This document provides instructions for setting up and running a private instance of Supermarket, the cookbook management site created by Chef. It describes installing the Private Supermarket package, configuring it to connect to an existing Chef server, and uploading cookbooks for internal use and sharing. Key steps include preparing the Chef server, installing Supermarket using an omnibus package and wrapper cookbook, registering the Supermarket node, and interacting with it using the knife supermarket plugin. A private Supermarket allows companies to securely manage and share company-specific cookbooks internally.

1. A Supermarket of Your Own: Running a
Private Supermarket
Nell Shamrell-Harrington

2. Who am I?

3. Nell Shamrell-Harrington
• Software Development Engineer at Chef
• Twitter: @nellshamrell
• Email: nshamrell@chef.io

4. Why Private Supermarket?

5. Supermarket – in the beginning…
• Started as the public community cookbooks site
• Can browse cookbooks from anywhere
• People really liked it!

6. However…
• Some companies create very company-specific cookbooks
• And cannot share those cookbooks publicly
• Still want to share internally

7. Before Private Supermarket
• Store Cookbooks on Github Enterprise
PROBLEM: Hard to know exactly what to search for
• Use Berkshelf with Github Enterprise
PROBLEM: Resolving dependencies directly from Github repos is slow

8. Private Supermarket – in the beginning…
• Chef Summit 2014 - Customers requested ability to run their own copy of
Supermarket
• Hadn’t thought of this before…but ready to try it
• Build a stand alone Supermarket package using Chef Omnibus Packager
https://github.com/chef/omnibus

9. Benefits of Private Supermarket
• Easily searchable cookbook repository that can on a company’s internal network
• Friendly GUI and command line interfaces
• Supermarket API simplifies and speeds up Berkshelf runs
• Easier to formalize process of release cookbooks

10. Sounds Great…
How Do I Get My Own Private Supermarket?

11. Installing Private Supermarket

12. Requirements
• Running Chef Server – need for oc-id (Chef Oauth Provider)

13. Requirements
• Running Chef Server – need for oc-id (Chef Oauth Provider)
• Admin User Account on Chef Server

14. Requirements
• Running Chef Server – need for oc-id (Chef Oauth Provider)
• Admin User Account on Chef Server
• Key for User Account on Chef Server

15. Requirements
• Running Chef Server – need for oc-id (Chef Oauth Provider)
• Admin User Account on Chef Server
• Key for User Account on Chef Server
• Fresh VM with 1 GB Memory (we use an Ubuntu instance on AWS)

16. What is oc-id?
• Chef’s Authentication/Authorization
Service
• Use credentials for Chef Server users to
access other applications
• Uses OAuth2 to talk to any applications
authorized by Chef Server

17. What is oc-id?

18. What is oc-id?
User clicks “Sign
In”

19. What is oc-id? User redirected to Chef
Server

20. What is oc-id? User signs into Chef Server

21. What is oc-id?
User is redirected to Supermarket, now signed
in!

22. Preparing Your Chef Server
• SSH into your Chef Server
$ (your workstation) ssh user@your-chef-server

23. Preparing Your Chef Server
• Open up /etc/opscode/chef-server.rb
$ (your chef server) sudo vim /etc/opscode/chef-server.rb

24. Preparing Your Chef Server
• Add this content, then save and exit the file
oc_id[‘applications’] = {
‘supermarket’ => {
‘redirect_uri’ => ‘https://supermarket-
hostname/auth/chef_oauth2/callback’
}
}

25. Preparing Your Chef Server
• Reconfigure your Chef Server
$ (your chef server) sudo chef-server-ctl reconfigure

26. Preparing Your Chef Server
• Look at /etc/opscode/oc-id-applications/supermarket.json – will need these
values later
$ (your chef server) sudo cat /etc/opscode/oc-id-
applications/supermarket.json
{
“name”: “supermarket”,
“uid”: “123……989”
“secret”: “1234…897”
“redirect uri”: “https://supermarket-
hostname/auth/chef_oauth2/callback”
}

27. Preparing Your Supermarket
• Will be using Irving Popovetsky’s supermarket-omnibus-cookbook
https://github.com/irvingpop/supermarket-omnibus-cookbook
• There IS another community cookbook, but uses an outdated method for installing Supermarket
and is (as of 8/17) no longer supported by Chef
• A blog post on converting from the old community cookbook to the new Supermarket cookbook is coming
soon!

