Repository navigation
Solutions Page - Phase 1 - Compliance - Part 1 - #4760
Open
Chef-Pradyumn wants to merge 84 commits into
Open
Chef-Pradyumn wants to merge 84 commits into
Chef-Pradyumn wants to merge 84 commits into
Conversation
- New content/solutions/_index.md: task/outcome-oriented Solutions homepage (card grid), with Compliance as the first fully-built solution and the remaining 7 areas from the Chef Docs Strategy & Information Architecture proposal marked 'Coming soon'. - New content/solutions/compliance/_index.md: Compliance solution overview page linking Chef InSpec, Chef Automate, Chef Infra Client, and Chef 360 into a single author -> scan -> visualize -> remediate -> orchestrate workflow, plus a benchmark coverage summary. - New content/solutions/compliance/<category>/_index.md (9 pages): category landing pages styled after /inspec/resource_packs/, each listing current audit/remediation coverage for that category, sourced from the Chef Compliance - Current Support Coverage catalog (Operating Systems, Desktop / Client, Databases, Cloud, Containers / Kubernetes, Web Servers, Applications / Middleware, Virtualization, Network / Infrastructure). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
…-span benchmark names Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
…r Chef Compliance Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
…view pages; enable sidebar on Solutions Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
✅ Deploy Preview for chef-web-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
…idebar Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Restructures the Compliance solution docs from a benchmark support matrix into a customer-outcome narrative, addressing review feedback that the content listed benchmarks without explaining what audit and remediation actually do or which real problems they solve. Overview page (content/solutions/compliance/_index.md): - Leads with the compliance problems Chef helps solve, not the catalog. - New reader journey: challenges -> how it works -> audit -> remediation -> scenarios -> coverage -> get started. - Adds a full "Compliance audit" section covering what is assessed, how a benchmark becomes runnable InSpec controls, the three ways to run an assessment, what results contain, how findings become a gap list, and how reports and waivers support evidence. - Adds a "Compliance remediation" section of equal depth covering what remediation content is, how it relates to benchmarks and controls, how it standardizes corrective action, how it pairs with audit, and what to check before using it. - Keeps audit and remediation distinct, and states explicitly that an audit version does not imply a matching remediation version. - Adds six real-world scenarios in problem -> approach -> outcome form. - Moves the coverage summary after the solution story and links out to the category pages. Category pages: - Regenerated from the validated internal catalog so the tables are derived from evidence rather than hand-maintained. - Each page now links back to the audit, remediation, and coverage-table explanations on the overview. - Drops the internal "OTHER" canonicalization prefix from five benchmark names. "OTHER" records the absence of a framework token in the source filename; it is a pipeline artifact, not a product fact. Affected pages note that no framework is shown rather than inferring one. - Excludes two internal/preview rows that are not customer-facing. Those records are unchanged in the internal catalog. Published coverage is now stated as 132 benchmarks (60 audit and remediation, 59 audit only, 13 remediation only) across 191 audit versions and 101 remediation versions. The previous 134 figure counted the two excluded internal rows, and contradicted the category index on the same page, which already summed to 132. All benchmark versions remain visible; no version set is reduced to a latest version. Every capability statement is grounded in existing Chef documentation. No new product capabilities, metrics, customer claims, or workflows are introduced. In particular, the Compliance Phase is described as audit-only, which is what its documentation supports. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Kuxhul <kushalj@progress.com>
- Replace RHEL mention in marketing copy with Ubuntu Linux - Add missing hyperlinks across the Compliance overview - Link to Chef InSpec install docs from "Write your own controls" - Simplify tautological/double-negative sentences; deduplicate repeated audit/remediation explanation - Add Chef Automate mention to "Evidence and reporting" - Replace all "estate" references with "fleet" for consistency - Reword all "rather than" phrasing for plainer language - Remove Inferred Current (dagger-marked) benchmark entries and their explanatory paragraph; recompute coverage totals and per-category counts across all affected pages - Remove the "no framework prefix" explanatory note (no longer broadly applicable) - Fix sidebar menu order to match the "Browse by category" table - Remove duplicate Chef Premium Content entitlement sentence - Introduce "The Chef Way" branding across headings and body copy Signed-off-by: Chef-Pradyumn <264104377+Chef-Pradyumn@users.noreply.github.com>
clintoncwolfe
self-requested a review
October 8, 2026 13:16
clintoncwolfe
previously approved these changes
Oct 8, 2026
clintoncwolfe
left a comment
clintoncwolfe
left a comment
Contributor
There was a problem hiding this comment.
