Tesco Supports Security and Transfer of 30,000+ Nodes with Progress Chef

Managing a vast, distributed and diverse technology estate

Tesco is a prominent grocery and merchandise retailer based in Britain. The organization manages more than 30,000 active nodes across data centers, stores and depots. Its technology estate spans on-premises infrastructure and Microsoft Azure, with Windows, Linux and Mac systems supporting operations across the United Kingdom and Europe. At this scale, configuration management, server builds, post-build actions, patching and security compliance must be dependable and repeatable.

Connectivity adds another layer of complexity. Retail locations do not always have consistent network availability, yet essential automation still needs to reach systems when connections are available. Tesco also needed a common approach that could serve multiple internal teams without taking away their ability to manage their own environments and define actions before or after patching and reboots.

Manual administration was too slow for the size of the environment. Building a single virtual machine manually was estimated to take at least two to three hours. Repeating that work across a large estate would consume significant engineering time and create additional inconsistency. Tesco also required clear compliance visibility so teams could identify vulnerable systems, understand failed controls and respond rapidly when urgent security issues emerged.

A shared automation foundation with flexibility for individual teams

Tesco uses the Progress® Chef® as a central foundation for configuration management, security compliance, server builds and post-build activity. Tesco’s team established automation pipelines to replace repetitive, manual tasks and help apply a consistent process across operating systems and locations. 

For store-focused workflows, the organization uses Jenkins as the front end while Chef automation performs the build processes, deployment steps, and required actions behind the scenes. The pull-based model in the Chef platform is valuable in locations with varying connectivity. When a connection is unavailable, the agent can retry and complete the required task once the store is reachable, enabling more reliable automation across a widely distributed retail environment. 

Tesco’s team also created a custom patching solution using Jenkins workflows and Chef cookbooks. Internal teams can schedule patching, create environments, and add cookbooks for actions that need to happen before or after a patch or reboot. This approach gives each team control over its own requirements while maintaining a shared, repeatable automation foundation. 

Chef also provides the reporting needed to support compliance work. Teams can identify vulnerable systems, missing patches and failed controls, investigate the cause and translate a remediation plan into automated action across the relevant organizations.