Chef: Refactor Jenkins security script to own recipe file - security

Question

I am currently using Chef's Jenkins supermarket cookbook to deploy an instance of Jenkins. As part of that deployment, my recipe includes installing Jenkins, installing specific plugin versions, enabling security and creating an Administrator account for Jenkins.
I'm currently using a single recipe file for this. The script that is executed to enable security and create the Administrator account is as follows:
jenkins_script 'activate global security' do
command <<-EOH.gsub(/^ {4}/, '')
import jenkins.model.*
import hudson.security.*
def instance = Jenkins.getInstance()
def hudsonRealm = new HudsonPrivateSecurityRealm(false)
hudsonRealm.createAccount("Administrator","administrator_passwd")
instance.setSecurityRealm(hudsonRealm)
instance.save()
def strategy = new GlobalMatrixAuthorizationStrategy()
strategy.add(Jenkins.ADMINISTER, "Administrator")
instance.setAuthorizationStrategy(strategy)
instance.save()
EOH
notifies :restart, 'runit_service[jenkins]', :immediately
end
The script activates security, creates the Jenkins Administrator user with a password, and then restarts the Jenkins instance. From what I understand, the jenkins_script resource executes Java or Groovy command against the Jenkins master, and is not idempotent.
As the script is not idempotent, if the recipe is run on the node subsequent times after the initial run, the chef-client run fails as security is already enabled and the Administrator user has already been created.
My thoughts are to move this security enablement script to its' own recipe file, and then specify the recipe for security in the node's run list if enabling security is required. If security has already been enabled, we simple don't add / remove the security recipe from the run list.
Is this a sound approach to working around this problem?
If this is a sound approach, should it be as simple as just
creating another ruby file, dumping the security code in it, and
adding it to the node's run list after the recipe for the initial
Jenkins install?

Answer 1

You don't have to restart Jenkins to configure security.

Answer 2

When configuring security there are a few considerations you have to take into account. One is that it almost always works the first run, but you want to make sure that on repeated runs it continues to successfully apply desired changes.
There is an attribute for the executor protocol which defaults to remoting and you'll see warnings all over about using it because it is less secure and has been deprecated. Other options are https or ssh, with the latter being the option we decided to go with. If you configure it as the protocol but the SSH key provided to be used isn't associated with a user (user has to be created and then an SSH public key associated with them) then it will fall back to using anonymous (part of the cookbook) and so you need to ensure you either do all your "privileged" operations like plugin installation and reconfiguration scripts before you enable authentication, or ensure you have the authentication pre-configured to request SSH so that it immediately kicks in when the authentication is turned on.