Chef Infra Automation

Best Practices User Guide

10 Ways to Optimize Your Chef

Infrastructure Automation Investment

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
The Infrastructure Automation Journey
Infrastructure configuration solutions like Chef Infra have been around for more than 10 years, all but
eliminating the need for IT admins to walk from system to system with thumbdrives and crash carts to
manually configure on-prem and remote servers. With automation, thousands of systems can be configured
in minutes, not days or weeks. 5 Chef
Key Infra Facts
Commands:
Over the past 10 years a lot has changed within the Chef Infra product portfolio. We’ve continued to evolve
our portfolio making it easier to use, adding new functionality and increasing scalability. The purpose of this
guide is to help existing Chef Infra users understand how product line has been evolved and get more out of 1. A new version of Chef Infra Client has
their Chef investments by taking advantage of new features and usage patterns. released every April for the past 5
years.
Chef Infra Past and Present: Summary of Key Platform Changes Made in the Last 5 Years
2. Chef Workstation is a full replacement
Chef Infra Past Chef Infra Present
for the ChefDK

Ruby Language Chef Language, Resources, and Helpers 3. Chef Infra Server does not follow the
same yearly cadence as Chef Infra
Chef Workstation, Test Kitchen, and Chef
Chef DK, ChefSpec, and Foodcritic Developer Kit Client. The Latest release is 14.x and
Cookstyle
both 14.x and 13.x work with all recent
Roles, Environments, and Audit Content and Policyfiles and Chef Client Compliance Chef Infra Client releases
Cookbook Compliance Phase
Stand Alone Chef Server and Chef Automate with 4. Chef Cookstyle has fully supplanted
Management Foodcritic and now includes 224
Chef Manage Integrated Chef Server
“cops”
Test Kitchen and Test Driven Development
Adhoc Testing Testing
Adoption 5. Chef Automate provides dashboards
CI/CD Automated Pipelines, GitHub Actions, and actionable data for Chef Infra
Manually Pushing Changes Deployment
and Pull Requests

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
Chef Infra Policy-Based Infrastructure Automation Architecture
Using Chef Infra to automate configuration management allows DevOps teams to define policies that are repeatable, consistent and reusable.
The result is increased business agility and security because all systems and resources are continuously and automatically evaluated,
corrected, and modified.

Chef Workstation Chef Infra Client and Server Chef Automate

Reduce risks by iterating on policy changes before Enforce policy by converging systems to the state View and validate intended and actual state
pushing them to production. Workstation includes: declared by Chef resources. Chef Infra Client key across all systems. Chef Automate key
capabilities include: capabilities include:
• Chef Tools: Chef Infra Client, Chef InSpec,
Chef Habitat, Chef Cookstyle, and knife • Planned, unstructured and policy-based updates • Real-time interactive dashboards
• Chef Language: Pre-built resources for • Dynamic behavior support • Role-based access controls
managing systems and helpers that make • Ephemeral resource management • Third-party integrations
authoring and distributing cookbooks easy • Data collection • Data APIs
• Chef Infra Server management
© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
Chef Infra Client 17:
Policy-Based Configuration Automation
Chef continued to improve the products we build and expand its automation coverage with
Chef Infra, and lead in the DevOps space. With the launch of Chef Infra Client 17, Chef has Key Commands:
made automation easier for a wider range of users and use cases. Along with tools provided
with Chef Workstation, Chef Infra Client 17 better enables organizations to adopt Test Driven
Development (TDD) practices that make infrastructure management reliable and secure.

