11 files changed, 154 insertions, 317 deletions

diff --git a/spec/functional/knife/ssh_spec.rb b/spec/functional/knife/ssh_spec.rb
index 4fe919c3a3..4f4290f66d 100644
--- a/spec/functional/knife/ssh_spec.rb
+++ b/spec/functional/knife/ssh_spec.rb
@@ -50,8 +50,8 @@ describe Chef::Knife::Ssh do
   describe "identity file" do
     context "when knife[:ssh_identity_file] is set" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_identity_file] = "~/.ssh/aws.rsa"
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the ssh_identity_file" do
@@ -62,8 +62,8 @@ describe Chef::Knife::Ssh do
 
     context "when knife[:ssh_identity_file] is set and frozen" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_identity_file] = "~/.ssh/aws.rsa".freeze
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the ssh_identity_file" do
@@ -74,8 +74,8 @@ describe Chef::Knife::Ssh do
 
     context "when -i is provided" do
       before do
-        setup_knife(["-i ~/.ssh/aws.rsa", "*:*", "uptime"])
         Chef::Config[:knife][:ssh_identity_file] = nil
+        setup_knife(["-i ~/.ssh/aws.rsa", "*:*", "uptime"])
       end
 
       it "should use the value on the command line" do
@@ -85,6 +85,7 @@ describe Chef::Knife::Ssh do
 
       it "should override what is set in knife.rb" do
         Chef::Config[:knife][:ssh_identity_file] = "~/.ssh/other.rsa"
+        @knife.merge_configs
         @knife.run
         expect(@knife.config[:ssh_identity_file]).to eq("~/.ssh/aws.rsa")
       end
@@ -92,8 +93,8 @@ describe Chef::Knife::Ssh do
 
     context "when knife[:ssh_identity_file] is not provided]" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_identity_file] = nil
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the default" do
@@ -119,8 +120,8 @@ describe Chef::Knife::Ssh do
   describe "user" do
     context "when knife[:ssh_user] is set" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_user] = "ubuntu"
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the ssh_user" do
@@ -131,8 +132,8 @@ describe Chef::Knife::Ssh do
 
     context "when knife[:ssh_user] is set and frozen" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_user] = "ubuntu".freeze
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the ssh_user" do
@@ -143,8 +144,8 @@ describe Chef::Knife::Ssh do
 
     context "when -x is provided" do
       before do
-        setup_knife(["-x ubuntu", "*:*", "uptime"])
         Chef::Config[:knife][:ssh_user] = nil
+        setup_knife(["-x ubuntu", "*:*", "uptime"])
       end
 
       it "should use the value on the command line" do
@@ -154,6 +155,7 @@ describe Chef::Knife::Ssh do
 
       it "should override what is set in knife.rb" do
         Chef::Config[:knife][:ssh_user] = "root"
+        @knife.merge_configs
         @knife.run
         expect(@knife.config[:ssh_user]).to eq("ubuntu")
       end
@@ -161,8 +163,8 @@ describe Chef::Knife::Ssh do
 
     context "when knife[:ssh_user] is not provided]" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_user] = nil
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the default (current user)" do
@@ -175,8 +177,8 @@ describe Chef::Knife::Ssh do
   describe "attribute" do
     context "when knife[:ssh_attribute] is set" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_attribute] = "ec2.public_hostname"
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the ssh_attribute" do
@@ -187,8 +189,8 @@ describe Chef::Knife::Ssh do
 
     context "when knife[:ssh_attribute] is not provided" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_attribute] = nil
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the default" do
@@ -199,8 +201,8 @@ describe Chef::Knife::Ssh do
 
     context "when -a ec2.public_public_hostname is provided" do
       before do
-        setup_knife(["-a", "ec2.public_hostname", "*:*", "uptime"])
         Chef::Config[:knife][:ssh_attribute] = nil
+        setup_knife(["-a", "ec2.public_hostname", "*:*", "uptime"])
       end
 
       it "should use the value on the command line" do
@@ -211,6 +213,7 @@ describe Chef::Knife::Ssh do
       it "should override what is set in knife.rb" do
         # This is the setting imported from knife.rb
         Chef::Config[:knife][:ssh_attribute] = "fqdn"
+        @knife.merge_configs
         # Then we run knife with the -a flag, which sets the above variable
         setup_knife(["-a", "ec2.public_hostname", "*:*", "uptime"])
         @knife.run
@@ -222,8 +225,8 @@ describe Chef::Knife::Ssh do
   describe "prefix" do
     context "when knife[:prefix_attribute] is set" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:prefix_attribute] = "name"
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the prefix_attribute" do
@@ -234,8 +237,8 @@ describe Chef::Knife::Ssh do
 
     context "when knife[:prefix_attribute] is not provided" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:prefix_attribute] = nil
+        setup_knife(["*:*", "uptime"])
       end
 
       it "falls back to nil" do
@@ -246,8 +249,8 @@ describe Chef::Knife::Ssh do
 
     context "when --prefix-attribute ec2.public_public_hostname is provided" do
       before do
-        setup_knife(["--prefix-attribute", "ec2.public_hostname", "*:*", "uptime"])
         Chef::Config[:knife][:prefix_attribute] = nil
+        setup_knife(["--prefix-attribute", "ec2.public_hostname", "*:*", "uptime"])
       end
 
       it "should use the value on the command line" do
@@ -258,6 +261,7 @@ describe Chef::Knife::Ssh do
       it "should override what is set in knife.rb" do
         # This is the setting imported from knife.rb
         Chef::Config[:knife][:prefix_attribute] = "fqdn"
+        @knife.merge_configs
         # Then we run knife with the -b flag, which sets the above variable
         setup_knife(["--prefix-attribute", "ec2.public_hostname", "*:*", "uptime"])
         @knife.run
@@ -269,8 +273,8 @@ describe Chef::Knife::Ssh do
   describe "gateway" do
     context "when knife[:ssh_gateway] is set" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_gateway] = "user@ec2.public_hostname"
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the ssh_gateway" do
@@ -282,8 +286,8 @@ describe Chef::Knife::Ssh do
 
