Chef Infra Server Overview

[edit on GitHub]

The Chef Infra Server acts as a hub for configuration data. The Chef Infra Server stores cookbooks, the policies that are applied to nodes, and the metadata that describes each registered node that is under management by Chef Infra Client. Nodes use Chef Infra Client to ask the Chef Infra Server for configuration details, such as recipes, templates, and file distributions. Chef Infra Client then does as much of the configuration work as possible on the nodes themselves (and not on the Chef Infra Server). This scalable approach distributes the configuration effort throughout the organization.

The Chef Infra Server API is written in Erlang, which is an excellent language for critical enterprise concerns like concurrency, fault-tolerance, and distributed environments. The Chef Infra Server can scale to the size of any enterprise.

Server Components

The following diagram shows the various components that are part of a Chef Infra Server deployment and how they relate to one another.

External Cookbooks

The following diagram highlights the specific changes that occur when cookbooks are stored at an external location, such as Amazon Simple Storage Service (S3).

The following table describes the components that are different from the default configuration of the Chef Infra Server when cookbooks are stored at an external location:

AWS Settings

Required Settings

To configure external cookbook storage using Amazon Simple Storage Service (S3) set the following configuration settings in the chef-server.rb file and run chef-server-ctl reconfigure:

An example chef-server.rb configuration:

bookshelf['vip'] = 's3-external-1.amazonaws.com'
bookshelf['external_url'] = 'https://s3-external-1.amazonaws.com'
bookshelf['access_key_id'] = '<ACCESS_ID>'
bookshelf['secret_access_key'] = '<ACCESS_KEY>'
opscode_erchef['s3_bucket'] = '<BUCKET_NAME>'

Optional Settings

The following optional settings are also available and may require modification when using an external S3 provider:

External PostgreSQL

The following diagram highlights the specific changes that occur when PostgreSQL is configured and managed independently of the Chef Infra Server configuration.

The following table describes the components in an external PostgreSQL configuration that are different from the default configuration of the Chef Infra Server:

PostgreSQL Settings

Use the following configuration settings in the chef-server.rb file to configure external PostgreSQL for use with the Chef Infra Server:

postgresql['db_superuser']

Required when postgresql['external'] is set to true. The PostgreSQL user name. This user must be granted either the CREATE ROLE and CREATE DATABASE permissions in PostgreSQL or be granted SUPERUSER permission. This user must also have an entry in the host-based authentication configuration file used by PostgreSQL (traditionally named pg_hba.conf). Default value: 'superuser_userid'.

postgresql['db_superuser_password']

The password for the user specified by postgresql['db_superuser']. Required when postgresql['external'] is set to true.

The db_superuser_password can also be set using chef-server-ctl set-db-superuser-password from the SecretsManagement commands.

postgresql['external']

Required. Set to true to run PostgreSQL external to the Chef Infra Server. Must be set once only on a new installation of the Chef Infra Server before the first chef-server-ctl reconfigure command is run. If this is set after a reconfigure or set to false, any reconfigure of the Chef Infra Server will return an error. Default value: false.

postgresql['port']

Optional when postgresql['external'] is set to true. The port on which the service is to listen. The port used by PostgreSQL if that port is not 5432. Default value: 5432.

postgresql['vip']

Required when postgresql['external'] is set to true. The virtual IP address. The host for this IP address must be online and reachable from the Chef Infra Server via the port specified by postgresql['port']. Set this value to the IP address or hostname for the machine on which external PostgreSQL is located when postgresql['external'] is set to true.

Optional Settings

The following optional settings are required when configuring external PostgreSQL on Microsoft Azure:

bookshelf['sql_connection_user']

The PostgreSQL user name in 'username@hostname' format (e.g. 'bookshelf@my_postgresql.postgres.database.azure.com'), where username would normally equal the value of bookshelf['sql_user'] (default: 'bookshelf'). This setting is required in an external Azure PostgreSQL database-as-a-service configuration. If set to nil, Chef Infra Server assumes that the database is not on Azure and the PostgreSQL connection will be made using the value specified in bookshelf['sql_user'] Default value: nil.

oc_bifrost['sql_connection_user']

The PostgreSQL user name in 'username@hostname' format (e.g. 'bifrost@my_postgresql.postgres.database.azure.com'), where username would normally equal the value of oc_bifrost['sql_user'] (default: 'bifrost'). This setting is required in an external Azure PostgreSQL database-as-a-service configuration. If set to nil, Chef Infra Server assumes that the database is not on Azure and the PostgreSQL connection will be made using the value specified in oc_bifrost['sql_user']. Default value: nil.

oc_id['sql_connection_user']

The PostgreSQL user name in 'username@hostname' format (e.g. 'oc_id@my_postgresql.postgres.database.azure.com'), where username would normally equal the value of oc_id['sql_user'] (default: 'od_id'). This setting is required in an external Azure PostgreSQL database-as-a-service configuration. If set to nil, Chef Infra Server assumes that the database is not on Azure and the PostgreSQL connection will be made using the value specified in oc_id['sql_user']. Default value: nil.

opscode_erchef['sql_connection_user']

The PostgreSQL user name in 'username@hostname' format (e.g. 'opscode_chef@my_postgresql.postgres.database.azure.com'), where username would normally equal the value of opscode-erchef['sql_user'] (default: 'opscode_chef'). This setting is required in an external Azure PostgreSQL database-as-a-service configuration. If set to nil, Chef Infra Server assumes that the database is not on Azure and the PostgreSQL connection will be made using the value specified in opscode_erchef['sql_user']. Default value: nil.

postgresql['db_connection_superuser']

The PostgreSQL superuser name in 'username@hostname' format (e.g. 'opscode_pgsql@my_postgresql.postgres.database.azure.com'), where username would normally equal the value of postgresql['db_superuser'] with any dashes replaced by underscores. This setting is required in an external Azure PostgreSQL database-as-a-service configuration. If set to nil, Chef Infra Server assumes that the database is not on Azure and the PostgreSQL connection will be made using the value specified in postgresql['db_superuser']. Default value: nil.

An example chef-server.rb configuration for External PostgreSQL on Microsoft Azure:

topology 'standalone'
postgresql['external'] = true
postgresql['vip'] = 'my_postgresql.postgres.database.azure.com'
postgresql['db_superuser'] = 'opscode_pgsql'
postgresql['db_superuser_password'] = 'My_postgres_password1!'
postgresql['db_connection_superuser'] = 'opscode_pgsql@my_postgresql.postgres.database.azure.com'
# postgresql['sslmode']='require' # required if 'Enforce SSL connection' is enabled on Azure PostgreSQL
bookshelf['sql_connection_user'] = 'bookshelf@my_postgresql.postgres.database.azure.com'
oc_bifrost['sql_connection_user'] = 'bifrost@my_postgresql.postgres.database.azure.com'
oc_id['sql_connection_user'] = 'oc_id@my_postgresql.postgres.database.azure.com'
opscode_erchef['sql_connection_user'] = 'opscode_chef@my_postgresql.postgres.database.azure.com'

Bookshelf Settings

In instances that require cookbooks to be stored within a SQL backend, such as in a high availability setup, you must set the storage_type to :sql:

bookshelf['storage_type'] = :sql