I85PREP
⌘ K
Chef Certified study materials
Chef Certified study resources

Chef Certified: Infrastructure Management

Chef Certified · Work through your exam, one topic at a time.

All guide sections

Infrastructure Management

This domain covers day-2 operations: registering and scheduling nodes, promoting cookbook versions through environments or policy groups, managing secrets and data bags, and troubleshooting the server and client. Questions tend to be operational rather than authoring-focused.

Node lifecycle and scheduled convergence

  • knife bootstrap over SSH or WinRM installs Chef Infra Client, registers the node, and applies an initial run list. The node object then holds normal attributes, the run list, and policy assignment.
  • Run Chef Infra Client as a service or scheduled task; the chef-client cookbook manages interval and splay. Splay spreads runs to avoid thundering-herd load on the server.
  • knife node list, knife node show, knife search node 'role:web', and knife ssh are the everyday inventory tools.

Version promotion and secrets

  • Environments carry cookbook version constraints. = 1.9.0 pins exactly; ~> 1.9 allows >=1.9 and <2.0; ~> 1.9.0 allows <1.10.0. The server resolves the constraint when the client fetches cookbooks.
  • Upload with knife cookbook upload, Berkshelf, or a Policyfile (chef install, chef export, chef push).
  • Data bags are global JSON stores; encrypted data bags use a shared secret from client.rb or --secret-file. Chef Vault adds per-node secret access, so one compromised node does not expose every secret.

Server operations

Chef Infra Server is managed with chef-server-ctl: status, reconfigure, tail, restart, backup, and restore. Logs are under /var/log/chef-server. For client debugging, use chef-client -l debug and --why-run to see intended actions without changing the system.

Worked example

A cookbook app 1.10.0 is uploaded. The prod environment pins = 1.9.0; qa uses ~> 1.9. A prod node converges and still gets 1.9.0; a QA node resolves 1.10.0 because the range allows any 1.x at or above 1.9. If QA had used ~> 1.9.0, 1.10.0 would be excluded. The reasoning is that ~> constrains the rightmost specified digit, not the major version alone.

Traps that cost marks

  • ~> 1.9 is not a patch-level pin; ~> 1.9.0 is.
  • Normal attributes persist on the node and can mask cookbook defaults; clear or override them deliberately.
  • chef-server-ctl reconfigure is configuration convergence, not the routine restart command.
  • An encrypted data bag is only as safe as its shared secret; committing the secret beside the bag defeats it.
  • knife ssh runs in parallel by default; use --concurrency 1 for a rolling change.