# Erchef privilege

**URL:** <https://discourse.chef.io/t/erchef-privilege/3882>\
**Category:** Chef Infra (archive)\
**Created:** [April 28, 2013, 5:31am UTC](https://discourse.chef.io/t/erchef-privilege/3882 "2013-04-28T05:31:58Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![liu\_jiwei](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@liu\_jiwei](https://discourse.chef.io/u/liu_jiwei)\
**Post date:** [April 28, 2013, 5:31am UTC](https://discourse.chef.io/t/erchef-privilege/3882/1 "2013-04-28T05:31:58Z")

</div>

Hi:  
i use erchef to manage server,but the client could use client.pem tu  
get information of other nodes and all environments,cookbook?

is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![liu\_jiwei](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@liu\_jiwei](https://discourse.chef.io/u/liu_jiwei)\
**Post date:** [April 29, 2013, 12:59am UTC](https://discourse.chef.io/t/erchef-privilege/3882/2 "2013-04-29T00:59:53Z")

</div>

is there any way to separate the nodes like private chef separate nodes by  
organizations?

2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)

> Hi:  
> i use erchef to manage server,but the client could use client.pem tu  
> get information of other nodes and all environments,cookbook?
> 
> is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![tetsu\_soh](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@tetsu\_soh](https://discourse.chef.io/u/tetsu_soh)\
**Post date:** [April 29, 2013, 11:01am UTC](https://discourse.chef.io/t/erchef-privilege/3882/3 "2013-04-29T11:01:10Z")

</div>

Hello,

maybe you can achieve what you want by:

1. using environment to group your nodes, or
2. setting tags to your nodes and searching nodes by tags, or
3. using data bag to define your grouping

Tetsu

On Apr 29, 2013, at 9:59 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:

> is there any way to separate the nodes like private chef separate nodes by organizations?
> 
> 2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)  
> Hi:  
> i use erchef to manage server,but the client could use client.pem tu get information of other nodes and all environments,cookbook?
> 
> is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![liu\_jiwei](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@liu\_jiwei](https://discourse.chef.io/u/liu_jiwei)\
**Post date:** [April 29, 2013, 11:26am UTC](https://discourse.chef.io/t/erchef-privilege/3882/4 "2013-04-29T11:26:43Z")

</div>

client could get the information of all environments

what i think is,the clinet just can get the information of it shoud to get,

if i have 3 envionment: envionment1,environment2,environemen3,  
node1's environemnt is environment1, this node shoud could just get the  
information environment1,it could get the information of environent2 and  
environment3

this will not be diffcoult in erchef?

how about my thoughts?

2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)

> Hello,
> 
> maybe you can achieve what you want by:
> 
> 1. using environment to group your nodes, or
> 2. setting tags to your nodes and searching nodes by tags, or
> 3. using data bag to define your grouping
> 
> Tetsu
> 
> On Apr 29, 2013, at 9:59 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> 
> is there any way to separate the nodes like private chef separate nodes by  
> organizations?
> 
> 2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)
> 
> > Hi:  
> > i use erchef to manage server,but the client could use client.pem tu  
> > get information of other nodes and all environments,cookbook?
> > 
> > is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![tetsu\_soh](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@tetsu\_soh](https://discourse.chef.io/u/tetsu_soh)\
**Post date:** [April 29, 2013, 11:41am UTC](https://discourse.chef.io/t/erchef-privilege/3882/5 "2013-04-29T11:41:38Z")

</div>

So you want to completely isolate nodes? just like multiple-tenant of hosted chef?

In that case just set up multi chef servers and register nodes to different chef servers.

On Apr 29, 2013, at 8:26 PM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:

> client could get the information of all environments
> 
> what i think is,the clinet just can get the information of it shoud to get,
> 
> if i have 3 envionment: envionment1,environment2,environemen3,  
> node1's environemnt is environment1, this node shoud could just get the information environment1,it could get the information of environent2 and environment3
> 
> this will not be diffcoult in erchef?
> 
> how about my thoughts?
> 
> 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)  
> Hello,
> 
> maybe you can achieve what you want by:
> 
> 1. using environment to group your nodes, or
> 2. setting tags to your nodes and searching nodes by tags, or
> 3. using data bag to define your grouping
> 
> Tetsu
> 
> On Apr 29, 2013, at 9:59 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> 
> > is there any way to separate the nodes like private chef separate nodes by organizations?
> > 
> > 2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)  
> > Hi:  
> > i use erchef to manage server,but the client could use client.pem tu get information of other nodes and all environments,cookbook?
> > 
> > is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![liu\_jiwei](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@liu\_jiwei](https://discourse.chef.io/u/liu_jiwei)\
**Post date:** [April 29, 2013, 11:53am UTC](https://discourse.chef.io/t/erchef-privilege/3882/6 "2013-04-29T11:53:20Z")

