Test Kitchen & InSpec

Test cookbooks before they ship.

Because cookbooks run as root on real machines, testing them before they ship is essential, and Chef has a mature stack. Test Kitchen spins up a throwaway instance (in Docker, a VM, or a cloud), applies your cookbook, and lets you verify the result — a full converge in a disposable environment. InSpec then asserts the machine is actually in the desired state: the package is installed, the port is listening, the file has the right mode.

driver: { name: dokken }        # docker-based test instances
provisioner: { name: chef_zero }
platforms:
  - name: ubuntu-22.04
  - name: rockylinux-9
suites:
  - name: default
    run_list: [recipe[web::default]]
    verifier: { inspec_tests: [test/integration/default] }

describe package('nginx') do
  it { should be_installed }
end
describe port(80) do
  it { should be_listening }
end
describe file('/etc/nginx/nginx.conf') do
  its('mode') { should cmp '0644' }
end

The full loop

kitchen test runs the whole cycle: create the instance, converge the cookbook, run the InSpec verifier, and destroy the instance — across every platform you listed, so you catch a Debian-vs-RHEL break before production does. Add cookstyle (Chef’s linter/style checker) for static analysis, and you have unit, integration, and lint coverage. This is what makes changing a widely-used cookbook safe.