Chef Automate Overview

My Journey to Centralized Visibility

As my infrastructure grew from a handful of servers to hundreds of nodes across multiple environments, I faced a critical challenge: visibility. I was managing Chef Infra for configuration management and Chef InSpec for compliance, but the data was scattered. I needed to answer questions like "What's our current compliance posture?" or "Which nodes failed their last Chef run?" without SSH-ing to individual systems or parsing logs.

Chef Automate solved this problem by providing a unified dashboard where I could see everything happening across my infrastructure in real-time. Today, it's become my mission control for infrastructure automation, compliance monitoring, and operational insights.

What is Chef Automate?

Chef Automate is an enterprise dashboard that provides comprehensive visibility into your automation activities. It integrates data from:

• Chef Infra Client - Configuration management runs

• Chef InSpec - Compliance scan results

• Chef Habitat - Application deployments and health

• Multiple Chef Infra Servers - Centralized multi-server visibility

Think of it as your automation observability platform - a single pane of glass for understanding what's happening across your entire infrastructure.

Core Components and Capabilities

Web UI: Your Automation Dashboard

The web interface provides intuitive access to all automation data:

Main Dashboards:

• Infrastructure Dashboard - Node status, Chef Client run history

• Compliance Dashboard - Compliance scan results, trend analysis

• Applications Dashboard - Habitat service health and deployments

• Event Feed - Real-time stream of all infrastructure changes

What I Monitor Daily:

Morning Routine:
1. Check compliance dashboard - any new failures?
2. Review failed Chef runs - what needs attention?
3. Scan event feed - unexpected changes overnight?
4. Verify application health - all services green?

Compliance Monitoring: Continuous Security Validation

This is where Chef Automate truly shines in my experience.

Capabilities:

• Visualize compliance status across all nodes

• Track compliance trends over time

• Filter by compliance framework (PCI-DSS, CIS, HIPAA)

• Drill down into specific control failures

• Export reports for auditors

My Real-World Example:

During a recent PCI-DSS audit, instead of spending days gathering evidence:

1. Filtered nodes by "PCI Scope" tag
2. Generated compliance report for Q4 2025
3. Exported detailed results showing:
   - 98.7% compliance rate
   - 3 controls with exceptions (documented waivers)
   - Historical trend showing improvement
4. Provided auditor with automated evidence
Result: 2-day audit vs. previous 2-week ordeal

Event Feed: Understanding Change

The event feed shows every change happening in your infrastructure:

What Gets Captured:

• Chef Client run completions (success/failure)

• InSpec scan results

• Cookbook uploads and policy changes

• Node additions and deletions

• User actions and API calls

How I Use It:

Scenario: Application issue reported at 2:37 AM

Event Feed Investigation:
1. Filter events from 2:30-2:40 AM
2. See Chef run completed on app-server-05 at 2:35 AM
3. Click event to view changed resources
4. Identify nginx config change as culprit
5. Review cookbook version that introduced change
6. Rollback to previous version

Total time to root cause: 5 minutes

Role-Based Access Control (RBAC)

RBAC allows fine-grained access control for different teams:

Teams in My Organization:

• Infrastructure Team - Full access to all features

• Security Team - Read access to compliance, manage InSpec profiles

• Audit Team - Read-only access to compliance reports

• Developers - Access to application dashboards only

Configuration Example:

{
  "name": "security-team",
  "projects": ["production"],
  "policies": [
    "inspec-compliance-admin",
    "infrastructure-viewer"
  ]
}

API: Programmatic Access

The Chef Automate API enables integration with other tools:

Endpoints I Use Regularly:

• /api/v0/compliance/reporting/nodes - Compliance data

• /api/v0/cfgmgmt/nodes - Node information

• /api/v0/ingest/events/chef/run - Chef run data

• /api/v0/applications/service-groups - Habitat services

Integration Example:

Pushing compliance metrics to my Grafana dashboard:

