Skip to content

Commit

Permalink
More edits
Browse files Browse the repository at this point in the history
Signed-off-by: Ian Maddaus <[email protected]>
  • Loading branch information
IanMadd committed Jun 7, 2024
1 parent 079abab commit e64ca37
Show file tree
Hide file tree
Showing 5 changed files with 105 additions and 106 deletions.
161 changes: 80 additions & 81 deletions content/saas/get_started.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,108 +13,101 @@ This guide explains how to set up and configure Chef SaaS. For details on how to

## Prerequisites

There are some prerequisites to be aware of before you start working with Chef SaaS:
Chef SaaS has the following prerequisites:

* You must have a system with [Chef Workstation installed](/workstation/install_workstation/).
- You must have a system with [Chef Workstation installed](/workstation/install_workstation/).

* Chef SaaS Starter Kit (provided by Progress Chef):
* SaaS Environment URL
* SaaS Credentials
* Pivotal PEM file for the initial setup of the environment (the PEM is temporary, so replace it later)
- Chef SaaS Starter Kit (provided by Progress Chef):
- SaaS Environment URL
- SaaS Credentials
- Pivotal PEM file for the initial setup of the environment. This PEM file is temporary and is replaced later.

## Add Chef Infra Server in Chef SaaS

Follow these steps in the Chef SaaS Automate Web User Interface to add the Chef Infra Server to the environment:
Follow these steps in Chef SaaS to add a Chef Infra Server:

1. Click **Infrastructure** in the top navigation.
1. Click **Chef Infra Servers** in the navigation on the left.
1. Click **Add Chef Infra Server**.
1. Select **Infrastructure** in the top navigation.
1. Select **Chef Infra Servers** in the navigation on the left.
1. Select **Add Chef Infra Server**.
1. Fill out the fields as follows:
* Provide a unique name for the Chef Infra Server.
* Enter the **FQDN** by copying the same URL used to connect to Chef SaaS, for example: **saas-example.com**.
- Provide a unique name for the Chef Infra Server.
- Enter the FQDN by copying the same URL used to connect to Chef SaaS, for example: `saas.example.com`.

{{< figure src="/images/saas/add-chef-server-popup-menu.png" width="500" alt="Enter Chef Infra Server name and FQDN in the Add Chef Infra Server dialog.">}}

1. Click **Add Chef Infra Server**.
1. Select **Add Chef Infra Server**.

## Configure Chef Workstation

For details on configuring Chef Workstation, refer to the following sections.

### Create the Chef credentials file
1. Create a Chef credentials file on your local workstation:

Create a credentials file to continue configuring Workstation with Chef SaaS. You can update the credentials later in the setup.

1. On the workstation, run: `knife configure init`.
1. This prompts you with several questions:
* Enter the Chef Infra Server URL provided in the Starter Kit, for example: `company-example.com.chef.io`.
* For the existing API **username** or **client_name**, enter the Super User account provided in the Starter Kit.
1. Copy the `pivotal.pem` file in the Starter Kit to the `~/.chef` directory before running additional commands with Knife.
```sh
knife configure init
```

The credentials file that gets created in the `~/.chef` directory looks like the following code snippet:
This prompts you with several questions:

```ruby
[default]
client_name - 'pivotal'
client_key = '/home/admin/.chef/pivotal.pem'
chef_server_url - 'https://saas-example.com' //Sample URL
```
- Enter the Chef Infra Server URL provided in the Starter Kit, for example: `saas.example.com`.
- For the existing API **username** or **client_name**, enter the superuser account provided in the Chef SaaS Starter Kit.

### Create the organization in the Command Line Interface (CLI)
This creates a credentials file in the `~/.chef` directory with contents similar to the following:

An organization must be added to Chef Infra Server. This organization acts as a top-level entity for role-based access control. Use the [knife org create](/workstation/knife_org/) command to create your organization. For example, create an organization:
```ruby
[default]
client_name - 'pivotal'
client_key = '/home/admin/.chef/pivotal.pem'
chef_server_url - 'https://saas.example.com'
```

```sh
Knife org create <ORGANIZATION_NAME> <ORGANIZATION_FULL_NAME>
```
1. Copy the `pivotal.pem` file from the Chef SaaS Starter Kit to the `~/.chef` directory.

In the above snippet, replace:
This gives you the proper credentials to connect to Chef SaaS in the following steps.

