[chef] version locking and roles

[KC Braunschweig < >]

So it sounds like a lot of people are protecting prod stability by
specifying cookbook versions in their prod environments but not in the
envs for pre-prod. How are you handling the fact that roles aren't
versioned though? I guess you can specify versions for the cookbooks
of the recipes inside an assigned role individually, but what if the
recipes in a role change? For instance, I want to introduce a new
recipe into my base role, but I want to do it in pre-prod before
production of course. If I add it into the base role, production
version specs won't stop it. What I want is to lock prod onto the
version of the ROLE that doesn't yet have the new recipe. I guess I
could make version 0.0.1 of the new cookbook a no-op and add then make
my real version 0.0.2 and lock prod to a no-op... and trust that it
really is a no-op, kinda weak.

Anyone done a longer term writeup on what it's like living with an
evolving chef repo in pre-prod and prod over the longer term?

KC