     context "when -G user@ec2.public_hostname is provided" do
       before do
-        setup_knife(["-G user@ec2.public_hostname", "*:*", "uptime"])
         Chef::Config[:knife][:ssh_gateway] = nil
+        setup_knife(["-G user@ec2.public_hostname", "*:*", "uptime"])
       end
 
       it "uses the ssh_gateway" do
@@ -295,9 +299,9 @@ describe Chef::Knife::Ssh do
 
     context "when knife[:ssh_gateway_identity] is set" do
       before do
-        setup_knife(["*:*", "uptime"])
         Chef::Config[:knife][:ssh_gateway] = "user@ec2.public_hostname"
         Chef::Config[:knife][:ssh_gateway_identity] = "~/.ssh/aws-gateway.rsa"
+        setup_knife(["*:*", "uptime"])
       end
 
       it "uses the ssh_gateway_identity file" do
@@ -309,9 +313,9 @@ describe Chef::Knife::Ssh do
 
     context "when -ssh-gateway-identity is provided and knife[:ssh_gateway] is set" do
       before do
-        setup_knife(["--ssh-gateway-identity", "~/.ssh/aws-gateway.rsa", "*:*", "uptime"])
         Chef::Config[:knife][:ssh_gateway] = "user@ec2.public_hostname"
         Chef::Config[:knife][:ssh_gateway_identity] = nil
+        setup_knife(["--ssh-gateway-identity", "~/.ssh/aws-gateway.rsa", "*:*", "uptime"])
       end
 
       it "uses the ssh_gateway_identity file" do
@@ -323,8 +327,8 @@ describe Chef::Knife::Ssh do
 
     context "when the gateway requires a password" do
       before do
-        setup_knife(["-G user@ec2.public_hostname", "*:*", "uptime"])
         Chef::Config[:knife][:ssh_gateway] = nil
+        setup_knife(["-G user@ec2.public_hostname", "*:*", "uptime"])
         allow(@knife.session).to receive(:via) do |host, user, options|
           raise Net::SSH::AuthenticationFailed unless options[:password]
         end
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 1d85acb4f3..b41e1b3cf3 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -114,6 +114,12 @@ resource_priority_map ||= nil
 provider_handler_map ||= nil
 resource_handler_map ||= nil
 
+class UnexpectedSystemExit < RuntimeError
+  def self.from(system_exit)
+    new(system_exit.message).tap { |e| e.set_backtrace(system_exit.backtrace) }
+  end
+end
+
 RSpec.configure do |config|
   config.include(Matchers)
   config.include(MockShellout::RSpec)
@@ -291,6 +297,15 @@ RSpec.configure do |config|
   config.before(:suite) do
     ARGV.clear
   end
+
+  # Protect Rspec from accidental exit(0) causing rspec to terminate without error
+  config.around(:example) do |ex|
+    begin
+      ex.run
+    rescue SystemExit => e
+      raise UnexpectedSystemExit.from(e)
+    end
+  end
 end
 
 require "webrick/utils"
diff --git a/spec/unit/application/client_spec.rb b/spec/unit/application/client_spec.rb
index 13b98b6434..004debf5ad 100644
--- a/spec/unit/application/client_spec.rb
+++ b/spec/unit/application/client_spec.rb
@@ -303,8 +303,12 @@ describe Chef::Application::Client, "reconfigure" do
         context "when there is no new config" do
           let(:config_exists) { false }
 
-          it "does not updates the config" do
+          it "does not update the config" do
             expect(Chef::Config).not_to receive(:from_string)
+              .with(
+                "new_config",
+                File.join("the_path_to_the_repo", ".chef/config.rb")
+              )
 
             app.reconfigure
           end
diff --git a/spec/unit/knife/bootstrap/chef_vault_handler_spec.rb b/spec/unit/knife/bootstrap/chef_vault_handler_spec.rb
index 29eeea62f7..4d36208be0 100644
--- a/spec/unit/knife/bootstrap/chef_vault_handler_spec.rb
+++ b/spec/unit/knife/bootstrap/chef_vault_handler_spec.rb
@@ -25,12 +25,12 @@ describe Chef::Knife::Bootstrap::ChefVaultHandler do
   let(:stdin) { StringIO.new }
   let(:ui) { Chef::Knife::UI.new(stdout, stderr, stdin, {}) }
 
-  let(:knife_config) { {} }
+  let(:config) { {} }
 
   let(:client) { Chef::ApiClient.new }
 
   let(:chef_vault_handler) do
-    chef_vault_handler = Chef::Knife::Bootstrap::ChefVaultHandler.new(knife_config: knife_config, ui: ui)
+    chef_vault_handler = Chef::Knife::Bootstrap::ChefVaultHandler.new(config: config, ui: ui)
     chef_vault_handler
   end
 
@@ -55,28 +55,28 @@ describe Chef::Knife::Bootstrap::ChefVaultHandler do
       expect(bootstrap_vault_item).to receive(:save).at_least(:once)
     end
 
-    context "from knife_config[:bootstrap_vault_item]" do
+    context "from config[:bootstrap_vault_item]" do
       it "sets a single item as a scalar" do
-        knife_config[:bootstrap_vault_item] = { "vault" => "item1" }
+        config[:bootstrap_vault_item] = { "vault" => "item1" }
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         chef_vault_handler.run(client)
       end
 
       it "sets a single item as an array" do
-        knife_config[:bootstrap_vault_item] = { "vault" => [ "item1" ] }
+        config[:bootstrap_vault_item] = { "vault" => [ "item1" ] }
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         chef_vault_handler.run(client)
       end
 
       it "sets two items as an array" do
-        knife_config[:bootstrap_vault_item] = { "vault" => %w{item1 item2} }
+        config[:bootstrap_vault_item] = { "vault" => %w{item1 item2} }
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item2").and_return(bootstrap_vault_item)
         chef_vault_handler.run(client)
       end
 
       it "sets two vaults from different hash keys" do
-        knife_config[:bootstrap_vault_item] = { "vault" => %w{item1 item2}, "vault2" => [ "item3" ] }
+        config[:bootstrap_vault_item] = { "vault" => %w{item1 item2}, "vault2" => [ "item3" ] }
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item2").and_return(bootstrap_vault_item)
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault2", "item3").and_return(bootstrap_vault_item)
@@ -84,28 +84,28 @@ describe Chef::Knife::Bootstrap::ChefVaultHandler do
       end
     end
 
