Terraform: Provisioning with chef

Question

I'm using this configuration in order to provision my guest using a chef client and vagrant:

  config.vm.provision "chef_client" do |chef|
    chef.add_recipe 'living-development'
    chef.chef_server_url = 'https://api.chef.io/organizations/my-organization'
    chef.validation_key_path = 'cert.pem'
    chef.validation_client_name = 'validation'
    chef.version = '12.19.36'
  end

This configuration is working fine using chef and vagrant. Nevertheless I need to provision my machine using terraform. I don't quite figure out how to set above "vagrant+chef" configuration using "terraform+chef".

Up to now, I've been to to get this:

# Create a new Web Droplet in the nyc2 region
resource "digitalocean_droplet" "web" {
  image  = "ubuntu-14-04-x64"
  name   = "web-1"
  region = "fra1"
  size   = "512mb"
  ssh_keys = ["${digitalocean_ssh_key.default.id}"]
  volume_ids = ["${digitalocean_volume.foobar.id}"]
  provisioner "chef" {
    server_url = "https://api.chef.io/organizations/my-organization"
    user_name = "living"
    user_key = "./living.pem"
    node_name = "living"
    run_list = [ "cookbook::living-development" ]
    version = "12.19.36"
  }
}

The execution is printing me out this:

digitalocean_droplet.web (chef): Connecting to remote host via SSH...
digitalocean_droplet.web (chef):   Host: 139.59.148.167
digitalocean_droplet.web (chef):   User: root
digitalocean_droplet.web (chef):   Password: false
digitalocean_droplet.web (chef):   Private key: false
digitalocean_droplet.web (chef):   SSH Agent: false
digitalocean_droplet.web: Still creating... (1m0s elapsed)
digitalocean_droplet.web (chef): Connecting to remote host via SSH...
digitalocean_droplet.web (chef):   Host: 139.59.148.167
digitalocean_droplet.web (chef):   User: root
digitalocean_droplet.web (chef):   Password: false
digitalocean_droplet.web (chef):   Private key: false
digitalocean_droplet.web (chef):   SSH Agent: false
digitalocean_droplet.web (chef): Connecting to remote host via SSH...
digitalocean_droplet.web (chef):   Host: 139.59.148.167
digitalocean_droplet.web (chef):   User: root
digitalocean_droplet.web (chef):   Password: false
digitalocean_droplet.web (chef):   Private key: false
digitalocean_droplet.web (chef):   SSH Agent: false
digitalocean_droplet.web (chef): Connecting to remote host via SSH...
digitalocean_droplet.web (chef):   Host: 139.59.148.167
digitalocean_droplet.web (chef):   User: root
digitalocean_droplet.web (chef):   Password: false
digitalocean_droplet.web (chef):   Private key: false
digitalocean_droplet.web (chef):   SSH Agent: false
digitalocean_droplet.web: Still creating... (1m10s elapsed)
digitalocean_droplet.web (chef): Connecting to remote host via SSH...
...

I don't know what does it mean...

What's chef trying to get?

Am I doing wrong?

Answer 1

Your problem is that Chef is trying to connect to your DigitalOcean Droplet using root credentials for SSH. root logins for SSH are disabled by default on ubuntu, and you don't want to change that as it is considered best practice to not allow it.

You therefore need to configure the Chef provisioner to use the correct SSH credentials to connect to your Droplet. To do that you will need the following in your chef provisioner definition:

provisioner "chef" {
 connection {
  type = "ssh"
  user = "your-ssh-user"
  key = $file("/path/to/.pem.key")
 }
}

Simply set the correct values for the user and key attributes of the connection within the chef provisioner and this should allow Chef to connect to your Droplet as you expect.