Phase 1 — Preconditions and Source Validation

1. Verify source Chef Infra Server health

Execute:

• chef-server-ctl status → confirm all services healthy

• Verify recent successful node converges

• Confirm no cookbook upload/authentication failures

This ensured the source system was stable before migration.

2. Confirm migration eligibility

Validate:

• Supported Chef Server version for migration

• Cookbooks stored in database or S3 (not filesystem-only)

• Sufficient disk space for backup generation

Phase 2 — Prepare Backup Tooling on Source Server

1. Install Habitat

curl https://raw.githubusercontent.com/habitat-sh/habitat/master/components/hab/install.sh | sudo bash

2. Install knife-ec-backup package

hab pkg install chef/knife-ec-backup -bf

This provides the supported export mechanism for Infra Server data.

3.  Execute the below command to generate a knife tidy server report to examine the stale node, data, etc.

    hab pkg exec chef/knife-ec-backup knife tidy server report --node-threshold 60 -s <chef server URL> -u <pivotal> -k <path of pivotal>

where 

• pivotal is the name of the user
• path of pivotal is where the user’s pem file is stored.
• node-threshold NUM_DAYS is the maximum number of days since the last checking before a node is considered stale. For Example:

Phase 3 — Backup Existing Infra Server Data

1. Run knife-ec-backup

Executed backup capturing:

• Organizations

• Users and keys

• Nodes and clients

• Cookbooks and policyfiles

• Data bags and ACLs

Backup generated in portable intermediate format suitable for restore into Automate HA.

Execute the below command to initiate a backup of your Chef Server data.

    hab pkg exec chef/knife-ec-backup knife ec backup backup_$(date '+%Y%m%d%H%M%s') --webui-key /etc/opscode/webui_priv.pem -s <chef server url>

In this command:

• --with-user-sql is required to handle user passwords and ensure user-specific association groups are not duplicated.
• --with-key-sql is to handle cases where customers have users with multiple pem keys associated with their user or clients. The current chef-server API only dumps the default key. Sometimes, users will generate and assign additional keys to give additional users access to an account but still be able to lock them out later without removing everyone’s access.

For example:

    hab pkg exec chef/knife-ec-backup knife ec backup backup_$(date '+%Y%m%d%H%M%s') --webui-key /etc/opscode/webui_priv.pem -s https://chef.io`.

2. Transfer backup to Automate HA environment

• Securely copied backup directory to the new Automate HA Infra node.

Execute the below command to copy the backup directory to the Automate HA Chef Server.

    scp -i /path/to/key /path/to/backup-file user@host:/home/user

Phase 4 — Restore Data into Automate HA Infra Server

1. To restore the data, you will need to use the knife-ec-backup utility, which can be installed on any of the Automate HA Chef-Infra-Server nodes.

Execute the below command to install the habitat package for knife-ec-backup.

hab pkg install chef/knife-ec-backup

Execute the below command to restore the backup:

export LC_ALL=en_US.UTF-8
export LANG=en_US.UTF-8
hab pkg exec chef/knife-ec-backup knife ec restore <path/to/directory/backup_file> -yes --concurrency 1 --webui-key /hab/svc/automate-cs-oc-erchef/data/webui\_priv.pem --purge -c /hab/pkgs/chef/chef-server-ctl/*/*/omnibus-ctl/spec/fixtures/pivotal.rb

Performed controlled restore of:

Chef objects

ACLs and identities

Cookbook and policy data

This completed data migration into the Automate-managed Infra Server.

Phase 5 — Post-Restore Functional Validation

1. Knife and API validation

Confirm:

• Knife authentication successful

• Cookbook upload/download working

• Policyfile operations functional

• Organizations and users accessible

2. Node convergence validation

Trigger converges from test nodes:

• Runs completed successfully

• Node reports visible in Automate

• No permission or authentication errors

Phase 6 — Production Cutover

1. Redirect node traffic to Automate HA

Perform controlled switch using either:

• DNS update to new Infra Server endpoint
  or

• Updating chef_server_url in node client.rb

2. Monitor stability after cutover

Observe:

• Nodes reconnecting successfully

• Converge success rate normal

• Automate HA services healthy

• No production disruption

If your HA Chef Server is in a private subnet, scp backup file to bastion and then to Chef Server.

Before restoring the backup on the Automate HA Chef Server, configure S3 storage for cookbooks. The cookbooks stored in S3 in the Chef server can be stored in S3 or PostgreSQL in Automate HA.