knife client — chef-client Man Pages

# knife client

The knife client subcommand is used to manage an API client list and their associated RSA public key-pairs. This allows authentication requests to be made to the Chef server by any entity that uses the Chef server API, such as the chef-client and knife.

Note

Review the list of common options available to this (and all) knife subcommands and plugins.

## bulk delete

The `bulk delete` argument is used to delete any API client that matches a pattern defined by a regular expression. The regular expression must be within quotes and not be surrounded by forward slashes (`/`).

### Syntax

This argument has the following syntax:

    $ knife client bulk delete REGEX

### Options

This command does not have any specific options.

### Examples

None.

## create

The `create` argument is used to create a new API client. This process will generate an RSA key pair for the named API client. The public key will be stored on the Chef server and the private key will be displayed on `STDOUT` or written to a named file.

- For the chef-client, the private key should be copied to the system as `/etc/chef/client.pem`.
- For knife, the private key is typically copied to `~/.chef/client_name.pem` and referenced in the knife.rb configuration file.

### Syntax

This argument has the following syntax:

    $ knife client create CLIENT_NAME (options)

### Options

This argument has the following options:

`-a`, `--admin`
  Use to create a client as an admin client. This is required for any user to access Open Source Chef as an administrator. This option only works when used with the open source Chef server and will have no effect when used with Enterprise Chef.
`-f FILE`, `--file FILE`
  Use to save a private key to the specified file name.
`--validator`
  Use to create the client as the chef-validator. Default value: `true`.

### Examples

The following examples show how to use this knife subcommand:

Create an admin client

To create a chef-client that can access the Chef server API as an administrator—sometimes referred to as an “API chef-client”—with the name “exampleorg” and save its private key to a file, enter:

    $ knife client create exampleorg -a -f "/etc/chef/client.pem"

Create an admin client for Enterprise Chef

When running the `create` argument on Enterprise Chef, be sure to omit the `-a` option:

    $ knife client create exampleorg -f "/etc/chef/client.pem"

## delete

The `delete` argument is used to delete a registered API client.

### Syntax

This argument has the following syntax:

    $ knife client delete CLIENT_NAME

### Options

This command does not have any specific options.

### Examples

The following examples show how to use this knife subcommand:

Delete a client

To delete a client with the name “client_foo”, enter:

    $ knife client delete client_foo

Type `Y` to confirm a deletion.

## edit

The `edit` argument is used to edit the details of a registered API client. When this argument is run, knife will open $EDITOR to enable editing of the `admin` attribute. (None of the other attributes should be changed using this argument.) When finished, knife will update the Chef server with those changes.

### Syntax

This argument has the following syntax:

    $ knife client edit CLIENT_NAME

### Options

This command does not have any specific options.

### Examples

The following examples show how to use this knife subcommand:

Edit a client

To edit a client with the name “exampleorg”, enter:

    $ knife client edit exampleorg

## list

The `list` argument is used to view a list of registered API client.

### Syntax

This argument has the following syntax:

    $ knife client list (options)

### Options

This argument has the following options:

`-w`, `--with-uri`
  Use to show the corresponding URIs.

### Examples

The following examples show how to use this knife subcommand:

View a list of clients

To verify the API client list for the Chef server, enter:

    $ knife client list

to return something similar to:

    exampleorg
    i-12345678
    rs-123456

To verify that an API client can authenticate to the Chef server correctly, try getting a list of clients using `-u` and `-k` options to specify its name and private key:

    $ knife client list -u ORGNAME -k .chef/ORGNAME.pem

## reregister

The `reregister` argument is used to regenerate an RSA key pair for an API client. The public key will be stored on the Chef server and the private key will be displayed on `STDOUT` or written to a named file.

Note

Running this argument will invalidate the previous RSA key pair, making it unusable during authentication to the Chef server.

### Syntax

This argument has the following syntax:

    $ knife client reregister CLIENT_NAME (options)

### Options

This argument has the following options:

`-f FILE_NAME`, `--file FILE_NAME`
  Use to save a private key to the specified file name.

### Examples

The following examples show how to use this knife subcommand:

Reregister clients

To regenerate the RSA key pair for a client named “testclient” and save it to a file named “rsa_key”, enter:

    $ knife client regenerate testclient -f rsa_key

## show

The `show` argument is used to show the details of an API client.

### Syntax

This argument has the following syntax:

    $ knife client show CLIENT_NAME (options)

### Options

This argument has the following options:

`-a ATTR`, `--attribute ATTR`
  The attribute (or attributes) to show.

### Examples

The following examples show how to use this knife subcommand:

Show clients

To view a client named “testclient”, enter:

    $ knife client show testclient

to return something like:

    admin:       false
    chef_type:   client
    json_class:  Chef::ApiClient
    name:        testclient
    public_key:

To view information in JSON format, use the `-F` common option as part of the command like this:

    $ knife role show devops -F json

Other formats available include `text`, `yaml`, and `pp`.