chef · IanMadd · Jun 12, 2026 · Jun 12, 2026 · Jun 12, 2026
@@ -25,7 +25,7 @@ Navigate to _API Tokens_ in the **Settings** tab. Then, use the **Create Token**
 
 If a policy is assigned to an API token on creation, the API token will have permissions. If no policy is selected during its creation, the API token will have no permissions. To assign permissions to the API token any time after creation, navigate to _Policies_ in the **Settings** tab, locate the appropriate policy, and then add the API token as a member of the policy using a [member expression]({{< relref "iam_v2_guide.md#member-expressions" >}}).
 
-![API Tokens](/images/automate/admin-tab-API-tokens-list.png)
+![The API Tokens list in the Settings tab, showing the Create Token button and a table of existing tokens.](/images/automate/admin-tab-API-tokens-list.png)
 
 #### API Token Value
 

@@ -31,7 +31,7 @@ The _Applications_ dashboard _Service Groups_ display gives you a top-level view
 The default _Service Groups_ view shows only the services that are available.
 The right sidebar provides detailed reporting for each individual service.
 
-![EAS Service Groups List](/images/automate/eas-service-groups.png)
+![Chef Automate Applications dashboard showing the Service Groups list with health status indicators and instance counts grouped by criticality in the sidebar.](/images/automate/eas-service-groups.png)
 
 ### Service Health Status Count
 
@@ -92,7 +92,7 @@ Available search field types include _Origin_, _Service Name_, _Version_, _Chann
 After selecting your search field type, enter your specific search term, or select one from the auto-populated list of existing values.
 Applying the filter changes the Service Groups list to display matching results and updates health status display accordingly.
 
-![EAS Filtered Service Groups List](/images/automate/eas-filtered-service-groups.png)
+![Chef Automate Service Groups list filtered with environment:demo showing filtered services with their health status donut charts and updated health status counts in the sidebar (Total 5, Critical 2, Warning 2, OK 1).](/images/automate/eas-filtered-service-groups.png)
 
 ## Lifecycle Management
 

@@ -15,7 +15,7 @@ draft = false
 
 ## Chef Automate 2 Architecture
 
-![Chef Automate 2 Architecture](/images/automate/a2-architecture-os.png)
+![Chef Automate 2 architecture diagram showing the load balancer, gateway, microservices including config management and compliance services, and backend databases with their port configurations.](/images/automate/a2-architecture-os.png)
 
 ## Component overview
 

@@ -21,7 +21,7 @@ Nodes appear in this view after a Chef Infra Client run completes.
 
 The Chef Infra Client Run Status chart displays a summary of node statuses: failed, successful, or missing, and the total node count. The chart changes as you select filters.
 
-![Client Runs Overview](/images/automate/client-runs.png)
+![Chef Automate Client Runs page showing a donut chart with Chef Infra Client run status (passed, failed, and missing nodes) with a status summary below and a node list table showing check-in status and platform details.](/images/automate/client-runs.png)
 
 ## Node list table
 

@@ -21,7 +21,7 @@ Navigate to _Settings_ > _Data Lifecycle_ and adjust any settings you would like
 
 Users with `dataLifecycle:*` IAM access can see the data lifecycle job statuses, configure jobs or run jobs. While configuring the data lifecycle in a number of days, please refer to the section on [Impact On OpenSearch Shards](/automate/data_lifecycle/#impact-on-opensearch-shards) to set the appropriate maximum shards per node value.
 
-![Data Lifecycle](/images/automate/data-lifecycle.png)
+![Chef Automate Settings page for Data Lifecycle showing retention configuration options for event feed, Chef Infra Server actions, service groups, client runs, and compliance data.](/images/automate/data-lifecycle.png)
 
 ### Event Feed
 

@@ -19,7 +19,7 @@ The Guitar Strings visualization helps you drill into infrastructure and complia
 Users require permission for the `event:*` action to view and interact with _Event Feed_.
 Filter and search ability in _Event Feed_ requires user permission for the `infra:nodes:list` action.
 
