I'm starting to adopt chef in an private managed client-server environment.
I'm looking to manage a fairly large environment of open access labs, user desktops and various types of server. Currently all systems are *nix based, but I want to create a structure which allows for flexibility and avoids duplication.
How are others structuring their environments? One area which I can't seem to work out is overriding or inheriting... For instance a workstation would have a workstation role, one recipe which is included permits a certain subset of users to login and use the machine, but no further privileges. I then want to allow a smaller subset of users to install packages on only one of the workstations. How should this handled with chef? I would usually just push a new /etc/sudoers file, but doing this will cause chef to revert to the workstation sudoers, then push the updated version each time it runs. I guess in this situation I could use /etc/sudoers.d/, but I feel this issue of overriding will arise in other situations so some insight would be good!
I don't think I, or my team, have fully got our heads round how chef plugs together so we might have missed how some attributes or metadata works, but it doesn't come across very clearly to us at the moment.