Hot answers tagged

84

Edit This question and answer are years old. The definitive best practices are taught via the Learn Chef Rally self-paced training modules produced by Chef Software, Inc. The bulk of the original answer is below. In this answer, "Chef" or "chef-client" usually refers to Chef Infra, the product. Opscode renamed to Chef Software, Inc in 2013. In April, 2019, ...


67

I am going to orient this answer as if the question was "what are the advantages of chef-solo" because that's the best way I know to cover the differences between the approaches. My summary recommendation is in line with others: use a chef-server if you need to manage a dynamic, virtualized environment where you will be adding and removing nodes often. A ...


56

A domain-specific language makes a big difference in the amount of code you write. For example, you could argue that there's not much difference between: chmod 640 /my/file and file { "/my/file": mode => 640, } but there's a great deal of difference between these: FILE=/my/file chmod 640 $FILE chown foo $FILE chgrp bar $FILE wget -O $FILE "http:/...


54

Let's use their respective web pages to find out what are all these projects about. I'll change the order in which you listed, though: Chef: Chef is an automation platform that transforms infrastructure into code. This is a configuration management software. Most of them use the same paradigm: they allow you to define the state you want a machine to be, ...


46

Look in the chef_environment Ruby attribute (not a regular Chef attribute) on the node: if node.chef_environment == "dev" # stuff end


33

This will be an unpopular opinion, but configuration management systems are not necessarily better. Sometimes simple really is best. There is a definite learning curve and administrative overhead associated with the configuration system you choose. You are after all introducing a dependency. As with any automation you must also be careful that security ...


28

The paid versions offer more features (i.e., puppet offers an easier way to deploy en mass) and, in many cases most importantly, paid support. When running enterprise servers, having paid support to help you get setup is typically worth it--especially when you run into issues. Chef version comparison Comparison between Puppet and Puppet Enterprise ...


25

IMHO it's worth learning even if you're only managing a single server, Yes, there will be a learning curve. Yes, you will get frustrated. For those costs, though, you will be paid back in multiples through reliable, consistent, one-click deployments, version-controlled server configuration, ease of setting up test/dev environments, etc. In addition to the ...


23

Disclaimer: I am one of the developers of Puppet, another tool in the space. The advantages of using Chef on a single node are the same as using it on multiple nodes: you declare how the system should be, in a form that is easy to version control, backup, audit, and change. Chef will then go ahead and make sure your system stays that way: if something ...


23

You've answered your own question... Automation is becoming more scalable and formalized. Puppet and Chef are considered standards these days (check the job ads). Cobbled-together shell scripts have their place, but they're not scalable in the context of the DevOps movement. Readability is part of that.


17

The cookbook_file and template resources support a "cookbook" parameter that specifies which cookbook contains the source file. Then you could create a "commons" cookbook where those files live as a single entity. For example: % cookbooks/commons cookbooks/commons |-- files | `-- default | `-- master.conf `-- templates `-- default `-- ...


17

Use the directory resource to create the directory before creating the template. The trick is to also specify the recursive attribute otherwise the action will fail unless all parts of the directory but the last exist already. config_dir = "#{node[:app][:deploy_to]}/#{node[:app][:name]}/shared/config" directory config_dir do owner node[:user][:username] ...


16

I figured it out. my nodes did not have an fqdn. I had to specify -a ipaddress. the error message was not helpful. I figured it out by debugging knife ssh code. there is also a bug that it does not read the attribute from the knife config file. I'm going to open up a ticket about the issue and perhaps submit a patch. What I did to get past this was put the ...


15

I work with multiple projects, so cjc's solution won't work for me. There's also an issue of common vs custom configuration (addresses etc are common to the company, there's also a bit of magic in the configs). The scheme I finally settled on is a bit of a hack, but it's a convenient-to-use one. Instead of global ~/.chef, I use '.chef' subdirectory within ...