I like this - as a partial take, need more product line obviously. I;d like the Docs teams input as well; it's a product-oriented direction, obviously with some marketing content.
Adds a shared capability page explaining how to build custom compliance checks with Chef InSpec, plus contextual resource-pack sections on the four domain pages where a pack is genuinely relevant: Cloud, Containers / Kubernetes, Databases, and Applications / Middleware. The change is strictly additive over the approved baseline (da44770): 228 insertions and no deletions. The nine domain pages keep their URLs, front matter, benchmark tables, published figures, and sidebar order unchanged, including the removal of Inferred Current entries and the recomputed coverage totals. The domain page changes are made through the local catalog generator, which was reconciled to reproduce the approved pages byte-for-byte so regeneration can't restore the superseded tables. The new page states explicitly that a resource pack is not a benchmark and that pack availability does not indicate benchmark coverage. No sentence on a domain page contradicts the benchmark table above it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Kushal J <kushalj@progress.com>
…nd installation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Leadership feedback on PR chef#4760 was that the Compliance solution pages read as marketing rather than as solutions, and don't explain how to do anything. This addresses that without changing the approved benchmark catalog. Add a task-oriented walkthrough, "Audit SSH configuration across a Linux fleet", covering profile creation, control authoring, validation, execution, reading results and exit codes, fix-and-reassess, and waiving an accepted exception. Commands and CLI output were captured from real runs rather than written from memory. Remote SSH, cloud and Kubernetes commands come from the official CLI reference and are shown without fabricated output. Rework the custom checks page from an inventory into practical guidance, documenting the three resource pack distribution patterns with a worked example for each. Rewrite the six compliance scenarios so each ends in concrete linked steps instead of an aspirational outcome, and point two of them at specific steps of the walkthrough. Note plainly where no dedicated guide exists yet. Replace a promotional paragraph in "Getting Chef Compliance content" with actionable guidance, preserving its intent. The nine domain pages, benchmark tables, published figures, domain taxonomy, URLs and navigation weights are unchanged. Catalog regeneration produces no diff. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The cspell check failed on the Compliance overview. "walkthrough" is only present in @cspell/dict-software-terms, and the version bundled with cspell-action v2.1.1 doesn't include it, so CI flagged five occurrences that a locally installed newer dictionary accepted. Use "guide" instead, which is in the base en_US dictionary and so doesn't depend on the software-terms dictionary version. Link targets and anchors are unchanged. Signed-off-by: Kushal J <kushalj@progress.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Hands-on guide using the AWS resource pack: install/verify Chef InSpec, set up AWS credentials, write controls against S3, IAM, and security group resources, run the assessment, read results, fix and reassess, waive an accepted exception, and schedule recurring AWS scan jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
- Collapse the five 'Compliance challenges' subsections into one bulleted list instead of a prose essay. - Shorten the audit mechanics subsections (benchmark-to-profile, assessment results, evidence/reporting) that duplicated detail already documented at the Compliance Phase, scan jobs, and compliance reporting pages; link out instead of re-explaining. - Link the SSH baseline guide from where profiles are introduced. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Replace the opening pitch-style intro and 'Compliance challenges Chef helps solve' agitate section with a concise intro, a direct problem statement, and a 'What this solution implements' section that routes straight to the SSH baseline and AWS foundations guides plus the scenarios list. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Remove 'The Chef Way of Compliance' 6-step loop, now redundant with the problem statement and 'What this solution implements' section at the top of the page. Replace the 3-bullet 'Chef Way of compliance remediation' benefit pitch with one factual paragraph covering the same facts (consistent application, cookbook workflow, idempotent convergence). Drop a trailing sentence that just re-sold the numbered steps above it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Replace generic/awkward headings with ones that name the actual content: 'The problem' -> 'Why compliance drifts between audits', 'How a benchmark becomes something you can run' -> 'From benchmark to runnable profile', 'What remediation content is' -> 'Remediation content', 'How remediation content behaves' -> 'How remediation content runs', 'How audit and remediation work together' -> 'The audit, remediate, reassess cycle'. Update the matching internal anchor link. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Merge or cut subsections whose content is already documented in detail elsewhere: 'From benchmark to runnable profile' (duplicates /inspec/profiles/), 'What an assessment gives you' and 'Evidence and reporting' (both duplicate /automate/reports/, merged into one 'Results and evidence' section), 'Remediation content' and 'How remediation content runs' (duplicate /client/.../cookbooks/ and general Chef Infra Client convergence docs, folded into the section intro), and 'The audit, remediate, reassess cycle' (duplicated the cycle already stated in 'What this solution implements'). Keep subsections that add information not found elsewhere: 'What gets assessed', 'How you run an assessment' (comparison table), 'How remediation relates to benchmarks and controls' (explains the audit/remediation version independence), and 'Before you use remediation content' (checklist). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pradyumn Prabhu <pradyumn.prabhu@progress.com>
Fix the IAM control, which used three identifiers the AWS resource pack doesn't document: where(attached:) instead of only_attached, entry_names instead of policy_names, and an allow_actions property that doesn't exist on aws_iam_policy. Use have_statement, which the pack documents for this check, and note that it matches literal values without expanding wildcards. Add the vendoring step. inspec check and inspec exec both fail on an unfetched dependency, so the guide couldn't be followed end to end. Correct the generator output and inspec.yml guidance, which omitted inputs.yml and showed supports as platform-name rather than platform, and keep depends and supports in the edited inspec.yml so copying the example doesn't break the profile. Replace the inspec detect claim that a failure indicates a credentials problem. On InSpec 5.24.7 the command returns platform details with no credentials set, so it confirms the transport loaded and nothing more. Fold in the material from the S3 baseline draft: per-resource IAM permissions, exit codes, the Automate AWS API node manager path, the be_public object-ACL limitation, and a note recording which output was executed and which is illustrative. Add an extension section covering S3 default encryption and secure transport on the same profile. Remove the unresolved screenshot placeholder from the reporting note. Link the guide from the Compliance overview as a cloud scenario and from the Cloud domain page through the page generator. Signed-off-by: Kushal J <kushalj@progress.com>
Signed-off-by: Chef-Pradyumn <264104377+Chef-Pradyumn@users.noreply.github.com>
Signed-off-by: Chef-Pradyumn <264104377+Chef-Pradyumn@users.noreply.github.com>
Chef-Pradyumn
commented
Nov 10, 2026
Chef-Pradyumn
left a comment
Chef-Pradyumn
left a comment
Contributor
Author
There was a problem hiding this comment.
[Copilot review] Language, clarity and accuracy suggestions.
Chef-Pradyumn
commented
Nov 10, 2026
Chef-Pradyumn
left a comment
Chef-Pradyumn
left a comment
Contributor
Author
There was a problem hiding this comment.
[Copilot review] Suggested language and clarity fixes. Each one can be committed from the PR.
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Remove unsourced claims and filler from platform pages, tighten the Oracle Solaris text, prefix category table versions with v, and drop the pinned Chef InSpec patch version from the AWS guide. Signed-off-by: Chef-Pradyumn <264104377+Chef-Pradyumn@users.noreply.github.com>
…point management card Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Chef-Pradyumn <264104377+Chef-Pradyumn@users.noreply.github.com>
… IBM AIX pages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Chef-Pradyumn <264104377+Chef-Pradyumn@users.noreply.github.com>
Chef-Pradyumn
requested review from
clintoncwolfe
and
a balanced review from Copilot
November 11, 2026 05:29
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The SSH baseline checks can pass while password-based logins remain possible because they do not evaluate effective configuration or cover keyboard-interactive authentication.