</div>

use multi chef server to manage mulit nodes is waste.

now just make a patch to erche to API will sloved this

2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)

> So you want to completely isolate nodes? just like multiple-tenant of  
> hosted chef?
> 
> In that case just set up multi chef servers and register nodes to  
> different chef servers.
> 
> On Apr 29, 2013, at 8:26 PM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> 
> client could get the information of all environments
> 
> what i think is,the clinet just can get the information of it shoud to get,
> 
> if i have 3 envionment: envionment1,environment2,environemen3,  
> node1's environemnt is environment1, this node shoud could just get the  
> information environment1,it could get the information of environent2 and  
> environment3
> 
> this will not be diffcoult in erchef?
> 
> how about my thoughts?
> 
> 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)
> 
> > Hello,
> > 
> > maybe you can achieve what you want by:
> > 
> > 1. using environment to group your nodes, or
> > 2. setting tags to your nodes and searching nodes by tags, or
> > 3. using data bag to define your grouping
> > 
> > Tetsu
> > 
> > On Apr 29, 2013, at 9:59 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> > 
> > is there any way to separate the nodes like private chef separate nodes  
> > by organizations?
> > 
> > 2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)
> > 
> > > Hi:  
> > > i use erchef to manage server,but the client could use client.pem  
> > > tu get information of other nodes and all environments,cookbook?
> > > 
> > > is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![tetsu\_soh](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@tetsu\_soh](https://discourse.chef.io/u/tetsu_soh)\
**Post date:** [April 29, 2013, 12:12pm UTC](https://discourse.chef.io/t/erchef-privilege/3882/7 "2013-04-29T12:12:44Z")

</div>

emm, still cannot get your point.

Private chef has role based access control. If that is what want you want, by private chef.

with OSC, I mentioned few alternative solution.  
Not perfect but works for small business/organization.

On Apr 29, 2013, at 8:53 PM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:

> use multi chef server to manage mulit nodes is waste.
> 
> now just make a patch to erche to API will sloved this
> 
> 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)  
> So you want to completely isolate nodes? just like multiple-tenant of hosted chef?
> 
> In that case just set up multi chef servers and register nodes to different chef servers.
> 
> On Apr 29, 2013, at 8:26 PM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> 
> > client could get the information of all environments
> > 
> > what i think is,the clinet just can get the information of it shoud to get,
> > 
> > if i have 3 envionment: envionment1,environment2,environemen3,  
> > node1's environemnt is environment1, this node shoud could just get the information environment1,it could get the information of environent2 and environment3
> > 
> > this will not be diffcoult in erchef?
> > 
> > how about my thoughts?
> > 
> > 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)  
> > Hello,
> > 
> > maybe you can achieve what you want by:
> > 
> > 1. using environment to group your nodes, or
> > 2. setting tags to your nodes and searching nodes by tags, or
> > 3. using data bag to define your grouping
> > 
> > Tetsu
> > 
> > On Apr 29, 2013, at 9:59 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> > 
> > > is there any way to separate the nodes like private chef separate nodes by organizations?
> > > 
> > > 2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)  
> > > Hi:  
> > > i use erchef to manage server,but the client could use client.pem tu get information of other nodes and all environments,cookbook?
> > > 
> > > is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![Pete\_Cheslock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/pete_cheslock/32/326_2.png) [@Pete\_Cheslock](https://discourse.chef.io/u/Pete_Cheslock)\
**Post date:** [April 29, 2013, 3:48pm UTC](https://discourse.chef.io/t/erchef-privilege/3882/8 "2013-04-29T15:48:57Z")

</div>

Separating nodes to orgs like you mention is one of the reasons why people buy private chef.

