# ONE-TIME Run of Chef Recipe

**URL:** <https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433>\
**Category:** Chef Infra (archive)\
**Created:** [September 16, 2016, 7:27pm UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433 "2016-09-16T19:27:49Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![r4hul](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@r4hul](https://discourse.chef.io/u/r4hul)\
**Post date:** [September 16, 2016, 7:27pm UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433/1 "2016-09-16T19:27:49Z")

</div>

Is there a way to run a chef recipe only one-time on the node. I want to do some OS configuration tasks (Rename computer, join to domain etc.) and want the recipe to run only during the first boot. Is there a way to do this directly in Chef?

As a general “best-practice” is it better to put guards in recipe rather than running it only one-time for such a use case (renaming computer, adding to domain, etc.) and leave this recipe in the run-list of the node?  
Just thinking if it is a good idea to let it run (even with guards in place) on every chef-client run.

Any help or information would be highly appreciated!

Thanks,  
Rahul

---

<div class="post-metadata">

**Author:** ![Matt\_Wrock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/matt_wrock/32/3394_2.png) [@Matt\_Wrock](https://discourse.chef.io/u/Matt_Wrock)\
**Post date:** [September 16, 2016, 10:07pm UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433/2 "2016-09-16T22:07:51Z")

</div>

Yes I think it is much better to use guards. Thats likely gonna be more reusable, readable and portable. So for example in the case of a domain join. I would have the guard look to see if it is already domain joined and, if so, it is is the desired domain.

---

<div class="post-metadata">

**Author:** ![budgester](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/budgester/32/1004_2.png) [@budgester](https://discourse.chef.io/u/budgester)\
**Post date:** [September 16, 2016, 10:18pm UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433/3 "2016-09-16T22:18:59Z")

</div>

Chef-client -o ‘recipe(my-cookbook::my-recipe)’

---

<div class="post-metadata">

**Author:** ![colby.white](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@colby.white](https://discourse.chef.io/u/colby.white)\
**Post date:** [September 16, 2016, 11:45pm UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433/4 "2016-09-16T23:45:08Z")

</div>

I’d vote for the guards approach as well. Just make sure to write good unit tests for them to make sure they do what you want them to do.

---

<div class="post-metadata">

**Author:** ![Lamont\_Granquist](https://avatars.discourse-cdn.com/v4/letter/l/d26b3c/32.png) [@Lamont\_Granquist](https://discourse.chef.io/u/Lamont_Granquist)\
**Post date:** [September 19, 2016, 6:10pm UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433/5 "2016-09-19T18:10:54Z")

</div>

you can also use any programming tactic that you care in place of guards as well. for example:

```ruby
unless File.exist?("#{Chef::Config[:file_cache_path]|/first-boot-configuration")
  include_recipe "::first_boot"
  FileUtils.touch "#{Chef::Config[:file_cache_path]|/first-boot-configuration"
end

```

then the whole “first\_boot” recipe is protected by that sentinel file, and you can nuke the sentinel file in order to re-run the recipe (or you can run it with -o itself and bypass this check as well).

if you wind up with 30 resources in that first\_boot recipe you probably don’t want to have 30 guards around your resources…

of course taking the time to carefully guard each one against its intended state is more correct and idempotent, but that also takes a lot more time and thought, and can potentially be more error prone if you’re not aware of all your edge conditions. sentinel files are lazier, but also brutally simple to reason about.

---

<div class="post-metadata">

**Author:** ![Gregoire\_Seux](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/gregoire_seux/32/491_2.png) [@Gregoire\_Seux](https://discourse.chef.io/u/Gregoire_Seux)\
**Post date:** [September 27, 2016, 10:13am UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433/6 "2016-09-27T10:13:54Z")

</div>

> [@r4hulgupta](#):
>
> Just thinking if it is a good idea to let it run (even with guards in place) on every chef-client run.

Yes it is a good idea (and safe) since you can tests guards easily.

---

<div class="post-metadata">

**Author:** ![r4hul](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@r4hul](https://discourse.chef.io/u/r4hul)\
**Post date:** [September 27, 2016, 7:53pm UTC](https://discourse.chef.io/t/one-time-run-of-chef-recipe/9433/7 "2016-09-27T19:53:23Z")

</div>

Thanks for your feedback and suggestions guys!