How do i remove a policyfile from a node?

Chef Infra doesn’t have a single command to remove a policyfile from a node directly. Instead, we can use a few effective methods, such as creating a dummy policy, updating the node’s client.rb, or reassigning nodes to new policies. Each method helps dissociate nodes from an outdated policy, allowing for smooth migrations without disrupting service.

Method 1: Assign a dummy policy

To dissociate nodes from an existing policy, you can assign a “dummy” policyfile with an empty run list. This allows nodes to keep communicating with Chef Infra Server but with no tasks to perform.

A. Write a policyfile.rb with no resources in its run list.

B. Upload this policy to the Chef Infra Server.

C. Assign the dummy policy to nodes.

knife node policy set NODE_NAME dummy_policy POLICY_GROUP_NAME

D. Run chef-client to ensure that the node's client.rb now references the fake policy and that no resources are being applied.

Method 2. Reassign a new policy

To transition nodes to a new Chef Infra Server or a different policyfile, assign the new policyfile, which will replace the previous policy association.

Run chef-client on the node and confirm it applies the new policy.

Method 3: Delete policyfile from Chef Infra Server

Use this step to delete old policyfile versions from the Chef Infra Server, which helps avoid conflicts and ensures nodes don’t reference outdated policies.

Before deleting, confirm that no active nodes reference this policy, otherwise, they will throw an error during their chef-client runs.

Note : If a node attempts to access a deleted policy, the chef-client will throw an error, but it will retry at the next scheduled interval. Assigning a new policy or applying a dummy policy will quickly resolve this issue.

For updating policy settings on multiple nodes at once, a batch script using knife commands can streamline the process and reduce manual steps.