Automation Improvements with Chef Infra Client 17:

• Streamlined Developer Experiences: The Chef Infra Language offers users built-in resources and
helpers that make codifying infrastructure easy and shareable across teams. Resources can install and Chef Infra Client 17
manage packages and services, define security policies, configure firewalls, and make other system
configurations across cloud providers, system architectures, and OS releases. Enhancements to Test Now Available!
Kitchen allow users to better preview configurations on the wide range of platforms and public clouds, and
Chef InSpec allows users to confirm configurations before deploying them to production environments. Chef Infra Client 17 improves
• Increased Platform Coverage and Support: Chef Infra 17 offers expanded coverage and support for Arm
platform coverage, cloud support
in the cloud, macOS Big Sur, the Apple M1 architecture, Linux, Windows and PowerShell Core. and the developer experience with
enhanced tools and capabilities.
• Cookstyle Enhancements: Chef Workstation includes Cookstyle, a code-analysis tool built on RuboCop,
which replaced Foodcritic in September 2019. It helps users fix deprecations, upgrade Chef Infra Client
releases, and modernize their codebase. The latest release includes 100+ new rules (called cops) that can >>> Download the Chef Infra Client
automatically detect and correct most coding style errors and bugs. Running Cookstyle against Chef 17 Product Guide Today!
configuration files helps ensure accuracy and consistency across teams.

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#1 Use Cookstyle to Upgrade Your
Cookbooks for Chef Infra 17
The tools you use to manage your infrastructure, just like your infrastructure, are in constant flux. Managing
updates to your automation tools should be just as easy as managing updates to your infrastructure. More About Chef
Historically, this was not always the case with Chef Infra Client, which introduced code changes that required
manual work to update cookbooks and other resources to avoid potential bugs. Today, Cookstyle dramatically Cookstyle
simplifies and automates the upgrade process.
Cookstyle is a code analysis tool built
With Chef Cookstyle, you no longer need to download or use
multiple versions of the Chef Development Kit (now Workstation) upon RuboCop that replaced Foodcritic
for version migrations, run Foodcritic against each cookbook and in September 2019 and ships as part of
then review the output for changes. With Cookstyle, you simply set Chef Workstation.
a target version in your cookbook’s .rubocop.yml and get rolling!
We’ve added even more “cops” to make this process easier to Today, Chef Cookstyle includes more
customize and manage.
than 220 Chef Infra specific rules
(called cops) that catch common
Benefits: Chef Workstation always includes the
cookbook coding mistakes, clean up
latest version of Cookstyle
• Reduce Defects: Find and eliminate potential bugs portions of code that are no longer
• Streamline Upgrades: Minimize time and effort required for upgrades
necessary, and detect deprecations
• Modernize Codebase: Take advantage of new features sooner
that prevent cookbooks from running on
the latest releases of Chef Infra Client.
Resources:
• OnDemand Webinar: Prepare for New Chef Infra Client Releases with Cookstyle Running Cookstyle on your
• Documentation: Chef Cookstyle infrastructure code ensures everyone
• Chef Infra Extension for Visual Studio Code
• chef_client_updater cookbook repo
on your team follows a common coding
style, avoids potential bugs, and utilizes
the latest Chef Infra Client functionality.
© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#2 Configure Chef with Chef
Over the years, users have changed how they configure and manage the Chef Infra Client. Many used the
chef-client cookbook or wrote their own cookbooks to manage the client.rb configuration file, run the chef-client Key Commands:
service, or install their own trusted certificates. Much of this manual work is eliminated with functionality now
included in Chef Infra Client 17.

The built-in chef_client_config resource creates a client.rb file in the Chef Infra Client configuration directory on
each node and includes your specified settings. The chef_client_launchd resource for macOS, the Chef Infra Client 17 includes
chef_client_scheduled_task resource for Windows, and the chef_client_systemd_timer or chef_client_cron resources that eliminate the need
resources for Linux and UNIX all schedule Chef Infra Client runs on their respective platforms. The to manually configure some
chef_client_trusted_certificate resource adds certificates to Chef Infra Client’s trusted certificate directory,
allowing the Chef Infra Client to communicate with internal encrypted resources without errors.
common system tasks, settings
and resources:

Benefits: • chef_client_config
• Simplify Management: Manage the Chef Infra Client with a single recipe specific to your organization • chef_client_launchd
• Reduce Maintenance: No longer necessary to update and track external cookbooks • chef_client_cron
• Increase ROI: Easily update to the latest version of Chef Infra Client and take advantage of new features
• chef_client_scheduled_task
Resources: • chef_client_launchd
• chef_client_systemd_timer
• config.rb - https://docs.chef.io/workstation/config_rb
• Cookbook resources - https://docs.chef.io/resource/ • chef_client_trusted_certificate

Learn more about Chef Infra

Resources here.
© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#3 Adopt Immutable Policy
Policyfiles are the best way to handle dependencies and change management across your Chef Infra
managed infrastructure. They combine the very best parts of Roles, Environments, and Berkshelf into a Top Policyfiles
single workflow. Because Chef Infra Policyfiles are immutable and cannot be changed once bundled,
the Chef Infra Client no longer recalculates dependencies at the start of every run, making them faster Adoption Drivers
and more efficient.

With Policyfiles, Chef Infra users no longer need to take precautions to prevent configurations from Policyfiles are particularly useful if you
changing out from under them. Policyfiles lock in specific cookbook versions and runlists. They cannot encounter one of the scenarios:
be changed without recreating the associated lock file. Policyfiles allow you to perform controlled
promotions of changes from dev to staging to production with confidence. No more pinned cookbook • Ongoing trouble with cookbook
versions in environments or roles that cannot be versioned. dependency management.
Benefits: • Want a faster way to onboard new
Chef Infra users and make it easier
• Create Immutable Artifacts: Ensure cookbooks running in production are the same versions that for them to work with Chef Infra.
were tested in development
• Single Workflow: Streamline the Roles and Environments patterns by placing dependency • Restrictions on change-control in
management into a single workflow your organization are very high.
• Improve Manageability: Solve the Roles and Environments versioning issues
• Working in air-gapped (i.e. network
Resources: disconnected) environments where
the process of packaging a policy
• Blog: Policyfiles: A Chef Best Practice and its dependent cookbooks into a
• Learn Chef: Manage Your Fleet with Chef Infra
• Documentation: About Policyfile single archive file works well.
• Documentation: About Berkshelf
• Community: Policyfiles, Hedge-ops.com

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#4 Get the Latest and Greatest Chef
Community Content
Chef’s community is one of its key strengths, and we really value the relationships and interactions we have with
our community members. Progress believes in the importance of this community and sees the contributor model Get Involved with
that Chef built as an ideal model for any open-source project. It provides value to the entire DevOps and
DevSecOps ecosystem, and Progress is happy to continue to support that. the Chef Community!
Chef Community Discourse
The Sous Chefs are a community of Chef Infra cookbook developers working
together to maintain important cookbooks. They also adopt cookbooks that https://discourse.chef.io
need new homes when a maintainer has moved on to focus on other work.
Chef Community Slack
Today, the Sous Chefs community manages more than 100 cookbooks used
by companies all over to the world. https://community-slack.chef.io/

Weekly Community Meetings

Benefits: Thursdays at 9:00AM PT |
• Constant Support: Help from people using Chef products at scale #community-meetings in Slack
• Access to Content: Access to community-provided and -supported resources
• Ongoing Collaboration: Weekly updates from internal development teams Chef User Groups and Meet-Ups
Resources: https://events.chef.io/
• Blog: Managing Cookbooks at Scale
• GitHub: Sous Chefs maintained cookbooks
• ChefConf Online 2020 Recorded Presentations

