I85PREP
⌘ K
Chef Certified study materials
Chef Certified study resources

Chef Certified: Job Orchestration

Chef Certified · Work through your exam, one topic at a time.

All guide sections

Job Orchestration

This domain covers coordinating work across many nodes and environments: on-demand Chef Infra Client runs, remote execution from Chef Workstation, Chef Automate pipelines, and Habitat-driven service deployment. The exam tests which tool is appropriate for fan-out, rolling change, and artifact promotion.

Orchestration options

  • Scheduled runs: chef-client as a service or cron job is the baseline; chef-client cookbook settings control interval and splay.
  • On-demand fan-out: knife ssh 'role:web' 'sudo chef-client' searches the server and runs the command over SSH. It is parallel by default; --concurrency 1 serializes it.
  • Remote execution without a preinstalled client: Chef Workstation's chef-run uses target mode over SSH/WinRM to apply a cookbook to a host.
  • Chef Automate pipelines: stages such as verify, build, union, deploy, and acceptance move an artifact through testing and release. Habitat provides the packaging and supervisor layer; hab svc load, hab svc status, and hab config apply manage services and configuration rings.
  • Chef Push Jobs is the legacy server-side job runner for executing commands on nodes; treat it as deprecated in favor of native orchestration and Automate.

Worked example

You must apply a new app cookbook to role:app without taking the fleet down. knife ssh 'role:app' 'sudo chef-client' -x deploy -a ipaddress --concurrency 1 runs one node at a time, letting you stop if the first node fails. A parallel knife ssh would converge all nodes at once and risk a full outage. If the cookbook were packaged as a Habitat service, hab config apply app.default 1 config.toml would target the app.default service group, with the supervisor applying the change to members in the ring.

Traps that cost marks

  • knife ssh uses a search query, not a static host list; a typo in the query can hit the wrong nodes.
  • Default concurrency is parallel; rolling deploys require explicit serialization.
  • chef-run needs SSH/WinRM access and privilege escalation; it is not a server-driven push.
  • Automate pipeline stages are not interchangeable: build packages, union assembles artifacts, deploy releases.
  • Habitat config applies to a service group/ring, not to an individual container by hostname.