Chef Validatorless Bootstrap Process Explanation With Source

# use ellipsis to skip line out of scope for simplicity
def run

    # ......

    # Step 1
    client_builder.run

    # .....

    # Step 2
    bootstrap_context.client_pem = client_builder.client_path
    # ......

  begin
    # Step 3
    knife_ssh.run
  rescue Net::SSH::AuthenticationFailed
    # ......
  end
end

@client_builder = Chef::Knife::Bootstrap::ClientBuilder.new(
          chef_config: Chef::Config,
          knife_config: config,
          ui: ui
        )

def run
  sanity_check

  ui.info("Creating new client for #{node_name}")

  @client = create_client!

  ui.info("Creating new node for #{node_name}")

  create_node!
end

# Create the client object and save it to the Chef API
def create_client!
  Chef::ApiClient::Registration.new(node_name, client_path, http_api: rest).run
end

# ==Chef::ApiClient::Registration
# Manages the process of creating or updating a Chef::ApiClient on the
# server and writing the resulting private key to disk. Registration uses
# the validator credentials for its API calls. This allows it to bootstrap
# a new client/node identity by borrowing the validator client identity
# when creating a new client.

def run
  # to make sure the resulting private key destination path is writable
  # the path is temp dir, something like, @tmpdir = Dir.mktmpdir
  # File.join(@tmpdir, "#{node_name}.pem")
  # One example is "/var/folders/2t/3qdzts6n75z981qp15dvzqc40000gn/T/d20181209-1663-7yn4es/one_node.pem"
  assert_destination_writable!
	# ....
  begin
    client = api_client(create_or_update)
  rescue Net::HTTPFatalError => e
		# .....
  end
  # writing down the private key to destination path as above
  write_key
  # return client object
  client
end

def create_or_update
  create
rescue Net::HTTPServerException => e
  # If create fails because the client exists, attempt to update. This
  # requires admin privileges.
  raise unless e.response.code == "409"
  update
end

def post_data
  post_data = { name: name, admin: false }
  post_data[:public_key] = generated_public_key if self_generate_keys?
  post_data
end
def generated_private_key
  @generated_key ||= OpenSSL::PKey::RSA.generate(2048)
end

def generated_public_key
  generated_private_key.public_key.to_pem
end

def private_key
  if self_generate_keys?
    generated_private_key.to_pem
  else
    @server_generated_private_key
  end
end
def write_key
  ::File.open(destination, file_flags, 0600) do |f|
    f.print(private_key)
  end
rescue IOError => e
  raise Chef::Exceptions::CannotWritePrivateKey, "Error writing private key to #{destination}: #{e}"
end

def api_client(response)
  return response if response.is_a?(Chef::ApiClient)

  client = Chef::ApiClient.new
  client.name(name)
  client.public_key(api_client_key(response, "public_key"))
  client.private_key(api_client_key(response, "private_key"))
  client
end

# Create the node object (via the lazy accessor) and save it to the Chef API
def create_node!
  node.save
end

# Create a new Chef::Node.  Supports creating the node with its name, run_list, attributes
# and environment.  This injects a rest object into the Chef::Node which uses the client key
# for authentication so that the client creates the node and therefore we get the acls setup
# correctly.
#
# @return [Chef::Node] new chef node to create
def node
  @node ||=
    begin
      node = Chef::Node.new(chef_server_rest: client_rest)
      node.name(node_name)
      node.run_list(normalized_run_list)
      node.normal_attrs = first_boot_attributes if first_boot_attributes
      node.environment(environment) if environment
      node.policy_name = policy_name if policy_name
      node.policy_group = policy_group if policy_group
      (knife_config[:tags] || []).each do |tag|
        node.tags << tag
      end
      node
    end
end

# @return [Chef::ServerAPI] REST client using the client credentials
def client_rest
  @client_rest ||= Chef::ServerAPI.new(chef_server_url, client_name: node_name, signing_key_filename: client_path)
end

def render_template
  @config[:first_boot_attributes] = first_boot_attributes
  template_file = find_template
  template = IO.read(template_file).chomp
  Erubis::Eruby.new(template).evaluate(bootstrap_context)
end

# setup a Chef::Knife::Ssh object using the passed config options
#
# @return Chef::Knife::Ssh
def knife_ssh
  ssh = Chef::Knife::Ssh.new
  ssh.ui = ui
  ssh.name_args = [ server_name, ssh_command ]
  ssh.config[:ssh_user] = user_name || config[:ssh_user]
  ssh.config[:ssh_password] = config[:ssh_password]
  # ....
  ssh.config[:ssh_identity_file] = config[:ssh_identity_file] || config[:identity_file]
	# ...
  ssh
end