Cinc Client

kitchen-cinc is a Test Kitchen provisioner for Cinc Client, the community distribution of Chef Infra Client. It downloads and installs omnibus packages via the Cinc omnitruck API, so you can test your cookbooks against different Cinc versions without pre-installing anything on your images.

Cinc Client is built from the same upstream source as Chef Infra Client — it is a different build, not different software.

Installation

This gem ships as part of Cinc Workstation. For standalone installation, add it to your Gemfile:

gem "kitchen-cinc"

Or install it directly:

gem install kitchen-cinc

The five provisioners

Compatibility with chef_* provisioner names

To ease migration from kitchen-omnibus-chef, every provisioner is also registered under its chef_* name: chef_infra, chef_solo, chef_apply, chef_target, and chef_zero. An existing kitchen.yml using provisioner: name: chef_infra works without modification — it transparently runs the Cinc Client equivalent.

The chef_* names follow this priority order across gems:

kitchen-chef-enterprise > kitchen-cinc > kitchen-omnibus-chef

When a higher-priority gem is installed, kitchen-cinc yields to it. So with chef_infra in your kitchen.yml:

Quick start

---
driver:
  name: vagrant

provisioner:
  name: cinc_infra
  product_name: cinc
  install_strategy: always
  channel: stable

platforms:
  - name: ubuntu-24.04
  - name: almalinux-9

suites:
  - name: default
    run_list:
      - recipe[my_cookbook::default]

Setting Provisioner Configuration

Installation options

These control how Cinc Client is downloaded and installed on the instance before the converge runs. product_name defaults to cinc, so installation is active by default — set install_strategy: skip to disable it entirely.

Proxy settings are forwarded to the install script and to Cinc itself:

Only http_proxy is honored by the PowerShell installer. If chef-config is available on the workstation, proxy settings from ~/.chef/config.rb are read at startup and exported automatically.

Run list and attributes

Logging

Multiple converges and idempotency

Proving idempotency is one of the most valuable things this provisioner can do for you:

provisioner:
  name: cinc_infra
  multiple_converge: 2
  enforce_idempotency: true

The first converge does the work; the second must change nothing, or the run fails.

Custom config injection

provisioner:
  name: cinc_infra
  client_rb:
    chef_server_url: https://my-chef-server.example.com/organizations/test
    ssl_verify_mode: :verify_peer

Values are formatted with Ruby inspect semantics, which is why :verify_peer is written as a symbol.

Chef Zero networking

Cookbook resolution

kitchen-cinc resolves cookbook dependencies before staging the sandbox, in this order:

1. Policyfile — used automatically when a Policyfile.rb is present in kitchen_root, or at policyfile_path.
2. Berkshelf — used when no Policyfile is found and a Berksfile is present.
3. None — cookbooks are copied from standard layout directories without resolution.

The default cookbook_files_glob is:

README.*,VERSION,metadata.{json,rb},attributes.rb,recipe.rb,
attributes/**/*,definitions/**/*,files/**/*,libraries/**/*,
providers/**/*,recipes/**/*,resources/**/*,templates/**/*,
ohai/**/*,compliance/**/*

If a file your cookbook needs is not reaching the instance, this glob is the first thing to check.

Paths

Sandbox paths on the workstation auto-resolve to subdirectories under kitchen_root when unset:

root_path is the directory on the instance the sandbox is copied into, and the root every other on-instance path is joined against. It defaults to the driver’s sandbox location. Under cinc_target it is redirected to the local sandbox path, because the converge runs from the workstation rather than on the instance.

On-instance binary paths — cinc_client_path, cinc_solo_path, cinc_apply_path, and ruby_bindir — default to values derived from cinc_omnibus_root, with .bat extensions on Windows.

Provisioner-specific notes

cinc_solo

Does not run in parallel with other provisioner instances, because Berkshelf is not thread-safe. Adds legacy_mode (Boolean, default false), which passes --legacy-mode to run a true Cinc Solo run rather than the local-mode shim.

cinc_apply

Runs each recipe in the suite’s run_list through cinc-apply against files staged under an apply/ directory in the sandbox.

cinc_target

Runs Cinc Client in target mode against a remote node using a Train-based transport. The provisioner runs cinc-client on the workstation, not on the test instance, so it does not install Cinc on the target. Inherits everything from cinc_infra.

Examples

With the Dokken driver

---
driver:
  name: dokken
  privileged: true
  chef_image: cincproject/cinc
  chef_version: latest

provisioner:
  name: cinc_infra
  product_name: cinc

transport:
  name: dokken

platforms:
  - name: ubuntu-24.04
    driver:
      image: dokken/ubuntu-24.04
      pid_one_command: /bin/systemd

  - name: almalinux-9
    driver:
      image: dokken/almalinux-9
      pid_one_command: /usr/lib/systemd/systemd

Air-gapped installation

provisioner:
  name: cinc_infra
  download_url: https://mirror.internal.example.com/cinc/cinc_19.2.12-1_amd64.deb
  checksum: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Pinning a version

provisioner:
  name: cinc_infra
  product_version: 19.2.12
  install_strategy: always