S3. I'm attaching that policy to the group, so I go to the next and then I create the group. So now I have a bucket management group with no users, but permissions to access S3. And this is exactly what happened to a couple of you who actually came in here to IAM and created a user and added that user without actually granting them permissions. So here is your Greg user, add that, maybe another user. So one, the Na user, the two users getting programmatic access. And then I get permissions and I can put them as bucket management people or bucket management entities and then go next to tag them if any in review and then create users. So when I create users, boom, I get some access keys and secret created like that for both of you. These are currently people, but you can actually think of these two things as entities. You can have a name of a tool in place of a person called Greg. And so that tool can access this and that secret access key pair. And then this tool is a member of the bucket management group. And so this tool can operate on my buckets. This tool will be S3CMD, for example. So you want to create a permission structure and give it to that tool. So you give this credential to this tool so it can then manage your buckets because it is now a part of the bucket management group. And so is this user with this key and this secret key. So now I have those keys and secrets, I can close. And now I have two new users in one new group so I can make use of these things. And what happens when you don't allocate and you just create a user, so let's go close this tab right now and go back to the front of IAM. So now I have Vandana here and Greg here. And I can see my groups and in the group I have bucket management in that group. I have two people and I can remove them and add them to a different group. Similarly, I can go create a group called my machine people or machine thingies, machine managers, let's call it machine manager. And so here, next, and there I need to give access to Amazon EC2. So EC2, get access to EC2 becomes here, this policy, EC2 full access, that policy need to be granted to the group. So group becomes a machine manager group. And then I can go to the next step and create the group. So now I have a machine manager group, sorry, I have a bucket management group and a machine manager group, so two new groups created. I have two new users, Greg and Vandana. What I can do is maybe assign this one of these users and so say Vandana should become a member of not this group, so I'm going to remove her from the bucket management group and then go to the other group and in the machine manager group and add the user Vandana to the machine group. So now you can see in my machine group or machine manager group, I have Vandana as a user and in the other group bucket management, I have Greg as the user. So that's the concept. Now when you create a new user and add a user and say, hello, this is the user, let's call it S3CMD, not S2, but S3, S3CMD and then enable programmatic access and you say next and next and next and then create the user and then you get an access key and secret and you try that secret and nothing will work, absolutely nothing will work. Do you know why? You have the key, you have access key and secret key and it looks good and you have the user created, but nothing will actually work because this user called S3CMD, even though it is a properly registered user, it has no permissions like zero, nothing, because I didn't give any, it is not a member of any group, it doesn't have any policy associated with it like the S3CMD user here. If you go and examine its details, permission policy, nothing, empty. A member of group, no, tags, don't care, security credentials, yes, they have it, there's a secret key and access key and all that and it is active and all, but it's not functional. Even though it is active, it is not going to work because the user doesn't have a permission. You can individually grant permissions to a user and say, you know what, yeah, make it a member of the machine manager group and a bucket management group so it can get both permissions. That's one approach. Another approach is to just, you know, directly attach existing policy and say, you know what, administrator access, just give the whole permission to the entire cloud and review and add permissions. Now suddenly this S3CMD user becomes a super user, root user, because I granted administrator access. Now this is equivalent, this is functionally equivalent to allow everything, allow everything to every resource and that is scary. It is basically root, basically the same idea, which is not the best practice. Like you can see here in the security credential section, you can create an access key and secret key and like that create one. So you have this key as a root key, which is granting super user privileges. So it's a bad idea. So I delete that and go back to IAM, which is here. And in there you will find that I have a group called bucket management and machine management, which I just created and I need to get rid of those two groups because it's not relevant for right now. And so what I will do now is maybe I'll leave the groups, but instead delete the users. So I have this user created. I have this user created and that one, I will delete these three users because that was just a test. So I'm deleting them. So Greg and S3CMD and Vandana, all these three users deleted and they don't exist in the system anymore. I still have groups that deals with machine management and this group has a permission to access EC2 full access. That's a good one, but it doesn't have S3 bucket access. So just understand that we are scoping our permission structure to narrow it down to what we want this particular group to deal with. So this is a machine manager group. It can handle machines, EC2 full access, but nothing else. No bucket access, no CDN access, no this, that there are hundreds of lots of policies I think Amazon allows. You can see all the list of policies here. They have lots of things and lots of policies to granularly control each and every aspect of their cloud. And that's the underlying idea behind it is to not just randomly grant super user privileges to everything you do. And that is why it is not the best practice to go root keys, but instead create groups like this, which will deal with machine management and they currently no users here. So we want to create one user right now for our chef exercise. So I'll create that one here, chef exercise, chef exercise. And then grant it programmatic access. Next I will attach this to the machine manager group, which I just created. So it gets Amazon EC2 full access. That's what I want to the machine manager group. Has it already? So I'm going to make this new user a member of the machine manager group, not tagging it, reviewing it that this user called chef exercise gets programmatic access with an access key and it becomes a member of the group machine manager. And I will now create a user and as a consequence, I will get this access key and secret key. Now this key is actually active, but it will still not be able to manage buckets and I don't care. We're dealing with machines here. So this credential that I obtained, I obtained it through IAM and it now has the permission to manage your EC2 instances. So it will be useful. So I'll need to copy that key and this secret key and later on delete it, of course. But right now I need to grab it. So I'm grabbing it here, putting it in my VM. Specifically, I want to put this in the knife RB. So here, that's where I dump it and grab the secret key, dump it here. So I have it now, yes, and I close it. So now I have my chef exercise keys, the user or entity called chef exercise, which is a member of the group called machine manager. And I have the corresponding key pair generated from identity and access management, not from here. This is root key and I have deleted every single key I have ever had. Having seen this idea, the core idea behind it was principle of least privilege. And that's why this is a better practice compared to this idea, which is root keys. Having seen that, I have secured my AWS access key and my secret key for the new user I created, which is going to be this exercise that will do the work for me. So I have granted it just enough privileges, just enough permissions to manage just EC2 machines and nothing else, no buckets, no nothing. There are lots of things in Amazon Cloud. It can handle only EC2. And so that's what we wanted to get our credentials. We went a scenic route to look at IAM and we got back with our key pairs. So we have the key pairs to manage our infrastructure in Amazon's EC2 portion of the Amazon Cloud, not the whole cloud, just that portion. And in our KnifeRB, we need to actually write these keys in a specific manner, not just randomly dump it like this. So we need to write that down in a very specific manner. And so what I'm doing right now is understanding what that method would be by reading what we have here. So here the first thing it is telling us to do is to edit the cookbook path like this. So currently the cookbook path is line number nine. I'm going to make it different, lay it like this. Why am I doing that way? I'm doing it this way because I want to create my own cookbooks and those cookbooks of my creation will go and sit in this folder. And then I will have some community created cookbooks. They will go and sit in this folder that gets precedence over this one. So there is a comma in here. And so this is one item, this is the other item, and they are in the cookbook path. So I would like to delete this line now, which is the older line they gave us. I'm making that modification because I want to actually eventually get to a point where I will create my own cookbooks. And that's why we have this segment written down here in this section to make a modification in this KnifeRB in this file like this, line number 10. And so the rest, what I want to do is grab these key pairs I have here and here. I want to write that down like this. So this approach is what I need to take here. So I will take that approach now. I will take this approach just like here. So I'll copy that and up it here. And then remember that I'm using Amazon's AWS Cloud. So