[http://www.opscode.com/private-chef/](http://www.opscode.com/private-chef/)

-Pete

On Apr 29, 2013, at 6:53 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:

> use multi chef server to manage mulit nodes is waste.
> 
> now just make a patch to erche to API will sloved this
> 
> 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)
> 
> > So you want to completely isolate nodes? just like multiple-tenant of hosted chef?
> > 
> > In that case just set up multi chef servers and register nodes to different chef servers.
> > 
> > On Apr 29, 2013, at 8:26 PM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> > 
> > > client could get the information of all environments
> > > 
> > > what i think is,the clinet just can get the information of it shoud to get,
> > > 
> > > if i have 3 envionment: envionment1,environment2,environemen3,  
> > > node1's environemnt is environment1, this node shoud could just get the information environment1,it could get the information of environent2 and environment3
> > > 
> > > this will not be diffcoult in erchef?
> > > 
> > > how about my thoughts?
> > > 
> > > 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)
> > > 
> > > > Hello,
> > > > 
> > > > maybe you can achieve what you want by:
> > > > 
> > > > 1. using environment to group your nodes, or
> > > > 2. setting tags to your nodes and searching nodes by tags, or
> > > > 3. using data bag to define your grouping
> > > > 
> > > > Tetsu
> > > > 
> > > > On Apr 29, 2013, at 9:59 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> > > > 
> > > > > is there any way to separate the nodes like private chef separate nodes by organizations?
> > > > > 
> > > > > 2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)
> > > > > 
> > > > > > Hi:  
> > > > > > i use erchef to manage server,but the client could use client.pem tu get information of other nodes and all environments,cookbook?
> > > > > > 
> > > > > > is there anyone could help me?

---

<div class="post-metadata">

**Author:** ![liu\_jiwei](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@liu\_jiwei](https://discourse.chef.io/u/liu_jiwei)\
**Post date:** [April 30, 2013, 2:56pm UTC](https://discourse.chef.io/t/erchef-privilege/3882/9 "2013-04-30T14:56:27Z")

</div>

thanks,  
but private-chef's api is not all public,so what i think is make a patch to  
erchef to make nodes just get infomation of it's should got

🙂

2013/4/29 Pete Cheslock [petecheslock@gmail.com](mailto:petecheslock@gmail.com)

> Separating nodes to orgs like you mention is one of the reasons why people  
> buy private chef.
> 
> [http://www.opscode.com/private-chef/](http://www.opscode.com/private-chef/)
> 
> -Pete
> 
> On Apr 29, 2013, at 6:53 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> 
> use multi chef server to manage mulit nodes is waste.
> 
> now just make a patch to erche to API will sloved this
> 
> 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)
> 
> > So you want to completely isolate nodes? just like multiple-tenant of  
> > hosted chef?
> > 
> > In that case just set up multi chef servers and register nodes to  
> > different chef servers.
> > 
> > On Apr 29, 2013, at 8:26 PM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> > 
> > client could get the information of all environments
> > 
> > what i think is,the clinet just can get the information of it shoud to  
> > get,
> > 
> > if i have 3 envionment: envionment1,environment2,environemen3,  
> > node1's environemnt is environment1, this node shoud could just get the  
> > information environment1,it could get the information of environent2 and  
> > environment3
> > 
> > this will not be diffcoult in erchef?
> > 
> > how about my thoughts?
> > 
> > 2013/4/29 Tetsu Soh [tetsu.soh@gmail.com](mailto:tetsu.soh@gmail.com)
> > 
> > > Hello,
> > > 
> > > maybe you can achieve what you want by:
> > > 
> > > 1. using environment to group your nodes, or
> > > 2. setting tags to your nodes and searching nodes by tags, or
> > > 3. using data bag to define your grouping
> > > 
> > > Tetsu
> > > 
> > > On Apr 29, 2013, at 9:59 AM, liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com) wrote:
> > > 
> > > is there any way to separate the nodes like private chef separate nodes  
> > > by organizations?
> > > 
> > > 2013/4/28 liu jiwei [ljvsss@gmail.com](mailto:ljvsss@gmail.com)
> > > 
> > > > Hi:  
> > > > i use erchef to manage server,but the client could use client.pem  
> > > > tu get information of other nodes and all environments,cookbook?
> > > > 
> > > > is there anyone could help me?