How to update nginx through a chef

Question

Please note that this is a copy of the question I asked ServerFault , but could not get an answer. Hope I can get some feedback here.

I am a developer who recently inherited our previous character chef customization. I am running a Chef 10 server and realized that the nginx cookbook from opscode is still using nginx version 1.2.6. Since there are many security fixes that have been released, I would like to go to 1.4.1 and feel that the chef should do this very simply. However, this was a nightmare.

My first thought was to just make cookbook nginx “normal” and change the default['nginx']['version'] attribute to 1.4.1, load the cooking and merge the test server. I watched him retrieve a new version of the cookbook (I remember to update metadata), and immediately ignored it, as it continued to use 1.2.6.

Then I decided to redefine the attributes in the role I am using (rails_tier_web is the name of the role). Speaking to a more experienced chef, he warned about this, since roles cannot be verified and secured, like cookbooks can. However, while reading the cookbook documentation, they tell you to use redefinition attributes in their role, so I do:

override_attributes( 'nginx' => { 'source' => { 'version' => '1.4.1', 'prefix' => '/opt/nginx-1.4.1' }, 'version' => '1.4.1' } )

However, when I converged, I still see traces 1.2.6 displayed in the output log.

 [2013-07-15T18:52:03-04:00] INFO: Processing remote_file[http://nginx.org/download/nginx-1.2.6.tar.gz] action create (nginx::source line 56) [2013-07-15T18:52:05-04:00] INFO: remote_file[http://nginx.org/download/nginx-1.2.6.tar.gz] updated 

and then right after that ...

 Mixlib::ShellOut::ShellCommandFailed ------------------------------------ Expected process to exit with [0], but received '1' ---- Begin output of "bash" "/tmp/chef-script20130715-4790-1m689ee" ---- STDOUT: STDERR: /tmp/chef-script20130715-4790-1m689ee: line 2: cd: nginx-1.4.1: No such file or directory ---- End output of "bash" "/tmp/chef-script20130715-4790-1m689ee" ---- Ran "bash" "/tmp/chef-script20130715-4790-1m689ee" returned 1 Resource Declaration: --------------------- # In /var/chef/cache/cookbooks/nginx/recipes/source.rb 84: bash "compile_nginx_source" do 85: cwd ::File.dirname(src_filepath) 86: code <<-EOH 87: tar zxf #{::File.basename(src_filepath)} -C #{::File.dirname(src_filepath)} && 88: cd nginx-#{node['nginx']['source']['version']} && 89: ./configure #{node.run_state['nginx_configure_flags'].join(" ")} && 90: make && make install 91: EOH 92: 93: not_if do 94: nginx_force_recompile == false && 95: node.automatic_attrs['nginx'] && 96: node.automatic_attrs['nginx']['version'] == node['nginx']['source']['version'] && 97: node.automatic_attrs['nginx']['configure_arguments'].sort == configure_flags.sort 98: end 99: 100: notifies :restart, "service[nginx]" 101: end 102: Compiled Resource: ------------------ # Declared in /var/chef/cache/cookbooks/nginx/recipes/source.rb:84:in `from_file' bash("compile_nginx_source") do action "run" retries 0 retry_delay 2 command "\"bash\" \"/tmp/chef-script20130715-4790-1m689ee\"" backup 5 cwd "/var/chef/cache" returns 0 code " tar zxf nginx-1.4.1.tar.gz -C /var/chef/cache &&\n cd nginx-1.4.1 &&\n ./configure --prefix=/opt/nginx-1.2.6 --conf-path=/etc/nginx/nginx.conf --with-http_gzip_static_module --with-http_realip_module --with-http_ssl_module --with-http_stub_status_module &&\n make && make install\n" interpreter "bash" cookbook_name "nginx" recipe_name "source" not_if { #code block } end 

I really in the end, because I was hoping that I could just override the version attribute and it all fell into place. Obviously, this is not the case so far, and I really do not want to perform manual repair and / or editing of node objects if I can help. Any help would be appreciated.

Answer 1

I am facing this very problem. Best of all, I can say the root of the problem is to use string concatenation in attribute files in the nginx cookbook. If you look at the /source.rb attributes, you will see the following

 default['nginx']['source']['default_configure_flags'] = [ "--prefix=#{node['nginx']['source']['prefix']}", "--conf-path=#{node['nginx']['dir']}/nginx.conf", "--sbin-path=#{node['nginx']['source']['sbin_path']}" ] 

These are great, reasonable defaults. And you might think that if one overrides one of the reference attributes, node ['nginx'] ['source'] ['prefix'], then the resulting default_configure_flags will reflect this change. However, this does not seem to be the case. It seems that the attribute files are one of the first things loaded when the chef starts. Thus, the values ​​assigned to things like default_configure_flags are based on the default values ​​provided by the cookbook (i.e. String version 1.2.6, which is set in the /default.rb attributes).

Without doing the serious work of cleaning up the nginx cookbook itself, the best solution was to override the default_configure_flags attribute in my own attribute file (along with a number of others that look like they should be ok but cause the same problem, look at the other attributes /source.rb for reset). Unfortunately, I override it the same way as the default, it just evaluates later after the other values ​​it refers to are set to what I want.

Answer 2

This line:

[2013-07-15T18:52:03-04:00] INFO: Processing remote_file[http://nginx.org/download/nginx-1.2.6.tar.gz] action create (nginx::source line 56)

Points to line 56 of the source recipe in the nginx cookbook. There you can see that the URL of the source archive is set using this logic :

nginx_url = node['nginx']['source']['url'] || "http://nginx.org/download/nginx-#{node['nginx']['source']['version']}.tar.gz"

Therefore, I assume that node['nginx']['source']['url'] points to nginx version 1.6. It should depend on the attribute node['nginx']['source']['version'] , as you can see here , but maybe there is some order of loading the attributes when working here, which interferes.

Try installing node['nginx']['source']['url'] at http://nginx.org/download/nginx-1.4.1.tar.gz , keeping the original version at 1.4.1 .

I assume that you load 1.2.6 when you try to extract 1.4.1, which is not there, so the bash script does not work.