Running chef-client remotely on demand on Windows nodes

Question

Looking for advice on best practices for executing a chef-client run on Windows instances remotely from a Linux box. All instances are hosted in AWS.

Right now, I run the following, which does execute and behave as expected:

knife winrm 'ec2_public_dns' 'chef-client...' -m -x Administrator -P 'WindowsPass'

My question is, is there a better way of doing this? Ideally, I wouldn't have passwords anywhere and am wondering if this is possible.

Answer 1

I think you can generate a TLS certificate to use for authentication, but I'm a little fuzzy on the details. https://github.com/chef/knife-windows#knife-windows-cert-generate has some details, but hopefully somewhere here can jump in with more knowledge.