you go to console, AWS, amazon.com, like that. And there you will find that I have chosen to operate on my EC2 section, which was Oregon, I think, Oregon. Yeah. So Oregon Cloud is known as US West 2. That's the region. That's why I have this US West 2 written down here. If you're operating in some other cloud or they call it region, I call it cloud because actually it's a different cloud, this Amazon, they think it's one cloud, but they're independent. They cannot even share a key pair. And that's the reason I call them separate clouds. But they like to call themselves as different regions of the same cloud. It is not. They call it region. So just remember that you have to choose the right region. So if you are in Virginia, you need to make this US East 1. If you are in California, you need to make it US West 1. And you can read Amazon's documentation to find these numbers. I am going forward with what I have here, US West 2, which is my current region. And I need to change this. Change this to do what? I grab it from here and put it right there. And be very careful when you copy and paste keys. So you make sure that you cut it properly and change this and paste it carefully and then save. So that's the structure it likes to use. And also this line cookbook path needs to be deleted because line number 10 takes over. So I'm getting rid of that. And line number 10 will be used. Now it is line number 9 now. I got rid of the older line. I did this because I want to accommodate my own cookbooks, which will be kept in this folder, which doesn't exist yet, but that's okay. We have added our keys like this and chosen the region. Now saving this file. There are a couple of things you will also observe in this particular file, which are it already makes a reference to your name, your client key, which is your private key that they have given to you. It is already edited by the way, if you look at your own KnifeRB file, you will find that your name shows up here already and your reference to your key pair shows up here and reference to your organization shows up here and all that. It's already done for you. This is a change I just did to expand from just the cookbooks to include site cookbooks, our own creations, then added key pair and the region. With that change, I will now save this file. And by the way, anytime you're using Atom Editor in the subsequent exercises coming up, it is a great idea to close the file you were done with. When you're done modifying this file, whatever you're doing with, close it. It's a great idea to close it to avoid fat fingering. You will accidentally type something and it will mess up your entire exercise and you will get frustrated. To reduce the frustration, it is a great idea to close the file like this. Close it and leave it like this. So you know exactly, I'm working with that file. Okay. I'm done with it. Close it. This is a very good practice to close a file after you're done doing with it, whatever you're doing. You make a change, you close it. If you don't, you will accidentally, I've seen it so many times, people will just type something by mistake and don't even realize that it did it. And then what? Nothing works. I've seen it so many times. That's why I'm repeating this idea is to close that window. I hope that is clear. Next, let's go forward. We're going to check our KnifeRV for accuracy. So here's the file. We want to make it look like this. Let's go see what else we have here. So let's grab it and just copy it quickly and make sure that we are copying, comparing line by line. So this line is okay, 17 is good, log level good, log location good. Your name is already there. So this is also good. Client key is good, chef URL good, cookbook path modified, access key for Amazon, secret key, region. When you're using other clouds, by the way, this Rackspace cloud is bad. Don't use it. I just said Rackspace bad. Don't use it because they charge you $50 for just opening an account and not using it. That's why I call it bad. There is nothing else wrong with the cloud as such, but then why do I even have this reference just to call them out bad? No, that's not the idea. The idea is to actually make a change in this Rackspace API key, Rackspace username, Rackspace version to point out to the fact that Rackspace is a major contributor to OpenStack and you have OpenStack in your company. And so what does that do? It means that you should use OpenStack internally in your company. So let's go identify. What does that mean? Knife, knife. I think that's the way to go. So go here and you will see that in here is how you should actually grab. So go here in this location and OpenStack is the creation of many companies, Rackspace happens to be one of them. And their structure is very similar to OpenStack. So what I'm doing now, this Rackspace API username, delete Rackspace API key, delete Rackspace version, delete and use OpenStack. I think I should update my exercises to not reference Rackspace, but instead reference OpenStack. So I just did that. I will also make a change in this documentation here, which actually says Rackspace and you will see this updated to make it look like this. This will pop up here, maybe later tonight. I will change it. And then this is another cloud, DigitalOcean. And you need to change this to get the token from the DigitalOcean cloud to dump it in that segment. We'll do that later. And all these things like mycloud.boying.com, you can go like that and then ask your OpenStack administrator. I know them, but you probably also know them. But if you need help identifying who the people are, ping me. They will give you a username and password and a tenant name and a region name and all that. So you can actually do these exercises in your company's internal private cloud. That's the whole point. And so this segment here deals with easy to cloud. This one line deals with DigitalOcean cloud. These four lines, five lines, they deal with OpenStack cloud. And like that, every cloud that is worth using has a Knife plugin. What does that mean? It means this. Go to GitHub and then search for Knife. I don't know how to type Knife, Knife plugin. And that's a bad search. So I should go tell you to go github.com and chef, github.com slash chef. And then in the chef repository, in the chef organization, you go search for Knife. That's a better approach. Now here you will see that there is a Knife EC2 plugin right there. Knife EC2, Knife vSphere, Knife Rackspace, Knife OpenStack, Knife Azure, Knife Windows, Knife Google, and Linode, and Push, and Cloud, and goes on. It's a long list. And there are companies outside that are not a part of the chef company, but they're also preparing open source Knife plugins to operate with other clouds. So there are a whole host of, almost every cloud will have a Knife plugin. And that means that you will have to add a bunch of lines here at the bottom of this Knife RV, like here, the credential section to operate on that particular cloud. So you will have something like IBM cloud, you add the IBM section. You have Google cloud, add Google section, add Azure cloud, Azure sections. So you just keep adding your credentials here, accumulate them. If you want to use with like 100 clouds, you can, but it's a stupid idea. I would not use hundreds of clouds together in one Git repository, one Chef repository, but instead use one, maybe two. That's a good idea. So, by the way, in my exercises, I will be doing with three clouds. It's too much already right there. So use one cloud is a good one. Maybe add one more. That's enough. Doing it with three clouds is a disaster. It will really begin right there because you will run into cross-dependency issues and you will see the nightmare, it will happen. But I can handle that nightmare, but I don't want you to be struggling like that. So just make sure that you're dealing with one or two clouds. In our example here, we have three, two is good. Actually, ideally one is the one you need, is the one you want. And that is the right approach, but two is okay. So you pick your choice of your cloud and go deal with it. So that's my idea behind checking IFRB for accuracy, which I just did. And I will now bring my Atom editor back. I know that my DigitalOcean connection is broken because this is not changed. I know that I don't have access to OpenStack, which is fine, but you have it. You should update it and run with it. So with that, I will save this IFRB and close it. See closing is important. Next, we'll go to the next page and see what we have in there. Next page is coming up and there it is, begins now. So what does it begin with? It begins with a gem file. So we need to have a gem file here. So do we have a gem file? We have a cookbook and we have a role, but we don't have a gem file. So we do, we create one and not in the chef folder. So we'll get out of that and create new file here, call it gem file. What does gem file do? It lists out all the things you need and use that in a very disciplined approach. So that's your list of things you need, copy that, put it here, save it, close it, gem file. Now the gem file is ready. We need to bundle it. How do you bundle? You say bundle and it installs the bundle, looks at the gem file and then there's going to be an issue. Let's see the issue that's coming up. I think the issue got avoided. I'll tell you what the issue was and tell you how it avoided itself. And so here is the issue that I see that I saw it and it prompted us and most of it is green, but there was a yellow, that is the yellow. And so here, the latest bundle is 201. That's what prompted me as if it's an issue, but you are currently running 115.4. And so I want you to run 115.4. I think it's this we did in the previous exercise, which we had a deadlock of gem dependency deadlock. I removed it by going down a gem version. And so I deliberately chose on this version, which you should have in a previous exercise. It will prompt you to update to this gem, don't update, it's going to cause trouble. So stick with this version. This is the version I carefully chose for us to operate and to get to that version of bundler, you need to install that 115.4 version. How do you do that? You go and look at my history of what I have done in the past and that will tell you