4 ms·

That's harsh. Once you're dug into a conf mgmt system it's hard to dig yourself out. I've never used Chef myself but I have noticed some message board posts la

That's harsh. Once you're dug into a conf mgmt system it's hard to dig yourself out. I've never used Chef myself but I have noticed some message board posts lately claiming it's dead in the water and Ansible is the victor. I've used Ansible since it came out, came straight from Puppet, so I'm biased. But I don't care what you use, as long as it works.

aleph- 7y ago
Is it hard to dig yourself out though?
- CameronNemo 7y ago
  1. If there is nobody who knows how the previous conf mgmt system was configured, or how the technology works. 2. If there is nobody willing to adopt a cluster using conf mgmt that they do not prefer. We had an admin that set up an ELK cluster with cfengine. All of the other admins do not claim to understand it, and hesitate to maintain it, update it, make changes to it, and otherwise perform their job duties. One of the admins is partial to Chef, and the other wants to maintain the ELK cluster with Kubernetes. Only problem is neither has done so, and they have made little progress. I hope to see that change.
- outworlder 7y ago
  > Is it hard to dig yourself out though? It can be, depending on how complex your environment is and the availability of people that understand it. Chef doesn't make this easy by storing so much "state" (nodes, environment, databags, etc). But at the end of the day, these are just scripts. You can reverse-engineer the environment and replicate in Ansible or what have you. One red flag is, if this process is found to be too difficult(as opposed to just time-consuming), then you have a very incomplete understanding of your system. That's dangerous.
brenden2 7y ago
I used to use Chef, have mostly switched to Ansible. Not sure about "dead in the water" but my experience has been that Ansible is a better tool.
- marcosdumay 7y ago
  Coming from Puppet, I almost migrated to Chef long ago because Puppet lacks stability (not "the system is down" stability, but "all my scripts stopped working again this month"), but looking at it, I concluded Chef lacked it too. I'm still at the "shell scripts are enough for everybody" camp, but Ansible is looking stable enough to use.
  - GhettoMaestro 7y ago
    Terraform + Ansible and a little Salt has pretty much deleted my needs for Chef and Puppet. Strongly recommend TF + Ansible as a building block of orchestration + post-orchestration config mgmt.
  - jes5199 7y ago
    I used to be a core Puppet developer. We tried, we really did, but we were unable to rehabilitate that codebase. I would not recommend anyone use it.
gtsteve 7y ago
I was under the impression that this is a consulting contract that will eventually end. They haven't said anything about banning government agencies using the product directly, so my guess is that said agencies are just going to have to find someone else to provide that expertise while they continue to use Chef's products.
Twirrim 7y ago
It's an open source project. ICE can, and likely will, continue to use the software. Chef is just no longer going to provide them with a paid support contract.
- sl1ck731 7y ago
  Which, in my experience, makes continued use of it completely impossible. There is no other product I've had to sit through vendor calls as much with while trying to do some kind of maintenance on the Chef server.
  - dodobirdlord 7y ago
    ICE will likely contract at great expense with individual ex-Chef engineers.
- dredmorbius 7y ago
  ICE will have to find, and pay, those willing and able to do such support. Those willing and able to do such support will find themselves with a very narrowed set of non-ICE clients. There's a reason moral suasion and taboo are such effective social management engines.
dastx 7y ago
All these replies saying ansible is the better tool. Highly disagree. Ansible is too procedural. "do this if that otherwise something else. Then that. Then this other thing". This is very much prone to human error. As a platform engineer I care that this file exists with this specific content and these specific permissions. I don't care how it happens. Puppet and Chef have the advantage of being declarative and that's 100% better than procedurally telling ansible what to do and what not to do (plus the overheads of every ssh connection that it creates every single time it generates a script). You might as well just write a bash script that does it all for you and execute it over ssh.
- avtar 7y ago
  > As a platform engineer I care that this file exists with this specific content and these specific permissions. I don't care how it happens. Puppet and Chef have the advantage of being declarative and that's 100% better than procedurally telling ansible what to do and what not to do These examples seem as declarative as Chef and Puppet: https://docs.ansible.com/ansible/latest/modules/file_module.html#examples https://docs.ansible.com/ansible/latest/modules/file_module.... https://docs.ansible.com/ansible/latest/modules/template_module.html#examples https://docs.ansible.com/ansible/latest/modules/template_mod...
StreamBright 7y ago
I have used all 3 of them in the order of Chef, Puppet, Ansible. I still have bad dreams about Chef & Puppet. I never had any serious problem with Ansible. Maybe because its design is much simpler.
takeda 7y ago
I personally used Chef, Salt and Ansible, Ansible was the easiest to start with, but also the least dependable one, and didn't deliver on one thing it supposed to - reproducibility. On the same image it sometimes succeeded and sometimes failed. This was happening on Amazon Linux 2, and basically once in a while yum database got corrupted. I'm suspecting there was a conflict between yum run by Amazon Linux 2 on boot, and ansible didn't respect locks acquired by yum?

aleph- 7y ago

Is it hard to dig yourself out though?

