Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pass Chef node to InSpec as an attribute #271

Merged
merged 1 commit into from Aug 29, 2017

Conversation

Projects
None yet
3 participants
@adamleff
Copy link
Contributor

adamleff commented Aug 29, 2017

Providing the Chef node object (attributes, environment, etc.) to InSpec as an attribute will allow the ability to write more flexible profiles and eliminate the need for users to write out JSON files during the converge phase only to get read in by the profile later.

Fixes #268

@adamleff

This comment has been minimized.

Copy link
Contributor Author

adamleff commented Aug 29, 2017

Travis failures in the "default" suites are unrelated to this change, fixed in #270

Pass Chef node to InSpec as an attribute
Providing the Chef node object (attributes, environment, etc.) to InSpec
as an attribute will allow the ability to write more flexible profiles
and eliminate the need for users to write out JSON files during the
converge phase only to get read in by the profile later.

Signed-off-by: Adam Leff <adam@leff.co>

@adamleff adamleff force-pushed the adamleff/pass-node-object branch from 7ee98c9 to 9cd4df1 Aug 29, 2017

@adamleff adamleff requested review from alexpop and arlimus Aug 29, 2017

@arlimus
Copy link
Contributor

arlimus left a comment

Exactly as promised, test passed after #270 !
Thank you @adamleff for adding this highly requested feature and making it very explicit in the readme too. Huge thanks!! 👍


While it is recommended that InSpec profiles should be self-contained and not rely on external data unless
necessary, there are valid use cases where a profile's test may exhibit different behavior depending on
aspects of the node under test.

This comment has been minimized.

Copy link
@arlimus

arlimus Aug 29, 2017

Contributor

Thank you for this wonderful description!

@arlimus arlimus merged commit 456939a into master Aug 29, 2017

2 checks passed

DCO This commit has a DCO Signed-off-by
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

@arlimus arlimus deleted the adamleff/pass-node-object branch Aug 29, 2017

@arlimus arlimus removed the in progress label Aug 29, 2017

@mhedgpeth

This comment has been minimized.

Copy link
Contributor

mhedgpeth commented Aug 29, 2017

@adamleff doesn't this get done by passing in inspec attributes through the cookbook? (My PR?)

@mhedgpeth

This comment has been minimized.

Copy link
Contributor

mhedgpeth commented Aug 29, 2017

@adamleff I believe that designing inspec profiles with a good interface of what it needs is the better way. I don't believe that providing the whole node attribute is the right way. Have chef tell inspec what it needs via the attribute feature. Make that as small as possible. That way you can run profiles without an implicit dependency on Chef.

@adamleff

This comment has been minimized.

Copy link
Contributor Author

adamleff commented Aug 29, 2017

@mhedgpeth your PR is similar to this but not exactly. Your PR allows for certain node attributes to be set (in the 'audit' tree) and then passed as-is. We've seen a number of use cases where people wanted more information, including other non-attribute information such as run_list, environment, etc. Those individuals were using Chef to write out node objects as JSON and then loading that data in later... and there are a whole suite of reasons why that's a bad practice. This simply provides a better pipe to plumb that data into the InSpec run.

InSpec can't tell Chef what is needs, therefore Chef selectively pass on data to InSpec for what a profile needs without an additional level of coordination. The implicit dependency is only there if the user elects for it to be there.

I agree that having a separation of concerns is better. This in no way ties InSpec to Chef or Chef to InSpec any more than writing out data files and reading them in later. The use of this additional data is optional and we're providing it in an effort to stop the bad practices of littering filesystems with node object JSON files and also meet the needs of many community members who have raised this as a feature request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.