Chef Certified cheat sheet

Chef Infra operates in two modes: client-server (Chef Infra Server with PostgreSQL and RabbitMQ) and chef-solo/chef-zero for local, serverless convergence.

Convergence order: compile phase builds the resource collection, then converge phase executes resources in the order declared; compile-time Ruby runs before any resource actions.

Resource execution is idempotent: each resource has a load_current_value or current state comparison, and actions run only when the desired state differs.

Notification types: notifies :action, 'resource[name]', :immediately runs at once; default :delayed queues the notification to run at the end of the converge.

Subscribes is the inverse of notifies: subscribes :restart, 'service[nginx]', :immediately makes the current resource trigger the named resource.

Chef Infra Client runs are recorded as a node object on the Chef Infra Server, including normal, default, override, and automatic attribute precedence levels.

Attribute precedence (low to high): default, force_default, normal, override, force_override, automatic; node.force_default and node.force_override are set in recipes.

Recipes use include_recipe for static composition; depends in metadata.rb declares cookbook dependency and is required for include_recipe across cookbooks.

Chef Habitat packages applications with a plan.sh, a studio build environment, and a supervisor that exports runtime configuration and service bindings.

Node object attributes: automatic (Ohai data), normal (persisted by chef-client), default, override; only normal and automatic survive a run and are searchable.

Search indexes are built from the Chef Infra Server Solr backend; search(:node, 'role:web') returns node objects from the index, refreshed after each client run.

Environments pin cookbook versions via cookbook_versions constraints; knife environment create and knife environment edit manage them.

Roles and environments are JSON; roles can set default_attributes and override_attributes and list a run_list.

knife bootstrap installs chef-client on a target via SSH/WinRM; knife bootstrap -N NAME -r 'role[base]' sets node name and initial run list.

Data bags store JSON objects in data_bags/<bag>/<item>.json; data_bag_item('bag', 'item') loads them, and encrypted data bags use encrypted_data_bag_secret.

Chef Infra Server components: Erchef (API), Bookshelf (cookbook storage), Solr (search), PostgreSQL (data), RabbitMQ (queues), and Chef Manage (web UI).

knife cookbook upload uploads cookbooks; berks upload and chef supermarket manage dependencies from a Berksfile or Policyfile.

Policyfiles replace roles/environments: chef install resolves a lockfile, chef push uploads a policy group, and chef-client -z runs locally with policy.

Chef InSpec profiles contain controls; each control has an impact (0.0-1.0), title, description, and one or more describe blocks with matchers.

Impact thresholds: 0.0-0.3 informational, 0.4-0.6 low, 0.7-0.8 medium, 0.9-1.0 high/critical; the --threshold flag fails the run when the score falls below it.

InSpec resources include file, service, package, port, sshd_config, auditd, os, and users; describe file('/etc/passwd') { it { should exist } }.

inspec exec profile.tar.gz -t ssh://user@host runs a profile remotely; -t docker://container targets a container; --reporter cli json html sets output formats.

Chef Automate ingests compliance reports via the automate reporter and data collector token; the compliance dashboard shows control status by node and profile.

Waivers: inspec exec --waiver-file waivers.yaml suppresses specified controls; control 'id' do ... end can also use only_if or skip_control.

inspec check validates profile syntax and metadata; inspec vendor packages dependencies; inspec json emits the profile as JSON for automation.

The compliance cookbook or inspec resource in a recipe can run profiles during convergence, and chef-client --audit-mode runs audits without converging.

Chef Automate includes a workflow engine (formerly Chef Delivery) with pipeline stages: verify, build, unit, lint, syntax, publish, provision, deploy, smoke, and functional.

A .delivery/cli.toml defines the project, pipeline, and channel; .delivery/build-cookbook supplies the build recipes for each stage.

delivery review creates a review pipeline; delivery job runs a stage locally; delivery setup configures the project in Automate.

Chef Push Jobs (push-jobs-client) executes commands on nodes on demand via the push-jobs server; knife job start 'chef-client' --nodes 'role:web'.

Push jobs use the push-jobs cookbook and a push_jobs data bag for whitelisted commands; the server is a Chef Infra Server add-on.

chef-client --once runs a single convergence and exits; --interval and --splay control the daemon schedule; --why-run simulates without changing state.

Chef Infra Server's chef-server-ctl commands manage services: reconfigure, status, tail, and restart; knife status reports last check-in times.

Cron and systemd timers are common orchestration triggers for chef-client; the cron resource writes entries and systemd_unit manages timers.