that you can install that version of gem by... I think the Heroku exercise prompted us to do that. So I'll just tell you how to do that. So the way to do that would be gem install bundler-v115.4. That should be it. I think that's the way to do it. Let's cross-check that. Bundler gem, 115.4, that's correct. So I'll just demonstrate that here. This is how you do it. And I hope the syntax is correct, so I'll run it. And it is correct. So that's the syntax. So just for you, if you somehow get prompted that you should use 201, don't. Don't get using that gem. Instead use this gem that I just pasted in Slack chat, that you have that instruction to get the correct version of gem, which is what we will be using in this exercise. And in the previous one, it might prompt you to go a little higher like it did to me. It tells me use 201, like right there. But don't, because this is causing trouble. So it tells you this is the latest and you are running 115.4, which is totally fine. Just stick to 115.4 unless you want trouble. And trouble is good and nothing wrong with getting into trouble. But just saying that if you want to avoid trouble, don't go there. Stick to this, learn how to handle trouble before you take on trouble. Take it on though, please do take on trouble because then you will know how to handle trouble. And so take it on, but not in the first attempt. So first attempt is this, v1, 15, 4, that's the first time you do deal with like this. It will reduce your trouble. I will tell you how to create trouble also, don't worry about that. But I will like you to not go into trouble the very first time you deal with these things. First time I want to go through smooth, the first run it should succeed. Later on, I'll tell you how to mess things up and then how to bring back to order and how to mess again. And that's where you learn. So we'll get there. But first time stick to this, even though it is telling you to go higher, it's not actually telling you. It's just hinting that there may be a higher version available, but whatever. So put this on the other side. And then Ruby gems, we got the gems we wanted. So we grab that in a gem file and then run bundle. We go next. And then what do we have? We have use knife with the cloud provider. So who's the cloud provider? In this example, we are choosing to go with first Amazon web services. And so let's see, can my chef talk to Amazon just on the command line and deal with it? So I know I can go to the browser and see what I have. And I can see my Amazon EC2 machines in the Oregon cloud and I have zero running instances. So I know that already, but that's the browser and that's me doing it. I don't want to do it myself. I want to get this done from the command line and tell my chef, hey chef, can you go check what do I got in my Amazon cloud? Can you tell me? So what I'm going to do is I have this chef exercise entity in the IAM permissions that I granted and that key pair I have here, here, here, here, 11 and 12. That was key. That key pair I have. I want chef to go talk to Amazon and find out, dude, what do I got? Tell me. That's what I'm asking. Hey, go check how many machines are there? So it says you've got nothing, which is fine. I got nothing. There's nothing here. Nothing in the Amazon cloud. I see there is, do not have any running instances in the region. And that's what this answer is. The question was bundle exec, which is a prefix. Knife is the tool, EC2, go to the EC2 cloud, Amazon EC2 cloud and look at the list of servers I got there. List of servers in the EC2 cloud, give me an entire list. So it gave you the list, which is empty. This is actually empty if you carefully look at that. It gives you just the header, instance ID, name, public IP, private IP, flavor, image, key, security group, IAM profile and state. But it doesn't actually give you anything after that because the list of servers in the EC2 cloud is empty. That's what Knife told me as a response when I ran this command. So you can see that our Chef setup is already talking to the Amazon cloud because of line number 11 and 12 in the Knife RV. It knows which region we are connected to and what's the access credential. Now, at this moment, if I go back to my Amazon console and go to IAM and look at my user, which is this Chef exercise user, which is here, and you know what? Group membership, you have the machine management capability. So I want to remove you from the group. Bye-bye. I laid you off. Sorry. I laid off that employee. Sorry, man. So yeah, the employee got laid off and it doesn't have any permissions. See what happens. Even though they have the key, the employee is laid off. You are not authorized to perform the operation. Simply saying, too bad. I cannot talk to you. There it is. So that's the scenario you're looking at right now. You are not authorized to perform this operation because that person got laid off. And so I want to hire him back again. How do I do that? I just add user to the group. Which one? The same one, Chef exercise, add user, and the user is now added. And so now I go back to my terminal and say, run it. And I get a response, which is empty list. It has the permission to look and operate on my Amazon Cloud again because I hired the user back. So now it has the permission. So I authorized it again simply by adding that to the group member called machine, whatever that name was, machine manager management, something like that, that group, machine manager group. So that was just a big sidetrack again on the IAM scenarios back to here. We are able to operate on the Amazon Cloud. Can we operate on the Digital Ocean Cloud? No, because we don't have a token from Digital Ocean yet. Can we operate on the OpenStack Cloud? Too bad. We don't have access, but that's okay. You can still do these exercises without me having access because I don't need to do the exercises. You want to do these exercises. So you should be actually doing these exercises on the OpenStack Cloud, not on other clouds because they are other. OpenStack is your own internal cloud. So you should use that yourself in your company. And you can also, of course, use other clouds. It's your choice. Having said, let us see if our Chef setup, just like this, can talk to the EC2 cloud. Can it talk to the Chef server? How about that? Can it ask the Chef server, what cookbooks do you have for me? So let's go ask, hey, Chef server, what do you got for me? What books you have? And so it says, I got these books. Wow. There are lots of books already there. This is from a previous, apparently, previous invocation of me using the Chef server. I still have a bunch of cookbooks there. So what does that mean? I should be deleting them. How do I delete them? I will again use the command line, by the way. You can see the books in my policy cookbooks. So here are the list of books that I apparently have, whole list of books in the Chef server. So go to policy and then cookbooks in the browser window. You should be able to see the books that you have, which probably is empty for you. But you can see on my screen, I see that I have books. So what I want to do now is bundle exec, knife, and I'm just exercising my memory. I have a very bad memory of any command. I will never remember anything. I don't want to remember anything because I have cheat sheets for that. For every single thing, there is a cheat sheet, and if I don't find a cheat sheet, it is Google for that. So I don't remember, but I sometimes exercise my memory and see if I can recall the delete command to delete all the books I have in the Chef server. So these books, you saw them here, long list comes up, but I want to delete them. So I'll say knife, bundle exec, knife, cookbook, delete. And then something like this. I think that's a command. No? Okay. No, that's not the command. Well, we'll find out. There should be a cheat sheet here on the website. We will go use that. And there is a reference to how to delete all the cookbooks. So yeah, taking a snapshot. So let's delete these cookbooks later. And at this moment, what I want to do, it is empty for you. So there's no reason to worry. But what I want you to do at this stage is to understand that you have done a lot of tedious, boring, and seemingly useless work up until now. All we have really done up until now is somehow managed to grab this folder and then put some things in here. And that was like copy and paste from here to there and pretty boring. And I don't want to be doing grunt work over and over and over again. I will do grunt grudgingly, but not repeatedly. So what do I do? I want to capture a snapshot of my workstation and keep it safe. So I don't have to do the painful, boring work again and again and again. So what I do is I go to my virtual box and take a snapshot. What does this do for me? Let's go first take a snapshot and then figure out what can we do with it. So here is my virtual box and I'm going to go to the machine and then take a snapshot. That's it. So here we go. I just took a snapshot. I will call it Chef is ready and then click the OK button. That's all it takes to take a snapshot. Now the snapshot is getting saved. It is saving the state of the machine, exactly how it is right now, including every single file, every single settings, every application, just like we want. It has been captured. Now I will just do create mess in my computer, whatever I want, power it off, delete it. And no, no, no, don't delete the snapshot, get deleted. You don't want to delete the snapshot. So you can create, delete all the files in here, no, no issue. You can delete everything that you have. For example, this Chef repo that I created, I can actually go delete it like that because I have a snapshot. So what it lets me do is bring the state back to how it was at the time when the snapshot was created. I'm assuming that this snapshotting idea is not new to you, but if it is new, remember that that's what we're doing is that we are basically getting the ability to bring back the entire state of the computer as it was when I took the snapshot. So the key thing to remember is to take a snapshot because now is a good time because you have done all the grand boring work, which is copy key from here and there and all that. So take a snapshot. And by the way, don't do like