* `<ORGANIZATION_NAME>` with the user's organization name.
* `<ORGANIZATION_FULL_NAME>` with the organization's full name.
1. Create an organization using the [`knife org create`](/workstation/knife_org/) command. This organization acts as a top-level entity for role-based access control.

The above code returns the private key for the organization's validator client.
```sh
knife org create <ORGANIZATION_NAME> <ORGANIZATION_FULL_NAME>
```

### Create a user in the CLI
Replace:

Create a new user associated with the new organization and use the credentials file. Create your new account using the [knife user create](/workstation/knife_user/) command. For example, to create a user:
- `<ORGANIZATION_NAME>` with the user's organization name.
- `<ORGANIZATION_FULL_NAME>` with the organization's full name.

```sh
knife user create <USERNAME> <DISPLAY_NAME> <FIRST_NAME> <LAST_NAME> <EMAIL_Address> <PASSWORD> <FILE_NAME>.pem
```
This returns a private key for the organization's validator client.
In the above snippet, replace:
1. Create a new user associated with the new organization and use the credentials file:
* `<USERNAME>` with the user's username.
* `<FIRST_NAME>` with the user's first name.
* `<LAST_NAME>` with the user's last name.
* `<EMAIL_ADDRESS>` with the user's e-mail address.
* `<PASSWORD>` with the user's password.
* `<FILE_NAME>` with the name of the file.
```sh
knife user create <USERNAME> --email <EMAIL> --password <PASSWORD>
```
Copy the new `<FILE_NAME>.pem` file created with this command to the `~/.chef` directory before updating the credentials file later in this document.
Replace:
### Add the new user to the organization in the CLI
- `<USERNAME>` with the user's username.
- `<EMAIL>` with the user's e-mail address.
- `<PASSWORD>` with the user's password.

Associate the created organization and user with each other. Use the [knife org user](/workstation/knife_org/) command to add the user to an organization. For example, to add the user to the organization:
Copy the new `<FILE_NAME>.pem` file created with this command to the `~/.chef` directory before updating the credentials file later in this document.

```sh
knife org user add <ORGANIZATION_NAME> <USERNAME>
```
1. Add the new user to the organization using the [`knife org user`](/workstation/knife_org/) command:

In the above code, replace:
```sh
knife org user add <ORGANIZATION_NAME> <USERNAME>
```

* \<ORGANIZATION_NAME\> with user's organization name.
* \<USERNAME\> with the user's username.
In the above code, replace:

### Update the credentials file to use a new account
- `<ORGANIZATION_NAME>` with user's organization name.
- `<USERNAME>` with the user's username.

Update the credentials file under the `~/.chef` directory on the Workstation to reflect the new **Organization**, **User**, and **PEM** file.
1. Open the credentials file in the `~/.chef` directory and update the following values:

1. Open the credentials file in the `~/.chef` directory. Modify the following values:
* `client_name` to the new account created.
* `client_key` to the new **PEM** file that was created.
* `chef_server_url` to include the new **Organization**.
- `client_name` to the new account created.
- `client_key` to the new **PEM** file that was created.
- `chef_server_url` to include the new **Organization**.

An example of the credentials in the `~/.chef` directory is as follows:

Expand All @@ -125,31 +118,37 @@ Update the credentials file under the `~/.chef` directory on the Workstation to
chef_server_url - 'https://saas-example.com'
```

### Create an organization in the Web User Interface
## Configure Chef Saas

The following steps add the organization to the Chef SaaS Web User Interface, allowing visualization of Cookbooks, Data Bags, Nodes, Policyfiles, and so on. Connect to the URL provided by Progress Chef and log in with the admin account credentials:
The following steps add the organization to Chef SaaS. Connect to the URL provided by Progress Chef and log in with the admin account credentials:

1. Click **Infrastructure** in the top navigation.
1. Click **Chef Infra Servers** in the navigation on the left.
1. Select the **Infra Server** created previously.
1. Click **Add Chef Organization** and:
* Provide the **Name** of the organization created earlier in the CLI, for example: `<ORGANIZATION_NAME>`.
* For **Admin User**, enter the new account created previously, for example: `<USER_NAME>`.
* For **Admin Key**, paste the contents of the new PEM file created previously along with the account, for example: `<USER_NAME>.pem`.
* Click **Add Chef Organization**.
1. Select **Infrastructure** in the top navigation.
1. Select **Chef Infra Servers** in the navigation on the left.
1. Select the **Chef Infra Server** created previously.
1. Select **Add Chef Organization** and:
- Provide the **Name** of the organization created using knife.
- For **Admin User**, enter the new account created using knife.
- For **Admin Key**, paste the contents of the new PEM file created with the user account.
- Select **Add Chef Organization**.

{{< figure src="/images/automate/add-chef-organization-popup-menu.png" width="500" alt="Add Chef Organization Form">}}
{{< figure src="/images/automate/add-chef-organization-popup-menu.png" width="350" alt="Add Chef Organization Form">}}

### Verify the SSL configuration

Chef SaaS uses public certificates to ensure a secure connection to the service. To eliminate connection issues, it is always best to run an SSL check on the Workstation to verify that the certificate is trusted.
Chef SaaS uses public certificates to ensure a secure connection to the service. To eliminate connection issues, verify the SSL connection and the certificate.

To verify the connection with the new organization, run the following command:
- Verify the connection with the new organization:

