# Should I be using chef?

**URL:** <https://discourse.chef.io/t/should-i-be-using-chef/2288>\
**Category:** Chef Infra (archive)\
**Created:** [December 26, 2011, 5:57pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288 "2011-12-26T17:57:48Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kelly\_Goedert](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kelly_goedert/32/769_2.png) [@Kelly\_Goedert](https://discourse.chef.io/u/Kelly_Goedert)\
**Post date:** [December 26, 2011, 5:57pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/1 "2011-12-26T17:57:48Z")

</div>

Hi,

I’ve read a bit about chef and I tried the tutorials in  
[http://devops.mashion.net/](http://devops.mashion.net/). after following the installation instructions  
on the site. I was able to follow it and see chef in action which is great.  
After this, I can see an usage on managing server configs, which I want to  
do on a future. For now, I was wondering if I could use chef to "manage"  
developers environment like, installing and configuring eclipse, cvs, java  
and whatever a developer might need to work.

I know this is possible with chef for what I have seen. But is this usual?  
Or I am trying to use the tool for something it is not really made for?

Thanks

Kelly

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [December 26, 2011, 6:34pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/2 "2011-12-26T18:34:36Z")

</div>

On Monday, December 26, 2011 at 10:57 AM, Kelly Goedert wrote:

> Hi,
> 
> I've read a bit about chef and I tried the tutorials in [http://devops.mashion.net/](http://devops.mashion.net/). after following the installation instructions on the site. I was able to follow it and see chef in action which is great. After this, I can see an usage on managing server configs, which I want to do on a future. For now, I was wondering if I could use chef to "manage" developers environment like, installing and configuring eclipse, cvs, java and whatever a developer might need to work.
> 
> I know this is possible with chef for what I have seen. But is this usual? Or I am trying to use the tool for something it is not really made for?  
> The overwhelming majority of Chef users are using Chef to manage servers, but it also works quite well for developer setup. At Opscode we use Chef to manage our developer workstations, and this has dramatically reduced the amount of setup time required for a new developer to get a test environment running. Pivotal Labs also uses Chef to manage workstations[1].

To my knowledge, most people managing workstations are using chef-solo, with developers updating the recipes at their leisure. This implies that your developers would get comfortable with basic Chef usage, but if workstation setup is a one-shot deal this isn't strictly required.

> Thanks
> 
> Kelly

1. [http://pivotallabs.com/users/cunnie/blog/articles/1872-got-lion-now-get-everything-else-](http://pivotallabs.com/users/cunnie/blog/articles/1872-got-lion-now-get-everything-else-)

HTH,

--  
Dan DeLeo

---

<div class="post-metadata">

**Author:** ![Kelly\_Goedert](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kelly_goedert/32/769_2.png) [@Kelly\_Goedert](https://discourse.chef.io/u/Kelly_Goedert)\
**Post date:** [December 26, 2011, 6:41pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/3 "2011-12-26T18:41:45Z")

</div>

Thank you... helped me a lot

On Mon, Dec 26, 2011 at 4:34 PM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:

> On Monday, December 26, 2011 at 10:57 AM, Kelly Goedert wrote:
> 
> > Hi,
> > 
> > I've read a bit about chef and I tried the tutorials in  
> > [http://devops.mashion.net/](http://devops.mashion.net/). after following the installation instructions  
> > on the site. I was able to follow it and see chef in action which is great.  
> > After this, I can see an usage on managing server configs, which I want to  
> > do on a future. For now, I was wondering if I could use chef to "manage"  
> > developers environment like, installing and configuring eclipse, cvs, java  
> > and whatever a developer might need to work.
> > 
> > I know this is possible with chef for what I have seen. But is this  
> > usual? Or I am trying to use the tool for something it is not really made  
> > for?  
> > The overwhelming majority of Chef users are using Chef to manage servers,  
> > but it also works quite well for developer setup. At Opscode we use Chef to  
> > manage our developer workstations, and this has dramatically reduced the  
> > amount of setup time required for a new developer to get a test environment  
> > running. Pivotal Labs also uses Chef to manage workstations[1].
> 
> To my knowledge, most people managing workstations are using chef-solo,  
> with developers updating the recipes at their leisure. This implies that  
> your developers would get comfortable with basic Chef usage, but if  
> workstation setup is a one-shot deal this isn't strictly required.
> 
> > Thanks
> > 
> > Kelly
> 
> 1. 
> 
> [http://pivotallabs.com/users/cunnie/blog/articles/1872-got-lion-now-get-everything-else-](http://pivotallabs.com/users/cunnie/blog/articles/1872-got-lion-now-get-everything-else-)
> 
> HTH,
> 
> --  
> Dan DeLeo

---

<div class="post-metadata">

**Author:** ![Brad\_Knowles](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/brad_knowles/32/716_2.png) [@Brad\_Knowles](https://discourse.chef.io/u/Brad_Knowles)\
**Post date:** [December 26, 2011, 8:22pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/4 "2011-12-26T20:22:50Z")

</div>

On Dec 26, 2011, at 12:34 PM, Daniel DeLeo wrote:

> To my knowledge, most people managing workstations are using chef-solo, with developers updating the recipes at their leisure. This implies that your developers would get comfortable with basic Chef usage, but if workstation setup is a one-shot deal this isn't strictly required.