I'm doing, right? RM minus RF, no, don't do that. You can because we have a snapshot. But when you do have a snapshot, what we need to do is restore from the snapshot. So I just shut down my machine and then I can restore my snapshot. How do I restore? I go to this machine here and look at Chef is ready one minute ago, snapshot and right click on it. Don't delete the snapshot. You want to restore to that point in time, which was two minutes ago. So right click on it and say, restore, be very careful. Don't touch the delete button, restore. And it says, you're about to restore your snapshot, Chef is ready. And when you're restoring it, you don't want to have another snapshot, not necessary. So you want to uncheck that and then restore. And then the machine comes back exactly how it was at the time when it was taken. The snapshot was taken. So here it comes, restoring the machine to the state it was at the time the snapshot was taken. And you will see a live running machine right now. At the same point in time when I took the snapshot. So that's the idea behind taking the snapshot. And now you have the whole thing running just like that. And it is clearing my ink and the command line and everything. Sorry, sorry, sorry. There we go. All the things are already in its place. So you have the whole thing ready just like it was. And the key file, the knife RB and the PEM file and the gem file and all of the things, they are there and that's what we wanted is to take a snapshot. This is a seemingly trivial step, but it's a very useful step because you want to come back to this point in time quickly and have your knife RB in good shape. And that's what we are able to accomplish by taking a snapshot. Having said, let's move forward. What I want to do now is to upload my kitchen to the chef server. So I have the cookbooks and the roles defined already given to me by the chef company for an example exercise. So they have given us the starter cookbook and the starter role and all that. So what I want to do now is send my kitchen, the chef repo over to the chef server. So what I'll do is I'll go back to the terminal and here first thing is to upload all the cookbooks I have. I have only one and I will upload all the cookbooks I have like that to the chef server. And so I will now do that. Simple exec knife cookbook upload and all of them from the path-o.slash cookbooks, which is the cookbooks folder, this take all the books I have here and send them over to the chef server. So that's the, that's the idea. So take all the books I have in this location, upload it to the chef server. So it goes, uploads it. Now what I do have, as you see the book is uploaded. Now if I see that, give me the list of all the books I have, I will see in my list. The book I just uploaded also available here. This is the starter book. I have a bunch of other books. So I think it makes sense to just clean up. So I will go cheat sheet and that's where the search feature comes in handy. So here's a cheat sheet with the cheat sheet. Come on. Cheat sheet with the cheat sheet. Cheat. Cheat. Cheat. Cheat. Hello, it's not going to show me the cheat sheet or what, it's the next step apparently. So the step after that should be the cheat sheet. I just want to clean up. There it is. So the cleanup step is how do I delete all the books I have? There it is. Delete all the books from the Chef server. So here I'm deleting all the books from my Chef server, just cleaning it up so that it becomes a clean slate for you to look at. So it becomes easier to understand. So I'm cleaning up my Chef server, deleting all the older books that I have there and making sure that I have only one book, which is the starter book that I will be sending again because currently it is getting deleted. So the starter book that I just uploaded will also get deleted with the bulk delete command. This was the bulk delete action, all the books from the Chef server. And so that was the command I think I remember, I forgot the word bulk in there. Apparently, I tried that command and I forgot the bulk action like here, there should be a bulk action like bulk delete. And then the dash y option after that. The dash y is just saying yes. So yes or no, yes, and there's nothing to delete, so it comes back. And then I will send my only cookbook up again. So my single cookbook that I have this one is going up and it went up. So I can now say that, Naif cookbook, show me the list of books I have. And there it is, only one, the starter book. I uploaded that and it is now there. Only one book, you can see it in my Chef server. If I refresh the, by the way, Chef server website sucks, you have to refresh it every single time. It doesn't update by itself. That's one of the reasons I don't use this website, but I don't even use the user interface like a browser interface at all. I just use the command line interface to using the Chef tool. And so cookbooks, starter, the only book I have there. Nice. What I would like to also do is that I have the other things in my folder. Like for example, I have the cookbooks and I have roles. So I need to send my roles also there. And so then I have gem file, which I don't need to because gem is a separate idea and not a part of Chef. So it's a Ruby thing. It's basically dependency management and discipline. So we are not sending gem file there. It doesn't make sense. And so now what I want to do is send a role, this role I have called starter role, which is sitting here. I need to send that role, starter, over to the Chef server. So I need to go back to where I was. So which is I think the exercise I was doing. So I just quickly zoom to that point. So it will give us the ideas to follow along. And so we have to list out the books and then you send the role. All this role sending business is kind of convoluted in that the command is not super intuitive, but let's go see what it is. So it says bundle, bundle, exec, knife, and then role upload. I think it should be like this, but who am I to decide? Something like that. That's how I would expect, but that's not how the command is. So don't run it like this. The command is slightly different. That's how the Chef has decided to, the developers of Chef decided to write it slightly different. They say bundle, exec, knife, role, from, file, and then give the path like that. That's how a role needs to be sent. So slightly different way of interacting. So this was a cookbook upload action, whereas this is knife, role, from, file. So different way of, different grammar. This is basically called grammar in, even in, just like in English or any language. This is the language how you interface with the command line. The grammar is different and that's bad. I mean, I don't like it, but there's a good thing that if you don't like something and if you really strongly believe it, then what you can do is go to this location and make a change. Not here. Not here. Go to the Chef product here and make a change. And hand a pull request, say, Hey, I don't like this. You should do it this way. My way is better than your way. And so if everybody agrees that you are better than them, they might accept your change. So that's how you deal with open source. If you don't like something, don't complain, change it and see if your ideas win. Because the best ideas win. If you have a better idea, like I think I do, but I don't pay too much attention to this. This is for the sake of saying it. So I don't really care what the command grammar is. But if you really strongly believe in something that, you know, this should be different. Go make a change and make a pull request and send them for them to review so that people will debate. You are better than them or they are better than you. And then the best idea will win. And they will either accept your pull request and make a change or reject your pull request and call you stupid. I'm not calling you stupid, but thank you for your contribution. We are sorry, we cannot take like, oh, whatever. So yeah, you get the point. But open source is rough. They can actually call you stupid. And you have seen that. You have seen probably heard of it. This guy, he does that all the time. You know, he's known to be very rough occasionally, you will see that his responses to pull request can be tough. And he'll call people stupid on their face in open, in public. And because he is smart. So I don't complain about that. I admire smart people and he's one of them. And yes, he's rough. But I guess with capability comes the privilege of being rough, maybe, maybe not, maybe not. I think he's acknowledged that he's being bad. So Linus has recently acknowledged that he will behave properly. Something like that. There was a news like that. And so yeah, so these are cosmetic things, but they're important to discuss, so behavior. There it is. So recently in September last year, Linus apologizes for his bad behavior, takes a break from Linux and then he came back saying, I'm sorry, I've been bad and so apologize and all that. But I guess this is the right thing to do is to just say sorry, even though he has been rough. And I'll be back. Yeah, he's not quitting. He came back and he's a softer version of himself. He doesn't call people stupid anymore. Earlier, he used to do that apparently and you can see his emails publicly posted emails and pull request comments and all that. It is, yeah, so eight times when Linus was a badass. You can read about these things, I'm just skipping ahead. But remember, open source lets you change stuff. So if you have a better idea, you should make a change. So we have this idea that I complained about, it's not that bad. So I'm living with it. I'm not making a change, at least not right now. Having said bundle exec, knife role list will give you a list of all the roles you have. And so apparently I have a bunch of roles. So I need to delete some of them. And so there is a role called base and a DB master and a web server that needs to be deleted. Again, it's strictly not required to delete them. You can keep multiple roles and use only the one you want. And that's my plan. So I'll not delete the rest. I'll leave them, not touch it. And go forward. Otherwise, you can always refer to the cheat sheet and go clean up if you like. But right now, not cleaning