-![Event feed](/images/automate/event-feed.png)
+![Chef Automate Event Feed dashboard showing a timeline of infrastructure events with symbols for create (blue circles), delete (pink circles), and update (purple diamonds) events.](/images/automate/event-feed.png)
 
 ## Event Guitar Strings
 
@@ -31,7 +31,7 @@ Hovering over the icon shows a text box summarizing the events for that 4-hour w
 
 ## Icon Legend
 
-![Event feed icon legend](/images/automate/event_icons.png)
+![Chef Automate event feed icon legend showing symbols for Cookbook, Data Bag, Environment, Group, Multiple Events, Node, Organization, Permission, Policyfile, Profile, Role, Scan Job, and User.](/images/automate/event_icons.png)
 
 ## Grouped Events
 

@@ -30,7 +30,7 @@ Although this requirement isn't explicitly illustrated in the network architectu
 
 ### Chef Automate HA Architecture for OnPremise / Cloud Non-Managed
 
-![High Availability Architecture](/images/automate/ha_arch_on_prem.png)
+![Chef Automate High Availability on-premises architecture diagram showing DNS routing, primary and secondary load balancers, Chef Automate and Chef Infra frontend clusters, and PostgreSQL and OpenSearch backend clusters with backup storage.](/images/automate/ha_arch_on_prem.png)
 
 {{< note >}}
 In Chef Automate HA architecture for on-premises or non-managed Cloud deployments, frontend nodes connect to PostgreSQL over port **5432** and use port **6432** to perform leader checks.
@@ -40,7 +40,7 @@ Chef has deprecated the earlier configuration that required frontend nodes to us
 
 ### Chef Automate HA Architecture for AWS Managed
 
-![High Availability Architecture](/images/automate/ha_arch_aws_managedservices.png)
+![Chef Automate High Availability architecture for AWS Managed Services showing DNS routing, load balancers for Chef Automate and Chef Infra, frontend clusters, and managed backend services (PostgreSQL and OpenSearch) with backup S3 storage.](/images/automate/ha_arch_aws_managedservices.png)
 
 {{< note >}}
 Chef Automate HA for Managed Services has default port 5432 for Managed PostgreSQL and 9200 for Managed OpenSearch. You can also change to your custom port.
@@ -50,7 +50,7 @@ Chef Automate HA for Managed Services has default port 5432 for Managed PostgreS
 
 The following shows a five-node cluster, which is a supported deployment pattern. Work with your Progress technical teams to determine the appropriate cluster configuration for optimal performance based on parameters such as node count and data size.
 
-![High Availability Architecture](/images/automate/ha_arch_minnode_cluster.png)
+![Chef Automate High Availability architecture for on-premises minimum node cluster showing DNS, frontend nodes with Chef Automate and Chef Infra, and backend clusters for PostgreSQL and OpenSearch with specific port configurations.](/images/automate/ha_arch_minnode_cluster.png)
 
 {{< note >}}
 In Chef Automate HA architecture for on-premises or non-managed Cloud deployments, frontend nodes connect to PostgreSQL over port **5432** and use port **6432** to perform leader checks.

@@ -26,7 +26,7 @@ In the above approach, there will be 2 identical clusters
 - primary cluster (or production cluster)
 - disaster recovery cluster
 
-![Disaster Recovery Setup with 2 Identical Clusters](/images/automate/DR-2-cluster.png)
+![Disaster recovery setup diagram showing a primary Chef Automate cluster and identical disaster recovery cluster with DNS failover routing, load balancers, and cron-triggered backup and restore operations.](/images/automate/DR-2-cluster.png)
 
 The primary cluster will be active and regular backups will be performed using `chef-automate backup create`. At the same time, the disaster recovery cluster will be restoring the latest backup data using `chef-automate backup restore`.
 

@@ -27,7 +27,7 @@ In the above approach, there will be two identical clusters
 - Primary Cluster (or Production Cluster)
 - Disaster Recovery Cluster
 
-![Disaster Recovery Setup with 2 Identical Clusters](/images/automate/DR_AWS_Deployment.png)
+![Chef Automate High Availability disaster recovery setup on AWS with DNS routing, primary and secondary load balancers, primary and DR clusters containing Chef Automate and Chef Infra frontend clusters, PostgreSQL and OpenSearch backend clusters, backup S3 storage, and cron-triggered backup/restore operations at regular intervals.](/images/automate/DR_AWS_Deployment.png)
 
 The primary cluster will be active and regular backups will be performed using `chef-automate backup create`. At the same time, the disaster recovery cluster will be restoring the latest backup data using `chef-automate backup restore`.
 