We're using Chef for our servers, but we're also going to be using Chef for our development systems. We'll install those machines just like regular servers (so that the developers get a working copy of a production system). but once we've done the initial install what we will be doing is removing the roles & recipes from the run\_list that pertain to the development they're doing.

So, as I add new stuff to our "role[base]", it will get incorporated out onto all machines, both production and development, and those development machines will continue to stay current on the configuration for everything except what the developer is actually working on.

I do believe that this is the "best of both worlds" combination.

--  
Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com)  
SAGE Level IV, Chef Level 0.0.1

---

<div class="post-metadata">

**Author:** ![Jake\_Vanderdray](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jake_vanderdray/32/613_2.png) [@Jake\_Vanderdray](https://discourse.chef.io/u/Jake_Vanderdray)\
**Post date:** [December 27, 2011, 3:31pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/5 "2011-12-27T15:31:57Z")

</div>

Brad,

How do you mange your validator PEM? Do you end up doing the  
initial install for the developers and put the PEM on manually, or do  
you openly share the validator within your organization?

We're testing out using Vagrant instances for developers that get  
built with our normal chef cookbooks. I'd love to just be able to  
point people at a wiki page of instructions and let it be self-serve.

Thanks,  
Jake.

On Mon, Dec 26, 2011 at 3:22 PM, Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com) wrote:

> On Dec 26, 2011, at 12:34 PM, Daniel DeLeo wrote:
> 
> > To my knowledge, most people managing workstations are using chef-solo, with developers updating the recipes at their leisure. This implies that your developers would get comfortable with basic Chef usage, but if workstation setup is a one-shot deal this isn't strictly required.
> 
> We're using Chef for our servers, but we're also going to be using Chef for our development systems. We'll install those machines just like regular servers (so that the developers get a working copy of a production system). but once we've done the initial install what we will be doing is removing the roles & recipes from the run\_list that pertain to the development they're doing.
> 
> So, as I add new stuff to our "role[base]", it will get incorporated out onto all machines, both production and development, and those development machines will continue to stay current on the configuration for everything except what the developer is actually working on.
> 
> I do believe that this is the "best of both worlds" combination.
> 
> --  
> Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com)  
> SAGE Level IV, Chef Level 0.0.1

---

<div class="post-metadata">

**Author:** ![Brad\_Knowles](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/brad_knowles/32/716_2.png) [@Brad\_Knowles](https://discourse.chef.io/u/Brad_Knowles)\
**Post date:** [December 27, 2011, 3:45pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/6 "2011-12-27T15:45:26Z")

</div>

On Dec 27, 2011, at 9:31 AM, Jake Vanderdray wrote:

> How do you mange your validator PEM? Do you end up doing the  
> initial install for the developers and put the PEM on manually, or do  
> you openly share the validator within your organization?

That's shared openly by all systems and users in the company. Of course, we're a small shop -- seven people at the moment, although I understand that they're looking to fill some positions. And of those, not all are developers. Of the developers we have, most aren't doing much of anything at all with Chef -- as the Ops guy, I'm the primary one doing most of the work with Chef.

Pretty much all of our systems are (or will be) VMs "in the cloud". Our developers do have local machines that they work from, but those are primarily used as a place to jump off into the actual development work that is done elsewhere.

To be honest, if you're using a Chef-managed environment, I don't see how you can avoid sharing the validator PEM amongst all systems. For those people who are developers but who don't need root access to their development machines, I could see where they wouldn't have open access to the validator PEM, but everyone doing anything with Chef would need to have access.

> We're testing out using Vagrant instances for developers that get  
> built with our normal chef cookbooks. I'd love to just be able to  
> point people at a wiki page of instructions and let it be self-serve.

We could use vagrant, but we really want to get away from having any physical hardware that we have to manage, beyond the desktops that each person sits in front of -- and they're mostly responsible for managing those machines.

We do have a server with a few VMs loaded on it, and that machine has been used for some development to date, but going forward I think we're going to get away from that.

Of course, in a larger shop, I could see where our flat development architecture wouldn't necessarily work so well.