up. That was all the setup. And just me talking about all sorts of things like IAM and whatever I did. So having said, now comes the time where we actually do some useful stuff, like actually productive useful work, meaning we'll have chef do the work. So now that we have a kitchen, the kitchen is sitting in the chef server. We have pushed our cookbook. We have pushed our role. We want to now make use of these things and make chef run to do certain things, like whatever they have, whatever the desire is. The desire in this kitchen is a very simple desire. It is just to make a log entry. That's it. Nothing much. You can actually see the starter cookbook in which we have a recipe section, which has a default recipe and the default recipe has one, two, three useful lines. These are the lines. That's it. Nothing much. All these lines do, it says, welcome to chef and it's a log entry in the command line. That's all it does. That's the starter cookbook. It does nothing much, nothing more than what you see in line number four. Log entry, welcome to chef, and then it will show your name there, pop up your name because it knows you. It knows you because you have an account with chef server. It knows your name from there. It will pop your name there and welcome to chef and then starter name that will pop up. That's the result that you are expecting to see when you run this kitchen on a target node using chef. Let's run it. What I want to do now is to not go to this location. I don't want to go there. Where do I not want to go? Here. I don't want to launch an instance. I'm clicking this to show you what I don't want to do. I don't want to go there in the EC2 section to go and launch a machine. That's not what I want. I just showed you that I don't want to be doing that. Instead, I will ask chef, you go start a machine there. You go run chef and you go run whatever I have in mind. What do I have in mind? Nothing much for right now. All I have is mind is make a log entry that looks like this. Welcome to chef, that's what it should say. That's what I want and that is my desire. What I want to do? Nothing else except ask chef to go to Amazon, start a machine, install chef, run chef and show me the logs. That's what I want. So we grab it, this section and understand what we intend to do and how do we use it. So here is your command line. You want to run this command. But let's understand it before we run it. So here we have bundle exec, which is a prefix, you're using the knife tool to interface with the Amazon cloud and ask a server to be created using a key pair that I think I have named bootcamp if I remember correctly. You may have a different name or you may have used the IDRSA name. So if you use the IDRSA name, that's okay, keep it like that. If you used a different name, change it. I think I choose the bootcamp name, let's go cross check. So we'll cross check EC2, key pair, the name is bootcamp. So you can change the name if you like or import with a different name or use the name you have. So I will be using the name bootcamp. The corresponding key is sitting in this file IDRSA. You can see that I have it here, that file. So this matches this file. The name here was bootcamp in this cloud. I want to ask Knife to go to Amazon cloud and create a server using this name in Amazon, this key file here. And by the way, when you create that machine, I would like you to use the Ubuntu user because I am actually going to create an Ubuntu machine. But what is this number? Where does it come from? What is this number? Where does this thing come from? What is this thing? Well, you know this thing, this thing is the starter role and that's your run list. The thing you want to do when you run Chef, because what you're doing is creating a server and you're starting installing Chef and then running Chef. And then when you run the Chef software, it needs to have a run list and you're passing this reference, which is the starter role. We have a role, we have a cookbook. Role is called starter, which references the cookbook called starter. So it will run. So this part is okay, line number 17, okay. But T2 micro, well, that's the size of the machine. So line number 16 references the size of the machine, the cheapest size you can get in Amazon. That's the size. It is the dash F option means flavor. Flavor is size. This is something that I still don't know where it comes from. So I'll talk about it a little bit. This is the Ubuntu user because this is probably an Ubuntu image. And it's not probably, it is definitely Ubuntu image. So this is your machine image, Amazon machine image, AMI. But then how do you come up with this number? And this is T2 micro is the size of the flavor. This is a run list for you to run. When you run, you create a server in the Amazon cloud. You use this key pair and all rest of it is understood. Let's go focus on this idea now. Where do you get this from? This thing is called Amazon machine image, but what's the number? Which was the right number? Is that the right number? I don't know. So we'll find it out. How do you find it out? You ask OS company operating system creator. What's the number? So who creates the Ubuntu OS? Well, it's the company called canonical.com. Those are the people that create this open source OS. You can ask them, what's the right machine image that we should be using in Amazon in the Oregon cloud, US West 2. You can also ask Amazon. They might know, but I think it's a better idea to ask the creator. What do you say as the machine image that we should be using in this Oregon cloud in Amazon? So please tell us. So that's the question we have. We'd have to go and ask these guys because they create the OS, the Ubuntu OS in this example. If it's a different OS, we're going to go ask the different company. But example, if it is Microsoft, you have to go ask Microsoft. If it is some other OS, you have to ask the OS creator. You can always ask Amazon, but I don't want to, because they did not create the OS unless you're using the Amazon Linux. In this case, yes, you should ask Amazon company for the Amazon Linux AMI, but not for Ubuntu. For Ubuntu, always go to the root. Always go to the creator, the origin, the beginning point. So let's go there and we'll say, hello Canonical, what AMI number, Ubuntu, come on, type properly for Amazon. So here is the answer. The first link is a good answer. And there it is. They have a comprehensive tool to decide these things for us, to help us decide. And this tool is giving you the answer. In fact, there are, I don't know how many entries, let's go look at the bottom. There are 536 entries. Oh my God, that's a problem right there. But I want to understand which is the one number that I will use out of this 536 images available on the Amazon's cloud. Which one do I use? So that's the EC2 AMI locator tool. It is provided by the ubuntu.com website, which is a Canonical company property. So let's go to the bottom and here we'll try to narrow down using these filters. The first filter is the region of choice, which is in my case, US West 2. Your case may be different. So just remember to choose the right region. Here I'm choosing US West 2, which is right there. So I chose that and I got narrowed down from 536 down to 37 entries. So I filtered 536 down to 37. I still have 37 entries to deal with. I'll further narrow it down now. So US West 2 is chosen. Let us now select the next entry. Now here is the next filter. I have no idea what Janiyal is and trustee is and I actually do know, but you don't need to know. So these things, I don't know which one to pick. So I'll skip it. Leave it like that. Any. Leave it any. Let's go to the second next one here. What's telling us here is that there are lots of these numbers and I can tell that they're version numbers and some of them have LTS and others don't. The biggest number is actually that one. Is that the latest release? Absolutely yes. But is that the best idea? Absolutely no. But why? Why is it not the best idea? Why are the others a better idea? Let's understand that piece. The differences between these numbers versus this number and that number is that they are not LTS. This is not LTS, but other numbers are LTS. What is LTS? So LTS is lethal supplies. So LTS is this long-term support. It means that you want to get an OS version that is supported for long-term, not for three months or five months or I don't know what, six months maybe, I don't know, we'll find out. Why is it so slow? Okay, it came. So this LTS stands for long-term support and there is a plan behind this. So the idea behind, keep changing the website on me. Okay, hold on. I need to see a picture of this. So the picture is maybe here, yeah, here. That's a good picture. Let's go see that. Now here you can see in this picture, what does long-term support mean and how long the long-term is. You can see that the long-term support are the ones with a label LTS and they have a longer duration of support, which is typically five years, I think. Maybe I'm wrong. Yeah, five years. This is a five-year period here. And I think the rest of these entries without LTS are typically one year long. Yes, they're one year period. So one year period, very short-term support and you want to get a long-term support product. If you're doing something for business, for enterprise usage, you want to get LTS and this is a good choice. This is a better choice because it is a slightly older established version. Right now we are in 2019. And so if you look at this line, you have two LTSs available to us. Actually, this is also available right now, three. So we have 14.04, we have 16.04, and we have 18.04 LTS available. Now this is almost getting out of service period, so it's going to go away. It's a good idea to just stay here and plan to go here. And then next LTS, eventually when it comes out, you should eventually change to that. But a good idea is to stay with this for most production applications and eventually plan to switch over in subsequent timeframe when you're ready for it. So that's how you should think about what operating system versions for every company that makes an operating system will have a chart like this. They typically have a thing called LTS or a different name for it from, I think Microsoft calls it long-term