The knife client
subcommand is used to manage an API client list and their associated RSA public key-pairs. This allows authentication requests to be made to the Chef server by any entity that uses the Chef server API, such as the chef-client and knife.
Note
Review the list of common options available to this (and all) knife subcommands and plugins.
Use the bulk delete
argument to delete any API client that matches a pattern defined by a regular expression. The regular expression must be within quotes and not be surrounded by forward slashes (/
).
This argument has the following syntax:
$ knife client bulk delete REGEX
This argument has the following options:
-D
, --delete-validators
None.
Use the create
argument to create a new API client. This process will generate an RSA key pair for the named API client. The public key will be stored on the Chef server and the private key will be displayed on STDOUT
or written to a named file.
/etc/chef/client.pem
.~/.chef/client_name.pem
and referenced in the knife.rb configuration file.This argument has the following syntax:
$ knife client create CLIENT_NAME (options)
This argument has the following options:
-a
, --admin
-f FILE
, --file FILE
-k
, --prevent-keygen
Create a user without a public key. This key may be managed later by using the knife user key
subcommands.
Note
This option is valid only with Chef server API, version 1.0, which was released with Chef server 12.1. If this option or the --user-key
option are not passed in the command, the Chef server will create a user with a public key named default
and will return the private key. For the Chef server versions earlier than 12.1, this option will not work; a public key is always generated unless --user-key
is passed in the command.
-p FILE
, --public-key FILE
--prevent-keygen
. When using Open Source Chef a default key is generated if this option is not passed in the command. For Chef server version 12.x, see the --prevent-keygen
option.--validator
true
.Note
See knife.rb for more information about how to add certain knife options as settings in the knife.rb file.
The following examples show how to use this knife subcommand:
Create an admin client
To create a chef-client that can access the Chef server API as an administrator—sometimes referred to as an “API chef-client”—with the name “exampleorg” and save its private key to a file, enter:
$ knife client create exampleorg -a -f "/etc/chef/client.pem"
Create an admin client for Enterprise Chef
When running the create
argument, be sure to omit the -a
option:
$ knife client create exampleorg -f "/etc/chef/client.pem"
Use the delete
argument to delete a registered API client.
This argument has the following syntax:
$ knife client delete CLIENT_NAME
This argument has the following options:
-D
, --delete-validators
The following examples show how to use this knife subcommand:
Delete a client
To delete a client with the name “client_foo”, enter:
$ knife client delete client_foo
Type Y
to confirm a deletion.
Use the edit
argument to edit the details of a registered API client. When this argument is run, knife will open $EDITOR to enable editing of the admin
attribute. (None of the other attributes should be changed using this argument.) When finished, knife will update the Chef server with those changes.
This argument has the following syntax:
$ knife client edit CLIENT_NAME
This command does not have any specific options.
The following examples show how to use this knife subcommand:
Edit a client
To edit a client with the name “exampleorg”, enter:
$ knife client edit exampleorg
Use the key create
argument to create a public key.
This argument has the following syntax:
$ knife client key create CLIENT_NAME (options)
This argument has the following options:
-e DATE
, --expiration-date DATE
YYYY-MM-DDTHH:MM:SSZ
. If this option is not specified, the public key will not have an expiration date. For example: 2013-12-24T21:00:00Z
.-f FILE
, --file FILE
--public-key
option is not specified the Chef server will generate a private key.-k NAME
, --key-name NAME
-p FILE_NAME
, --public-key FILE_NAME
--key-name
is specified, the Chef server will generate a public/private key pair.None.
Use the key delete
argument to delete a public key.
This argument has the following syntax:
$ knife client key delete CLIENT_NAME KEY_NAME
None.
Use the key edit
argument to modify or rename a public key.
This argument has the following syntax:
$ knife client key edit CLIENT_NAME KEY_NAME (options)
This argument has the following options:
-c
, --create-key
--public-key
instead.-e DATE
, --expiration-date DATE
YYYY-MM-DDTHH:MM:SSZ
. If this option is not specified, the public key will not have an expiration date. For example: 2013-12-24T21:00:00Z
.-f FILE
, --file FILE
--public-key
option is not specified the Chef server will generate a private key.-k NAME
, --key-name NAME
-p FILE_NAME
, --public-key FILE_NAME
--key-name
is specified, the Chef server will generate a public/private key pair.None.
Use the key list
argument to view a list of public keys for the named client.
This argument has the following syntax:
$ knife client key list CLIENT_NAME (options)
This argument has the following options:
-e
, --only-expired
-n
, --only-non-expired
-w
, --with-details
None.
Use the key show
argument to view details for a specific public key.
This argument has the following syntax:
$ knife client key show CLIENT_NAME KEY_NAME
None.
Use the list
argument to view a list of registered API client.
This argument has the following syntax:
$ knife client list (options)
This argument has the following options:
-w
, --with-uri
The following examples show how to use this knife subcommand:
View a list of clients
To verify the API client list for the Chef server, enter:
$ knife client list
to return something similar to:
exampleorg i-12345678 rs-123456
To verify that an API client can authenticate to the Chef server correctly, try getting a list of clients using -u
and -k
options to specify its name and private key:
$ knife client list -u ORGNAME -k .chef/ORGNAME.pem
Use the reregister
argument to regenerate an RSA key pair for an API client. The public key will be stored on the Chef server and the private key will be displayed on STDOUT
or written to a named file.
Note
Running this argument will invalidate the previous RSA key pair, making it unusable during authentication to the Chef server.
This argument has the following syntax:
$ knife client reregister CLIENT_NAME (options)
This argument has the following options:
-f FILE_NAME
, --file FILE_NAME
Note
See knife.rb for more information about how to add certain knife options as settings in the knife.rb file.
The following examples show how to use this knife subcommand:
Re-register a client
To re-register the RSA key pair for a client named “testclient” and save it to a file named “rsa_key”, enter:
$ knife client reregister testclient -f rsa_key
Use the show
argument to show the details of an API client.
This argument has the following syntax:
$ knife client show CLIENT_NAME (options)
This argument has the following options:
-a ATTR
, --attribute ATTR
The following examples show how to use this knife subcommand:
Show clients
To view a client named “testclient”, enter:
$ knife client show testclient
to return something like:
admin: false chef_type: client json_class: Chef::ApiClient name: testclient public_key:
To view information in JSON format, use the -F
common option as part of the command like this:
$ knife client show devops -F json
Other formats available include text
, yaml
, and pp
.
© Chef Software, Inc.
Licensed under the Creative Commons Attribution 3.0 Unported License.
The Chef™ Mark and Chef Logo are either registered trademarks/service marks or trademarks/servicemarks of Chef, in the United States and other countries and are used with Chef Inc's permission.
We are not affiliated with, endorsed or sponsored by Chef Inc.
https://docs-archive.chef.io/release/12-13/knife_client.html