Distributed Configuration Enforcement Engine (Ceph Infra Client, Habitat)

Distributed Ceph Infra client, Habitat

Chef Software developed Chef Infra, an Infrastructure-as-Code (IaC) platform that automates following on remote laptop/servers/clients:
- Download artifacts (software to be installed. eg: nginx1.28)
- Verify checksums/signatures
- Execute installers or configuration changes
- Restart services if necessary
- Verify final state
- Report compliance

Ceph Infra client & Habitat

	Ceph Infra client	Habitat
What	Machine/infrastructure-level desired-state management. Works it can do: 1. Download pacakges using RPM/DEB/MSI 2. Machine state management(Check OpenSSL ,Create nginx user ,Create directories ,Install certificate ,Configure firewall ,Configure OS) 3. Habitat to install nginx binary, Ceph Infra will setup files/permissions etc	Only 1 work Application/package download and install using .hart file. Works: Download nginx-1.28.hart ,Verify ,Start ,Monitor ,Upgrade

Requirements

Functional

1. Agent periodically pulls policy from control plane.
2. Support millions of nodes.
3. Download only changed policy versions.
4. Support versioning and rollback.

Non Functional

1. Massive Scalability. 10+ million nodes
2. Low Resource Consumption

Architecture

1. Administrator creates a policy: Install NGINX 1.28

2. Policy Engine performs these independent actions:
a. Stores the desired state in the Policy Repository.
b. Publishes lightweight metadata (latest version, artifact URL, checksum, signature).
c. Uploads the platform-specific installers to the Artifact Repository.

3. The Chef Infra Client wakes up periodically (with jitter) and only asks the Metadata Service:
a. "Has the desired state changed?"

4. If the metadata indicates a newer policy, the client:
a. Compares the desired state with the current local state.
b. Determines whether an upgrade is actually required (idempotency).
c. Only if an upgrade is needed does the client download the installer directly from the CDN/Artifact Repository, verify its integrity, and invoke the native package manager to install NGINX 1.28

flowchart LR

subgraph ControlPlane["Chef Control Plane"]

    Admin["Administrator"]

    PolicyUI["Policy Management UI"]

    PolicyEngine["Policy Engine"]

    PolicyRepo["Policy Repository
    Desired State
    Install:
    NGINX 1.28
    Service=Running"]

    HabitatDepot["Habitat Builder Depot
    self contained app package
    nginx-1.28.hart
    app plus ALL its deps
    bundled into ONE artifact"]

    Metadata["Metadata Service
    Latest Policy = v128
    Artifact URL
    Checksum
    Signature"]

    ArtifactRepo["Artifact Repository
    nginx-1.28.rpm
    nginx-1.28.deb
    nginx-1.28.msi
    nginx-1.28.pkg"]

    LB["Global Load Balancer"]

    CDN["CDN / Edge Cache"]

    Admin -->|"Create Policy"| PolicyUI

    PolicyUI --> PolicyEngine

    PolicyEngine -->|"Upload Hart Package"| HabitatDepot

    PolicyEngine -->|"Store Desired State"| PolicyRepo

    PolicyEngine -->|"Publish Metadata"| Metadata

    PolicyEngine -->|"Upload Artifacts"| ArtifactRepo

    Metadata --> LB
    ArtifactRepo --> LB
    HabitatDepot --> LB

    LB --> CDN

end

subgraph Endpoint["Managed Laptop"]

    subgraph Chef["Chef Infra Client"]
      ChefClient["Chef Client"]
      Cache["Local Metadata Cache"]
      State["Current State Collector"]
      Diff["Diff Engine"]
      Downloader["Artifact Downloader"]
      Verifier["Checksum / Signature Verification"]
      OSConfig["OS Configuration
            Files / Users / Certificates"]
    end

    subgraph Habitat["Chef Habitat"]
      HabSup["Habitat Supervisor
      Manages ONE PACKAGE
      via a single hart file"]
      HabDownloader["Habitat Downloader"]
      HartVerifier["Package .hart Verification
Checksum / Signature"]
      HabRuntime["Habitat Runtime"]
      Nginx["NGINX 1.28 Running Application"]
    end
    Laptop["Local Operating System"]

    Scheduler --> ChefClient
    Scheduler --> HabSup
    ChefClient --> Cache

    ChefClient <-->|"GET Latest policyMetadata"| Metadata
    HabSup -->|"GET Latest metadata"| Metadata
    HabSup --> HabDownloader