10 open issues
What changed in this PR
Introduces outcome-focused Solutions documentation, starting with Chef Compliance, and a separate Chef Premium Content catalog that connects compliance guidance to benchmark coverage.
Changes:
- Adds a Solutions landing page, compliance overview, and SSH and custom-check guides.
- Adds Premium Content access guidance, nine category indexes, and 31 platform references covering audit profiles and remediation availability.
- Updates navigation, homepage and enterprise links, and spelling dictionaries.
| File | Description |
|---|---|
cspell.yaml |
Adds compliance and benchmark terminology. |
content/solutions/compliance/ssh_baseline/_index.md |
Adds an SSH assessment, remediation, and waiver tutorial. |
content/solutions/compliance/custom_compliance_checks/_index.md |
Explains custom controls and resource-pack dependencies. |
content/solutions/compliance/_index.md |
Introduces compliance workflows and fleet scenarios. |
content/solutions/_index.md |
Adds the Solutions card-grid landing page. |
content/premium_content/web_servers/microsoft_iis/_index.md |
Documents IIS benchmarks and profile variants. |
content/premium_content/web_servers/apache_http_server/_index.md |
Documents Apache HTTP Server coverage. |
content/premium_content/web_servers/_index.md |
Indexes web-server benchmark coverage. |
content/premium_content/virtualization/vmware_esxi/_index.md |
Documents ESXi coverage and scan cookbooks. |
content/premium_content/virtualization/_index.md |
Indexes virtualization benchmark coverage. |
content/premium_content/operating_systems/windows_server/_index.md |
Documents Windows Server benchmarks and variants. |
content/premium_content/operating_systems/ubuntu/_index.md |
Documents Ubuntu coverage and profile naming. |
content/premium_content/operating_systems/sles/_index.md |
Documents SUSE coverage and profile variants. |
content/premium_content/operating_systems/rocky_linux/_index.md |
Documents Rocky Linux benchmark coverage. |
content/premium_content/operating_systems/rhel/_index.md |
Documents RHEL CIS and STIG coverage. |
content/premium_content/operating_systems/oracle_solaris/_index.md |
Documents Solaris audit coverage. |
content/premium_content/operating_systems/oracle_linux/_index.md |
Documents Oracle Linux benchmarks and variants. |
content/premium_content/operating_systems/ibm_aix/_index.md |
Lists AIX benchmarks and exact profile names. |
content/premium_content/operating_systems/hp_ux/_index.md |
Documents HP-UX audit profiles. |
content/premium_content/operating_systems/debian/_index.md |
Documents Debian benchmark coverage. |
content/premium_content/operating_systems/centos/_index.md |
Documents CentOS coverage and naming exceptions. |
content/premium_content/operating_systems/amazon_linux/_index.md |
Lists Amazon Linux coverage and profile names. |
content/premium_content/operating_systems/almalinux/_index.md |
Documents AlmaLinux audit and remediation coverage. |
content/premium_content/operating_systems/_index.md |
Indexes operating-system benchmark coverage. |
content/premium_content/network_infrastructure/cisco_ios/_index.md |
Documents Cisco IOS audit profiles. |
content/premium_content/network_infrastructure/_index.md |
Indexes network benchmark coverage. |
content/premium_content/desktop_client/windows/_index.md |
Documents Windows desktop benchmarks and variants. |
content/premium_content/desktop_client/apple_macos/_index.md |
Documents macOS coverage and profile naming. |
content/premium_content/desktop_client/_index.md |
Indexes desktop benchmark coverage. |
content/premium_content/databases/postgresql/_index.md |
Documents PostgreSQL benchmarks and profile scopes. |
content/premium_content/databases/oracle_mysql/_index.md |
Documents MySQL Community audit coverage. |
content/premium_content/databases/oracle_database/_index.md |
Lists Oracle Database profiles by version and scope. |
content/premium_content/databases/mongodb/_index.md |
Documents MongoDB audit and remediation coverage. |
content/premium_content/databases/microsoft_sql_server/_index.md |
Documents SQL Server coverage and deployment variants. |
content/premium_content/databases/mariadb/_index.md |
Documents MariaDB audit profiles and scopes. |
content/premium_content/databases/_index.md |
Indexes database benchmarks and inspection resources. |