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#5 Create Custom Resources
Chef Infra Client includes more than 150 built-in resources to manage things like files, packages, templates,
and services. It also enables users like website managers to build custom resources by combining built-in Custom Resources
resources into reusable site features, directories, templates, files and port settings. Custom resources simplify
Chef Infra recipes by removing complexities from the /recipes/default.rb file and adding them to an easier-to-
Basics
manage /resources/CustomResourcesName file.
Custom resources enable users to add their
Custom Resources allow you to define in one place complete configurations, such as “This is how we setup an own resources as an extension of Chef Infra
apache vhost”. If you need to change your vhosts later, you just update one shared custom resource, rather
client. Commonly used resources can be
than having to go through multiple files to make updates. This object-oriented approach is easier to manage
further streamlined by packaging them into
and results in custom resources that work the same way wherever you use them.
custom resources as resource-only
cookbooks. Custom resources are created
Benefits: by making a Ruby file in the cookbook’s
• Reuseability: Create a single resource that can be used on different target platforms resource file. Cookbooks can have multiple
• Simplicity: A Custom Resource is much simpler to create when compared with the LWRP and HWRP. resources.
• Ease of Use: Automation experts can create custom resources that others across the organization can then
easily consume Custom resource contents are composed of
three basic parts:
Resources:
• Declarations of the properties used in the
• Webinar: Custom Resources the Building Blocks of your Cookbooks
• Learn Chef: Extending Chef Infra: Custom Resources Custom Resource
• Documents: Custom Resources • Loading of the current value of the
• Documents: Custom Resource DSL properties, if they already exist
• Definitions of the actions that the Custom
Resource can take

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#6 Use Test Kitchen with Docker
Test Kitchen allows you to spin up containers or VMs and test your cookbooks all in a single step. You
can define the systems – Ubuntu, CentOS, RHEL, etc.– and have your Chef configurations and Test Kitchen
cookbooks applied as they launch. It’s a great way to test your configurations on multiple platforms all at
once and in real-world environments. Overview
Kitchen Dokken (not to be confused with less capable kitchen-docker) allows users to deploy more Test Kitchen is an independent open-
complex configurations quickly using Docker alongside other provisioning tools, like Vagrant. source project sponsored by Chef to
provide real-world test environments to
Kitchen Dokken starts with familiar Docker OS images, but adds back in capabilities that give the execute infrastructure code on one or
containers a true Linux test environment. Instead of requiring add-ons, Test Kitchen installs the Chef
more platforms in isolation.
Infra Client agent and deploys your cookbooks, policies and other Chef Infra configurations quickly and
easily, making Kitchen Dokken ideal for developers. Finished and tested Chef Infra configurations can
then be confidently added to your infrastructure and application-delivery workflows. Test Kitchen is Chef’s integration testing
tool of choice for cookbooks. It's included
as part of Chef Workstation and used by
Benefits: all Chef-managed community cookbooks.
• Rapid, lightweight provisioning: Use Docker to quickly test and deploy configurations in real-world
environments Test Kitchen uses a driver plugin
• Built-in Networking Capabilities: Containers can readily communicate and exchange data architecture and can be used to test
• Test Driven Development: Include configurations and compliance tests in one step to ensure across multiple platforms, not just Docker:
reliable outcomes before deploying to production
• Cloud platforms including Amazon EC2,
Resources: Google Compute Engine, and Microsoft
• Blog and Ondemand Webinar: Testing Chef Infra Cookbooks Fast with Docker
Azure.
• GitHub Kitchen-Dokken: Test Kitchen Driver and Transport for Docker
• Local hypervisors, such as VMware,
• Documentation: Test Kitchen Hyper-V, or VirtualBox.
© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#7 Get to Know GitHub Actions
GitHub Actions makes it easy to automate all your software
workflows. With GitHub Actions, merging a pull request, pushing Meet the Sous-Chef!
a commit, creating a new issue, and other tasks can run as
events, signaling other processes to occur. GitHub Actions allow
you to easily integrate Chef Infra runs into existing CI/CD
processes and implement Test Driven Development (TDD). This
approach to infrastructure configuration ensures all changes are
automatically run through Test Kitchen before being promoted to
the next release state.