```cd
knife ssl checks
```
```cd
knife ssl check
```

### Verify the client connection

Lastly, run a client list command to verify a successful connection to the new organization: `knife client list`. This command returns a list of registered clients.
- Finally, verify a successful connection to the new organization:

```sh
knife client list
```

This returns a list of Infra Client nodes and workstations that are registered with a Chef Infra Server.
30 changes: 15 additions & 15 deletions content/saas/opsworks_migration.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,26 +13,26 @@ This guide describes the migration scenarios from AWS OpsWorks to Chef SaaS.

## Prerequisites

There are some prerequisites that must be in place before migrating from AWS OpsWorks to Chef SaaS:
The following prerequisites must be in place before migrating from AWS OpsWorks to Chef SaaS:

* AWS OpsWorks must be running Chef Automate 2.0.
* A Chef SaaS environment must be configured. Refer to the [Getting Started with Chef SaaS](/saas/get_started/) page.
* An S3 bucket must be provided from Progress Chef.
- AWS OpsWorks must be running Chef Automate 2.0.
- A Chef SaaS environment must be configured. Refer to the [Getting Started with Chef SaaS](/saas/get_started/) page.
- An S3 bucket must be provided from Progress Chef.

## Backup AWS OpsWorks

AWS OpsWorks for Chef Automate can have two configuration setups;
AWS OpsWorks for Chef Automate can have two configuration setups:

* Cluster with SSH access
* Cluster without SSH access
- cluster with SSH access
- cluster without SSH access

Both types of clusters have SSM access. You should be able to log in to the AWS OpsWorks Chef Automate instance and follow the steps to create a backup. By default, AWS OpsWorks has the manual backup feature, which creates a backup in S3. You can use the S3 backup if you cannot log in to an instance using SSH/SSM.
Both types of clusters have SSM access. You should be able to log in to the AWS OpsWorks Chef Automate instance and follow the steps to create a backup. By default, AWS OpsWorks has the manual backup feature, which creates a backup in S3. You can use the S3 backup if you can't log in to an instance using SSH/SSM.

### Back up AWS OpsWorks using SSH/SSM

If you have SSH/SSM access, follow these steps to create a backup:

1. Log in to to the AWS OpsWorks EC2 instance using SSH/SSM from the EC2 console.
1. Log in to the AWS OpsWorks EC2 instance using SSH/SSM from the EC2 console.
1. Create a `patch.toml` as shown in the following code snippet:

