hashicorp/vagrant · error · VagrantPlugins::Chef::Provisioner::Base::ChefError

Chef server provisioning requires that the `config.chef.vali

Error message

Chef server provisioning requires that the `config.chef.validation_key_path` configuration
be set to a path on your local machine of the validation key used to register the
VM with the chef server.

What it means

Raised in ChefClient#configure during config validation: chef-client (server-based) provisioning registers the node with a Chef server using a validation key, and `config.chef.validation_key_path` is the only way to supply it. If the option is nil, provisioning aborts before anything touches the machine. This is a pure Vagrantfile configuration error.

Source

Thrown at plugins/provisioners/chef/provisioner/chef_client.rb:21

require 'pathname'

require 'vagrant'
require 'vagrant/util/presence'
require 'vagrant/util/subprocess'

require_relative "base"

module VagrantPlugins
  module Chef
    module Provisioner
      # This class implements provisioning via chef-client, allowing provisioning
      # with a chef server.
      class ChefClient < Base
        include Vagrant::Util::Presence

        def configure(root_config)
          raise ChefError, :server_validation_key_required if @config.validation_key_path.nil?
          raise ChefError, :server_validation_key_doesnt_exist if !File.file?(validation_key_path)
          raise ChefError, :server_url_required if @config.chef_server_url.nil?
        end

        def provision
          install_chef
          verify_binary(chef_binary_path("chef-client"))
          chown_provisioning_folder
          create_client_key_folder
          upload_validation_key
          upload_encrypted_data_bag_secret
          setup_json
          setup_server_config
          run_chef_client
          delete_encrypted_data_bag_secret
        end

        def cleanup

View on GitHub (pinned to 35f3160f4a)

Solutions

Set the path to your org validator key: `chef.validation_key_path = "keys/org-validator.pem"` (relative to the Vagrantfile project root)
Use an absolute path if the key lives outside the project
Download the validation key from your Chef server (Chef Infra Server UI or hosted Chef: Administration > Reset Validation Key) if you do not have one

Example fix

# Vagrantfile - before
config.vm.provision "chef_client" do |chef|
  chef.chef_server_url = "https://api.chef.io/organizations/myorg"
end

# Vagrantfile - after
config.vm.provision "chef_client" do |chef|
  chef.chef_server_url = "https://api.chef.io/organizations/myorg"
  chef.validation_key_path = "keys/myorg-validator.pem"
end

Defensive patterns

Strategy: validation

Validate before calling

# Vagrantfile: fail fast with your own message
raise "Set CHEF_VALIDATION_KEY_PATH" if ENV["CHEF_VALIDATION_KEY_PATH"].nil?
config.vm.provision "chef_client" do |chef|
  chef.validation_key_path = ENV["CHEF_VALIDATION_KEY_PATH"]
end

Type guard

def chef_client_config_valid?(chef)
  !chef.validation_key_path.nil?
end

Prevention

Use a project template that already wires validation_key_path, chef_server_url and validation_client_name together
Keep a rake task or pre-flight script that validates chef_server settings before `vagrant up`
Store the validator key path in an env var so missing keys fail with your own clear message

When it happens

Trigger: Declaring `config.vm.provision "chef_client"` (or any chef provisioner bound to a server) without setting `chef.validation_key_path` in the provisioner block.

Common situations: Copying a chef_solo Vagrantfile and changing only the provisioner name to chef_client; onboarding templates that omit server registration settings; assuming the ORG_VALIDATOR key from knife.rb is picked up automatically (it is not).

Related errors

AI-assisted analysis of hashicorp/vagrant@35f3160f4a (2026-08-21). Data as JSON: /api/errors/da4e2fc6f7992c55. Report an issue: GitHub.