only master needs to run chef-client.