@@ -17,7 +17,7 @@ This page explains the frequently encountered issues in Chef Automate High Avail
 
 ### Post Automate HA deployment if the chef-server service is in a critical state
 
-![Chef Infra Server critical Error](/images/automate/chef-server-critical-error.png)
+![Chef Infra Server service status output showing critical health check failures with process state, uptime, and error messages indicating deployment issues.](/images/automate/chef-server-critical-error.png)
 
 #### Solution
 

@@ -74,7 +74,7 @@ Once you run the verify command, it checks all the test cases defined. After it
 
 An example of a checks performed are shown in the below image:
 
-![Config Verify Check](/images/automate/verify_checks_example.png)
+![Chef Automate verify command output table showing health check results for system resources, software versions, certificates, SSH configuration, and backup settings with success and failure status indicators.](/images/automate/verify_checks_example.png)
 
 The above image shows the checks performed for Automate node. The checks in the above image are also performed on all the nodes in Automate HA, i.e., Chef Infra Server, PostgreSQL, OpenSearch, and Chef Automate (the one showed above).
 

@@ -33,7 +33,7 @@ This policy display includes the following:
 * Imported v1 default policies--now called _legacy policies_--in the new v2 policy format and marked with the `[Legacy]` prefix.
 * Imported v1 custom policies that you created, which are marked with the `[Legacy]` prefix and a `(custom)` suffix.
 
-![Migrated IAM v2 policies page](/images/automate/admin-policies-migrated.png)
+![Chef Automate Settings Policies page showing the IAM v2 policies table with migrated legacy policies marked with [Legacy] prefix, indicating their type as custom, and status as in use.](/images/automate/admin-policies-migrated.png)
 