15

Good question - both of your examples work the way that I would expect, but it isn't immediately obvious why. As StephenKing wrote in his response, the first thing to understand is that recipes are compiled (to produce a set of resources), and then resources are converged (to effect changes to your system). These two phases are often interleaved - some of ...


15

Jeffrey Snover, who is the father of Powershell and has a strong influence on the future of Windows Server, recently said that Chef is currently aligned with the Windows Server strategy, while Puppet is not currently demonstrating this. (But it could in the future. And I don't have specific examples about all the other CM platforms/tools/solutions - I'm just ...


14

I haven't tested this, but I believe that after you run your dpkg-reconfigure on an example machine, you can run debconf-get-selections | egrep "^gitolite\s" to get what was set. (it's in the debconf-utils package if you don't have it). Then on the CLI, debconf-set-selections $FILENAME before running apt. Then with puppet it would be something like: file {...


14

The software is free. The support for that software isn't.


14

To summarize the IRC session at https://github.com/chef/irc_log_archives/blob/master/chef/2013/2/23.log: Chef-server redirects api clients between its components (in this case erchef and bookshelf). These redirects are based on the FQDN of the chef-server. If the server doesn't have a valid FQDN at install time, this can result in redirects to https://...


14

Here is an example where my execute resource is only converged when my directory resource converges: directory '/opt/foo' do action :create notifies :run, 'execute[custom command]', :immediately end execute 'custom command' do command 'echo foo' action :nothing end See https://docs.chef.io/chef/resources.html#notifications for more examples.


13

Chef makes it a lot easier to manage and version the setup of a complex infrastructure, especially in any type of cloud environment vs. having to manually ftp or scp a bunch of shell scripts organized in a unstandardized fashion. Depending on how many dependencies you need to manage, the size of this win can vary greatly, making the decision to move to a CM ...


13

This question seems subjective, but I'll try to approach this answer objectively. The Chef Server provides a publishing system and search index with a RESTful API. This means you can: Distribute cookbooks for nodes through a single location that has an API, and primitives for creating version constraints, retrieval, all the things you'd probably expect ...


13

You can pass arguments to avoid getting prompts. This works for me; apt-get update apt-get --yes --force-yes -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" upgrade apt-get --yes --force-yes -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade --force-confold (my choice) will make these "What do ...


12

They're actually different products that solve different specific problem classes, but when used together can solve as a system the overall problem of managing a distributed application. Products like RightScale are good at turning on new machines when needed. Products like Puppet/Chef/bcfg are good at turning just-turned-on machines into productive ...


12

You could use knife ssh to run chef-client on all boxes that contain a certain role or recipe: knife ssh "role:web" "sudo chef-client" -x ubuntu --sudo Or if you're in EC2: knife ssh "role:web" "sudo chef-client" -x ubuntu -a ec2.public_hostname


12

Use action :nothing during declaration.


11

That'd pretty much how you get things started to begin with, but it only needs to be done once. The initial run of chef-client typically enables and starts the chef-client daemon as an init.d service. If you really wanted to do it more elegantly, you could ditch knife-ssh and run ssh directly: ssh ubuntu@ipadddress -i mycredentials.pem sudo chef-client ...


11

It wasn't long after I started using Chef in earnest that I was coming up against these same issues. I only came to some sense of sanity when I started doing four things operationally. Note that these may not be considered "best practices" by some in the Chef community. Nonetheless, this is how I brought sanity, repeatability, and order to my world. Create ...


11

I've evaluated Elastic Beanstalk in addition to other AWS offerings while trying to improve our hand-rolled AWS instances. The reasons I chose not to use it were due to complications that would arrise migrating my existing application and not with the offering itself. The catch is that you don't have as much control about application deployment / ...


11

By default, Chef will check if the service is running, and starts it if the service isn't running. How it determines that the service is running depends. By default, Chef will attempt to match the name of the service (postgresql here) in the process table using ps. ps -ef | grep postgresql Essentially. The name of the service will be used for the pattern ...


Only top voted, non community-wiki answers of a minimum length are eligible