[chef] Re: Force recipe to run at the end

[Ranjib Dey < >]

Can you break you base role as base-start , base-end ? And then group the recipes the way you want?

Though there are pretty established usage of using resources in the compile time, its not clean. Its difficult to test . I wish we had something like initializers (like what we have in Rails) , where you can specify a set of requirements in chef dsl, but they'll be executed in compile time.

I've asked similar question, you can either use an orchestrator(mco) along with multiple chef runs. This way the chef recipes will be clean. Though convergence will be a multi step process . Else, you can   always do the raw chef api calls in a recipe (and this will be executed in compile time unless you wrap them in ruby_block resource).

You can add a dummy end recipe, to do the hacks for you. i.e re order the resource. Look at runner  and run_context class. You can also use a report handler to do some thing weird , invoking the iptables reload .  

On Sun, Sep 23, 2012 at 2:46 AM, Julien Vehent < " target="_blank"> > wrote:

Hi everyone,

Is there a way to force a recipe to run at the very end of the run list ?
I have this firewall cookbook (AFW) that creates iptables rules into a template, but it runs in a base role and gets called before everything else.

I have other cookbooks that create rules, but those rules won't appear until the next chef run when AFW runs again. I would like to converge in one run instead, by forcing AFW to run after everyone else.

Is it doable ?


Thanks,
Julien


--
Julien Vehent - http://jve.linuxwall.info