    ChefClient --> State
    State --> Diff
    Cache --> Diff
    Diff -->|"Download files"| Downloader

    Downloader <-->|"HTTP GET Artifact
(config files, permissions,
certificates)"| CDN
    HabDownloader <-->|"nginx.hart"| CDN
    HabDownloader -->|""verify .hart signatures|HartVerifier
    HartVerifier --> HabRuntime
    HabRuntime -->|Start / Stop / 
Upgrade / Monitor|Nginx
    Nginx --> Laptop

    Downloader --> Verifier

    Verifier --> OSConfig

    OSConfig --> Laptop

end

Sequence Diagram (Download nginx1.28) Ceph Infra Client, Habitat

sequenceDiagram
    autonumber

    actor Admin

    box Customer Admin 
        participant UI as Policy UI
        participant Engine as Policy Engine
        participant Repo as Policy Repository
        participant Meta as Metadata Service
        participant Depot as Habitat Builder
    end
        participant CDN as CDN


    participant Scheduler as Laptop Scheduler

    box "Ceph Infra Client"
        participant Chef as Chef Infra Client
        participant Cache as Chef
Local Cache
        participant State as Machine State
Process
        participant Diff as Diff Engine
        participant Downloader as Chef Artifact
Downloader
        participant OSConfig as OS Config
Executor
    end

    box Habitat
        participant Supervisor as Habitat Supervisor
        participant HabDownload as Habitat Downloader
        participant HartVerify as Hart Verifier
        participant Runtime as Habitat Runtime
    end

    participant Audit as Audit Service

    Admin->>UI: Create deployment
policy
    UI->>Engine: Submit policy
    Engine->>Repo: Store Chef
desired state
    Note over Repo: Files, users, certificates,
directories, permissions

    Engine->>Depot: Publish NGINX 1.28 package
    Depot-->>Engine: nginx-1.28.hart available

    Engine->>Meta: Publish policy metadata
    Note over Meta: Policy v128
Infrastructure state
NGINX version 1.28
Artifact URLs
Checksums
Signatures


    Note over Scheduler: Periodic run
30 min + random jitter

    Scheduler->>Chef: Start Chef run
    Scheduler->>Supervisor: Trigger Habitat reconciliation

    rect rgb(230, 245, 255)
        Chef->>Cache: Read last applied policy
        Cache-->>Chef: Last applied = v127

        Chef->>Meta: GET latest policy metadata
        Meta-->>Chef: Policy v128 + infrastructure desired state

        Note over State: Inspect local machine
Read files, users, certificates, permissions
        State-->>Chef: Current state

        Chef->>Diff: Compare desired vs current
        Diff-->>Chef: Changes required

        Chef->>Downloader: Download infrastructure artifacts
        Downloader->>CDN: GET certificate/config artifact
        CDN-->>Downloader: Stream artifact
        Downloader-->>Chef: Download complete

        Note over Chef: Verify checksum
Verify digital signature
        Chef->>OSConfig: Apply machine configuration
        Note over OSConfig:Install certificate
Create nginx user
Create directories
Set permissions
        OSConfig-->>Chef: Machine converged

        Chef->>State: Verify machine state
        Note over State: Re-check configuration
        State-->>Chef: ok
        Chef->>Cache: Store policy v128
    end

    rect rgb(235, 255, 235)

        Supervisor->>Meta: GET desired application metadata
        Meta-->>Supervisor: NGINX 1.28 + .hart URL

        Note over Supervisor: Current = NGINX 1.27
Desired = NGINX 1.28

        Supervisor->>HabDownload: Download nginx-1.28.hart
        HabDownload->>CDN: GET nginx-1.28.hart
        CDN-->>HabDownload: Stream .hart package
        HabDownload-->>Supervisor: Package downloaded

        Supervisor->>HartVerify: Verify .hart checksum
        HartVerify-->>Supervisor: Checksum valid

        Supervisor->>HartVerify: Verify .hart signature
        HartVerify-->>Supervisor: Signature valid

        Supervisor->>Runtime: Install / prepare NGINX 1.28
        Note over Runtime:Stop NGINX 1.27
Start NGINX 1.28
Health check

        Runtime-->>Supervisor: NGINX 1.28 running
    end


    Chef->>Audit: Report infrastructure compliance
    Supervisor->>Audit: Report NGINX 1.28 healthy

    Audit-->>Chef: ACK
    Audit-->>Supervisor: ACK

    Chef-->>Scheduler: Chef run complete
    Supervisor-->>Scheduler: Habitat reconciliation complete