hashicorp/vagrant · error · VagrantPlugins::Chef::Provisioner::Base::ChefError

The validation key set for `config.chef.validation_key_path`

Error message

The validation key set for `config.chef.validation_key_path` does not exist! This
file needs to exist so it can be uploaded to the virtual machine.

What it means

Raised in ChefClient#configure when `validation_key_path` is set but `File.file?` fails after the path is expanded with `File.expand_path(path, @machine.env.root_path)`. The key must exist on the host because the provisioner uploads it to the guest (upload_validation_key) before running chef-client. Most instances are relative-path mistakes: the path resolves against the Vagrant environment root, not the cwd you ran vagrant from.

Source

Thrown at plugins/provisioners/chef/provisioner/chef_client.rb:22

require 'pathname'

require 'vagrant'
require 'vagrant/util/presence'
require 'vagrant/util/subprocess'

require_relative "base"

module VagrantPlugins
  module Chef
    module Provisioner
      # This class implements provisioning via chef-client, allowing provisioning
      # with a chef server.
      class ChefClient < Base
        include Vagrant::Util::Presence

        def configure(root_config)
          raise ChefError, :server_validation_key_required if @config.validation_key_path.nil?
          raise ChefError, :server_validation_key_doesnt_exist if !File.file?(validation_key_path)
          raise ChefError, :server_url_required if @config.chef_server_url.nil?
        end

        def provision
          install_chef
          verify_binary(chef_binary_path("chef-client"))
          chown_provisioning_folder
          create_client_key_folder
          upload_validation_key
          upload_encrypted_data_bag_secret
          setup_json
          setup_server_config
          run_chef_client
          delete_encrypted_data_bag_secret
        end

        def cleanup
          if @config.delete_node

View on GitHub (pinned to 35f3160f4a)

Solutions

Check the file exists at the path Vagrant resolves: run `ls <project-root>/<your-path>`
Use an absolute path: `chef.validation_key_path = "/home/you/keys/myorg-validator.pem"`
Copy the validator key into the project (e.g. `keys/`) and reference it relative to the project root, and gitignore it

Example fix

# Vagrantfile - before
chef.validation_key_path = "~/chef/myorg-validator.pem"  # '~' not expanded the way you expect

# Vagrantfile - after
chef.validation_key_path = "keys/myorg-validator.pem"   # file exists at <project>/keys/

Defensive patterns

Strategy: validation

Validate before calling

# Fail fast before vagrant reads the Vagrantfile
key = File.expand_path(ENV.fetch("CHEF_VALIDATION_KEY", "keys/myorg-validator.pem"), __dir__)
abort "Validation key missing at #{key}" unless File.file?(key)

config.vm.provision "chef_client" do |chef|
  chef.validation_key_path = key
end

Type guard

def validation_key_present?(path, root)
  File.file?(File.expand_path(path, root))
end

Prevention

Remember the path is expanded against the Vagrant project root, not your shell cwd
Prefer absolute paths or project-relative paths committed in a (gitignored) keys/ folder
Add a pre-flight check (rake task, Makefile target) that verifies the key exists before vagrant up

When it happens

Trigger: Setting `chef.validation_key_path` to a file that does not exist, or to a relative path that resolves incorrectly against `machine.env.root_path` (the project root containing the Vagrantfile).

Common situations: Key not committed/cloned with the project; path written relative to home (`~/chef/...` sometimes mishandled by team members); typo in filename; key on a different machine.

Related errors

AI-assisted analysis of hashicorp/vagrant@35f3160f4a (2026-08-21). Data as JSON: /api/errors/f6fd0a942180eb34. Report an issue: GitHub.