knife to bootstrap my VM with vanilla Debian 7.0 installation. In bootstrap stage I'm just setting
sources.list, updating & upgrading system, then I install
rubygems). As a last step, my bootstrap template install
chef as a gem.
Bang! my node is in this point bootstrapped and ready to run recipes. But on that machine is still only root able to run
chef-solo. And this a point I'm getting confused:
- should I use root to run my recipes on target node?
- or should I bootstrap separate system user with elevated permisions by
- or should I cook that separate unix user using some recipe?
The thing is, when I run
cook email@example.com I want to cook (provision) that machine as non-root user (for example user named
chef). You know, some of my recipes will setup
sshd not to accept connections to root (as one of the security measures).
But if some other recipe will setup unix user named
chef and some another
sudo for that user, then until that point I must cook as root. And then, if I want to cook as a
chef, I must run
knife solo cook ... again, with separate list of recipes.
And to me this is complete antipattern. Node should be provisioned in one step. So my question is, should I leave the idea of provisioning as other user as root and use root to run all my chef recipes?