knife-bastion Knife Plugin
This plugin allows Knife to access Chef server over a secure SSH connection, without exposing Chef server port to your VPN network.
Install & Usage Instructions
Add this line to your Chef repository's Gemfile:
And then execute:
Or install it yourself as:
$ gem install knife-bastion
Configure your bastion server in
.chef/knife.rb (at the bottom):
# ... # your knife configurations goes here # ... # Bastion host SSH settings knife[:bastion_host] = "bastion.mycorp.net" knife[:bastion_user] = ENV["MYCORP_USER"] || ENV["CHEF_USER"] || ENV["USER"] # If you have multiple networks, that require different MFA tokens, specify # each network name here. (This configuration is referenced to clarify the # token a user should employ.) # knife[:bastion_network] = "mynet" # By default, the proxy server is created on port 4443. You may configure the # local bastion port here: # knife[:bastion_local_port] = 4443 require "knife-bastion/activate"
Now, your workflow will look like this:
knife bastion start- this command will establish SSH connection to bastion box for 10 minutes, and create a SOCKS proxy on port
4443, that will forward all Chef requests to Chef server via bastion box.
- Use Chef to do your work.
- At any time you can use
knife bastion status- which will verify the proxy and make sure everything works as expected.
- After you finished, run
knife bastion stopto shutdown the connection and turn off the proxy. If you forget to do this, it will die automatically after 10 minutes.
Sometimes when you work on a big change, default timeout of 10 minutes is too short.
You can increase timeout with
knife bastion start --timeout 1800
Maximum timeout is 3600 (1 hour) for security reasons. You can re-establish bastion
connection by executing
knife bastion start (if the connection is currently active,
it will be forcibly closed.)
If something is not right, you need to ensure you have access to bastion box.
Try connecting to
bastion.mycorp.net via SSH:
Check current bastion connection status (it will tell you if there is anything wrong with your box):
knife bastion status