Configuration Management for Windows Server with Chef and

DSC

Jeffrey SnoverMicrosoft Technical Fellow

Lead Architect for Enterprise Cloud Group@jsnover

Steven MurawskiPrincipal Engineer @ Chef

Microsoft MVP – Cloud and Datacenter Management@stevenmurawski

Agenda• The Evolution of Windows Server and Automation• State of Configuration Management On Windows Server• Configuring Windows Server With Desired State Configuration (DSC)• Configuring Windows Server With Chef• Why Use DSC With Chef?• Bringing Legacy Infrastructure Under Control• Windows Server – Present and Future

LAB Machine Setup• RDP In

USERNAME: ChefPowerShell PASSWORD: P2ssw0rd!

• Open PowerShell from the ChefDK shortcut• Run chef-apply c:/setup.rb

On with the class!

Evolution of Windows Server

Server for the Masses

Enterprise Servers

Datacenter Servers

Cloud Servers

20016: An Automation Odyssey

The Evolution of Automation on Windows Server• 2006 - Windows PowerShell V1

Interactive Shell, Scripting Language, .Net cmdlets• 2009 – Windows PowerShell V2

Remoting, script cmdlets, modules• 2012 – Windows PowerShell V3

WMIv2 cmdlets, jobs• 2013 – Windows PowerShell V4

Desired State configuration• 2015/2016 – Windows PowerShell V5 RTM

DSC+++, Classes, Pester & Operational Validation Framework, Package mgmt., JEA, Remoting improvements, Security+++

• What they are really asking is: Why not:

Salt? Chef? Ansible? Puppet? CFEngine? GuardRail? BrewMaster?

• Lots of great tools for Unix, why not just use them?

Why DSC?

“Why PowerShell DSC?” is the wrong question

• Why PowerShell?• Why not just use *sh and the Unix utils?

Right Question

• If you can edit files and restart processes, you can manage Unix• awk, grep, sed are management tools

Unix is a document-oriented OS

• awk didn’t work against WMI• grep didn’t work against Active Directory• sed didn’t work against Registry

Windows is an API-oriented OS

• Unix CM tools “hit a brick wall” managing Windows• Need tools which work against an API-oriented OS

Why DSC?

State of Configuration Management On Windows Server• Until Desired State Configuration there

were MMCs and WMI as the default admin interface on Windows Server was no central standard for administrative automation and configuration (modulo

GP for clients) Chef and Puppet worked on Windows, mostly as very thin wrappers over a bunch

of PowerShell• Enter Desired State Configuration (DSC) platform which

identified a standard for how to define configuration management tasks supports a growing ecosystem of configuration management resources enables a resource-sharing hub – the PowerShell Gallery

DSC enables a rich ecosystem of CM tools that will compete on features vs coverage

Configuring Windows Server With Desired State Configuration

• New Keywords Configuration Node Import-DscResource

Find the lab at https://github.com/smurawski/chef-and-windows-lab

• New Automatic Variables ConfigurationData AllNodes Node

• Resources Binary Script WMI Class-based

wusa C:\Win8.1AndW2K12R2-KB3134758-x64.msu

LAB Exercise 1 – Build and Apply a Basic Configuration

https://github.com/smurawski/chef-and-windows-lab/tree/master/exercise-1

Configuring Windows Server With Chef• Chef is a mature platform with evolving capabilities around

Audit and Compliance Reporting and Analytics Continuous Delivery for Applications and Infrastructure

• Chef has embraced DSC and the Windows Server management model One of the first partners integrating DSC Started shipping support for DSC in September 2014

Why Use DSC with Chef?• DSC is great and Chef is great• DSC is a platform feature, not an end to end solution• DSC has some rough edges• How Chef helps• What DSC offers to Chef

Why Use DSC with Chef?• DSC is great and Chef is great

Both systems have strong capabilities on their own. Chef is a mature, flexible automation platform. DSC is built into the Windows operating system and has a growing ecosystem of

resources.• DSC is a platform feature, not an end to end solution• DSC has some rough edges• How Chef helps• What DSC offers to Chef

Why Use DSC with Chef?• DSC is great and Chef is great• DSC is a platform feature, not an end to end solution

DSC primarily is a platform feature (the Local Configuration Manager and the patterns for resources).

DSC has limited constructs for separating out environment specific data. There are workflow and management limits. You will need to build some tooling.

• DSC has some rough edges• How Chef helps• What DSC offers to Chef

Why Use DSC with Chef?• DSC is great and Chef is great• DSC is a platform feature, not an end to end solution• DSC has some rough edges

Resources in a configuration cannot execute conditionally. Resources cannot be reused inside other resources (outside of composite

resources). Parameters to resources have to be provided ahead of time.

• How Chef helps• What DSC offers to Chef

Why Use DSC with Chef?• DSC is great and Chef is great• DSC is a platform feature, not an end to end solution• DSC has some rough edges• How Chef helps

Use run-time information to determine how policy is applied. Constructs for modeling your environmental data – roles, environments, data bags,

and policyfiles. Workflow tooling in the Chef Development Kit (ChefDK), to help scaffold and

extend projects. Strong community of test tools including lint, syntax, unit, and

integration/acceptance. Compliance as a first-class citizen (testing tools, Audit mode, and Chef

Compliance). Chef server makes configuration and environment data available for reporting and

during configuration management tasks.• What DSC offers to Chef

Why Use DSC with Chef?• DSC is great and Chef is great• DSC is a platform feature, not an end to end solution• DSC has some rough edges• How Chef helps• What DSC offers to Chef

Resources, resources, and more resources.