28. • Good practice – using a wrapper cookbook with Irving’s cookbook
• Will need to supply certain attributes through wrapper cookbook
Preparing Your Supermarket

29. Preparing Your Supermarket
Wrapper
Cookbook
• Defines node[supemarket_omnibus]
attributes

30. Preparing Your Supermarket
Wrapper
Cookbook
Omnibus
Supermarket
Cookbook
• Defines node[supemarket_omnibus]
attributes
• Installs supermarket omnibus
package
• Writes node[supermarket_omnibus]
attributes to
/etc/supermarket/supermarket.json

31. Preparing Your Supermarket
Wrapper
Cookbook
Omnibus
Supermarket
Cookbook
Omnibus
Supermarket
Package
• Has internal Chef cookbook to run
• Configures package using
attributes defined in:
/etc/supermarket/supermarket.json
• supermarket-ctl reconfigure
• Like running chef solo
• Defines node[supemarket_omnibus]
attributes
• Installs supermarket omnibus
package
• Writes node[supermarket_omnibus]
attributes to
/etc/supermarket/supermarket.json

32. Preparing Your Supermarket
• Create wrapper cookbook on your local workstation
$ (your workstation) chef generate cookbook my-supermarket-wrapper
$ (your workstation) cd my-supermarket-wrapper

33. Preparing Your Supermarket
• Open your cookbook’s metadata.rb
$ (your workstation) vim metadata.rb

34. Preparing Your Supermarket
• Add dependency on the supermarket-omnibus-cookbook to metadata.rb. Save
and close file.
depends ‘supermarket-omnibus-cookbook’

35. Preparing Your Supermarket
• Open your cookbook’s default recipe at recipes/default.rb
$ (your workstation) vim recipes/default.rb

36. Preparing Your Supermarket
• Include the default recipe of the supermarket-omnibus-cookbook
include_recipe ‘supermarket-omnibus-cookbook’

37. Preparing Your Supermarket
• Next, need to define attributes for your Supermarket and how it connects to Chef
Server
• Can hard code attributes in your wrapper cookbook’s default recipe
• Better practice – place attributes in a databag, then reference it in your recipe
• At minimum – must define
• chef_server_url
• chef_oauth2_app_id
• chef_oauth2_secret

38. Preparing Your Supermarket
• Add attributes to wrapper cookbook’s default recipe
# calling the data bag
app = data_bag_item(‘apps’, ‘supermarket’)

39. Preparing Your Supermarket
• Add attributes to wrapper cookbook’s default recipe, save and close.
# calling the data bag
app = data_bag_item(‘apps’, ‘supermarket’)
node.set[‘supermarket_omnibus’][‘chef_server_url’] = app[‘chef_server_url’]
node.set['supermarket_omnibus']['chef_oauth2_app_id'] = app[‘app_id’]
node.set['supermarket_omnibus']['chef_oauth2_secret'] = app[‘secret’]

40. Preparing Your Supermarket
• Download dependent cookbooks using Berkshelf
$ (your workstation) berks install

41. Preparing Your Supermarket
• Then upload all dependent cookbooks to your Chef Server
$ (your workstation) cd ~/.berkshelf/cookbooks
$ (your workstation) knife cookbook upload -a

42. Preparing Your Supermarket
• Now upload your wrapper cookbook
$ (your workstation) cd path/to/wrapper/cookbook/..
$ (your workstation) knife cookbook upload -a

43. Preparing Your Supermarket
• Bootstrap and register your Supermarket node with your Chef Server
# For an Ubuntu node on AWS
$ (your workstation) knife bootstrap ip_address –N supermarket-
node –x ubuntu --sudo

44. Preparing Your Supermarket
• Bootstrap and register your Supermarket node with your Chef Server
# For an Ubuntu node on AWS
$ (your workstation) knife bootstrap ip_address –N supermarket-
node –x ubuntu –-sudo
# -N flag defines name of node