-    context "from knife_config[:bootstrap_vault_json]" do
+    context "from config[:bootstrap_vault_json]" do
       it "sets a single item as a scalar" do
-        knife_config[:bootstrap_vault_json] = '{ "vault": "item1" }'
+        config[:bootstrap_vault_json] = '{ "vault": "item1" }'
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         chef_vault_handler.run(client)
       end
 
       it "sets a single item as an array" do
-        knife_config[:bootstrap_vault_json] = '{ "vault": [ "item1" ] }'
+        config[:bootstrap_vault_json] = '{ "vault": [ "item1" ] }'
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         chef_vault_handler.run(client)
       end
 
       it "sets two items as an array" do
-        knife_config[:bootstrap_vault_json] = '{ "vault": [ "item1", "item2" ] }'
+        config[:bootstrap_vault_json] = '{ "vault": [ "item1", "item2" ] }'
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item2").and_return(bootstrap_vault_item)
         chef_vault_handler.run(client)
       end
 
       it "sets two vaults from different hash keys" do
-        knife_config[:bootstrap_vault_json] = '{ "vault": [ "item1", "item2" ], "vault2": [ "item3" ] }'
+        config[:bootstrap_vault_json] = '{ "vault": [ "item1", "item2" ], "vault2": [ "item3" ] }'
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item1").and_return(bootstrap_vault_item)
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault", "item2").and_return(bootstrap_vault_item)
         expect(chef_vault_handler).to receive(:load_chef_bootstrap_vault_item).with("vault2", "item3").and_return(bootstrap_vault_item)
@@ -113,12 +113,12 @@ describe Chef::Knife::Bootstrap::ChefVaultHandler do
       end
     end
 
-    context "from knife_config[:bootstrap_vault_file]" do
+    context "from config[:bootstrap_vault_file]" do
 
       def setup_file_contents(json)
         stringio = StringIO.new(json)
-        knife_config[:bootstrap_vault_file] = "/foo/bar/baz"
-        expect(File).to receive(:read).with(knife_config[:bootstrap_vault_file]).and_return(stringio)
+        config[:bootstrap_vault_file] = "/foo/bar/baz"
+        expect(File).to receive(:read).with(config[:bootstrap_vault_file]).and_return(stringio)
       end
 
       it "sets a single item as a scalar" do
diff --git a/spec/unit/knife/bootstrap/client_builder_spec.rb b/spec/unit/knife/bootstrap/client_builder_spec.rb
index 87720091cd..10edd13882 100644
--- a/spec/unit/knife/bootstrap/client_builder_spec.rb
+++ b/spec/unit/knife/bootstrap/client_builder_spec.rb
@@ -25,7 +25,7 @@ describe Chef::Knife::Bootstrap::ClientBuilder do
   let(:stdin) { StringIO.new }
   let(:ui) { Chef::Knife::UI.new(stdout, stderr, stdin, {}) }
 
-  let(:knife_config) { {} }
+  let(:config) { {} }
 
   let(:chef_config) { {} }
 
@@ -34,7 +34,7 @@ describe Chef::Knife::Bootstrap::ClientBuilder do
   let(:rest) { double("Chef::ServerAPI") }
 
   let(:client_builder) do
-    client_builder = Chef::Knife::Bootstrap::ClientBuilder.new(knife_config: knife_config, chef_config: chef_config, ui: ui)
+    client_builder = Chef::Knife::Bootstrap::ClientBuilder.new(config: config, chef_config: chef_config, ui: ui)
     allow(client_builder).to receive(:rest).and_return(rest)
     allow(client_builder).to receive(:node_name).and_return(node_name)
     client_builder
@@ -160,7 +160,7 @@ describe Chef::Knife::Bootstrap::ClientBuilder do
     it "adds tags to the node when given" do
       tag_receiver = []
 
-      knife_config[:tags] = %w{foo bar}
+      config[:tags] = %w{foo bar}
       allow(node).to receive(:run_list).with([])
       allow(node).to receive(:tags).and_return(tag_receiver)
       client_builder.run
@@ -168,34 +168,34 @@ describe Chef::Knife::Bootstrap::ClientBuilder do
     end
 
     it "builds a node when the run_list is a string" do
-      knife_config[:run_list] = "role[base],role[app]"
+      config[:run_list] = "role[base],role[app]"
       expect(node).to receive(:run_list).with(["role[base]", "role[app]"])
       client_builder.run
     end
 
     it "builds a node when the run_list is an Array" do
-      knife_config[:run_list] = ["role[base]", "role[app]"]
+      config[:run_list] = ["role[base]", "role[app]"]
       expect(node).to receive(:run_list).with(["role[base]", "role[app]"])
       client_builder.run
     end
 
     it "builds a node with first_boot_attributes if they're given" do
-      knife_config[:first_boot_attributes] = { baz: :quux }
+      config[:first_boot_attributes] = { baz: :quux }
       expect(node).to receive(:normal_attrs=).with({ baz: :quux })
       expect(node).to receive(:run_list).with([])
       client_builder.run
     end
 
     it "builds a node with an environment if its given" do
-      knife_config[:environment] = "production"
+      config[:environment] = "production"
       expect(node).to receive(:environment).with("production")
       expect(node).to receive(:run_list).with([])
       client_builder.run
     end
 
     it "builds a node with policy_name and policy_group when given" do
-      knife_config[:policy_name] = "my-app"
-      knife_config[:policy_group] = "staging"
+      config[:policy_name] = "my-app"
+      config[:policy_group] = "staging"
 