```sh
Expand All @@ -49,7 +49,7 @@ If you have SSH/SSM access, follow these steps to create a backup:
chef-automate config patch patch.toml
```

Check the chef-automate status and wait for all services to turn healthy.
Check the Chef Automate status and wait for all services to turn healthy.

1. Back up your Chef Automate data:

Expand All @@ -73,14 +73,14 @@ If you have SSH/SSM access, follow these steps to create a backup:

You can share the backup using pre-signed URLs. The SOP provides steps for sharing the backup with the Chef team.

### Back up AWS OpsWorks using the AWS User Interface (UI)
### Back up AWS OpsWorks using the AWS Management Console

If you do not have SSH/SSM access, follow these steps to create a backup:
If you don't have SSH/SSM access, follow these steps to create a backup:
1. Go to the **AWS OpsWorks** console.
1. Choose the server to back up on the **Chef Automate servers** page.
1. On the properties page for the Chef Infra Server, in the left navigation pane, select **Backups**.
1. Click **Create backup**.
1. Select **Create backup**.
1. The manual backup is finished when the page shows a green checkmark in the backup's **Status** column.

{{< figure src="/images/saas-status-column.png" alt="Status Column">}}
Expand All @@ -91,8 +91,8 @@ If you do not have SSH/SSM access, follow these steps to create a backup:

1. Zip the latest `timestamp-based` directory and `automate-elasticsearch-data` directory and share it with the Chef team.

Progress Chef Engineers handle the restoration process. Your Account Manager will notify you when the restoration is complete.
Progress Chef engineers handle the restoration process. Your account manager will notify you when the restoration is complete.

## Verify the restore

When the restore is complete, log into Chef SaaS. When you are logged in, you will see data in the environment up to the day of the backup. This includes users, cookbooks, client runs, and so on.
When the restore is complete, log into Chef SaaS. You will see data in the environment up to the day of the backup including users, cookbooks, Infra Client runs.
12 changes: 6 additions & 6 deletions content/saas/register_nodes.md
Original file line number Diff line number Diff line change
@@ -1,29 +1,29 @@
+++
title = "Register Existing Nodes to Chef SaaS Environment"
title = "Redirect existing nodes to Chef SaaS"
draft = false
[menu]
[menu.saas]
title = "Register Nodes"
title = "Redirect nodes"
identifier = "chef_infra/Register Nodes to Chef SaaS Environment"
parent = "chef_saas"
weight = 50
+++

When everything has been set up and restored to the new Chef environment, you must redirect the nodes under management from AWS OpsWorks to Chef SaaS. This guide provides recommendations on how to accomplish this.
After you've migrated to Chef SaaS, you must redirect Chef Infra Client nodes from AWS OpsWorks to Chef SaaS. This guide provides recommendations on how to accomplish this.

## Prerequisites

There are some prerequisites to be aware of before you start working on the Chef environment of Chef SaaS:
The following are prerequisites for migrating nodes from AWS OpsWorks to Chef SaaS:

- AWS OpsWorks must be running Chef Automate 2.0.
- A Chef SaaS environment must be configured. Refer to the [Getting Started with Chef SaaS](/saas/get_started/) page.
- Restoration is performed on AWS OpsWorks for Chef SaaS.
- Splay mode and baseline are up to two client runs an hour. Refer to the [Chef Infra Client](/ctl_chef_client/) page for more details on configuring splay mode in the `client.rb` file.
- There must be one compliance scan per hour.

## Redirect the nodes to Chef SaaS
## Redirect nodes to Chef SaaS

Progress Chef developed a Cookbook that can run against all nodes under management in the AWS OpsWorks environment. This Cookbook redirects all nodes to the new Chef SaaS instance.
Progress Chef developed a cookbook that can run against all nodes under management in the AWS OpsWorks environment. This cookbook redirects all nodes to the new Chef SaaS instance.

To redirect nodes from AWS OpsWorks to Chef SaaS:

Expand Down
6 changes: 3 additions & 3 deletions content/saas/sso.md
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ Use the following instructions to add a SAML configuration in Chef SaaS.
- `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`
- `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`

1. After entering these fields, click **Submit** to add the user SSO configuration. After Chef SaaS validates all form values, the **Submit** button is enabled.
1. After entering these fields, select **Submit** to add the user SSO configuration. After Chef SaaS validates all form values, the **Submit** button is enabled.

The SSO page refreshes, showing the filled-in SAML configuration fields with a message at the top that says, "SSO Request is complete. Config applied successfully."

Expand All @@ -89,8 +89,8 @@ As a user with the Administrator policy, you have the power to manage your SSO c

1. Log in to your Chef SaaS account and append `/sso` to your FQDN in your browser toolbar. For example, `https://automate.example.com/sso`.

1. Click **Remove Configuration** on the Chef SaaS SSO page.
1. Select **Remove Configuration** on the Chef SaaS SSO page.

1. A dialog box asks you to confirm that you want to remove the configuration. Click **Remove** to remove the SSO configuration.
1. A dialog box asks you to confirm that you want to remove the configuration. Select **Remove** to remove the SSO configuration.

The SSO page refreshes, showing empty SAML configuration fields and a message at the top that says, "SSO Request is complete. Config removed successfully."
2 changes: 1 addition & 1 deletion cspell.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -55,4 +55,4 @@ ignoreRegExpList:
- "/'s\\b/"
- "/'d\\b/"
- "/^\\s*```[\\s\\S]*?^\\s*```/gm"
- "{{(.+)(?=}})"
- "{{(.+)(?=}})"

0 comments on commit e64ca37

Please sign in to comment.