lease or God knows, something long-term, long-term something. I don't know what, they'll call it something like that, long-term release, long-term cycle, make your own names. But essentially it stands for longer duration support. And so you have to identify how long will the support be available from the origin company that makes the operating system and use that one. So that's the reason why LTS and that's the reason why 16.04 is what I am going to pick. Because in certain cases we know we need something different. So we'll now go back to this and here we'll select 16.04. Now the logical, the choice is very clear. It is not 18.10, that's limited to a short-term support. So one year support. I don't want that. I would either go here or go there for right now 16.04. So now I suddenly have a very narrow choice of only five entries out of 536. Well that's nice. Let's go see, we can further narrow it down. Architecture, it's only AMD 64. There are ARM 64 choices also available, but not in this particular cloud. So other clouds will have ARM 64-bit and 32-bit, 32-bit choice I think is out of availability yet, they don't have it anymore, 32-bit is gone, 64-bit is the only choice. You can get the AMD architecture, Intel architecture or the ARM architecture. Not in this cloud though. Other clouds you will have that choice. For example, the other cloud is Scaleway, there you will find Scaleway cloud will have a choice of ARM CPUs. And so here is your pricing for simple cloud product for ARM based CPUs. And it's dirt cheap. I mean cheap as in, as you can tell, like a 8 GB memory is 12 euros, 2 GB memory. Is that the cheapest cloud you can find right now? Is this Scaleway cloud? I think it is the cheapest today. They also give you bare metal cloud, like dedicated hardware directly. So no VM, direct metal, direct silicon usage dedicated for you if you like. That is also cheap. And ARM CPU with 2 GB memory is 3 euros per month. It's also very nice and very cheap. The problem with this cloud is that it is fully booked, so even if you have an account, you're probably not likely to get the cheap machines. They're already taken. Let's go see quickly. So if I log in, see if they're available, if the machines are available, I think most of them are taken. So let's see quickly if we have something, if I start to provision a server and see if I get Ubuntu Bionic, yeah, trusty, and then go to Paris and then get a bare metal machine. This machine are 2.99 euro or looks like it is available. Okay. Yeah. That's good. That means they have added capacity and that's nice. So you could potentially get an account here and play with it. It's very cheap, dirt cheap cloud and it's based in Paris and Amsterdam, two locations. And it gives you access to what they provide. Check it out. It's a good cloud. It's just based in Europe, away from us. But if you have customers there, it might make sense to use this. So it's your choice. Having said, let's go back, AMD 64 is only available, ARM 64 not available. So there's no question there. So we select AMD 64. It narrowed down further. Was it any before? Oh, there was an ARM bit. Oh, so it is available in Amazon. So there is an ARM solution now available. Okay, good. These are AMD 64 choices. This is an ARM choice. I did not pay careful attention to it. So now you see that ARM is available in Amazon. Nice. I did not know. Now I know. So ARM choice available. And there you can select, let's not use ARM right now. So let's go stick to our i386. I'm going to filter it down to AMD 64. So now I have four choices. I go further. And here I have these numbers to select from. But what do I select? What instance type do I select? So there we have the choice of instance store. The choice of hardware virtual machine instance store. Let me tell you that this hardware virtual machine is a newer technology and is better. That means I don't need this. So skip them. Now we remain, we have only two choices left. How do we make a decision between the two? The difference in these two is that this is elastic block storage bagged, SSD bagged. So basically a machine with SSD that doesn't disappear when you kill the cow. So you can protect it and keep it safe if you kill the cow. And the other choice is instance store. This storage is ephemeral. It will disappear on you if you kill the cow. The storage will go away. That's a valid use case scenario if you don't have to store things on the hard disk. There is no reason to have it safe when you kill the cow. And by the way, you don't want to store your stuff on the disk. This disk is not the place to store data. You want to store data away from these machines because they are cows and you will shoot them. And so you don't store data in there. You store data elsewhere, like a bucket or external database, external file system like elastic file systems or NFS systems or other data stores or buckets or database servers or other places, but definitely not here. You don't store data here. Don't, please don't. It will make your life a whole lot simple and it will let you behave like a cowboy. If you don't have data there, if you don't have it, makes life easy. Just pull your gun and shoot the cow and move on. It's a whole lot easier. Having said, it is really up to you which of the two choices you select right here. So you can select this, which is this one. That's a good choice. So that's the date for release. So I'll just select that choice right here, right now, and say, I would like to get a hardware virtual machine, elastic block storage, SSD bagged. And that is my choice. So I get narrowed down to one number with a release date of 2019, February 4. And then here is the AMI ID, grab it and bring it here and dump it right on top of this thing paste. So now the AMI ID numbers are slightly older or bigger, like longer. The newer numbering scheme has a longer numbers. So just be aware of the fact that this is, well, you don't need to know. The older people like me, they have these smaller numbers, but yeah, that's the new style, bigger numbers. All the new accounts are getting these new numbers. Having said, now we know what to do. Now we know what to ask Chef to do for us. So we will now carefully review this line, by the way, it's a one line command. This one line command has trailing slashes. These trailing slashes have nothing after them. And that's why they are called trailing. They are at the end of the line. And that makes it a one line command. All of this needs to go in one shot and paste it in your terminal. That's when things will happen. If you have a space after this slash, it will not work. So remember, it is a one line command. Now let's go cross check its components, bundle exec, knife EC2, create a server using this key that I have. It should be an Ubuntu OS. This is the machine image T2 microsize and run my starter role, please. That's what I want. So please do it. Now enough talking and get to business. So grab this, copy it. I will also paste it in Slack chat. So you have it handy there. What just happened? Hold on. Yeah. I think I should use a different editor. That's what happened. So atom and oops, new editor. There we go. Now this should go and this goes here. And that's the command I want to execute. I'll bring my VM in front and make sure that I'm in the right folder, which is the chef repo and then paste it. And when I paste, you should see the entire thing running just like I described. And I'm going to paste it right here. And I will just watch my dashboard for the running instances. I have nothing here. And I will now run this one line command and you will see what it does. I'm going to let it run and watch the fun. So here we go. Let's see what happens. It is doing something. It created an instance ID and a flavor T2 micro, an image that I've selected from the EC2 AMI finder, that image number. It is region US West 2, availability zone US West 2B that was selected automatically. It has taken security group called default, which we have taken care of already. In our security group selection, we have made sure that this default VPC group already allows inbound permissions to port number 22. If you don't give this permission, it will get stuck here and it will not be able to connect through SSHD. Right now the machine is started and it has the public IP address and this machine is getting ready. Once the machine becomes ready, it will pop up here and the one running instance will become running. Now the running instance needs to have SSHD running. As soon as the SSHD is available, it will make a connection. It will then create a new client and a node entry in Chef server. So you should see that here in our nodes. You should see a new node popping up and that node is showing you the entry that Chef server now has about this client and that run succeeded. Now you have a run success that tells you that there's a log entry saying, welcome to Chef Nilesh. That just happened. That means the Chef server not only created a machine here, but also ran our cookbook, which basically said recipe starter default, which is what the action was to begin with. What the action expected is to run the starter role and that role basically is a reference to this starter role. What does it do? Let's go see that. You saw a log entry, which is exactly what you expected. So there is a starter name variable. It's an override attribute and it has a run list inside the starter role. This is a role. The role has a starter run list. The run list has a recipe starter reference, which basically means you run the default recipe in the starter cookbook. So the cookbook starter has a recipe called default, which is this reference here and our run action here references the role starter. So we begin here. Then it looks at this flow and it says starter role, run list, and so, oh, I need to do this. Okay, I will do that. So it will go and do that thing. And then it will start to invoke the default recipe in the starter cookbook. That's the action here. And so you begin here, but then it takes over here. And then there is an override attribute. What this override does, let's go explore. So we'll go look at this step first. So recipe starter means it is running the default recipe in the starter cookbook, which means we need to go and look at the default