       expect(node).to receive(:run_list).with([])
       expect(node).to receive(:policy_name=).with("my-app")
diff --git a/spec/unit/knife/bootstrap_spec.rb b/spec/unit/knife/bootstrap_spec.rb
index dfe896d3c8..e746c6b936 100644
--- a/spec/unit/knife/bootstrap_spec.rb
+++ b/spec/unit/knife/bootstrap_spec.rb
@@ -518,6 +518,7 @@ describe Chef::Knife::Bootstrap do
 
     before do
       Chef::Config[:knife][:bootstrap_template] = template_file
+      knife.merge_configs
     end
 
     let(:rendered_template) do
@@ -530,7 +531,6 @@ describe Chef::Knife::Bootstrap do
       end
 
       it "renders 'fips true'" do
-        Chef::Config[:fips] = true
         expect(rendered_template).to match("fips")
       end
     end
@@ -617,6 +617,7 @@ describe Chef::Knife::Bootstrap do
       allow(knife).to receive(:host_descriptor).and_return host_descriptor
       if knife_connection_protocol
         Chef::Config[:knife][:connection_protocol] = knife_connection_protocol
+        knife.merge_configs
       end
     end
 
@@ -827,6 +828,7 @@ describe Chef::Knife::Bootstrap do
           before do
             # Set everything to easily identifiable and obviously fake values
             # to verify that Chef::Config is being sourced instead of knife.config
+            knife.config = {}
             Chef::Config[:knife][:max_wait] = 9999
             Chef::Config[:knife][:winrm_user] = "winbob"
             Chef::Config[:knife][:winrm_port] = 9999
@@ -841,20 +843,7 @@ describe Chef::Knife::Bootstrap do
             Chef::Config[:knife][:winrm_ssl_peer_fingerprint] = "ABCDEF"
           end
 
-          context "and unsupported Chef::Config options are given in Chef::Config, not in CLI" do
-            before do
-              Chef::Config[:knife][:connection_password] = "blah"
-              Chef::Config[:knife][:winrm_password] = "blah"
-            end
-            it "does not include the corresponding option in the connection options" do
-              expect(knife.connection_opts.key?(:password)).to eq false
-            end
-          end
-
           context "and no CLI options have been given" do
-            before do
-              knife.config = {}
-            end
             let(:expected_result) do
               {
                 logger: Chef::Log, # not configurable
@@ -874,6 +863,7 @@ describe Chef::Knife::Bootstrap do
             end
 
             it "generates a config hash using the Chef::Config values" do
+              knife.merge_configs
               expect(knife.connection_opts).to match expected_result
             end
 
@@ -885,7 +875,7 @@ describe Chef::Knife::Bootstrap do
                 logger: Chef::Log, # not configurable
                 ca_trust_path: "no trust",
                 max_wait_until_ready: 9999,
-                operation_timeout: 60,
+                operation_timeout: 9999,
                 ssl_peer_fingerprint: "ABCDEF",
                 winrm_transport: "kerberos",
                 winrm_basic_auth_only: true,
@@ -908,6 +898,7 @@ describe Chef::Knife::Bootstrap do
             end
 
             it "generates a config hash using the CLI options when available and falling back to Chef::Config values" do
+              knife.merge_configs
               expect(knife.connection_opts).to match expected_result
             end
           end
@@ -954,6 +945,7 @@ describe Chef::Knife::Bootstrap do
               }
             end
             it "generates a config hash using the CLI options and pulling nothing from Chef::Config" do
+              knife.merge_configs
               expect(knife.connection_opts).to match expected_result
             end
           end
@@ -963,7 +955,6 @@ describe Chef::Knife::Bootstrap do
           before do
             # We will use knife's actual config since these tests
             # have assumptions based on CLI default values
-            knife.merge_configs
           end
           let(:expected_result) do
             {
@@ -977,6 +968,7 @@ describe Chef::Knife::Bootstrap do
             }
           end
           it "populates appropriate defaults" do
+            knife.merge_configs
             expect(knife.connection_opts).to match expected_result
           end
         end
@@ -990,6 +982,7 @@ describe Chef::Knife::Bootstrap do
           before do
             # Set everything to easily identifiable and obviously fake values
             # to verify that Chef::Config is being sourced instead of knife.config
+            knife.config = {}
             Chef::Config[:knife][:max_wait] = 9999
             Chef::Config[:knife][:session_timeout] = 9999
             Chef::Config[:knife][:ssh_user] = "sshbob"
@@ -1002,9 +995,6 @@ describe Chef::Knife::Bootstrap do
           end
 
           context "and no CLI options have been given" do
-            before do
-              knife.config = {}
-            end
             let(:expected_result) do
               {
                 logger: Chef::Log, # not configurable
@@ -1018,13 +1008,14 @@ describe Chef::Knife::Bootstrap do
                 keys_only: true,
                 key_files: ["/identity.pem", "/gateway.pem"],
                 sudo: false,
-                verify_host_key: nil,
+                verify_host_key: "always",
                 port: 9999,
                 non_interactive: true,
               }
             end
 
             it "generates a correct config hash using the Chef::Config values" do
+              knife.merge_configs
               expect(knife.connection_opts).to match expected_result
             end
           end
@@ -1038,6 +1029,7 @@ describe Chef::Knife::Bootstrap do
               Chef::Config[:knife][:ssh_forward_agent] = "blah"
             end
             it "does not include the corresponding option in the connection options" do
+              knife.merge_configs
               expect(knife.connection_opts.key?(:password)).to eq false
               expect(knife.connection_opts.key?(:ssh_forward_agent)).to eq false
               expect(knife.connection_opts.key?(:use_sudo)).to eq false
@@ -1047,6 +1039,7 @@ describe Chef::Knife::Bootstrap do
 
