knife-linode: need access to assigned private IP address (etc)

I'm resolving this ticket as fixed because it contains a patch. In the future, please remember to resolve tickets as fixed when you provide a solution. This way we can find tickets with resolutions and add them to the project.

http://wiki.opscode.com/display/chef/How+to+Contribute

We're wondering if this would be better as an Ohai plugin than as node attributes. Steven Danna is going to poke a little in the next day or so. The new ohai hints system may be useful as well.

Fair enough - I wasn't sure of the Right Way; if there's a better way, I'm happy to help with whatever it is. Thanks again!

One thing, though: I'm not sure Ohai has access to this information (specifically, the private IP address that started me working on this). On a brand-new Linode, the interface hasn't been set up yet, so it's not like Ohai can query it. (The only other piece of new information I'm actually using now is the datacenter ID; I suppose that could be guessed from parsing traceroute's output or something, but that seems less sturdy)

Unfortunately, from what I can see it is difficult to get much information about a brand new Linode without making an API which requires your API key. As Bryan mentioned, Ohai's new hint system is the next best alternative. First, we will need to add the ability to specify hints into the linode plugin with something like this:

option :hint,
  :long => "--hint HINT_NAME[=HINT_FILE]",
  :description => "Specify Ohai Hint to be set on the bootstrap target.  Use multiple --hint options to specify multiple hints.",
  :proc => Proc.new { |h|
    Chef::Config[:knife][:hints] ||= Hash.new
    name, path = h.split("=")
    Chef::Config[:knife][:hints][name] = path ? JSON.parse(::File.read(path)) : Hash.new  }

Then we have to add the desired information to the hints hash:

Chef::Config[:knife][:hints]['linode'] => { 
  'server_id' => server.id.to_s,
  'datacenter_id' => locate_config_value(:linode_datacenter),
  'flavor_id' => locate_config_value(:linode_flavor),
  'image_id' => locate_config_value(:linode_image),
  'kernel_id' => locate_config_value(:linode_kernel),
  'ip_addresses' => server.ips.map(&:ip)}

The newest version of knife-bootstrap will then take care of getting this on disk for us. In the ohai plugin, `hint?("linode")` should return that hash to us, which we can then use populate other Ohai attributes. I hope this helps.

I'd thought of doing that, but it seemed like a (minor) security weakness to give the API key to our production machines: having the key would allow an intruder to destroy our other machines.

I guess I could create a new Linode user identity, give it lower privileges, and hand that user's key to Ohai ... is that what's recommended?

Reopening ticket as there's more discussion to be had here. Steven plans to follow up.

Hi Bryan,

The solution I outlined above shouldn't require API keys at all as it is simply using Ohai's hint system. Essentially, just like with the first boot solution you original submitted we are constructing the value from the machine using knife and then injecting them into the node data. The difference is that the recommended solution is to use Ohai's new hint system rather than normal node attributes.

Thanks, Steven – sorry, I misunderstood and thought your 3/Aug comment referred to stuff that would run on the Ohai side, not a new more-general knife pass-hints-to-ohai mechanism (which I hadn't heard about and looks cool; the comments on http://tickets.opscode.com/browse/OHAI-267 were fascinating).

I'll switch to the --hints mechanism when I get back on this next week, and if no one's updated knife-linode for it by then I'll open a new pull request. (Looks like knife-rackspace hasn't, but knife-ec2 has?)