[chef] Policyfile questions (was: Single chef server vs. multiple chef servers - pros and cons?)

[Daniel DeLeo < >]

Forked this to a new topic.

On Friday, October 24, 2014 at 3:00 AM, Yauhen Artsiukhou wrote:

> After first read, policy file looks very complicated. Especially if I have 
> many cookbooks with its own policyfiles. How it would be merged?

You only have one Policyfile per functional server role, e.g., a specific web 
application, front-end LB, etc. Maybe you could have them for individual 
cookbooks as part of your testing flow, but you wouldn’t ever send those to 
your Chef Server, you’d just use them to get dependencies for local tests.

Also, you don’t merge Policyfile.lock.json documents, these describe the full 
set of cookbooks you’ll use to configure a host to fulfill a given role in 
your infrastructure. This gives you a guarantee that the exact code you test 
locally is the exact code that you test in staging/qa/etc is the exact code 
that you run in production.
  
>  
> To solve environment-cookbook pattern with berkshelf I've decided to remove 
> cookbook itself and leave only Berksfile with list of top-level cookbooks.
The Policyfile is like the environment cookbook pattern but without the 
environment cookbook.
  
> This Berkfile has two sources:
> 1. Berkshelf API (proxy to my Chef Server, hope berkshelf will work with 
> chef server api directly in next releases)

That is up to the Chef team, not the Berks team. But a ‘universe’ endpoint is 
planned for the server, see this accepted RFC: 
https://github.com/opscode/chef-rfc/blob/master/rfc014-universe-endpoint.md

When that’s added, Policyfiles will also support using your Chef Server as an 
artifact storage location.
  
> 2. Community Site
>  
> Now you can do something like 'berks install', 'berks upload' for updating 
> cookbook information.
> Then, stage by stage you can do:
> 1. berks apply dev
> 2. knife ssh "chef_environment:dev" "sudo chef-client # force global 
> reconfiguration
> 3. <Look that there are no errors>
> 4. berks apply qa
> 5. knife ssh "chef_environment:qa" "sudo chef-client # force global 
> reconfiguration
> 6. Test all
> 7. berks apply production
>  
Policyfiles work the same way, you use `chef push` instead of `berks apply`.

HTH, and happy to chat more,


--  
Daniel DeLeo