I85PREP
⌘ K
Chef Certified study materials
Chef Certified study resources

Chef Certified: Chef Automation and Infrastructure Management

Chef Certified · Work through your exam, one topic at a time.

All guide sections

Chef Automation and Infrastructure Management

This domain tests the Chef Infra architecture and the automation loop: how a workstation-authored cookbook becomes a converged node through the Chef Infra Server. Expect questions on the roles of Workstation, Server, and Client, the compile/converge lifecycle, resource idempotence, attribute precedence, and the Policyfile model that replaces roles and environments.

The three tiers and the run lifecycle

  • Chef Workstation provides knife, chef, Test Kitchen, Cookstyle, and InSpec; it authors cookbooks and pushes them to the server or a policy store.
  • Chef Infra Server is the hub: it stores cookbooks, policies, environments, roles, data bags, and node objects. Its services include PostgreSQL, Redis, OpenSearch (historically Solr), Bookshelf for cookbook storage, and Erlang services.
  • Chef Infra Client starts a run by loading the node object and run list, running Ohai to collect automatic attributes, fetching cookbooks, compiling recipes into a resource collection, then converging resources. A resource is idempotent when it only changes the system if the current state differs from the declared state.

Attributes and precedence

Attributes are merged by precedence, lowest to highest: default, force_default, normal, override, force_override, automatic. Attribute files, recipes, environments, and roles can all contribute values at those levels. normal attributes persist on the node object, while automatic attributes come from Ohai and win over all others. Policyfiles pin cookbook revisions and attributes into a single policy, then chef push promotes that policy to a policy group; a node assigned a policy group ignores roles and environments.

Worked example

A node has run list role[web]; the role sets default['nginx']['version'] = '1.24'; the prod environment sets override['nginx']['version'] = '1.26'. The recipe does package 'nginx' do version node['nginx']['version'] end. The resolved value is 1.26 because environment override outranks role default. If Ohai reported automatic['nginx']['version'] = '1.27', that would win instead. The resource then installs only if the installed version differs.

Traps that cost marks

  • Recipes are compiled before resources converge; notifies defaults to :delayed, so the notified resource runs at the end of the run unless :immediately is specified.
  • only_if and not_if are guards; they are not the same as notifies/subscribes.
  • A node cannot mix a Policyfile and a role/environment run list.
  • chef-client --local-mode (chef-zero) needs no server but does not provide the server's search index or centralized policy store.
  • Do not confuse cookbook version constraints, resolved by the server, with attribute precedence, resolved on the client.