45. Preparing Your Supermarket
• Bootstrap and register your Supermarket node with your Chef Server
# For an Ubuntu node on AWS
$ (your workstation) knife bootstrap ip_address –N supermarket-
node –x ubuntu –sudo
# -N flag defines name of node
# -x flag defines username to use (default on AWS is ubuntu)

46. Preparing Your Supermarket
• Bootstrap and register your Supermarket node with your Chef Server
# For an Ubuntu node on AWS
$ (your workstation) knife bootstrap ip_address –N supermarket-
node –x ubuntu –sudo
# -N flag defines name of node
# -x flag defines username to use (default on AWS is ubuntu)
# --sudo runs bootstrap command as sudo on node

47. Preparing Your Supermarket
• Edit your Supermarket node
$ (your workstation) knife node edit supermarket-node

48. Preparing Your Supermarket
• Add wrapper cookbook’s default recipe to Supermarket node’s run list, save and
quit file
"run_list": [
“recipe[my_supermarket_wrapper::default]”
]

49. Preparing Your Supermarket
• SSH into your Supermarket node
# For an Ubuntu instance on AWS
$ (your workstation) ssh ubuntu@your-supermarket-node-public-dns

50. Preparing Your Supermarket
• Run Chef Client
$ (your-supermarket-node) sudo chef-client

51. Using Private Supermarket

52. Using Private Supermarket
• Open up /etc/hosts on your local workstation
$ (your workstation) vim /etc/hosts

53. Using Private Supermarket
• Add an entry for your Supermarket instance
# Supermarket ip address Supermarket hostname
00.00.000.000 supermarket-hostname

54. Using Private Supermarket
• Visit Supermarket hostname in browser (accept SSL certificate)
• Click the “Create Account” link

55. Using Private Supermarket
• Log into your Chef Server

56. Using Private Supermarket
• Authorize the app to use your Chef Server account

57. Using Private Supermarket
• And you’re in!

58. Using Private Supermarket
• Knife Supermarket Plugin
Best current way to interact with a private Supermarket
https://github.com/chef/knife-supermarket

59. Using Private Supermarket
• Install knife-supermarket
# If using the Chef DK
$ chef gem install knife-supermarket
# If not using the Chef DK
$ gem install knife-supermarket

60. Using Private Supermarket
• Open up knife.rb
$ vim .chef/knife.rb

61. Using Private Supermarket
• Define supermarket site in knife.rb, then save and close.
knife[:supermarket_site] = ‘https://your-private-supermarket’

62. Using Private Supermarket
• knife supermarket commands
• same as knife cookbook site commands
• see https://docs.chef.io/knife_cookbook_site.html

63. Using Private Supermarket
• Using knife supermarket share
$ (your-workstation) knife supermarket share ‘my_cookbook’

64. Using Private Supermarket
• When you first use this command, might see an SSL error
$ (your-workstation) knife supermarket share ‘my_cookbook’
Making tarball my_cookbook.tgz
ERROR: Error uploading cookbook my_cookbook to the Opscode
Cookbook Site: SSL_connect returned=1 errno=0 state=SSLv3 read
server certificate B: certificate verify failed. Increase log
verbosity (-VV) for more information.

65. Using Private Supermarket
• By default, Chef 12 enforces ssl when sharing cookbooks (Chef 11 did NOT do
this)
• Private Supermarkets (by default) use self-signed certificates
• When using chef-client 12.4 or above, can fix error through fetching
Supermarket’s ssl certificate
• When using < chef-client 12.4, must set knife[:ssl_verification] = :verify_none

66. Using Private Supermarket
• When using >= Chef 12.4, fetch the ssl certificate of your Private Supermarket
$ (your workstation) knife ssl fetch https://your-private-supermarket

67. Using Private Supermarket
• When using >= Chef 12.4, fetch the ssl certificate of your Private Supermarket
$ (your workstation) knife ssl fetch https://your-private-
supermarket
WARNING: Certificates from your-private-supermarket will be fetched
and placed in your trusted_cert
directory (/home/ubuntu/.chef/trusted_certs).
Knife has no means to verify these are the correct certificates. You
should
verify the authenticity of these certificates after downloading.

