knife-client(1) on Linux
The text abe13be96377, as Debian 9 (Stretch) shipped it.
The man page for the knife client subcommand. Every request made by the chef-client to the Chef server must be an authenticated request using the Chef server API and a private key. When the chef-client makes a request to the Chef server, the chef-client authenticates each request using a private key located in /etc/chef/client.pem. However, during the first chef-client run, this private key does not exist. Instead, the chef-client will attempt to use the private key assigned to the chef-validator, located in /etc/chef/validation.pem. (If, for any reason, the chef-validator is unable to make an authenticated request to the Chef server, the initial chef-client run will fail.) During the initial chef-client run, the chef-client will register with the Chef server using the private key assigned to the chef-validator, after which the chef-client will obtain a client.pem private key for all future authentication requests to the Chef server. After the initial chef-client run has completed successfully, the chef-validator is no longer required and may be deleted from the node. Use the delete_validation recipe found in the chef-client cookbook (https://github.com/opscode-cookbooks/chef-client) to remove the chef-validator. The knife client subcommand is used to manage an API client list and their associated RSA public key-pairs. This allows authentication requests to be made to the Chef server by any entity that uses the Chef server API, such as the chef-client and knife.
Flags it lists
-
--chef-zero-port -
--config -
--defaults -
--disable-editing -
--editor -
--environment -
--format -
--help -
--key -
--local-mode -
--print-after -
--server-url -
--user -
--verbose -
--version -
--yes -
-E -
-F -
-V -
-c -
-d -
-e -
-h -
-k -
-s -
-u -
-v -
-y -
-z