recipe in the starter cookbook and also have our starter role available. Now you will see that the only thing that we have to do in our default recipe here, which is make a log entry with welcome to chef and then a variable. This variable has a node starter name and the starter name has been overridden with my name. So that is what will pop up here. So this will be replaced by my name. And so let's go see the log. It is exactly what we think it is. So I'm clearing my ink. The log entry was welcome to chef Lilesh L. And the action expected was welcome to chef and then my name. So that's the idea behind invoking chef to go create a machine to run some run list. So it will then run. In our example, we began running it through a role, which then takes or transports its control to the default recipe in this cookbook. And that's why we have the name pop up here. If you take another example and maybe not use the starter role reference, but instead you say recipe starter. If you go like this, instead of using a role reference, you say recipe reference directly. What do you think will happen? If you go like this and not use the role reference, it will still work, but what will be the difference? We are directly invoking this. That means we are not using the role. We are straight up running this. So what do you think it will do? Well, it will not know my name. So it will say welcome to chef. I don't know who you are. And so it will say welcome to chef comma and whatever the default name is. So what's the default attribute, which has been overridden by my name. You can go and read that attribute in here. So let's go read that attribute in this segment and we'll find the default value. That's what will show up. So his attributes default and the default name is Sam Doe, like John Doe, Sam Doe. So it will say welcome to chef Sam Doe. So welcome to chef Sam Doe overridden by my name when we run it like this. But when you don't use the starter role reference, you directly invoke not the role, but the recipe, the default recipe in the starter cookbook. It doesn't know what your name is. So it just says welcome to chef Sam Doe. And that's fine. It's just how it is. That's the difference. Now this was a trivial exercise, but it walks us through the motions of understanding how do we actually use Chef Server. And that's why we did this exercise, just to understand what's going on. And we have our chef setup connected and now we should do some interesting things here. So let's go begin playing with playing with this thing. One of them that I would like to do is actually look at the cheat sheet. So where is the cheat sheet here? And we started a machine, we go look at the next one, the cheat sheet comes up. So the first thing I would like to do is, hello, chef, please tell me what machine do I have running in my cloud. So it goes and tells me that I have this one machine running in my cloud. So let's go see it again. What do I have in my cloud? Well, you have that machine running there. The machine has an instance ID, it has a name, you see, we had named our cows with a number. We did not name this like a name for an animal. I don't know cow names, but just saying, like you name your dog, we have a name for it. You don't number your dog, I-03F1, like that. So that's the difference. If you put a name to a machine, you might fall in love with the machine. I don't want you to fall in love with machines. I want you to treat them like cattle. I'm not kidding. That's how we should treat. So somebody, Bessie, okay. So my challenge is I will use a name for a cow, which is Indian name. So that is not, it will just take the wrong direction. And then once I use an Indian name for a cow, I cannot even talk about shooting the cow because it is religious. And I'm not a religious person, but I'm just saying that, you know, it just takes me in the wrong direction. I did not grow up in this country just so you know. And so that's why I don't come up with these names like Bessie, because yeah, it's Bessie is a good name. I remember that for the next time. So don't name your cows, leave them like a number. The moment you name something, you might accidentally fall in love. Well, don't fall in love with machines, at least cloud machines, you know, treat them like they are cattle. And I have a picture for you somewhere here in the website. I just uploaded, I think two days ago or maybe yesterday. And so that is a picture that I, it's a public domain picture. You should take a little, you'll run into it at some point. Let's see where it is. I think it is maybe here, here maybe, no here, yeah, there it is. So this is your pet and this is your cattle. And that I just wrote these things, just a pet versus cattle treatment to help you really identify and understand that this is a pet. Well, I'm just saying, and this is how you treat cattle. This is a famous painting by the way, by this person. Okay. That's enough for that. Let's go back to where we were, which was come on back, back, back, back, cheat sheet. There it is. Here's the cheat sheet. So we saw the list of machines running in our cloud. Let's go play with a little bit more. We can destroy our server. How do you destroy it? You just take your server and its name, the name or number or the instance ID and copy it and say bundle exec, knife ec2, go to my ec2 cloud, ec2, delete ec2, delete ec2, delete server, delete this one, this one, yeah, go delete that one. And so it will say, okay, I will delete it for you. Are you sure? You sure you want to really kill that machine? And I'll say yes. The moment you kill it, it is dead and it will disappear from here. It is showing you running, but let's refresh. Then it's shutting down. It will die. It will terminate. That's what you want to do when you're done with the machine, is to extinguish them like I just did on the command line. Now what happens when you do it this way is that you have to remember to go back to the Chef server and look at the policy and nodes and you still have that node. The Chef doesn't know, by the way, Chef server website sucks, you need to refresh it. Hold on, where is that, Chef server refresh. And there you see that this machine is still in the list. It checked in 12 minutes ago when we ran it. It was, you know, Chef doesn't know that you killed the machine right here. You killed this server from the Amazon cloud. Chef has no idea. Chef server has no idea. It still thinks that there is a machine like that. So what do you need to do is to ask Chef bundle exec, bundle exec, knife node list. So it will tell you I got a node. But you know what? That node is dead. So what do you do? Bundle exec, knife node delete. This one. So it deletes. Are you sure? I say yeah, corresponding to this knife node delete action, there is one more thing that is left over, which is bundle exec, knife client list. And there is your client. That client needs to be deleted also. So it's a bundle exec, knife client delete. And that one. I say are you sure? And I'll say yes. So it deletes. Now Chef server doesn't have any idea that we ever started such a machine like that. And so you can see that knife client list doesn't show. Knife node list doesn't show. And knife server list shows a dead body. There's a dead body right there. This dead body is terminated here. Terminated. Same body. This dead body will disappear in one hour after death. It will need to stay there. At least that's how Amazon has designed their website or their systems. This 404 shows up in Chef manage because you killed the node. So it doesn't know. So you need to go back and refresh. Now it will not show you the node because there are none. All nodes are dead, killed. Node doesn't exist anymore. In your Amazon console, you have this extinguished dead machine will disappear in about an hour from now. That's how Amazon's policy is to show dead bodies for one hour. So they will disappear. Don't worry about that. Just make sure that you're terminating them. Let's see a couple of other actions with our cheat sheet. A couple of interesting actions here are to delete node, delete client. What is this action? Well, this is an exotic thing. If you need a key in PEM format, sometimes this is... Let me talk about this later. This key formatting is a scenario we have to... So there's a shortcut, you can actually play with this example and see if you like it, if you need it. It may not be relevant directly. In only some esoteric cases, you might need the key in a different format, like PEM format, as opposed to the regular RSA format for our keys that are the default way of using. The Amazon likes to use the PEM format, which is... That's their way of handling. So just a different format. There is a way to convert it. Then you can also connect to a cloud instance and then operate it like just SSH connection that you can do. You can do bulk delete actions. You can also upload a particular cookbook. You already saw that. Upload all the cookbooks you have, we already saw that. You can list cookbooks. You can also delete roles. So you have roles here in our cookbook, in our chef server. I have some roles here, so I'm going to delete all of them. And so it is deleting all the dead roles, old roles that I used to use in the last exercise that I ran. It is deleting all that. You can also bundle exec knife cookbook, come on with the delete action, knife cookbook. Knife cookbook, delete starter, should delete the starter cookbook. I'll say, yeah, I don't want to deal with the starter cookbook. That's great. Next, I want to see if I have roles, bundle exec knife role list, which should be empty by now. The role list is gone. The cookbook list should also be empty. That is empty. Then we have node list empty, role list empty, and all that good stuff. So there are a bunch of other things in the cheat sheet. You can deal with that as you need to. It's not a sequence that you don't have to follow it. And now we will go prepare for the big exercise. So that is the bigger exercise coming up. We'll actually do the exercise next time, but I want to do some preparations. And that preparation step is like this. First thing is if you are doing one exercise for Chef, this is the exercise you want to do. Next thing, it is a intense exercise. Just make a note of this and