#!/bin/bash
# fetch-compliance.sh

# Get compliance summary
curl -H "api-token: $AUTOMATE_TOKEN" \
  https://automate.company.internal/api/v0/compliance/reporting/stats/summary \
  | jq -r '.compliance_summary | 
    "compliance.passed \(.compliant) \n
     compliance.failed \(.noncompliant) \n 
     compliance.skipped \(.skipped)"' \
  | while read metric value; do
    echo "$metric $value $(date +%s)" | nc graphite 2003
done

Notifications: Stay Informed

Chef Automate can send notifications to external systems:

Webhook Integrations:

• Slack - Chef run failures, compliance violations

• ServiceNow - Automated incident creation

• PagerDuty - Critical compliance failures

• Custom Webhooks - Any system with an HTTP API

My Slack Integration:

{
  "name": "production-alerts",
  "url": "https://hooks.slack.com/services/T00/B00/XX",
  "target_url": "https://automate.company.internal",
  "filters": {
    "node_name": "prod-*",
    "status": "failed"
  }
}

Result: Team gets notified immediately when production Chef runs fail.

Data Feeds: Export to External Systems

Data feeds continuously stream data to third-party platforms:

Supported Integrations:

• Splunk - Centralized log aggregation

• ServiceNow - CMDB synchronization

• ELK Stack - Log analysis and visualization

• Custom Endpoints - Any system accepting JSON over HTTP

My Splunk Integration:

Streaming Chef and InSpec data to Splunk for correlation with application logs:

{
  "name": "splunk-feed",
  "url": "https://splunk.company.internal:8088/services/collector",
  "services": ["chef-infra-client", "chef-inspec"],
  "headers": {
    "Authorization": "Splunk ${SPLUNK_TOKEN}"
  }
}

Setting Up Chef Automate

Installation Overview

I deployed Chef Automate using the automated installer:

# Download installer
curl https://packages.chef.io/files/current/latest/chef-automate-cli/chef-automate_linux_amd64.zip \
  | gunzip - > chef-automate && chmod +x chef-automate

# Create minimal config
cat > config.toml << EOF
[deployment.v1.svc]
channel = "current"
upgrade_strategy = "at-once"

[global.v1]
fqdn = "automate.company.internal"

[global.v1.external.postgresql]
enable = true
nodes = ["postgres1.internal:5432", "postgres2.internal:5432"]

[auth_n.v1.sys.service]
a1_data_collector_token = "generated-token-here"
EOF

# Deploy
sudo ./chef-automate deploy config.toml

Deployment Considerations:

• Sizing: 4 CPU, 16GB RAM minimum for 100-500 nodes

• Storage: 50GB+ for data retention

• Database: External PostgreSQL for HA setups

• Network: HTTPS (443) and data collector endpoint (443)

Configuring Chef Infra Server Integration

Connect Chef Automate to your Chef Infra Server:

# On Chef Infra Server, create data collector token
cat > /etc/opscode/chef-server.rb << EOF
data_collector['root_url'] = 'https://automate.company.internal/data-collector/v0/'
data_collector['token'] = 'generated-token-from-automate'
EOF

# Reconfigure
sudo chef-server-ctl reconfigure

Verification:

# Trigger a Chef run on any node
sudo chef-client

# Check Automate UI - run should appear within seconds

Configuring InSpec Reporting

Send InSpec results to Automate:

# Run InSpec with Automate reporter
inspec exec linux-baseline \
  -t ssh://node1 \
  --reporter cli automate \
  --config automate-config.json

automate-config.json:

{
  "reporter": {
    "automate": {
      "url": "https://automate.company.internal/data-collector/v0/",
      "token": "inspec-reporter-token",
      "node_name": "web-server-01",
      "environment": "production"
    }
  }
}

My Automated Scanning:

# /etc/cron.d/inspec-scan
0 */6 * * * inspec-user inspec exec /opt/inspec/profiles/linux-baseline \
  --reporter automate \
  --config /etc/inspec/automate.json \
  >> /var/log/inspec/scan.log 2>&1

Using the Compliance Dashboard

The compliance dashboard is where I spend most of my time in Automate.