           context "and some CLI options have been given" do
             before do
+              knife.config = {}
               knife.config[:connection_user] = "sshalice"
               knife.config[:connection_port] = 12
               knife.config[:ssh_port] = "13" # canary to indirectly verify we're not looking for the wrong CLI flag
@@ -1072,19 +1065,21 @@ describe Chef::Knife::Bootstrap do
                 keys_only: false, # implied false from config password present
                 key_files: ["/identity.pem", "/gateway.pem"], # Config
                 sudo: true, # ccli
-                verify_host_key: nil, # Config
+                verify_host_key: "always", # Config
                 port: 12, # cli
                 non_interactive: true,
               }
             end
 
             it "generates a config hash using the CLI options when available and falling back to Chef::Config values" do
+              knife.merge_configs
               expect(knife.connection_opts).to match expected_result
             end
           end
 
           context "and all CLI options have been given" do
             before do
+              knife.config = {}
               knife.config[:max_wait] = 150
               knife.config[:session_timeout] = 120
               knife.config[:connection_user] = "sshroot"
@@ -1129,6 +1124,7 @@ describe Chef::Knife::Bootstrap do
               }
             end
             it "generates a config hash using the CLI options and pulling nothing from Chef::Config" do
+              knife.merge_configs
               expect(knife.connection_opts).to match expected_result
             end
           end
@@ -1137,7 +1133,7 @@ describe Chef::Knife::Bootstrap do
           before do
             # We will use knife's actual config since these tests
             # have assumptions based on CLI default values
-            knife.merge_configs
+            config = {}
           end
 
           let(:expected_result) do
@@ -1153,6 +1149,7 @@ describe Chef::Knife::Bootstrap do
             }
           end
           it "populates appropriate defaults" do
+            knife.merge_configs
             expect(knife.connection_opts).to match expected_result
           end
         end
@@ -1169,17 +1166,6 @@ describe Chef::Knife::Bootstrap do
       allow(knife).to receive(:connection_protocol).and_return connection_protocol
     end
 
-    context "when determining knife config keys for user and port" do
-      let(:connection_protocol) { "fake" }
-      it "uses the protocol name to resolve the knife config keys" do
-        allow(knife).to receive(:config_value).with(:max_wait)
-
-        expect(knife).to receive(:config_value).with(:connection_port, :fake_port)
-        expect(knife).to receive(:config_value).with(:connection_user, :fake_user)
-        knife.base_opts
-      end
-    end
-
     context "for all protocols" do
       context "when password is provided" do
         before do
@@ -1940,22 +1926,15 @@ describe Chef::Knife::Bootstrap do
       Chef::Config[:knife][:test_key_a] = "a from Chef::Config"
       Chef::Config[:knife][:test_key_c] = "c from Chef::Config"
       Chef::Config[:knife][:alt_test_key_c] = "alt c from Chef::Config"
+      knife.merge_configs
     end
 
-    it "returns CLI value when key is only provided by the CLI" do
-      expect(knife.config_value(:test_key_b)).to eq "b from cli"
-    end
-
-    it "returns CLI value when key is provided by CLI and Chef::Config" do
-      expect(knife.config_value(:test_key_a)).to eq "a from cli"
-    end
-
-    it "returns Chef::Config value whent he key is only provided by Chef::Config" do
-      expect(knife.config_value(:test_key_c)).to eq "c from Chef::Config"
+    it "returns the Chef::Config value from the cli when the CLI key is set" do
+      expect(knife.config_value(:test_key_a, :alt_test_key_c)).to eq "a from cli"
     end
 
     it "returns the Chef::Config value from the alternative key when the CLI key is not set" do
-      expect(knife.config_value(:test_key_c, :alt_test_key_c)).to eq "alt c from Chef::Config"
+      expect(knife.config_value(:test_key_d, :alt_test_key_c)).to eq "alt c from Chef::Config"
     end
 
     it "returns the default value when the key is not provided by CLI or Chef::Config" do
diff --git a/spec/unit/knife/core/bootstrap_context_spec.rb b/spec/unit/knife/core/bootstrap_context_spec.rb
index c797af38f2..a55047a739 100644
--- a/spec/unit/knife/core/bootstrap_context_spec.rb
+++ b/spec/unit/knife/core/bootstrap_context_spec.rb
@@ -20,12 +20,6 @@ require "spec_helper"
 require "chef/knife/core/bootstrap_context"
 
 describe Chef::Knife::Core::BootstrapContext do
-  before do
-    # This is required because the chef-fips pipeline does
-    # has a default value of true for fips
-    Chef::Config[:fips] = false
-  end
-
   let(:config) { { foo: :bar, color: true } }
   let(:run_list) { Chef::RunList.new("recipe[tmux]", "role[base]") }
   let(:chef_config) do
@@ -182,34 +176,18 @@ describe Chef::Knife::Core::BootstrapContext do
       expect(bootstrap_context.config_content).not_to include("ssl_verify_mode")
     end
 
-    describe "when configured in config" do
-      let(:chef_config) do
-        {
-          knife: { ssl_verify_mode: :verify_peer },
-        }
-      end
+    describe "when configured via the config hash" do
+      let(:config) { { node_ssl_verify_mode: "none" } }
 
       it "uses the config value" do
-        expect(bootstrap_context.config_content).to include("ssl_verify_mode :verify_peer")
-      end
-
-      describe "when configured via CLI" do
-        let(:config) { { node_ssl_verify_mode: "none" } }
-
-        it "uses CLI value" do
-          expect(bootstrap_context.config_content).to include("ssl_verify_mode :verify_none")
-        end
+        expect(bootstrap_context.config_content).to include("ssl_verify_mode :verify_none")
       end
     end
   end
 
   describe "fips mode" do
     before do
-      Chef::Config[:fips] = true
-    end
-
-    after do
-      Chef::Config.reset!
+      chef_config[:fips] = true
     end
 
     it "sets fips mode in the client.rb" do
@@ -222,23 +200,11 @@ describe Chef::Knife::Core::BootstrapContext do
       expect(bootstrap_context.config_content).not_to include("verify_api_cert")
     end
 