--  
Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com)  
SAGE Level IV, Chef Level 0.0.1

---

<div class="post-metadata">

**Author:** ![Adam\_Greene](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@Adam\_Greene](https://discourse.chef.io/u/Adam_Greene)\
**Post date:** [December 27, 2011, 4:13pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/7 "2011-12-27T16:13:02Z")

</div>

We split Dev/testing/qa and staging/production into separate  
organizations. We lock down access to production quite tightly but  
five open access to everything else. This also allows us to lock down  
what is in production a bit more so we don't have accidental  
migrations of code and recipes to prod.

Not sure if this is the optimal way, but it is what we are currently  
doing (and always looking for ways to improve!)  
Adam

* * *

Adam Greene  
Diabetes Data Management, Simplified

SweetSpot Diabetes Care, Inc.  
http:/www.SweetSpotDiabetes.com  
ph: 503.922.2223 | cell: 503.784.2104

On Dec 27, 2011, at 10:45 AM, Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com) wrote:

> On Dec 27, 2011, at 9:31 AM, Jake Vanderdray wrote:
> 
> > How do you mange your validator PEM? Do you end up doing the  
> > initial install for the developers and put the PEM on manually, or do  
> > you openly share the validator within your organization?
> 
> That's shared openly by all systems and users in the company. Of course, we're a small shop -- seven people at the moment, although I understand that they're looking to fill some positions. And of those, not all are developers. Of the developers we have, most aren't doing much of anything at all with Chef -- as the Ops guy, I'm the primary one doing most of the work with Chef.
> 
> Pretty much all of our systems are (or will be) VMs "in the cloud". Our developers do have local machines that they work from, but those are primarily used as a place to jump off into the actual development work that is done elsewhere.
> 
> To be honest, if you're using a Chef-managed environment, I don't see how you can avoid sharing the validator PEM amongst all systems. For those people who are developers but who don't need root access to their development machines, I could see where they wouldn't have open access to the validator PEM, but everyone doing anything with Chef would need to have access.
> 
> > We're testing out using Vagrant instances for developers that get  
> > built with our normal chef cookbooks. I'd love to just be able to  
> > point people at a wiki page of instructions and let it be self-serve.
> 
> We could use vagrant, but we really want to get away from having any physical hardware that we have to manage, beyond the desktops that each person sits in front of -- and they're mostly responsible for managing those machines.
> 
> We do have a server with a few VMs loaded on it, and that machine has been used for some development to date, but going forward I think we're going to get away from that.
> 
> Of course, in a larger shop, I could see where our flat development architecture wouldn't necessarily work so well.
> 
> --  
> Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com)  
> SAGE Level IV, Chef Level 0.0.1

---

<div class="post-metadata">

**Author:** ![Charles\_Sullivan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/charles_sullivan/32/483_2.png) [@Charles\_Sullivan](https://discourse.chef.io/u/Charles_Sullivan)\
**Post date:** [December 27, 2011, 4:14pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/8 "2011-12-27T16:14:33Z")

</div>

It would be nice if Chef supported multiple validation keys and had ACL  
support. Possibly something similar to how Amazon does  
IAM[http://aws.amazon.com/iam/](http://aws.amazon.com/iam/)policies.

Brad,

For now you could always pre-generate a pool of client/node keys if you  
really need to keep your validation key secret.

Fellow Austinite - Charles

On Tue, Dec 27, 2011 at 9:45 AM, Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com) wrote:

> On Dec 27, 2011, at 9:31 AM, Jake Vanderdray wrote:
> 
> > How do you mange your validator PEM? Do you end up doing the  
> > initial install for the developers and put the PEM on manually, or do  
> > you openly share the validator within your organization?
> 
> That's shared openly by all systems and users in the company. Of course,  
> we're a small shop -- seven people at the moment, although I understand  
> that they're looking to fill some positions. And of those, not all are  
> developers. Of the developers we have, most aren't doing much of anything  
> at all with Chef -- as the Ops guy, I'm the primary one doing most of the  
> work with Chef.
> 
> Pretty much all of our systems are (or will be) VMs "in the cloud". Our  
> developers do have local machines that they work from, but those are  
> primarily used as a place to jump off into the actual development work that  
> is done elsewhere.
> 
> To be honest, if you're using a Chef-managed environment, I don't see how  
> you can avoid sharing the validator PEM amongst all systems. For those  
> people who are developers but who don't need root access to their  
> development machines, I could see where they wouldn't have open access to  
> the validator PEM, but everyone doing anything with Chef would need to have  
> access.
> 
> > We're testing out using Vagrant instances for developers that get  
> > built with our normal chef cookbooks. I'd love to just be able to  
> > point people at a wiki page of instructions and let it be self-serve.
> 
> We could use vagrant, but we really want to get away from having any  
> physical hardware that we have to manage, beyond the desktops that each  
> person sits in front of -- and they're mostly responsible for managing  
> those machines.
> 
> We do have a server with a few VMs loaded on it, and that machine has been  
> used for some development to date, but going forward I think we're going to  
> get away from that.
> 
> Of course, in a larger shop, I could see where our flat development  
> architecture wouldn't necessarily work so well.
> 
> --  
> Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com)  
> SAGE Level IV, Chef Level 0.0.1