Benefits:
• Automate Deployments: Integrate with existing CI/CD workflows
• Adopt Test Driven Development Approach: Each step is verified by design, not by chance Jason Field, ECS
• Secure: Avoid man-in-the-middle and other untrusted code from making its way into your workflows
• Open Source Advocate
Resources: • Creator of @actionshub
• Git Repository Test Kitchen Workflow: actionshub-test-kitchen Github Action • @sous-chefs Board Member
• Git Repository Chef Sous-Chefs: Running Test Kitchen tests on Windows with Github Actions
• Webinar: Automated Cookbook Testing with GitHub Actions

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#8 Improve Visibility Across all Your Chef
Infra Runs with Real-Time Dashboards
Chef Automate provides enterprise management and observability capabilities, and it’s included with every
Chef subscription. Chef Automate offers visual UIs, real-time interactive dashboards, Identity and Access New! Chef Automate
Management (IAM), third-party integrations, data APIs, and much more. Chef Automate enables Infrastructure,
DevOps, Security, Cloud and Release teams to easily collaborate and get work done, all while maintaining an
Infrastructure State
auditable history of changes to system environments. Management Dashboard
Chef Automate also can be used to install Chef Infra Server, either for a single-host installation that contains
both Chef Infra Server and Chef Automate, or for a standalone Chef Infra Server instance. Chef Automate
provides a graphical management console for the Chef Infra Server.

Benefits:
• Real-Time Data Across Environments: Aggregated, filterable dashboards collect configuration details for
every datacenter, cloud provider and environment you manage
• Faster Remediation: Automate the end-to-end process of identifying and remediating infrastructure drift
• Continuous Compliance: Enable compliance and audit teams with self-service dashboards and reports
The Chef Automate Infrastructure
Resources: State Management Dashboard
• Documents: Chef Infra Server dashboards in Chef Automate provides users views of the desired
• Blog: New Chef Infra Server Automate Functionality and EOL Updates for Chef Manage and Backend state of their infrastructure, speeding
• Learn Chef: Secure Your Infrastructure with Chef Automate their ability to identify the cause of any
• Documents: Install Chef Infra Server with Automate
configuration drift and take action.

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#9 Simplify User Management with Identity
and Access Management (IAM)
Operating complex services and
environments is a collaborative effort
Chef Automate Policy Structure
Enterprise Control
requiring a consistent view of intended and
and Coordination
IAM id
members

actual system states across teams. Chef Policy name

Automate administrators can create WHO

*
WHERE

customizations that provide them with Statement *

id
Data within Chef Automate can
User Project name
resource-specific authorization for users or * Allow | Deny ingest rules

teams, either created locally or imported *

be restricted to the projects a user or
* team has access to. Notifications can
1
*
from existing LDAP or Active Directory.
Team WHAT Role
id
Resource be displayed on a per-node, per-failure
Project data within Automate is then *
name

restricted to authorized users and teams. basis, or configured for alerts to chat,
*
API
* Action webhook endpoints, or ServiceNow.
Token *
Benefits:
• Secured Access: Enhanced multi-statement policies and role-based access control with a set of built-in
roles to simplify typical security configurations.
• Project Level Control: Project-scoped access control for up to 30 projects that limit permissions to
resources defined in the project
• Enterprise Manageability: Easily onboard and manage 100s of users

Resources:
• Documents: Chef Automate LDAP Authentication via Existing Identity Management Systems
• Documents: Chef Automate Identity and Access Management (IAM) Overview
• Blog: Chef Automate Product Announcement: Identity and Access Management Release

