CHEF - SYSTEM REQUIREMENTS

System Requirements💻

This part of the blog discusses the requirements your device must satisfy to implement chef automate high availability in your network infrastructure. Before directly jumping into the chef-system requirements for hardware, let us first look at some crucial points.
 

📌A minimum requirement of 3 nodes should be satisfied for Postgres and OpenSearch.

📌OpenSearch volume depends on the number of nodes present in the cluster.

📌OpenSearch volume also depends on the frequency of chef infra client runs.

Hardware Requirements📍

There are some assumptions based on which we have some benchmarking tests, which are an essential part of the hardware requirements.

✅Frequency of event feed: 1/hour

✅Data retention policy:    1/days

✅Client run size:   300 Kb

✅Frequency of compliance scan: 1/hour

✅Frequency of client runs:  1/hour

✅Event feed update size:    2Kb

✅Compliance scan report size:  400Kb

The machine requirements are also listed below.

Type	vCPU	RAM	Count	Storage Size
Chef Infra Server	2	8	2	80Gb
Bastion Machine	2	8	1	150Gb
Chef Automate	2	8	2	80Gb
Postgres	2	8	3	150Gb
OpenSearch	2	8	3	58.9Gb

Software Requirements💻

After going through the chef-system requirements for hardware, let us now look at the software requirements. The chef-system requirements for software refer to the operating systems and the required version are given in the following table -

Operating System	Version Required
Centos(64 bit)	7
Ubuntu(64 bit)	16.04.x, 18.04.x, 20.04.x
Red Hat Enterprise Linux(64 bit)	7 or 8
Amazon Linux 2(64 bit)	2
Suse Linux	12

Let’s go through the next topic, which is firewall and security!

Firewall and Security⭕

The chef-system requirements also include multiple ports for frontend and backend servers in order to operate efficiently. This also reduces the traffic on the network.

Let us have a look at these ports in detail.

Type	Incoming	Outgoing
Postgres	TCP 22, 9631, 7432, 5432, 9638 UDP 9638	TCP 22, 9631, 7432, 5432, 9638 UDP 9638
OpenSearch	TCP 22, 9631, 9200, 9300, 9638 UDP 9638	TCP 22, 9631, 9200, 9300, 9638 UDP 9638
Bastion Machine	-	TCP 22, 9631
Chef Infra Server	TCP 22, 9631, 443, 80	TCP 22, 9631, 443, 80
Chef Automate	TCP 22, 9631, 443, 80	TCP 22, 9631, 443, 80

All the ports that chef uses are basically TCP ports. The ports must manage the services coming to them. We often test whether a specific port is servicing the connections properly or not.

What is TCP?🙄

TCP stands for Transmission Control Protocol. It is a communication protocol enabling computing devices and application programs to communicate over a network. It ensures that the data packets are successfully transmitted and delivered to their destination. It helps in the organization of data between a server and a client.

It first sets up a connection between the data source and destination. Then it breaks large packets of data into smaller packages to ensure adequate transmission.

Let us now go through the ports and their usage. These port definitions are for the TCP protocol.

Port Number	Usage
443	Users can reach API using this
80	Users are redirected to 443
9200	OpenSearch access
9300	Nodes in OpenSearch can distribute their data
9631	Habitat HTTP API
7432	Redirects to Postgres leader
9638	Habitat Gossip

Loadbalancer Configuration🤷‍♀️

Load balancers help to improve the responsiveness of a server. It is a single point of contact for the clients sending in the requests. It is a solution to distribute the traffic of requests on a single network to multiple servers to improve efficiency. It plays a significant role in preventing the server from overloading.

Let us see how the load balancers are configured.

Before proceeding, ensure that you have DNS setup with the following domain name type.

📌Chef Infra Server:chefinfraserver.example.com

📌Chef Automate:chefautomate.example.com

Steps for Setup💻

Nginx: Nginx is a web server used as a load balancer. It is open-source software. It ensures the optimum performance and stability of the server.