-    describe "when configured in config" do
-      let(:chef_config) do
-        {
-          knife: { verify_api_cert: :false },
-        }
-      end
-
-      it "uses the config value" do
-        expect(bootstrap_context.config_content).to include("verify_api_cert false")
-      end
-
-      describe "when configured via CLI" do
-        let(:config) { { node_verify_api_cert: true } }
+    describe "when configured via the config hash" do
+      let(:config) { { node_verify_api_cert: true } }
 
-        it "uses CLI value" do
-          expect(bootstrap_context.config_content).to include("verify_api_cert true")
-        end
+      it "uses config value" do
+        expect(bootstrap_context.config_content).to include("verify_api_cert true")
       end
     end
   end
diff --git a/spec/unit/knife/core/windows_bootstrap_context_spec.rb b/spec/unit/knife/core/windows_bootstrap_context_spec.rb
index 14ca563a58..656b05b905 100644
--- a/spec/unit/knife/core/windows_bootstrap_context_spec.rb
+++ b/spec/unit/knife/core/windows_bootstrap_context_spec.rb
@@ -20,19 +20,14 @@ require "spec_helper"
 require "chef/knife/core/windows_bootstrap_context"
 describe Chef::Knife::Core::WindowsBootstrapContext do
   let(:config) { {} }
-  let(:bootstrap_context) { Chef::Knife::Core::WindowsBootstrapContext.new(config, nil, Chef::Config, nil) }
+  let(:chef_config) { Chef::Config.save } # "dup" to a hash
+  let(:bootstrap_context) { Chef::Knife::Core::WindowsBootstrapContext.new(config, nil, chef_config, nil) }
 
   describe "fips" do
-    before do
-      Chef::Config[:fips] = fips_mode
-    end
-
-    after do
-      Chef::Config.reset!
-    end
-
     context "when fips is set" do
-      let(:fips_mode) { true }
+      before do
+        chef_config[:fips] = true
+      end
 
       it "sets fips mode in the client.rb" do
         expect(bootstrap_context.config_content).to match(/fips true/)
@@ -40,7 +35,9 @@ describe Chef::Knife::Core::WindowsBootstrapContext do
     end
 
     context "when fips is not set" do
-      let(:fips_mode) { false }
+      before do
+        chef_config[:fips] = false
+      end
 
       it "sets fips mode in the client.rb" do
         expect(bootstrap_context.config_content).not_to match(/fips true/)
@@ -223,55 +220,4 @@ describe Chef::Knife::Core::WindowsBootstrapContext do
       end
     end
   end
-
-  describe "bootstrap_install_command for bootstrap through WinRM" do
-    context "when bootstrap_install_command option is passed on CLI" do
-      let(:bootstrap) { Chef::Knife::Bootstrap.new(["--bootstrap-install-command", "chef-client"]) }
-      before do
-        bootstrap.config[:bootstrap_install_command] = "chef-client"
-      end
-
-      it "sets the bootstrap_install_command option under Chef::Config::Knife object" do
-        expect(Chef::Config[:knife][:bootstrap_install_command]).to eq("chef-client")
-      end
-
-      after do
-        bootstrap.config.delete(:bootstrap_install_command)
-        Chef::Config[:knife].delete(:bootstrap_install_command)
-      end
-    end
-
-    context "when bootstrap_install_command option is not passed on CLI" do
-      let(:bootstrap) { Chef::Knife::Bootstrap.new([]) }
-      it "does not set the bootstrap_install_command option under Chef::Config::Knife object" do
-        expect(Chef::Config[:knife][:bootstrap_install_command]). to eq(nil)
-      end
-    end
-  end
-
-  describe "bootstrap_install_command for bootstrap through SSH" do
-    context "when bootstrap_install_command option is passed on CLI" do
-      let(:bootstrap) { Chef::Knife::Bootstrap.new(["--bootstrap-install-command", "chef-client"]) }
-      before do
-        bootstrap.config[:bootstrap_install_command] = "chef-client"
-      end
-
-      it "sets the bootstrap_install_command option under Chef::Config::Knife object" do
-        expect(Chef::Config[:knife][:bootstrap_install_command]).to eq("chef-client")
-      end
-
-      after do
-        bootstrap.config.delete(:bootstrap_install_command)
-        Chef::Config[:knife].delete(:bootstrap_install_command)
-      end
-    end
-
-    context "when bootstrap_install_command option is not passed on CLI" do
-      let(:bootstrap) { Chef::Knife::Bootstrap.new([]) }
-      it "does not set the bootstrap_install_command option under Chef::Config::Knife object" do
-        expect(Chef::Config[:knife][:bootstrap_install_command]). to eq(nil)
-      end
-    end
-  end
-
 end
diff --git a/spec/unit/knife/data_bag_secret_options_spec.rb b/spec/unit/knife/data_bag_secret_options_spec.rb
index 2b9425999c..e8f99c3f79 100644
--- a/spec/unit/knife/data_bag_secret_options_spec.rb
+++ b/spec/unit/knife/data_bag_secret_options_spec.rb
@@ -50,8 +50,8 @@ describe Chef::Knife::DataBagSecretOptions do
   describe "#validate_secrets" do
 
     it "throws an error when provided with both --secret and --secret-file on the CL" do
-      Chef::Config[:knife][:cl_secret_file] = secret_file.path
-      Chef::Config[:knife][:cl_secret] = secret
+      example_db.config[:cl_secret_file] = secret_file.path
+      example_db.config[:cl_secret] = secret
       expect(example_db).to receive(:exit).with(1)
       expect(example_db.ui).to receive(:fatal).with("Please specify only one of --secret, --secret-file")
 
@@ -61,6 +61,7 @@ describe Chef::Knife::DataBagSecretOptions do
     it "throws an error when provided with `secret` and `secret_file` in knife.rb" do
       Chef::Config[:knife][:secret_file] = secret_file.path
       Chef::Config[:knife][:secret] = secret
+      example_db.merge_configs
       expect(example_db).to receive(:exit).with(1)
       expect(example_db.ui).to receive(:fatal).with("Please specify only one of 'secret' or 'secret_file' in your config file")
 