68. Using Private Supermarket
• Then check the ssl certificate
$ (your-workstation) knife ssl check https://your-private-supermarket

69. Using Private Supermarket
• Then check the ssl certificate
$ (your-workstation) knife ssl check https://your-private-supermarket
[Connecting to host your-private-supermarket:443
Successfully verified certificates from `your-private-supermarket'

70. Using Private Supermarket
• Now try sharing the cookbook again
$ (your-workstation) knife supermarket share ‘my_cookbook’

71. Using Private Supermarket
• Success!
$ (your workstation) knife supermarket share ‘my_cookbook’
Generating metadata for my_cookbook from /tmp/chef-my_cookbook-
build20150722-14976-8e8bdz/my_cookbook/metadata.rb
Making tarball my_cookbook.tgz
Upload complete!

72. Managing Private Supermarket

73. Managing Private Supermarket
• You can manage services and other settings of your instance with supermarket-
ctl

74. Managing Private Supermarket
• You can manage services and other settings of your instance with supermarket-
ctl
• Examples:
supermarket-ctl reconfigure - does an internal Chef run based on the cookbooks
included
within the omnibus package
supermarket-ctl make-admin user - makes a supermarket user an admin user
supermarket-ctl restart - stops services if they are running, then starts them again

75. Managing Private Supermarket
• Restarting services on your Supermarket instance
$ (your-supermarket-node) sudo supermarket-ctl restart
ok: run: nginx: (pid 16737) 1s
ok: run: postgresql: (pid 16742) 0s
ok: run: rails: (pid 16751) 1s
ok: run: redis: (pid 16755) 0s
ok: run: sidekiq: (pid 16760) 0s

76. Managing Private Supermarket
• Monitoring URL: https://your_private_supermarket/status

77. Other Tools You Can Use
With Private Supermarket

78. Stove
https://github.com/sethvargo/stove

79. Berkshelf Integration

80. Berksfile
source 'https://supermarket.yourcompany.com'
source 'https://supermarket.chef.io'
...

81. Dependency Resolution
• Multiple sources can be defined in a Berksfile
• Cookbook dependency resolution is performed from the top down. i.e. the
source defined first in the Berksfile will be searched for a cookbook version
before the second source and so on.

82. Alternative Datastores / HA

83. Public Supermarket HA configuration

84. Why?
• Make better use of Amazon's services RDS, Elasticache and S3
• Make your company’s existing infrastructure better
• Handle a heavy traffic load spike
• Improve uptime

85. Load Balancing

86. Load Balancer Health Checks
http://app1-staging-supermarket.internal/status
{
"status":"ok",
...
}

87. External Database

88. Postgres / RDS
node.set['supermarket_omnibus']['postgresql']['enable'] = false
node.set['supermarket_omnibus']['database']['user'] = 'supermarket'
node.set['supermarket_omnibus']['database']['name'] = 'supermarket'
node.set['supermarket_omnibus']['database']['host'] = 'yourcompany...rds.amazon.com'
node.set['supermarket_omnibus']['database']['port'] = '5432'
node.set['supermarket_omnibus']['database']['pool'] = '25'
node.set['supermarket_omnibus']['database']['password'] = 'topsecretneverguessit'

89. Cache

90. Cache Configuration
node.set['supermarket_omnibus']['redis']['enable'] = false
node.set['supermarket_omnibus']['redis_url'] =
'redis://supermarket.yourcompany.use1.cache.amazonaws.com:6379'

91. Storage

92. Cookbook Storage Methods
• Local Filesystem
• S3

93. S3 Configuration
node.set['supermarket_omnibus']['s3_access_key_id'] = 'XYZXYZXYZXYZXYZXYZ'
node.set['supermarket_omnibus']['s3_bucket'] = 'supermarket'
node.set['supermarket_omnibus']['s3_secret_access_key'] = 'wXYzwXYzwXYzwXYzwXYz'

94. Additional Configuration Options
• https://github.com/chef/omnibus-
supermarket/blob/master/cookbooks/omnibus-
supermarket/attributes/default.rb