[chef] berks version locks and modifying environments

[Koert Kuipers < >]

we use the ruby DSL for defining our environments, and berks to apply versions locks to them.

so after modifying an environment ruby file we do this:

$ knife environment from file environments/myenvironment.rb
$ berks apply myenvironment

this all works great. however as i execute these commands there is a small window in which the new environment is on the chef server without the version locks. if any box where to run chef-client in this window it would run with the latest versions of the cookbooks on the chef server, with potentially disastrous results.

so my question is:

how do i avoid this?

i could download the json environment from the chef server (which includes the version locks) to make modifications, but that is rather unsatisfying. we use the ruby dsl to avoid managing endless repetitive json data structures (which would be error prone to edit). for example the list of hadoop slave servers is needed in a few different places in the environment, and in the ruby dsl we define it once as a variable and re-use it.

thanks! koert