When you are using the encrypted data bag feature for Chef how do you go about deploying the key to many servers? If you put it into a recipe anyone who has access to any of the chef servers or clients can pull the key and potentially decrypt any of the databags.
How do you go about ensuring that the key is on the machines that need it, but also safe from anyone snooping around?
I understand the advantages of using Chef and puppet in a multiserver environment. Its fantastic for enforcing and describing configuration across many servers.
But lets say you have a single server, what advantage does chef-solo give you over simply manually configuring the server? I love chef, but I can't think of a reason why taking the time to setup chef-solo is worth the hassle on a single or even 2 server architecture, but apparently people do it.