add whitelist config options for attributes saved by the node

1 files changed, 34 insertions, 0 deletions

diff --git a/DOC_CHANGES.md b/DOC_CHANGES.md
index 00d15f7b18..c9b4d3e86a 100644
--- a/DOC_CHANGES.md
+++ b/DOC_CHANGES.md
@@ -37,3 +37,37 @@ You can now modify the chef-full template with the following options in `knife b
 ### Parallelize cookbook synchronization
 
 You can now synchronize your cookbooks faster by parallelizing the process. You can specify the number of helper threads in your config file with `cookbook_sync_threads NUM_THREADS`. The default is 10. Increasing `NUM_THREADS` can result in gateway errors from the chef server (namely 503 and 504). If you are experiencing these often, consider decreasing `NUM_THREADS` to fewer than default.
+
+### New chef config options: Whitelisting for the attributes saved by the node
+
+You can now whitelist attributes that will be saved by the node by providing a hash with the keys you want to include. Whitelist filters are described for each attribute level: `automatic_attribute_whitelist`, `default_attribute_whitelist`, `normal_attribute_whitelist`, and `override_attribute_whitelist`.
+
+If your automatic attribute data looks like
+````
+{
+  "filesystem" => {
+    "/dev/disk0s2" => {
+      "size" => "10mb"
+    },
+    "map - autohome" => {
+      "size" => "10mb"
+    }
+  }
+}
+````
+and your config file looks like
+````
+automatic_attribute_whitelist =
+  {
+    "filesystem" => {
+      "/dev/disk0s2" => true
+    }
+  }
+````
+then the entire `map - autohome` subtree will not be saved by the node.
+
+If your config file looks like `automatic_attribute_whitelist = {}`, then none of your automatic attribute data will be saved by the node.
+
+The default behavior is for the node to save all the attribute data. This can be ensured by setting your whitelist filter to `nil`.
+
+Note that only the keys in this has will be used. If the values are anything other than a hash, they are ignored. You cannot magically morph these config options into a blacklist by putting `false` as a value in the whitelist.