How to access Chef data_bags data in InSpec

Question

I am writing InSpec tests for some of the new chef recipes I'm working on. I would like to use the data_bags used by cookbooks to iterate through the elements of a data packet. I can't figure out how to access them in my InSpec tests! Recipes use search methods, data_bag and data_bag_item. But these methods do not seem to be available in my InSpec test. I suspect these are special Chef DSL methods? The source for data_bags is under source control, so I have access to json for them on the local file system.

How do I access these data_bags in Chef_zero using InSpec syntax?

I found some examples on the Internet, but I don’t see how data_bags really load chef_zero so that they can be used in tests, for example. https://github.com/charlesjohnson/fundamentals-with-tests/blob/master/chef-repo/cookbooks/users/test/integration/default/serverspec/default_spec.rb as well as https://github.com/chef /chef/blob/master/kitchen-tests/test/integration/webapp/default_spec.rb

I am using a box of Windows Server 2012R2 in the Vagrant test kitchen. This is an example of a data packet element from one of the data packets:

{ "User": "mcummins", "FullName": "Martin Cummins", "id": "mcummins" } 

This specific dataset lists the Windows Active Directory users added to the Administrators group.

I set the data_bag_ path in my .kitchen.yml (I set it in the sets and provisioning), but I did not get to the point where I can see which one is correct:

 --- driver: name: vagrant customize: natdnshostresolver1: "on" provisioner: name: chef_zero data_bags_path: ../../../data_bags # client_rb: # audit_mode: :audit_only verifier: name: inspec platforms: - name: mwrock/Windows2012R2 transport: name: winrm suites: - name: default data_bags_path: ../../../data_bags run_list: - recipe[SPMWindowsBuilder::default] verifier: inspec_tests: - test/integration attributes: 

Answer 1

It's impossible. InSpec works completely separate from the chef and has nothing to do with the chef. You will need to write the elements of the bag in the form of files from the chef's side, and then read them through your InSpec code, which would be difficult, something like this is possible (unverified):

 item = JSON.parse(command('cat /tmp/item.json').stdout) 

Answer 2

There are many ways to execute inspec — local, SSH, WinRM, or Dockerit — and it is not clear from the question how to execute inspec .

provided that:

1. you execute inspec locally on the host connected to the chef server (install inspec on the host itself and then call it)
2. the node contains the client configuration (provided that it is in /etc/chef/client.rb , the client key and the secret key of the packet with encrypted data

3. in inspec built-in ruby ​​installed chef rubygem. here is a hint:

   $/opt/inspec/embedded/bin/gem install chef

then you can use inspec to read the contents of the data packet using ruby.

 require 'chef' Chef::Config.from_file '/etc/chef/client.rb' data_bag = Chef::DataBagItem.load 'data_bag_name' item = data_bag['item']