prepare. What we will be doing, I have already done in this video. So you have the video already available. You can watch it ahead of the next session, which is what, Wednesday is when we do this. So today's Monday, we'll do this exercise on Wednesday. It is a long exercise. I would like to finish it that day. Sometimes we take longer and that's okay. We'll extend the session duration if you need to. Ideally, I like to finish it off in the very same exercise on Wednesday itself. It is fairly long and I would like to actually describe to you the end result of the exercise. The end result is like this. We'll use an open source product called WordPress. And that is what we want to run for a customer, for real. And we like to understand what does it mean when we want to run it for production. So here's a notepad. What we want to do is take this software, which is available in the open source from that website, and make sure that this software, by the way, we will only be running one command line, just one command line, sometimes two, I'll tell you when, one command. And this should do everything that is necessary to go to a cloud, start a bunch of machines we need, grab this software, install it, set it up, everything that is necessary, all the dependencies, install them, make sure that they are configured correctly, use your passwords, your database passwords, use a data bag, encrypted data bag with your own chosen password. You push that to the Chef server, all that configuration for a database, we'll have the dependencies here are LAMP stack, which means Linux, Apache, MySQL database, MySQL database and PHP language, PHP. The four dependencies necessary for these things to run, we'll have to basically handle these things one at a time in a bunch of specific steps to build it together. We'll have to have an encrypted data bag for the data, the MySQL database, root password need to be stored in an encrypted data bag in the Chef server and have it available to this Chef run when it runs on the cloud. And we want to be able to do this exercise in three different clouds. Just to further complicate, we'll choose our clouds. So we'll have the exercise run in Amazon cloud, we'll run it in Digital Ocean cloud, we'll run it in Azure cloud. And those are the current available examples I have in this exercise. You can run it in OpenStack cloud, but again, please run one cloud at a time. Don't try to bundle up all these things and put them in one Chef report, it makes things super complicated for no good reason, no benefit. So don't try to run, if you are, like many of you run it here, that is totally great. Please do run in this cloud, that's your choice. I will be doing in this cloud and this cloud and this cloud depending on how much time we have, but the exercise written down for all these three clouds, it's available. This is not written down here because I have no idea what you have in where you run it and I've never seen it. But most people run it here, which is great idea, do it, I'll help you without actually looking at what you're dealing with, but I'll still be able to figure out and solve your problems if you get stuck. You don't need to show it to me, I don't need to see it. I know your company has strict policy about not sharing, so don't share, please do not share anything with me except just the concept. In fact, I'll share with you what you might have inside. So I'll know OpenStack, you will be able to use OpenStack without me looking at what you are dealing with. If you get stuck, you need to copy and paste the critical error message that you are running into and describe it to me in a very non-specific manner without giving me internal company specifics and I will still be able to answer your questions and you will be able to figure it out. It's not an issue there. By the way, do not tell me anything about company private. Don't disclose. I don't want to hear it. I do not want to hear company confidential information. Please don't talk about it to me or anybody else. Having said, we'll do this, at least I will do these three steps. I have them already in this video, where is that? Here in this video, we already do that in three different clouds. This is like a two-hour, 13-minute video and I am doing this as I talk through the video, so that's why it's taking longer for me. This entire result at the end of the exercise is already stored in this Git repository. You can already see it, the result, the final result is right here. This is what we will build in the exercise, this entire Chef repo. It's already available to you in the open source. You can already examine. Here's how you run it in the Amazon Cloud, in the Digital Ocean Cloud, and in the Microsoft example. It should be there at the end. It's there. There are lots of steps here. All the numbers, 5555, all the way you go through, you will see it. You are welcome to watch this video. You are welcome to go ahead and you will notice a couple of things here, which is this gem file is excruciatingly long, really, really long. You can see it. What does this mean? Let's go see it. Let's go quickly look at this gem file and put that in our existing gem file on top, like right here. So paste it, save it. Now I have 162 gems, 163 lines, and this is just, oh my God, 161 gems and 163 lines. The first line is the Ruby gems reference. The second line is Ruby language, Ruby version reference, and then there are 161 gems. Now when you run it, you will see that it already gives you an error. It is the bundler version error. So what does that mean? We have to match the bund gem list by grab bundler. Let's see what the version number is. Type bundler properly, bundler. The version number is 115.4. That version number has to be matching here, bundler version 116.1, I need to match it. That should be the matching number. When I save it and then close the gem file, we'll try to build the bundle. This takes a long time, like really long. I'm not kidding. It already tells me something has broken. What does that broken mean? I need to remove my gem file lock and then bundle again. That was a different gem file with a different lock. So I need to remove the lock and bundle again. It will show you a new error, if at all, and it will try to build all these 161 gems. I told you it will take a long time, but it apparently finished so quickly. Why is that? It is because I have already done this action and I've captured it in the image that I gave you, the virtual machine image has it already, and that is to save you time. It takes like maybe 15, 20 minutes just to bundle the whole thing. It is a very, very long, unnecessarily long gem file. It is long for a reason though, it is long for a reason that I have one, two, and three clouds in one Chef repo. So I am managing cross dependencies, very, very delicate balance in that gem file. There is no reason, practical reason to do it this way, except in my unique case where I have to demonstrate to all of you that it can be done in multiple clouds without having to change my repository. That's the only reason, the only reason why you need to have such a long gem file. There is no other reason I can think of. Most practical uses, you will have one cloud to deal with and that gem file will be like four lines, five, maybe seven, who knows, but it's manageable, not 161. It is excruciatingly long because I have basically narrowed down the exact balancing combination of all the versions of gems that are necessary for these three clouds to work together. If you ask me to add another cloud, it will throw the balance off and we'll run into errors, which is not what we want. So we have carefully crafted this particular gem file for this exercise to just allow you to understand that you can do it and at the same time allows me to manage multiple clouds without changing my repository too much. That's the reason why it is so long. This is already bundled up so you don't have to worry about it. So all I need to do now is to just change the gem file in the website to match this bundler gem and we are done. So that's the step we'll be doing when we meet on Wednesday. We'll begin from this introduction step and you are welcome to watch ahead. This video walkthrough will walk you through. I will not be playing this video, but you have the video and you will have a real live video recording also available to you at the end of the session. And that's the plan for Wednesday. I will like to again cross check the thing that I discussed briefly is about 23rd. We are planning for a get together at that location at that time, which is a Saturday. Is that okay with you guys? Can you meet on Saturday in this location at 1130 for lunch? It is said dinner, but actually it should be lunch now. So lunch get together at Haiku Sushi in Redmond. Is that a place that is possible if you are in our area? And is this timing possible if you are available on that Saturday, which is at 23rd of February? So if that is the case, please tell me you can or please tell me you cannot both ways. I need to hear yes or no. And if you're away from our region, I need to know. I don't know. I need to actually write that down. I know a few of you are away, but I don't know who is exactly away. So please tell me in Slack chat that you are from that location. So at least I will know how many to expect. And with that, I will now stop recording. And I am local, yes Travis, I know that. I think I am away, not in that region. Oh, James is away. So Paul is away. James is away. Who else is away? Paul and James. Well, you guys, when you come from the away location, I don't know if it's St. Louis or it's Charleston or I have a bad memory. So sorry about that. I know Paul is Charleston. He just wrote that. So James is what location? St. Louis? Florida? Oh, wow. Florida. Oh my God. Well, enjoy your sun. Apparently, is it sunny there? We have lots of snow going on here in our region. Can we have lunch in Florida? Yes we can. And I will come there to see you, sir. I will. I will absolutely come. You just invite me. I will show up. So please do. And if you come down here, let us get together and grab a bite or something or have coffee depending on whatever your time availability is and please ping me. And I will now stop recording. And I'm still here for questions.