 ## Policy Conversion
 
@@ -311,13 +311,13 @@ Compliance reports must be using **audit cookbook 7.5+** in order to make use of
 }
 ```
 
-![Create project rule interface](/images/automate/create-project-rule.png)
+![Chef Automate Create Project Rule form showing fields for rule name, resource type selection (Node), and conditions for filtering resources by Chef Organization.](/images/automate/create-project-rule.png)
 
 Save the rule. If you later need to change the name or the conditions, select the project rule name on the project details page.
 
 When edits are pending, a banner will be shown at the bottom of every page. Selecting the `Update Projects` button on that banner will apply those changes.
 
-![Chef Automate admin projects page](/images/automate/admin-projects.png)
+![Chef Automate Settings Projects page showing a table of projects with their names, IDs, and ingest rule statuses, plus a banner indicating pending edits that need to be applied.](/images/automate/admin-projects.png)
 
 Updating a project begins an operation that applies all pending rule edits and then moves ingested resources into the correct projects according to those latest changes. An ingested resource is moved into a project if it matches at least one of the project's rules.
 In this example, upon successful update, all ingested resources whose Chef Organization matches `devops` will be considered a part of the project `project-devops`.
@@ -335,7 +335,7 @@ Once rules have been successfully applied, the banner will be dismissed until th
 To verify that the ingested resources have been moved into the correct projects, select `project-devops` in the global projects filter, which is on the top navigation. The data in Chef Automate filters by the selected `project-devops` project.
 In this example, the effect is revealed by navigating to the Compliance Reports' Nodes tab, which only features nodes that belong to the `devops` Chef Organization.
 
-![Global projects filter in navigation](/images/automate/global-projects-filter.png)
+![Chef Automate global projects filter dropdown in top navigation showing project-devops selected with (unassigned) option and Apply Changes button, filtering Compliance Reports to show 3 nodes from DevSec Prod Beta environment.](/images/automate/global-projects-filter.png)
 
 Now that the first set of ingested data associated is in the new project, add another condition and a new rule to add more data to `project-devops`.
 
@@ -373,7 +373,7 @@ Upon completion of the update, you should be able to filter by `project-devops`
 
 To create a project that contains all Effortless Infra nodes, create a ingest rule with resource type `Node` and a condition that uses attribute `Chef Infra Server`, operator `equals`, and value `localhost`.
 
-![Effortless Infra project rule configuration](/images/automate/effortless-project-rule.png)
+![Chef Automate project rule form for Effortless Infra showing Rule Name (all nodes), Resource Type (Node), and Conditions section with NODE ATTRIBUTE (Chef Infra Server), OPERATOR (equals), VALUE (localhost) fields, plus Save Rule and Cancel buttons.](/images/automate/effortless-project-rule.png)
 
 The above rule matches on a node's Chef Infra Server field, which is set to `localhost`. This rule works because all Effortless Infra nodes list the `Chef Infra Server` attribute as `localhost`.
 

@@ -26,7 +26,7 @@ The "who" may be a user, a team, or an API token.
 
 The following diagram shows the new policy structure. We detail the specifics in the next sections.
 
-![IAM v2 policy structure diagram](/images/automate/iam-v2-diagram.png)
+![Chef Automate IAM v2 policy structure diagram showing WHO (User, Team, API Token) connected to Policy, Policy containing Statements (Allow/Deny) and Roles with Actions, and WHERE (Project with Resource) scoping.](/images/automate/iam-v2-diagram.png)
 
 ## Policy Definition
 

@@ -22,7 +22,7 @@ Chef Automate fails to ingest compliance reports larger than 4 MB sent through t
 
 The following architecture change enables Chef Automate to ingest reports larger than 4 MB.
 
-![LCR Architecture](/images/automate/lcr_architecture.jpg)
+![Chef Automate Large Compliance Report architecture diagram showing Chef Infra Client/InSpec sending compliance reports through data collector to Chef Automate OpenSearch, with backup S3 storage and an external MinIO service for storing large reports.](/images/automate/lcr_architecture.jpg)
 
 With this configuration, Chef Automate allows ingestion of large compliance reports and sends data to OpenSearch and an externally deployed MinIO service. In this configuration, Chef Automate expects a MinIO server running outside the Chef Automate ecosystem.
 

@@ -35,7 +35,7 @@ For example, if today you are on version _2021201164433_, your upgrade journey s
 
 ## Upgrade and migration flow
 
-![Upgrade flow](/images/automate/migration-and-upgrade-v4-flow.png)
+![Chef Automate upgrade and migration flowchart showing the major upgrade process from Start major upgrade through prerequisite checks, Y/N decision points, Elasticsearch to OpenSearch migration, and completion or termination outcomes.](/images/automate/migration-and-upgrade-v4-flow.png)
 
 ## Prerequisites
 

@@ -19,7 +19,7 @@ The Chef Automate Credentials page allows you to add, edit, and delete ``SSH``,
 
 To manage your credentials, navigate to the _Node Credentials_ page from the **Settings** tab.
 
-![Node Credentials](/images/automate/node-credentials.png)
+![Chef Automate Node Credentials page in Settings showing Create Credential button, credentials table with columns for Name, Credential Type, and Last Modified, displaying one example SSH credential entry.](/images/automate/node-credentials.png)
 
 Adding SSH, WinRM, and Sudo credentials is the first step for using the Chef Automate Compliance Scanner. After adding credentials, you'll be able to add nodes and create scan jobs.
 
@@ -35,13 +35,13 @@ Select _Add Credential_ and a dialog box appears as shown below. Select the _Cre
 
 ### Add a SSH Credential
 
-![SSH Credential Form](/images/automate/credentials-ssh.png)
+![Chef Automate Create Credential form for SSH with fields for Name, Credential Type dropdown (SSH selected), SSH Username (abc), SSH Credential Type radio buttons (Password selected), SSH password field, and Create Credential/Cancel buttons.](/images/automate/credentials-ssh.png)
 
 **SSH** requires a credential name, a user name and either a SSH password **or** a SSH Private key, but not both.
 
 ### Add a WinRM Credential
 
-![WINRM Credential Form](/images/automate/credentials-winrm.png)
+![Chef Automate Create Credential form for WinRM with fields for Name, Credential Type dropdown (WinRM selected), WinRM Username, WinRM password (password for private WinRM), and Create Credential/Cancel buttons.](/images/automate/credentials-winrm.png)
 
 **WinRM** requires a credential name, a user name, and a WinRM password.
 
@@ -69,7 +69,7 @@ Windows machines **must have** the following configurations:
 
 ### Add a Sudo Credential
 
-![Sudo Credential Form](/images/automate/credentials-sudo.png)
+![Chef Automate Create Credential form for Sudo with fields for Name, Credential Type dropdown (Sudo selected), Sudo Password (password for sudo), Command Line options field, and Create Credential/Cancel buttons.](/images/automate/credentials-sudo.png)
 
 **Sudo** requires a credential name, a user name, and a password **or** sudo options, but not both.