✅Install Nginx

For Ubuntu🎯

sudo apt-get update
sudo apt-get install nginx

 

For Centos🎯

sudo yum install epel-release
sudo yum update
sudo yum install nginx

Starting with the Configuration✅

1️⃣Create a file using (for chef automate)

/etc/nginx/sites-available/chef-automate-lb.conf
upstream chef-automate-servers {
   server 10.1.0.101:443 max_fails=2 fail_timeout=30s;
   server 10.1.0.102:443 max_fails=2 fail_timeout=30s;
   server 10.1.0.103:443 max_fails=2 fail_timeout=30s;
}
server {
   listen 443 ssl;
   server_name chefautomate.example.com;
   ssl_certificate /etc/letsencrypt/live/chefautomate.example.com/cert.pem;
   ssl_certificate_key /etc/letsencrypt/live/chefautomate.example.com/privkey.pem;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   location / {
      proxy_pass https://chef-automate-servers;
      proxy_set_header Host $host;
   }
}
server {
   listen 80;
   server_name chefautomate.example.com;
   return 301 https://$server_name$request_uri;
}

 

2️⃣Create a new file (for chef infra server) 

using/etc/nginx/sites-available/chef-infra-server-lb.conf
     upstream chef-infra-servers {
   server 10.1.0.101:443 max_fails=2 fail_timeout=30s;
   server 10.1.0.102:443 max_fails=2 fail_timeout=30s;
   server 10.1.0.103:443 max_fails=2 fail_timeout=30s;
}
server {
   listen 443 ssl;
   server_name chefinfraserver.example.com;
   ssl_certificate /etc/letsencrypt/live/chefinfraserver.example.com/cert.pem;
   ssl_certificate_key /etc/letsencrypt/live/chefinfraserver.example.com/privkey.pem;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   location / {
      proxy_pass https://chef-infra-servers;
      proxy_set_header Host $host;
   }
}
server {
   listen 80;
   server_name chefinfraserver.example.com;
   return 301 https://$server_name$request_uri;
}

 

3️⃣Enabling sites for chef automate and chef infra server

sudo ln -s /etc/nginx/sites-available/chef-automate-lb.conf /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/chef-infra-server-lb.conf /etc/nginx/sites-enabled/

 

4️⃣Testing the configuration

sudo nginx -t

 

5️⃣Restart Nginx now

sudo systemctl restart nginx

We hope you have understood everything about Chef-system requirements. 🙌

Frequently Asked Questions

Are there agents in chef?

Yes, chef uses the master-agent model for its work.

Should I use ansible or chef?

Both ansible and chef have their own advantages and disadvantages. Ansible is easier to understand and implement, whereas chef is known for handling more complex tasks efficiently.

Can chef server be used on windows?

According to the chef-system requirements, chef cannot be installed and set up on a windows machine. You should always use chef on a Linux machine.

What are chef nodes?

Chef nodes basically refer to the machines that are under management by chef.

What do you mean by chef-solo?

Chef solo is an open-source tool that runs locally to establish client-server communication and data transfer.

Conclusion

In this blog, we talked about everything about chef-system requirements. We first looked at the underlying concepts of chef. We then explored the hardware and software chef-system requirements in detail. Finally, we discussed firewall, security, load balancer, and setting up the configuration.

Refer to our guided paths on Coding Ninjas Studio to learn more about DSA, Competitive Programming, JavaScript, System Design, etc. Enroll in our courses and refer to the mock test and problems available.

You can refer to other similar articles as well

• DevOps Interview Questions - Coding Ninjas Coding Ninjas Studio
• Amazon DevOps Guru - Coding Ninjas Coding Ninjas Studio
• Ansible vs. Chef
• Ansible vs. Puppet
• Loadbalancer Configuration
• Platform Support
   

Happy Learning Ninja! 🥷