title: Chef: Refactor Jenkins security script to own recipe file
body: <p>I am currently using <a href="https://supermarket.chef.io/cookbooks/jenkins" rel="nofollow noreferrer">Chef's Jenkins supermarket cookbook</a> to deploy an instance of Jenkins. As part of that deployment, my recipe includes installing Jenkins, installing specific plugin versions, enabling security and creating an Administrator account for Jenkins.</p>
  
  <p>I'm currently using a single recipe file for this. The script that is executed to enable security and create the Administrator account is as follows:</p>
  
  <pre><code> jenkins_script 'activate global security' do
    command &lt;&lt;-EOH.gsub(/^ {4}/, '')
        import jenkins.model.*
        import hudson.security.*
  
        def instance = Jenkins.getInstance()
  
        def hudsonRealm = new HudsonPrivateSecurityRealm(false)
        hudsonRealm.createAccount("Administrator","administrator_passwd")
        instance.setSecurityRealm(hudsonRealm)
        instance.save()
  
        def strategy = new GlobalMatrixAuthorizationStrategy()
          strategy.add(Jenkins.ADMINISTER, "Administrator")
          instance.setAuthorizationStrategy(strategy)
  
        instance.save()
    EOH
  
    notifies :restart, 'runit_service[jenkins]', :immediately
  
   end
  </code></pre>
  
  <p>The script activates security, creates the Jenkins Administrator user with a password, and then restarts the Jenkins instance. From what I understand, the jenkins_script resource executes Java or Groovy command against the Jenkins master, and is not idempotent.</p>
  
  <p>As the script is not idempotent, if the recipe is run on the node subsequent times after the initial run, the chef-client run fails as security is already enabled and the Administrator user has already been created.</p>
  
  <p>My thoughts are to move this security enablement script to its' own recipe file, and then specify the recipe for security in the node's run list if enabling security is required. If security has already been enabled, we simple don't add / remove the security recipe from the run list.</p>
  
  <ul>
  <li>Is this a sound approach to working around this problem?</li>
  <li>If this is a    sound approach, should it be as simple as just
  creating another ruby    file, dumping the security code in it, and
  adding it to the node's    run list after the recipe for the initial
  Jenkins install?</li>
  </ul>