{"record":{"id":"f6fd0a942180eb34","repo":"hashicorp/vagrant","slug":"the-validation-key-set-for-config-chef-validation","errorCode":null,"errorMessage":"The validation key set for `config.chef.validation_key_path` does not exist! This\nfile needs to exist so it can be uploaded to the virtual machine.","messagePattern":"The validation key set for `config\\.chef\\.validation_key_path` does not exist! This\nfile needs to exist so it can be uploaded to the virtual machine\\.","errorType":"exception","errorClass":"VagrantPlugins::Chef::Provisioner::Base::ChefError","httpStatus":null,"severity":"error","filePath":"plugins/provisioners/chef/provisioner/chef_client.rb","lineNumber":22,"sourceCode":"require 'pathname'\n\nrequire 'vagrant'\nrequire 'vagrant/util/presence'\nrequire 'vagrant/util/subprocess'\n\nrequire_relative \"base\"\n\nmodule VagrantPlugins\n  module Chef\n    module Provisioner\n      # This class implements provisioning via chef-client, allowing provisioning\n      # with a chef server.\n      class ChefClient < Base\n        include Vagrant::Util::Presence\n\n        def configure(root_config)\n          raise ChefError, :server_validation_key_required if @config.validation_key_path.nil?\n          raise ChefError, :server_validation_key_doesnt_exist if !File.file?(validation_key_path)\n          raise ChefError, :server_url_required if @config.chef_server_url.nil?\n        end\n\n        def provision\n          install_chef\n          verify_binary(chef_binary_path(\"chef-client\"))\n          chown_provisioning_folder\n          create_client_key_folder\n          upload_validation_key\n          upload_encrypted_data_bag_secret\n          setup_json\n          setup_server_config\n          run_chef_client\n          delete_encrypted_data_bag_secret\n        end\n\n        def cleanup\n          if @config.delete_node","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/plugins/provisioners/chef/provisioner/chef_client.rb#L4-L40","documentation":"Raised in ChefClient#configure when `validation_key_path` is set but `File.file?` fails after the path is expanded with `File.expand_path(path, @machine.env.root_path)`. The key must exist on the host because the provisioner uploads it to the guest (upload_validation_key) before running chef-client. Most instances are relative-path mistakes: the path resolves against the Vagrant environment root, not the cwd you ran vagrant from.","triggerScenarios":"Setting `chef.validation_key_path` to a file that does not exist, or to a relative path that resolves incorrectly against `machine.env.root_path` (the project root containing the Vagrantfile).","commonSituations":"Key not committed/cloned with the project; path written relative to home (`~/chef/...` sometimes mishandled by team members); typo in filename; key on a different machine.","solutions":["Check the file exists at the path Vagrant resolves: run `ls <project-root>/<your-path>`","Use an absolute path: `chef.validation_key_path = \"/home/you/keys/myorg-validator.pem\"`","Copy the validator key into the project (e.g. `keys/`) and reference it relative to the project root, and gitignore it"],"exampleFix":"# Vagrantfile - before\nchef.validation_key_path = \"~/chef/myorg-validator.pem\"  # '~' not expanded the way you expect\n\n# Vagrantfile - after\nchef.validation_key_path = \"keys/myorg-validator.pem\"   # file exists at <project>/keys/","handlingStrategy":"validation","validationCode":"# Fail fast before vagrant reads the Vagrantfile\nkey = File.expand_path(ENV.fetch(\"CHEF_VALIDATION_KEY\", \"keys/myorg-validator.pem\"), __dir__)\nabort \"Validation key missing at #{key}\" unless File.file?(key)\n\nconfig.vm.provision \"chef_client\" do |chef|\n  chef.validation_key_path = key\nend","typeGuard":"def validation_key_present?(path, root)\n  File.file?(File.expand_path(path, root))\nend","tryCatchPattern":null,"preventionTips":["Remember the path is expanded against the Vagrant project root, not your shell cwd","Prefer absolute paths or project-relative paths committed in a (gitignored) keys/ folder","Add a pre-flight check (rake task, Makefile target) that verifies the key exists before vagrant up"],"tags":["chef","chef-client","provisioning","vagrant","file-not-found","configuration"],"backgroundTag":"config-file-not-found","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}