I'm starting to adopt chef in an private managed client-server environment.

I'm looking to manage a fairly large environment of open access labs, user desktops and various types of server. Currently all systems are *nix based, but I want to create a structure which allows for flexibility and avoids duplication.

How are others structuring their environments? One area which I can't seem to work out is overriding or inheriting... For instance a workstation would have a workstation role, one recipe which is included permits a certain subset of users to login and use the machine, but no further privileges. I then want to allow a smaller subset of users to install packages on only one of the workstations. How should this handled with chef? I would usually just push a new /etc/sudoers file, but doing this will cause chef to revert to the workstation sudoers, then push the updated version each time it runs. I guess in this situation I could use /etc/sudoers.d/, but I feel this issue of overriding will arise in other situations so some insight would be good!

I don't think I, or my team, have fully got our heads round how chef plugs together so we might have missed how some attributes or metadata works, but it doesn't come across very clearly to us at the moment.


Whenever possible using a "foo.d" solution is preferable. However, when two recipes must make changes to the same file you need to select one recipe to be the controller and then use attributes to generate the file from a template.

You can override and set attributes in recipe, role, environment, or node configuration, with a complicated precedence scheme. See http://docs.opscode.com/chef_overview_attributes.html#attribute-precedence

For managing sudoers, I'd take a look at the community cookbook http://community.opscode.com/cookbooks/sudo to see if it will suit your needs.

| improve this answer | |
  • Thanks Mark, it looks like we need to do some testing with chef in this way. I'll try out the community version, that should give us some exposure to how it should be done as well. – Mark Jun 4 '13 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.