@@ -72,14 +73,16 @@ describe Chef::Knife::DataBagSecretOptions do
   describe "#read_secret" do
 
     it "returns the secret first" do
-      Chef::Config[:knife][:cl_secret] = secret
-      expect(example_db).to receive(:config).and_return({ secret: secret })
+      example_db.config[:cl_secret] = secret
+      Chef::Config[:knife][:secret] = secret
+      example_db.merge_configs
       expect(example_db.read_secret).to eq(secret)
     end
 
     it "returns the secret_file only if secret does not exist" do
-      Chef::Config[:knife][:cl_secret_file] = secret_file.path
-      expect(example_db).to receive(:config).and_return({ secret_file: secret_file.path })
+      example_db.config[:cl_secret_file] = secret_file.path
+      Chef::Config[:knife][:secret_file] = secret_file.path
+      example_db.merge_configs
       expect(Chef::EncryptedDataBagItem).to receive(:load_secret).with(secret_file.path).and_return("secret file contents")
       expect(example_db.read_secret).to eq("secret file contents")
     end
@@ -87,11 +90,13 @@ describe Chef::Knife::DataBagSecretOptions do
     it "returns the secret from the knife.rb config" do
       Chef::Config[:knife][:secret_file] = secret_file.path
       Chef::Config[:knife][:secret] = secret
+      example_db.merge_configs
       expect(example_db.read_secret).to eq(secret)
     end
 
     it "returns the secret_file from the knife.rb config only if the secret does not exist" do
       Chef::Config[:knife][:secret_file] = secret_file.path
+      example_db.merge_configs
       expect(Chef::EncryptedDataBagItem).to receive(:load_secret).with(secret_file.path).and_return("secret file contents")
       expect(example_db.read_secret).to eq("secret file contents")
     end
@@ -101,58 +106,61 @@ describe Chef::Knife::DataBagSecretOptions do
   describe "#encryption_secret_provided?" do
 
     it "returns true if the secret is passed on the CL" do
-      Chef::Config[:knife][:cl_secret] = secret
+      example_db.config[:cl_secret] = secret
       expect(example_db.encryption_secret_provided?).to eq(true)
     end
 
     it "returns true if the secret_file is passed on the CL" do
-      Chef::Config[:knife][:cl_secret_file] = secret_file.path
+      example_db.config[:cl_secret_file] = secret_file.path
       expect(example_db.encryption_secret_provided?).to eq(true)
     end
 
     it "returns true if --encrypt is passed on the CL and :secret is in config" do
-      expect(example_db).to receive(:config).and_return({ encrypt: true })
+      example_db.config[:encrypt] = true
       Chef::Config[:knife][:secret] = secret
+      example_db.merge_configs
       expect(example_db.encryption_secret_provided?).to eq(true)
     end
 
     it "returns true if --encrypt is passed on the CL and :secret_file is in config" do
-      expect(example_db).to receive(:config).and_return({ encrypt: true })
+      example_db.config[:encrypt] = true
       Chef::Config[:knife][:secret_file] = secret_file.path
+      example_db.merge_configs
       expect(example_db.encryption_secret_provided?).to eq(true)
     end
 
     it "throws an error if --encrypt is passed and there is not :secret or :secret_file in the config" do
-      expect(example_db).to receive(:config).and_return({ encrypt: true })
+      example_db.config[:encrypt] = true
       expect(example_db).to receive(:exit).with(1)
       expect(example_db.ui).to receive(:fatal).with("No secret or secret_file specified in config, unable to encrypt item.")
       example_db.encryption_secret_provided?
     end
 
     it "returns false if no secret is passed" do
-      expect(example_db).to receive(:config).and_return({})
       expect(example_db.encryption_secret_provided?).to eq(false)
     end
 
     it "returns false if --encrypt is not provided and :secret is in the config" do
-      expect(example_db).to receive(:config).and_return({})
       Chef::Config[:knife][:secret] = secret
+      example_db.merge_configs
       expect(example_db.encryption_secret_provided?).to eq(false)
     end
 
     it "returns false if --encrypt is not provided and :secret_file is in the config" do
-      expect(example_db).to receive(:config).and_return({})
       Chef::Config[:knife][:secret_file] = secret_file.path
+      example_db.merge_configs
       expect(example_db.encryption_secret_provided?).to eq(false)
     end
 
     it "returns true if --encrypt is not provided, :secret is in the config and need_encrypt_flag is false" do
       Chef::Config[:knife][:secret] = secret
+      example_db.merge_configs
       expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(true)
     end
 
     it "returns true if --encrypt is not provided, :secret_file is in the config and need_encrypt_flag is false" do
       Chef::Config[:knife][:secret_file] = secret_file.path
+      example_db.merge_configs
       expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(true)
     end
 
diff --git a/spec/unit/knife/ssh_spec.rb b/spec/unit/knife/ssh_spec.rb
index 470868d479..72111eed3d 100644
--- a/spec/unit/knife/ssh_spec.rb
+++ b/spec/unit/knife/ssh_spec.rb
@@ -253,15 +253,19 @@ describe Chef::Knife::Ssh do
       expect(@knife.session.servers[0].options[:timeout]).to eq(120)
     end
 
