[chef] Re: Re: Chef AWS server with nodes in multiple regions

[Morgan Blackthorne < >]

In terms of proxying, we already have a use for a proxy server to connect to our datastore cluster which is offsite, and using proxies with ElasticIPs ensures that we can generate a knowable list of hosts traffic should come from. I'm assuming that I should easily be able to add another stanza to the config to push a path to the master host, which then whitelists the same hosts that the datastore clusters do, just on a different port.

Also does Chef's API interface (4000) operate over SSL? Less concerned about the server gui (4040) as that will be more tightly restricted and I can toss Apache proxying around it, or a one node ELB to downstep the ssl.

(Thanks, and apologies for any typoes or other oddities; my weird vision right now is a side effect of the Ambien telling me to go to sleep.)

--

~*~ StormeRider ~*~

"Every world needs its heroes [...] They inspire us to be better than we are. And they protect from the darkness that's just around the corner."

(from Smallville Season 6x1: "Zod")

On why I hate the phrase "that's so lame"... http://bit.ly/Ps3uSS

On Wed, Aug 8, 2012 at 1:39 AM, Ranjib Dey < " target="_blank"> > wrote:

sorry not AZ , i mean aws region

On Wed, Aug 8, 2012 at 2:09 PM, Ranjib Dey < " target="_blank"> > wrote:

Not sure if theres an easy solution to this. You can consider a NAT box or ssh tunnel setup in one region , and every chef clients from that region used this proxy to access the chef server (which is hosted in another location).  This proxy server in turn needs to be whitelisted in chef server security group. You need to have one proxy server in every zone though.

On Wed, Aug 8, 2012 at 12:48 PM, Morgan Blackthorne < " target="_blank"> > wrote:

Just wondering how others approach this situation. Elastic IPs aren't viable as we'll have nodes in autoscaling groups, etc.

One approach mentioned in #chef was to launch the EC2 nodes inside VPC, and then link the regions via VPC. We'd end up paying for that, but it's an option. Any others? I'm not sure I want to (on short notice) add VPC into the mix while I'm on a deadline, though. 

Does Chef support the concept of slave servers, where I could have a server host in each region with an ElasticIP that pulls from the master host?

--

~*~ StormeRider ~*~

"Every world needs its heroes [...] They inspire us to be better than we are. And they protect from the darkness that's just around the corner."

(from Smallville Season 6x1: "Zod")

On why I hate the phrase "that's so lame"... http://bit.ly/Ps3uSS