Learn Chef - Chef Automate

#Introduction

In episode 11 you used Chef InSpec to validate nodes for compliance — writing profiles, running inspec exec, and reading the results. But running scans one by one will not hold up as the number of nodes grows. In episode 12 we step up a level: Chef Automate, the platform that combines visibility, compliance, and workflows in a single dashboard.

The goals of this episode:

Understand Automate's position in the Chef architecture.
Get to know the main components: dashboard, data collection service, and event feed.
Connect nodes to the data collection service.
Build a compliance, approval, and deployment pipeline in CI/CD.

#What Is Chef Automate

Chef Automate is a management platform that sits on top of Chef Infra Server. It provides:

Compliance & visibility dashboard — a summary of node health, run status, and compliance scores on one screen.
Node health — see which nodes checked in successfully, failed, or never reported within a given time frame.
Cookbook run status — an event feed for every chef-client run, complete with the resources that changed.
Data collection service — the endpoint that receives reports from nodes and the Infra Server.

Data flows from nodes toward Automate, not the other way around. Automate is an aggregator.

#Architecture and Data Flow

Nodes send data to Automate through two channels:

Data collector — nodes configured with data_collector.server_url send a report after every run.
Compliance — Automate runs InSpec scans on nodes remotely, or receives reports from nodes that run InSpec during their run.

The Infra Server can also forward its data to Automate so all reports are collected in one place.

Note

Automate does not replace the Infra Server. The Infra Server remains the source of truth for cookbooks, data bags, and run lists; Automate is the observability and workflow layer on top of it.

#Installing Chef Automate

Installation starts with the chef-automate CLI:

curl -L https://packages.chef.io/files/current/latest/chef-automate-cli/chef-automate_linux_amd64.zip | gunzip - > chef-automate
chmod +x chef-automate
sudo ./chef-automate init-config

Important

The deploy process takes several minutes and requires root access and an open port 443. Pay attention to the minimum hardware requirements in the official documentation — Automate is not suited to running on a small VPS.

#Connecting Nodes to the Data Collection Service

To get run reports into Automate, add configuration to the node's client.rb:

client.rb — Automate data collector

data_collector.server_url "https://automate.example.com/data-collector/v0/"
data_collector.token "TOKEN_AUTOMATE"
data_collector.mode "both"

Once the configuration is applied and the next run completes, the node immediately appears in the dashboard with run details, check-in time, and resource changes. This is the key to node health — you can immediately see which nodes have not checked in for more than 24 hours.

#Dashboard, Compliance, and Event Feed

Once data arrives, the Automate dashboard shows:

Overview — the number of healthy versus problematic nodes, and the overall compliance score.
Compliance — the results of InSpec scans run by Automate; Automate can run profiles without installing inspec on the nodes.
Node Runs — the history of every run, including the cookbooks used, resources changed, and duration.
Event Feed — a stream of events: node bootstrap, successful or failed runs, data bag changes, and more.

Compliance scans are managed through profile scanning jobs. Automate uses node credentials (such as an SSH key or WinRM) to run InSpec remotely, then displays the scores and findings in the dashboard.

#CI/CD Workflow: Compliance, Approval, Deployment Pipeline

Automate acts as a quality gate in the pipeline. A common pattern:

Test — the cookbook is tested with Test Kitchen and InSpec.
Compliance — the InSpec profile is scanned against the staging environment.
Approval — compliance results are reviewed before being approved.
Deploy — production nodes are converged or a new image is built.

A typical pipeline flow

lint -> kitchen test -> inspec scan -> approval -> deploy

Automate provides an API that CI/CD can call to pull compliance results as a gate.

Tip

Make the scan results part of the CI report. If the compliance score drops below the threshold, the pipeline deliberately fails — that way changes that do not meet the standards never reach production.

#Conclusion

In this episode 12 you got to know Chef Automate: a dashboard platform that aggregates data from nodes and the Infra Server through the data collection service, shows node health, cookbook run status, and compliance results on one screen, and serves as the foundation of the compliance and approval pipeline in CI/CD.

Key takeaways:

Automate is an aggregator — nodes send reports, Automate displays and analyzes them.
Data collection service — node connectivity is configured via data_collector.server_url in client.rb.
Centralized compliance — InSpec scans are run and managed from Automate.
Pipeline gate — compliance results can be a requirement for approval and deployment.
Not a replacement for the Infra Server — the two work together.

In the next episode, episode 13, we cover the foundation that keeps all this communication secure: Authentication & Security — client key validation, SSL certificates, encrypted data bags, and chef-vault for storing secrets. See you in episode 13!