Tesco uses Progress Chef to automate configuration, server builds, patching and compliance across more than 30,000 nodes, helping teams reduce manual work and resolve critical vulnerabilities quickly.

Challenge

Managing a vast, distributed and diverse technology estate

Tesco is a prominent grocery and merchandise retailer based in Britain. The organization manages more than 30,000 active nodes across data centers, stores and depots. Its technology estate spans on-premises infrastructure and Microsoft Azure, with Windows, Linux and Mac systems supporting operations across the United Kingdom and Europe. At this scale, configuration management, server builds, post-build actions, patching and security compliance must be dependable and repeatable.

Connectivity adds another layer of complexity. Retail locations do not always have consistent network availability, yet essential automation still needs to reach systems when connections are available. Tesco also needed a common approach that could serve multiple internal teams without taking away their ability to manage their own environments and define actions before or after patching and reboots.

Manual administration was too slow for the size of the environment. Building a single virtual machine manually was estimated to take at least two to three hours. Repeating that work across a large estate would consume significant engineering time and create additional inconsistency. Tesco also required clear compliance visibility so teams could identify vulnerable systems, understand failed controls and respond rapidly when urgent security issues emerged.

Solution

A shared automation foundation with flexibility for individual teams

Tesco uses the Progress® Chef® as a central foundation for configuration management, security compliance, server builds and post-build activity. Tesco’s team established automation pipelines to replace repetitive, manual tasks and help apply a consistent process across operating systems and locations. 

For store-focused workflows, the organization uses Jenkins as the front end while Chef automation performs the build processes, deployment steps, and required actions behind the scenes. The pull-based model in the Chef platform is valuable in locations with varying connectivity. When a connection is unavailable, the agent can retry and complete the required task once the store is reachable, enabling more reliable automation across a widely distributed retail environment. 

Tesco’s team also created a custom patching solution using Jenkins workflows and Chef cookbooks. Internal teams can schedule patching, create environments, and add cookbooks for actions that need to happen before or after a patch or reboot. This approach gives each team control over its own requirements while maintaining a shared, repeatable automation foundation. 

Chef also provides the reporting needed to support compliance work. Teams can identify vulnerable systems, missing patches and failed controls, investigate the cause and translate a remediation plan into automated action across the relevant organizations. 

Results

Faster remediation, less manual work and stronger compliance visibility 

The value of this approach became particularly clear when Tesco encountered a critical software agent vulnerability. The team captured the removal of the vulnerable agent, reinstallation, and restoration of the required configuration in a single Chef cookbook. It then deployed the remediation across the relevant organizations and resolved critical exposure within one day.

Tesco’s environment generally operates at approximately 90% to 92% compliance, with some controls intentionally skipped. The reporting capabilities of Chef help the team see widespread failures, investigate affected systems, and move from an identified issue to a repeatable remediation workflow.

Automation has also reduced the burden of routine infrastructure work. Virtual -machine builds that were estimated to require two to three hours manually can now move through established automation pipelines. Multiple teams can trigger patching and manage their own pre-change and post-change actions without rebuilding the underlying process each time.

Looking ahead, Tesco is migrating to the Chef 360 platform. The longer-term goal is to connect infrastructure health and patching information with clearer explanations of the security risk created when an update is deferred. This would help users understand the impact of pending updates, rather than only seeing a list of packages awaiting action.