CameronNemo 7y ago
1. If there is nobody who knows how the previous conf mgmt system was configured, or how the technology works. 2. If there is nobody willing to adopt a cluster using conf mgmt that they do not prefer. We had an admin that set up an ELK cluster with cfengine. All of the other admins do not claim to understand it, and hesitate to maintain it, update it, make changes to it, and otherwise perform their job duties. One of the admins is partial to Chef, and the other wants to maintain the ELK cluster with Kubernetes. Only problem is neither has done so, and they have made little progress. I hope to see that change.
outworlder 7y ago
> Is it hard to dig yourself out though? It can be, depending on how complex your environment is and the availability of people that understand it. Chef doesn't make this easy by storing so much "state" (nodes, environment, databags, etc). But at the end of the day, these are just scripts. You can reverse-engineer the environment and replicate in Ansible or what have you. One red flag is, if this process is found to be too difficult(as opposed to just time-consuming), then you have a very incomplete understanding of your system. That's dangerous.

brenden2 7y ago

I used to use Chef, have mostly switched to Ansible. Not sure about "dead in the water" but my experience has been that Ansible is a better tool.

marcosdumay 7y ago
Coming from Puppet, I almost migrated to Chef long ago because Puppet lacks stability (not "the system is down" stability, but "all my scripts stopped working again this month"), but looking at it, I concluded Chef lacked it too. I'm still at the "shell scripts are enough for everybody" camp, but Ansible is looking stable enough to use.
- GhettoMaestro 7y ago
  Terraform + Ansible and a little Salt has pretty much deleted my needs for Chef and Puppet. Strongly recommend TF + Ansible as a building block of orchestration + post-orchestration config mgmt.
- jes5199 7y ago
  I used to be a core Puppet developer. We tried, we really did, but we were unable to rehabilitate that codebase. I would not recommend anyone use it.

gtsteve 7y ago

I was under the impression that this is a consulting contract that will eventually end. They haven't said anything about banning government agencies using the product directly, so my guess is that said agencies are just going to have to find someone else to provide that expertise while they continue to use Chef's products.

Twirrim 7y ago

It's an open source project. ICE can, and likely will, continue to use the software. Chef is just no longer going to provide them with a paid support contract.

sl1ck731 7y ago
Which, in my experience, makes continued use of it completely impossible. There is no other product I've had to sit through vendor calls as much with while trying to do some kind of maintenance on the Chef server.
- dodobirdlord 7y ago
  ICE will likely contract at great expense with individual ex-Chef engineers.
dredmorbius 7y ago
ICE will have to find, and pay, those willing and able to do such support. Those willing and able to do such support will find themselves with a very narrowed set of non-ICE clients. There's a reason moral suasion and taboo are such effective social management engines.

dastx 7y ago

All these replies saying ansible is the better tool. Highly disagree. Ansible is too procedural. "do this if that otherwise something else. Then that. Then this other thing". This is very much prone to human error. As a platform engineer I care that this file exists with this specific content and these specific permissions. I don't care how it happens. Puppet and Chef have the advantage of being declarative and that's 100% better than procedurally telling ansible what to do and what not to do (plus the overheads of every ssh connection that it creates every single time it generates a script). You might as well just write a bash script that does it all for you and execute it over ssh.

avtar 7y ago
> As a platform engineer I care that this file exists with this specific content and these specific permissions. I don't care how it happens. Puppet and Chef have the advantage of being declarative and that's 100% better than procedurally telling ansible what to do and what not to do These examples seem as declarative as Chef and Puppet: https://docs.ansible.com/ansible/latest/modules/file_module.html#examples https://docs.ansible.com/ansible/latest/modules/file_module.... https://docs.ansible.com/ansible/latest/modules/template_module.html#examples https://docs.ansible.com/ansible/latest/modules/template_mod...

StreamBright 7y ago

I have used all 3 of them in the order of Chef, Puppet, Ansible. I still have bad dreams about Chef & Puppet. I never had any serious problem with Ansible. Maybe because its design is much simpler.

takeda 7y ago

I personally used Chef, Salt and Ansible, Ansible was the easiest to start with, but also the least dependable one, and didn't deliver on one thing it supposed to - reproducibility. On the same image it sometimes succeeded and sometimes failed. This was happening on Amazon Linux 2, and basically once in a while yum database got corrupted. I'm suspecting there was a conflict between yum run by Amazon Linux 2 on boot, and ansible didn't respect locks acquired by yum?