Dashboard Overview

Key Metrics Displayed:

• Overall compliance percentage

• Nodes by compliance status (passed, failed, skipped)

• Control failures by severity

• Compliance trends over time

• Top failing controls

My Dashboard Setup:

Filters I Always Use:
- Environment: production
- Time Range: Last 24 hours
- Profile: linux-baseline, ssh-baseline
- Severity: Critical, High

Analyzing Compliance Results

Drill-Down Workflow:

1. View Overall Status

   • 95% compliant across 120 nodes

   • 6 nodes with failures

2. Filter to Failed Nodes

   • web-server-03: 2 critical failures

   • db-server-01: 1 high severity failure

3. Examine Specific Node

   • Click web-server-03

   • View all control results

   • See exactly which controls failed

4. Investigate Failed Control

   • Control: ssh-03 (Password Authentication)

   • Expected: "no"

   • Got: "yes"

   • Impact: 1.0 (Critical)

5. Take Action

   • Update cookbook to fix configuration

   • Re-run Chef Client

   • Verify compliance in next scan

Creating Custom Reports

Generate reports for specific audiences:

# Using Automate API
curl -H "api-token: $TOKEN" \
  "https://automate.company.internal/api/v0/compliance/reporting/reports/id/REPORT_ID" \
  -o compliance-report-q4-2025.json

# Convert to PDF for auditors
# (Using custom reporting tool)
./generate-pdf-report.sh compliance-report-q4-2025.json

Report Types I Generate:

• Monthly Executive Summary - High-level compliance trends

• Quarterly Audit Reports - Detailed control-by-control results

• Weekly Team Reports - Actionable items for remediation

• On-Demand Investigation - Deep dives into specific issues

Event Feed Deep Dive

The event feed is invaluable for understanding infrastructure changes.

Filtering Events

Common Filters:

# Recent Chef run failures
Type: Chef Client Run
Status: Failed
Time: Last 24 hours

# Compliance scans in production
Type: InSpec Scan
Environment: production
Time: Last 7 days

# Changes by specific user
User: deploy-automation
Time: Last 1 hour

Event Details

Each event shows rich context:

Event: Chef Client Run Failed
Node: web-server-05
Time: 2026-01-07 14:32:15 UTC
Run ID: 12345-abcde
Duration: 45 seconds

Resources:
  ✓ 45 succeeded
  ✗ 2 failed
  ↷ 3 skipped

Failed Resources:
  - service[nginx] - Failed to restart
  - template[/etc/nginx/nginx.conf] - Permission denied

Error Messages:
  nginx: configuration file /etc/nginx/nginx.conf test failed

Investigation Path:

1. Click event for full details

2. View resource delta (what changed)

3. Check cookbook version applied

4. Review error logs

5. SSH to node if needed (from event UI)

High Availability Configuration

For production, I run Automate in HA mode:

My HA Setup:

┌─────────────────────┐
│   Load Balancer     │ ← HTTPS entry point
└──────────┬──────────┘
           │
    ┌──────┴──────┐
    ▼             ▼
┌────────┐    ┌────────┐
│Auto-1  │    │Auto-2  │ ← Automate instances
└────┬───┘    └───┬────┘
     │            │
     └──────┬─────┘
            ▼
    ┌───────────────┐
    │ PostgreSQL HA │ ← External database cluster
    └───────────────┘
            │
            ▼
    ┌───────────────┐
    │ Elasticsearch │ ← Search and analytics
    └───────────────┘

Benefits:

• Zero downtime for maintenance

• Automatic failover

• Horizontal scaling for data ingestion

• Resilient to single-node failures

Real-World Usage Patterns

Pattern 1: Post-Deployment Validation

After deploying new cookbooks:

# 1. Upload cookbook
knife cookbook upload nginx -o cookbooks

# 2. Apply to canary nodes
knife ssh "role:web-canary" "sudo chef-client"

# 3. Check Automate for successful runs
# Navigate to: Nodes > Filter: role:web-canary
# Verify: All runs succeeded, no failures

# 4. Monitor for 1 hour
# Check Event Feed for unexpected changes

# 5. Deploy to production
knife ssh "role:web-production" "sudo chef-client"

Pattern 2: Compliance Remediation Workflow

Weekly compliance review process:

Monday Morning:
1. Open Compliance Dashboard
2. Filter: Environment=production, Status=failed
3. Export list of failed nodes/controls
4. Create Jira tickets for each failure category
5. Assign to infrastructure team