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
#10 Streamline Compliance Checks with
Chef Infra Compliance Phase
Chef Infra Client Compliance Phase replaces the existing audit cookbook, enabling compliance and
auditing reporting using our Chef InSpec engine as part of any Chef Infra Client run without the need for the Chef Infra and Chef
audit cookbook. The new compliance phase is fully backwards compatible with the audit cookbook.
InSpec Better Together
The Compliance Phase also features a new compliance reporter: `cli`. This report mimics the Chef InSpec
command line output giving you a visual indication of your system's compliance status. Thanks for this new
reporter Chef Community Contributor @aknarts. Chef Infra Compliance Phase
simplifies the workflow needed to
Existing audit cookbook users can migrate to the new Compliance Phase by removing the audit cookbook run Chef InSpec compliance
from their run_list and setting the `node['audit']['compliance_phase'] = true`
audits, view results and do
analysis. It extends our policy-
Benefits: based approach to configuration
• Zero Dependencies: Compliance out of the box without the need for solving or managing cookbook enabling a single agent than can
dependencies handle the end-to-end workflow
• Simplified Upgrade: Compliance code upgrades with your Chef Infra Client releases so you always
have a working solution
from state enforcement to, data
• Reduced Server Dependency: No cookbook code to fetch from the server. Perfect for high latency or aggregation to validation.
air-gapped environments

Resources:
• Documents: Chef Infra Compliance Phase
• Blog: Serve-up Continuous Compliance with Chef Infra Compliance Phase
• Webinar: Configure Chef Infra & Compliance Using Built-In Functionality

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
Go Beyond Infrastructure Management Automation
Chef Enterprise Automation Stack (EAS) provides teams
implementing DevSecOps with a common approach for EVERY TEAM EVERY CHANGE EVERY ENVIRONMENT
automating application delivery, infrastructure configuration and
compliance auditing.
Key Commands:
Chef InSpec provides an additional level of system state
OBSERVABILITY
enforcement. It provides a language that describes system state CHEF AUTOMATE™

expectations in a way that can be directly mapped to policies

defined for Chef Infra, providing insight into how to remediate APPLICATION
any misconfigurations uncovered in audits within the same CHEF HABITAT™

toolkit.
SECURITY

Chef Habitat is the evolution of Chef’s software configuration APPS: CHEF INSPEC™

capabilities and redefines the way applications are delivered. � IT INFRASTRUCTURE

While traditional code-based configuration solutions are good for � Legacy
CHEF INFRA™

managing infrastructure-as-code they are not well suited for � Cloud-native

managing service architected applications with many DEV EXPERIENCE
� Packaged CHEF WORKSTATION™
dependencies that are updated frequently and require quick
actions like stop/start/restart.

An example of a use case Chef EAS is especially well suited for “We not only wanted to accelerate our adoption of agile delivery practices but create an
includes managing complex applications on Windows. Operating organization of developers that we taught to do operations and collaborate via code.
system level configuration concerns such as domains, firewalls Chef’s code based approach to automation enabled us to do this and now sits as the
and others can be managed with Chef Infra, while Chef Habitat foundation that everything else is built upon including our core applications, services,
handles the build and deployment of your applications itself. containers, etc.”
Together with Chef InSpec you can guarantee that your Corey Johnston
application has been delivered safely and securely with all the Manager of Cloud Engineering, Edgenuity
policy you’ve defined for it enforced.

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.
Stay on Top of the Latest and Greatest from Chef

Subscribe to the Chef Releases Discourse Channel: https://discourse.chef.io/c/chef-release/9

© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 16
 ABOUT CHEF AND PROGRESS
Progress (NASDAQ: PRGS) provides the best products to develop, deploy and manage high-impact business applications. Acquired
in October 2020, Chef extends Progress offerings in DevOps and DevSecOps, with market-leading, modern infrastructure,
compliance, and application automation. With Progress, you can accelerate the creation and delivery of strategic business
applications, automate the process by which you configure, deploy and scale those apps, and make your critical data and content
more accessible and secure— leading to competitive differentiation and business success. Over 1,700 independent software
vendors, 100,000+ enterprise customers, and a three-million-strong developer community rely on Progress to power their
applications. Learn about Progress at www.progress.com or +1-800-477-6473.

http://www.chef.io
© 2021 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.