[chef] Re: Re: Re: Chef Client 12.1.0.rc.0 Released

["Julian C. Dunn" < >]

On Tue, Feb 24, 2015 at 7:49 PM, Anton Koldaev 
<
 >
 wrote:

> What's the idea behind "Experimental Audit Mode"? It seems like all that
> info should be provided by monitoring system. Should it supplement current
> monitoring or replace it? Any examples?

Sure, I can speak to this. Also some reading of Chef RFC 35 should
shed much light:
https://github.com/chef/chef-rfc/blob/master/rfc035-audit-mode.md

The short answer: audit mode == invoke ServerSpec at the end of your
Chef run, but specs sit right inside recipes as part of the DSL using
this control_group/control syntax.

Long answer and justification:

1. Many folks have brownfield infrastructures, and as these folks get
started w/ Chef, they are often too afraid to go right to the
"remediation" (declaring Chef resources in recipes and running them).
Instead, they'd much rather write a set of expectations around their
current brownfield, then go off and write recipes that can conform to
those expectations in a test environment, and then come back to apply
the recipes to the brownfield.
2. We heard a lot of people say they loved how minitest-handler works;
it can, on a live system, assure you that nothing is broken.
Unfortunately, minitest-handler has a couple of problems, chief among
them that it's not true "black box" acceptance testing (because you
can make assertions about node attributes and whatnot rather than
inspecting the system state).

There is also a compliance use case here. Chef only runs resources
that you declare. It doesn't know or do anything about things of
interest that you didn't declare, so this is a way of having a system
state as a whole accounted for. You could imagine a security team
writing controls that they care about, and the sysadmins writing the
recipes containing resources.

I hope that helps. BTW, the for-pay Chef Analytics product will let
you write rules based on these control failures and do things with
those events (send them by email, webhook, chat, whatnot).

- Julian