Menu

Chef Supermarket

Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

View our collection of guides, documentation, and articles

Cookbooks
Advanced Options

Select Badges

Select Supported Platforms

Select Status

RSS

mondoo (11) Versions 1.2.0

Installs and configures Mondoo's cnspec for continuous vulnerability management, security, and compliance

Policyfile
Berkshelf
Knife 
cookbook 'mondoo', '~> 1.2.0', :supermarket
cookbook 'mondoo', '~> 1.2.0'
knife supermarket install mondoo
knife supermarket download mondoo
README
Dependencies
Changelog
Quality 33%

Mondoo Package Chef Cookbook

Cookbook Version
Unit Tests
License

This cookbook installs and configures Mondoo's cnspec on Linux servers and connects it to Mondoo Platform for continuous vulnerability management, security, and compliance.

Usage

  1. Get a registration token. In the Mondoo Platform, open the Space you want assets to report into and create a registration token under that Space's settings. See the cnspec documentation for more on how cnspec registers and scans.

  2. Add the cookbook to your run list and set the token. Depend on mondoo from your wrapper cookbook (depends 'mondoo' in metadata.rb) and set the registration token as an attribute. The minimum required attribute is registration_token:

   # in a role, environment, Policyfile, or wrapper cookbook attributes
   default['mondoo']['registration_token'] = 'YOUR_REGISTRATION_TOKEN'

Then add the default recipe to your run list:

   run_list 'recipe[mondoo::default]'

[!CAUTION]
The registration token is a secret. Source it from an encrypted data bag, a node attribute set by your provisioning pipeline, or another secrets manager rather than committing it to version control.

See the [examples/](examples) directory for a complete wrapper cookbook (including a chef-run walkthrough).

What this cookbook does

The default recipe:

  • Adds the signed Mondoo package repository (APT on Debian/Ubuntu, YUM/DNF on RHEL-family, Zypper on SUSE) and installs the mondoo package
  • Creates the /etc/opt/mondoo/ configuration directory
  • Registers the node with Mondoo Platform by running cnspec login with your registration token (and optional API proxy), writing credentials to /etc/opt/mondoo/mondoo.yml
  • Adds or removes the api_proxy setting in mondoo.yml based on the api_proxy attribute
  • Starts and enables the cnspec.service systemd service (which runs cnspec serve)

Requirements

Platforms

The cookbook supports all non-EOL releases of:

  • Amazon Linux
  • Debian
  • Fedora
  • Red Hat, AlmaLinux, Rocky Linux
  • SLES and openSUSE Leap
  • Ubuntu

Chef Infra

  • Chef Infra Client >= 17

Cookbooks

Recipes

Recipe Description
mondoo::default Entry point. Configures the repository, installs cnspec, registers the node, and enables the service. This is the only recipe you should add to a run list.
mondoo::deb Internal helper. Configures the APT repository and installs the package on Debian/Ubuntu. Included automatically by default.
mondoo::rpm Internal helper. Configures the YUM/Zypper repository and installs the package on RHEL-family and SUSE platforms. Included automatically by default.

Attributes

Attribute Default Description
default['mondoo']['registration_token'] change_me Mondoo registration token used to retrieve client credentials. Required — override this.
default['mondoo']['api_proxy'] nil Proxy server URL for communication with Mondoo Platform (for example, http://proxy.example.com:3128). When set, it is written to mondoo.yml; when unset, any existing api_proxy line is removed.
default['mondoo']['deb']['repo'] https://releases.mondoo.com/debian/ APT repository URL for Debian/Ubuntu. Override to use a local mirror.
default['mondoo']['deb']['gpgkey'] https://releases.mondoo.com/debian/pubkey.gpg GPG key URL used to verify the APT repository.
default['mondoo']['rpm']['repo'] https://releases.mondoo.com/rpm/$basearch/ YUM/Zypper repository URL for RHEL-family and SUSE. Override to use a local mirror.
default['mondoo']['rpm']['gpgkey'] https://releases.mondoo.com/rpm/pubkey.gpg GPG key URL used to verify the RPM repository.

Verify

After a successful Chef run, confirm the node is registered and reporting:

# The service that runs scheduled scans should be active and enabled
systemctl status cnspec.service

# Confirm cnspec is registered with Mondoo Platform
cnspec status

# Credentials and configuration are written here
cat /etc/opt/mondoo/mondoo.yml

The registered asset also appears in your Space in the Mondoo Platform.

Troubleshooting

  • Registration fails / asset never appears. Confirm the registration_token is valid and belongs to the intended Space. The token is consumed during cnspec login; once /etc/opt/mondoo/mondoo.yml exists, the login step is skipped on subsequent converges (it is guarded by creates). To re-register, remove mondoo.yml and run Chef again.
  • Behind a proxy. Set default['mondoo']['api_proxy'] so both the cnspec login call and the persisted mondoo.yml use the proxy.
  • Offline or mirrored repositories. Override the deb/rpm repo and gpgkey attributes to point at your internal mirror.