Throughout Week:
- Team remediates issues
- Chef runs apply fixes
- InSpec scans validate compliance

Friday Afternoon:
- Review compliance trends
- Verify all critical items resolved
- Report to management

Pattern 3: Incident Investigation

Using Automate during outages:

Incident: Application errors at 3:15 AM

Investigation Steps:
1. Check Event Feed around 3:15 AM
2. Filter to affected nodes
3. Identify: Chef run at 3:12 AM changed app config
4. Click event → View changed resources
5. See: template[app-config.yml] modified
6. Review: Cookbook version change introduced bug
7. Rollback: Pin to previous cookbook version
8. Verify: Next Chef run fixes issue

Resolution time: 15 minutes vs. hours of log searching

Integration with External Tools

Grafana Dashboards

I pull metrics from Automate API to Grafana:

# grafana-automate-sync.py
import requests
import time

AUTOMATE_URL = "https://automate.company.internal"
TOKEN = "api-token"

def get_compliance_stats():
    response = requests.get(
        f"{AUTOMATE_URL}/api/v0/compliance/reporting/stats/summary",
        headers={"api-token": TOKEN}
    )
    return response.json()

def send_to_graphite(metric, value):
    # Send to Graphite for Grafana
    message = f"{metric} {value} {int(time.time())}\n"
    # ... graphite sending logic

# Run every 5 minutes
while True:
    stats = get_compliance_stats()
    send_to_graphite("chef.compliance.passed", 
                     stats['compliance_summary']['compliant'])
    send_to_graphite("chef.compliance.failed", 
                     stats['compliance_summary']['noncompliant'])
    time.sleep(300)

ServiceNow Integration

Automated ticket creation for compliance failures:

{
  "name": "servicenow-compliance",
  "type": "webhook",
  "url": "https://servicenow.company.internal/api/now/table/incident",
  "filters": {
    "compliance_status": "failed",
    "impact": "critical"
  },
  "payload": {
    "short_description": "Critical Compliance Failure: {{node_name}}",
    "description": "Control {{control_id}} failed on {{node_name}}\nImpact: {{impact}}",
    "urgency": "1",
    "assignment_group": "Infrastructure Security"
  }
}

Best Practices from My Experience

1. Data Retention Strategy

# Configure in Chef Automate
[compliance.v1.sys.retention]
compliance_report_days = 90  # Keep 90 days of compliance data

[event_feed.v1.sys.service]
event_days = 30  # Keep 30 days of events

My Approach:

• 90 days for compliance (audit requirements)

• 30 days for events (operational needs)

• Export historical data to S3 for long-term retention

2. Meaningful Tagging

Tag nodes for effective filtering:

# In cookbook
node.normal['tags'] = ['production', 'pci-scope', 'web-tier']

Tags I Use:

• Environment: production, staging, dev

• Compliance Scope: pci-scope, hipaa-scope

• Application: web, database, cache

• Business Unit: finance, marketing, engineering

3. Regular Report Reviews

My Schedule:

• Daily: Quick dashboard check for critical issues

• Weekly: Deep dive into trends and patterns

• Monthly: Executive reports for management

• Quarterly: Comprehensive audit preparation

4. Alert Fatigue Prevention

Configure notifications thoughtfully:

❌ Don't Alert On:
- Every InSpec scan completion
- Non-critical control failures
- Expected Chef run failures (maintenance windows)

✅ Do Alert On:
- Critical compliance failures in production
- Chef run failures on production nodes
- Security-related control failures
- Unexpected configuration changes

What's Next?

You now understand how Chef Automate provides: ✅ Unified visibility across infrastructure automation ✅ Continuous compliance monitoring and reporting ✅ Real-time event tracking and investigation ✅ Role-based access for different teams ✅ Integration with external tools and workflows

Continue to Best Practices to learn production deployment patterns and operational excellence strategies.

Chef Automate transforms scattered automation data into actionable insights. With proper setup and workflows, it becomes the central nervous system of your infrastructure automation practice.

---

Ready to master Chef best practices? Continue to Best Practices