--  
Charles Sullivan  
[charlie.sullivan@gmail.com](mailto:charlie.sullivan@gmail.com)

---

<div class="post-metadata">

**Author:** ![tduffield\_opscode](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tduffield_opscode/32/463_2.png) [@tduffield\_opscode](https://discourse.chef.io/u/tduffield_opscode)\
**Post date:** [December 27, 2011, 5:15pm UTC](https://discourse.chef.io/t/should-i-be-using-chef/2288/9 "2011-12-27T17:15:06Z")

</div>

There's an FAQ with a recommended approach for managing individual  
credentials and knife.rb when multiple developers will be using the same  
chef-repo.

[http://wiki.opscode.com/display/chef/Troubleshooting+and+Technical+FAQ#TroubleshootingandTechnicalFAQ-Istherearecommendedapproachformanagingindividualcredentialsandknife.rbwhenmultipledeveloperswillbeusingthesamechefrepo%3F](http://wiki.opscode.com/display/chef/Troubleshooting+and+Technical+FAQ#TroubleshootingandTechnicalFAQ-Istherearecommendedapproachformanagingindividualcredentialsandknife.rbwhenmultipledeveloperswillbeusingthesamechefrepo%3F)

Perhaps that will be of use to you.

- Tom

On Tue, Dec 27, 2011 at 8:14 AM, Charles Sullivan \<  
[charlie.sullivan@gmail.com](mailto:charlie.sullivan@gmail.com)\> wrote:

> It would be nice if Chef supported multiple validation keys and had ACL  
> support. Possibly something similar to how Amazon does IAM[http://aws.amazon.com/iam/](http://aws.amazon.com/iam/)policies.
> 
> Brad,
> 
> For now you could always pre-generate a pool of client/node keys if you  
> really need to keep your validation key secret.
> 
> Fellow Austinite - Charles
> 
> On Tue, Dec 27, 2011 at 9:45 AM, Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com) wrote:
> 
> > On Dec 27, 2011, at 9:31 AM, Jake Vanderdray wrote:
> > 
> > > How do you mange your validator PEM? Do you end up doing the  
> > > initial install for the developers and put the PEM on manually, or do  
> > > you openly share the validator within your organization?
> > 
> > That's shared openly by all systems and users in the company. Of course,  
> > we're a small shop -- seven people at the moment, although I understand  
> > that they're looking to fill some positions. And of those, not all are  
> > developers. Of the developers we have, most aren't doing much of anything  
> > at all with Chef -- as the Ops guy, I'm the primary one doing most of the  
> > work with Chef.
> > 
> > Pretty much all of our systems are (or will be) VMs "in the cloud". Our  
> > developers do have local machines that they work from, but those are  
> > primarily used as a place to jump off into the actual development work that  
> > is done elsewhere.
> > 
> > To be honest, if you're using a Chef-managed environment, I don't see how  
> > you can avoid sharing the validator PEM amongst all systems. For those  
> > people who are developers but who don't need root access to their  
> > development machines, I could see where they wouldn't have open access to  
> > the validator PEM, but everyone doing anything with Chef would need to have  
> > access.
> > 
> > > We're testing out using Vagrant instances for developers that get  
> > > built with our normal chef cookbooks. I'd love to just be able to  
> > > point people at a wiki page of instructions and let it be self-serve.
> > 
> > We could use vagrant, but we really want to get away from having any  
> > physical hardware that we have to manage, beyond the desktops that each  
> > person sits in front of -- and they're mostly responsible for managing  
> > those machines.
> > 
> > We do have a server with a few VMs loaded on it, and that machine has  
> > been used for some development to date, but going forward I think we're  
> > going to get away from that.
> > 
> > Of course, in a larger shop, I could see where our flat development  
> > architecture wouldn't necessarily work so well.
> > 
> > --  
> > Brad Knowles [bknowles@ihiji.com](mailto:bknowles@ihiji.com)  
> > SAGE Level IV, Chef Level 0.0.1
> 
> --  
> Charles Sullivan  
> [charlie.sullivan@gmail.com](mailto:charlie.sullivan@gmail.com)