You should go to great lengths to protect your pivotal.pem so that only administrators of chef-servers know about it. One approach would be to pre-create the pivotal.pem in advance and setup chef-server to use your specified pivotal.pem. This is assuming only administrators users can access your chef server vms. When you have multiple production chef servers it makes life easier for administrator if they all use the same pivotal.pem.
The problem of user management becomes very complicated when you're dealing with multiple chef servers in your infrastructure. Initially I was hoping chef replication would be able to sync RBAC information (users/groups/orgs) across servers but unfortunately it only focusses on policy information (cookbooks, roles, data bags, environments). Leaning towards having custom automation around dynamically figuring out originations/users that need to be created, which users should be members of an org, and what group within org should they be part of (group permissions). Although I guess LDAP integration might already solve this problem. Has anyone played around with LDAP yet? Do orgs/users get created automatically when you integrate with an LDAP server?
- Phil
-----Original Message-----
From: Noah Kantrowitz [mailto: "> ]
Sent: Thursday, March 05, 2015 1:31 PM
To: ">
Subject: [chef] Re: Controlling the Chef 12 Pivotal user
On Mar 3, 2015, at 3:35 PM, Michael Weinberg < "> > wrote:
> Taking this off twitter (https://twitter.com/luckymike/status/572856407692746754) and to the list.
>
> It's unclear to me how one can manage the pivotal admin user. There's no user editing via chef-server-ctl or knife, and the user creation seems to occur deep within the chef-server-core installer. What is the approach for controlling that user creation and/or updating the user?
So the problem is that this user is kind of magic. It is used in a lot of places as a non-member superuser for internal administration tasks like adding new users or creating new orgs. You can edit some of the data, like give it a new display name (though nothing uses that so not terribly interesting) but changing its permissions would likely brick your Chef Server. You should never need to actually touch the pivotal user, and it should be as invisible as possible (the Web UI automatically hides) because it is effectively an implementation detail of Chef Server.
--Noah
Archive powered by MHonArc 2.6.16.