content/premium_content/containers_kubernetes/docker/_index.md |
Documents Docker audit coverage. |
content/premium_content/containers_kubernetes/_index.md |
Indexes container coverage and resource packs. |
content/premium_content/cloud/microsoft_azure/_index.md |
Documents Azure profiles and remediation prerequisites. |
content/premium_content/cloud/microsoft_365/_index.md |
Documents Microsoft 365 setup and limitations. |
content/premium_content/cloud/aws_foundations/_index.md |
Documents AWS Foundations audit profiles. |
content/premium_content/cloud/_index.md |
Indexes cloud benchmarks and resource packs. |
content/premium_content/applications_middleware/ibm_websphere_liberty/_index.md |
Documents WebSphere Liberty audit coverage. |
content/premium_content/applications_middleware/apache_tomcat/_index.md |
Documents Tomcat coverage and naming exceptions. |
content/premium_content/applications_middleware/_index.md |
Indexes application and middleware benchmarks. |
content/premium_content/_index.md |
Adds catalog navigation, access guidance, and coverage definitions. |
content/enterprise_chef.md |
Links enterprise entitlement guidance to the new catalog. |
content/_index.md |
Adds a Premium Content homepage card. |
config/_default/params.toml |
Adds Premium Content to menu ordering. |
config/_default/menu.toml |
Registers Solutions and Premium Content navigation. |
Review effort: Balanced
|
|
||
| ## Benchmark coverage | ||
|
|
||
| Current coverage is **118 benchmarks**, with 164 audit versions and 87 remediation versions. |
There was a problem hiding this comment.
Confirmed. These releases appear in the release notes but not in the Premium Content delivery email the catalog is built from. For the MVP the catalog stays based on what's delivered. We're raising the gap with the content team and will update coverage once they confirm.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
- SSH guide: check KbdInteractiveAuthentication in ssh-02, and add ssh-04-effective-auth, which checks the configuration the daemon enforces through sshd -T. Add an included-file override example and a note on sshd -T -C for Match blocks. All output re-captured on Amazon Linux 2023 with Chef InSpec 7.3.4. - Register premium-content in the search defaults and product filters. - Microsoft 365: mark the retired MSOnline and AzureADPreview modules as a blocking limitation and list the affected controls. - Custom compliance checks: set inspec_version, vendor the AWS and Kubernetes profiles, and note the train-kubernetes transport. - Restore the monthly delivery email wording on the Premium Content overview. - Add OpenSSH setting names to the cspell word list. Signed-off-by: Kushal J <kushalj@progress.com>
|
The GitHub repository and GitHub organization governance pages are out of this PR and move to #4784 (Phase 2), where we'll address the review comments on them. Resolving those threads here, as they no longer apply to this PR. |
Chef-Pradyumn
changed the title
Chef-Pradyumn
changed the title
clintoncwolfe
previously approved these changes
Nov 12, 2026
Jayamathans12
previously approved these changes
Nov 12, 2026
Signed-off-by: Chef-Pradyumn <prabhu@progress.com>
Chef-Pradyumn
dismissed stale reviews from Jayamathans12 and clintoncwolfe
via
November 13, 2026 06:51
1992f7b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introduces a new Solutions section to chef-web-docs, organized around customer outcomes rather than individual products, starting with Chef Compliance (Phase 1). It also adds a separate Chef Premium Content section that documents the benchmark coverage behind it.
Solutions are written as "The Chef way of …" practitioner guides.
Solutions (
/solutions/)Overview -> Solutions- landing page (card grid). Chef Compliance is live and 7 other solution areas are marked "Coming soon".Overview -> Solutions -> Chef Compliance(/solutions/compliance/) - overview built around the Chef way: why compliance drifts, how audit and remediation content reaches your systems, common scenarios, and where to start.Chef Premium Content (
/premium_content/)A separate top-level menu (
Chef Premium Content), not nested under Solutions.Other changes
config/_default/menu.toml,params.toml,content/_index.md, andcontent/enterprise_chef.md- navigation and landing-page links.cspell.yaml- new terms.