More Resources == More Options

LAB Exercise 2 – Build and Apply a Basic Chef Recipe

https://github.com/smurawski/chef-and-windows-lab/tree/master/exercise-2

Where Should I Use DSC Resources vs. Chef Resources?• 5 Questions For IT Operations

Is there a cookbook with resources or recipes on Supermarket that meets the use case?

Is there a DSC resource in PowerShell Gallery that meets the use case? How easily can I test that the (recipe/resource) meets my need? Is my team stronger in Ruby or PowerShell? What kind of community support is out there for the recipe/resource?

Where Should I Use DSC Resources vs. Chef Resources?• 5 Questions For IT Operations

Is there a cookbook with resources or recipes on Supermarket that meets the use case?

Is there a DSC resource in PowerShell Gallery that meets the use case? Very often the presence of a community resource or recipe can get us 80 to 90%

of the way to solving our problem. Even when there is overlap, there can be differences in their behavior.

How easily can I test that the (recipe/resource) meets my need? Is my team stronger in Ruby or PowerShell? What kind of community support is out there for the recipe/resource?

Where Should I Use DSC Resources vs. Chef Resources?• 5 Questions For IT Operations

Is there a cookbook with resources or recipes on Supermarket that meets the use case?

Is there a DSC resource in PowerShell Gallery that meets the use case? How easily can I test that the (recipe/resource) meets my need?

Probably the most important aspect, if you cannot verify what the resource or recipe does, you cannot trust the resource in production.

Is my team stronger in Ruby or PowerShell? What kind of community support is out there for the recipe/resource?

Where Should I Use DSC Resources vs. Chef Resources?• 5 Questions For IT Operations

Is there a cookbook with resources or recipes on Supermarket that meets the use case?

Is there a DSC resource in PowerShell Gallery that meets the use case? How easily can I test that the (recipe/resource) meets my need? Is my team stronger in Ruby or PowerShell?

If you have to build a custom resource or modify an existing one, where does your team’s skillset lie?

You will need to troubleshoot the application of resources at some point. What kind of community support is out there for the recipe/resource?

Where Should I Use DSC Resources vs. Chef Resources?• 5 Questions For IT Operations

Is there a cookbook with resources or recipes on Supermarket that meets the use case?

Is there a DSC resource in PowerShell Gallery that meets the use case? How easily can I test that the (recipe/resource) meets my need? Is my team stronger in Ruby or PowerShell? What kind of community support is out there for the recipe/resource?

One of the greatest parts of the Chef and PowerShell communities is the depth of the community support.

DSC is still fairly new in the PowerShell community.

Where Should I Use DSC Resources vs. Chef Resources?• 5 Questions For IT Operations

Is there a cookbook with resources or recipes on Supermarket that meets the use case?

Is there a DSC resource in PowerShell Gallery that meets the use case? How easily can I test that the (recipe/resource) meets my need? Is my team stronger in Ruby or PowerShell? What kind of community support is out there for the recipe/resource?

One of the greatest parts of the Chef and PowerShell communities is the depth of the community support.

DSC is still fairly new in the PowerShell community.

Where Should I Use DSC Resources vs. Chef Resources?• For ISV (Independent Software Vendors),

if you build software to run on Windows Server

THERE ISNO

QUESTION

BUILD DSC RESOURCES

Windows Server 2016• Great server for

the Masses, the Enterprise, the Datacenter and now the Cloud• Cloud Competitive OS

Small and Fast Devops friendly Minimize attack service Minimize patches/reboots

• Ergo: NanoServer Desired State Configuration +++ WSA, Pkg Mgmt, Pester, OVT, JIT, JEA, Containers & Docker Remote Management Tool & Emergency Mgmt Console PowerShell Core

Bringing Legacy Infrastructure Under Control• When you have to make a change in a legacy code base, here is an algorithm you can use.

Identify change points. Find test points. Break dependencies. Write tests. Make changes and refactor.

Source: Feathers, Michael C. Working Effectively with Legacy Code. Upper Saddle River, NJ: Prentice Hall PTR, 2004.

Bringing Legacy Infrastructure Under Control• There is no “easy” button

It’s Just Not Going To Happen.

Get Over It.

LAB Exercise 3 – Using Pester To Define Acceptance Tests For

Legacy Infrastructurehttps://github.com/smurawski/chef-and-windows-lab/tree/master/exercise-3

Questions?Non-bullet slide subtitle

More Resources• https://learn.chef.io• https://msdn.microsoft.com/powershell• http://stevenmurawski.com/devops-reading-list • http://aka.ms/thereleasepipelinemodel (or http://aka.ms/trpm )• https://supermarket.chef.io• https://powershellgallery.com• https://github.com/powershell• https://github.com/chef-cookbooks