Examples

See the [examples/](examples) directory for a complete wrapper cookbook and a chef-run walkthrough.

Development

Testing and release instructions for contributors are in [DEVELOPMENT.md](DEVELOPMENT.md).

Author

Mondoo, Inc

License

This project is licensed under the Business Source License 1.1 (BUSL-1.1). See the [LICENSE](LICENSE) file for details.

Join the community!

Join the Mondoo Community GitHub Discussions to collaborate on policy as code and security automation.

Dependent cookbooks

line >= 0.0.0

Contingent cookbooks

There are no cookbooks that are contingent upon this one.

Mondoo Changelog

This file is used to list changes made in each version of the mondoo cookbook.

1.2.0 (June 27, 2026)

  • Fix cnspec being stopped and disabled on every Chef run. cnspec.service declares Alias=mondoo.service, so the recipe's old "disable deprecated mondoo.service" step was tearing down the very service it had just enabled; cnspec now runs as a persistent service after each converge.
  • Mark the cnspec login execution as sensitive so the registration token is not written to Chef run output.
  • Remove CentOS from the supported platforms; CentOS Linux is end-of-life.
  • Refresh the cookbook description and drop references to cnquery; the cookbook installs and runs cnspec.
  • Run Test Kitchen integration tests in CI on Cinc across the supported platforms, switch spell-checking to typos, and automate Supermarket releases with the Cinc CLI.

1.1.0 (June 27, 2026)

  • Change the cookbook license from Apache 2.0 to the Business Source License 1.1 (BUSL-1.1).
  • Drop end-of-life platforms and raise the minimum supported Chef Infra Client and Cookstyle versions.
  • Expand unit and integration test coverage.
  • Add ubuntu to the supported platforms in metadata.rb.

1.0.0 (September 14, 2023)

  • Update metadata.rb with a new cookbook description.
  • Improve README.md content to better describe usage and testing.

0.6.0 (May 9th, 2023)

  • Add a new attribute default['mondoo']['api_proxy'] to support setting a proxy server for all asset -> Mondoo Platform communication. This value will be applied to new assets during registration and existing assets via the configuration file. This release also now depends on the line cookbook, which is used to manage entries in the configuration file.

0.5.0 (May 25th, 2022)

  • switch to mondoo package and install cnquery + cnspec
  • add example for Chef Workstation run

0.4.1 (May 25th, 2022)

  • Add a CONTRIBUTING.md file
  • Tag cookbook releases on GitHub

0.4.0 (March 23rd, 2022)

  • Added support for AlmaLinux

0.3.0 (March 21st, 2022)

  • Added support for SLES, openSUSE, Fedora, Rocky Linux, and Scientific Linux.
  • Updated repository domains from mondoo.io to mondoo.com
  • Expanded testing to include additional distros
  • Added Docker-based testing with the Test Kitchen dokken plugin
  • Added a SPDX compliant license string in the metadata.rb file
  • Added source_url and issues_url values in the metadata.rb file
  • Add a dedicated TESTING.md file
  • Added a LICENSE file and licensing information to the README.md file

0.2.0

  • Initial release on GitHub

Collaborator Number Metric 
            
1.2.0 passed this metric

Contributing File Metric 
            
1.2.0 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file

Cookstyle Metric 
            
1.2.0 passed this metric

No Binaries Metric 
            
1.2.0 failed this metric
Failure: Cookbook should not contain binaries. Found:
mondoo/cinc_v0.21.0_linux_amd64/cinc
mondoo/cinc_v0.21.0_linux_amd64.tar.gz

Testing File Metric 
            
1.2.0 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file

Version Tag Metric 
            
1.2.0 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must include a tag that matches this cookbook version number

Mondoo Mondoo
chris-rock
arlimus
Timothy Smith

Details

View Source View Issues

Updated June 28, 2026 Created on

Supported Platforms

  • suse >= 12.0
  • amazon >= 2.0
  • ubuntu >= 20.04
  • opensuseleap >= 15.0
  • fedora >= 34.0
  • rocky >= 8.0
  • almalinux >= 8.0
  • debian >= 11.0
  • redhat >= 8.0

License

BUSL-1.1

Required Chef Infra Client

(>= 17)

Download Cookbook
Copyright © 2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.

Progress and certain product names used herein are trademarks or registered trademarks of Progress Software Corporation and/or one of its subsidiaries or affiliates in the U.S. and/or other countries.
See Trademarksfor appropriate markings. All rights in any other trademarks contained herein are reserved by their respective owners and their inclusion does not imply an endorsement, affiliation, or sponsorship as between Progress and the respective owners.

Code of Conduct Terms and Conditions of Use Privacy Policy Cookie Policy Trademark Policy Status