-    it "uses the timeout from Chef Config" do
-      Chef::Config[:knife][:ssh_timeout] = 5
-      @knife.config[:ssh_timeout] = nil
+    it "uses the timeout from the CLI" do
+      @knife.config = {}
+      Chef::Config[:knife][:ssh_timeout] = nil
+      @knife.config[:ssh_timeout] = 5
       @knife.session_from_list([["the.b.org", nil, nil]])
+      @knife.merge_configs
       expect(@knife.session.servers[0].options[:timeout]).to eq(5)
     end
 
     it "uses the timeout from knife config" do
-      @knife.config[:ssh_timeout] = 6
+      @knife.config = {}
+      Chef::Config[:knife][:ssh_timeout] = 6
+      @knife.merge_configs
       @knife.session_from_list([["the.b.org", nil, nil]])
       expect(@knife.session.servers[0].options[:timeout]).to eq(6)
     end
@@ -396,111 +400,4 @@ describe Chef::Knife::Ssh do
       end
     end
   end
-
-  describe "#configure_password" do
-    before do
-      @knife.config.delete(:ssh_password_ng)
-      @knife.config.delete(:ssh_password)
-    end
-
-    context "when setting ssh_password_ng from knife ssh" do
-      # in this case ssh_password_ng exists, but ssh_password does not
-      it "should prompt for a password when ssh_passsword_ng is nil" do
-        @knife.config[:ssh_password_ng] = nil
-        expect(@knife).to receive(:get_password).and_return("mysekretpassw0rd")
-        @knife.configure_password
-        expect(@knife.config[:ssh_password]).to eq("mysekretpassw0rd")
-      end
-
-      it "should set ssh_password to false if ssh_password_ng is false" do
-        @knife.config[:ssh_password_ng] = false
-        expect(@knife).not_to receive(:get_password)
-        @knife.configure_password
-        expect(@knife.config[:ssh_password]).to be_falsey
-      end
-
-      it "should set ssh_password to ssh_password_ng if we set a password" do
-        @knife.config[:ssh_password_ng] = "mysekretpassw0rd"
-        expect(@knife).not_to receive(:get_password)
-        @knife.configure_password
-        expect(@knife.config[:ssh_password]).to eq("mysekretpassw0rd")
-      end
-    end
-
-    context "when setting ssh_password from knife bootstrap / knife * server create" do
-      # in this case ssh_password exists, but ssh_password_ng does not
-      it "should set ssh_password to nil when ssh_password is nil" do
-        @knife.config[:ssh_password] = nil
-        expect(@knife).not_to receive(:get_password)
-        @knife.configure_password
-        expect(@knife.config[:ssh_password]).to be_nil
-      end
-
-      it "should set ssh_password to false when ssh_password is false" do
-        @knife.config[:ssh_password] = false
-        expect(@knife).not_to receive(:get_password)
-        @knife.configure_password
-        expect(@knife.config[:ssh_password]).to be_falsey
-      end
-
-      it "should set ssh_password to ssh_password if we set a password" do
-        @knife.config[:ssh_password] = "mysekretpassw0rd"
-        expect(@knife).not_to receive(:get_password)
-        @knife.configure_password
-        expect(@knife.config[:ssh_password]).to eq("mysekretpassw0rd")
-      end
-    end
-    context "when setting ssh_password in the config variable" do
-      before(:each) do
-        Chef::Config[:knife][:ssh_password] = "my_knife_passw0rd"
-      end
-      context "when setting ssh_password_ng from knife ssh" do
-        # in this case ssh_password_ng exists, but ssh_password does not
-        it "should prompt for a password when ssh_passsword_ng is nil" do
-          @knife.config[:ssh_password_ng] = nil
-          expect(@knife).to receive(:get_password).and_return("mysekretpassw0rd")
-          @knife.configure_password
-          expect(@knife.config[:ssh_password]).to eq("mysekretpassw0rd")
-        end
-
-        it "should set ssh_password to the configured knife.rb value if ssh_password_ng is false" do
-          @knife.config[:ssh_password_ng] = false
-          expect(@knife).not_to receive(:get_password)
-          @knife.configure_password
-          expect(@knife.config[:ssh_password]).to eq("my_knife_passw0rd")
-        end
-
-        it "should set ssh_password to ssh_password_ng if we set a password" do
-          @knife.config[:ssh_password_ng] = "mysekretpassw0rd"
-          expect(@knife).not_to receive(:get_password)
-          @knife.configure_password
-          expect(@knife.config[:ssh_password]).to eq("mysekretpassw0rd")
-        end
-      end
-
-      context "when setting ssh_password from knife bootstrap / knife * server create" do
-        # in this case ssh_password exists, but ssh_password_ng does not
-        it "should set ssh_password to the configured knife.rb value when ssh_password is nil" do
-          @knife.config[:ssh_password] = nil
-          expect(@knife).not_to receive(:get_password)
-          @knife.configure_password
-          expect(@knife.config[:ssh_password]).to eq("my_knife_passw0rd")
-        end
-
-        it "should set ssh_password to the configured knife.rb value when ssh_password is false" do
-          @knife.config[:ssh_password] = false
-          expect(@knife).not_to receive(:get_password)
-          @knife.configure_password
-          expect(@knife.config[:ssh_password]).to eq("my_knife_passw0rd")
-        end
-
-        it "should set ssh_password to ssh_password if we set a password" do
-          @knife.config[:ssh_password] = "mysekretpassw0rd"
-          expect(@knife).not_to receive(:get_password)
-          @knife.configure_password
-          expect(@knife.config[:ssh_password]).to eq("mysekretpassw0rd")
-        end
-      end
-    end
-  end
 end
diff --git a/spec/unit/knife_spec.rb b/spec/unit/knife_spec.rb
index b73a46397f..88f36a3973 100644
--- a/spec/unit/knife_spec.rb
+++ b/spec/unit/knife_spec.rb
@@ -353,6 +353,24 @@ describe Chef::Knife do
         expect(knife_command.config_source(:listen)).to eq(:cli)
       end
 
+      it "merges Chef::Config[:knife] values into the config hash even if they have no cli keys" do
+        Chef::Config[:knife][:opt_with_no_cli_key] = "from-knife-config"
+        knife_command = KnifeSpecs::TestYourself.new([]) # empty argv
+        knife_command.configure_chef
+        expect(knife_command.config[:opt_with_no_cli_key]).to eq("from-knife-config")
+        expect(knife_command.config_source(:opt_with_no_cli_key)).to eq(:config)
+      end
+
+      it "merges Chef::Config[:knife] default values into the config hash even if they have no cli keys" do
+        Chef::Config.config_context :knife do
+          default :opt_with_no_cli_key, "from-knife-default"
+        end
+        knife_command = KnifeSpecs::TestYourself.new([]) # empty argv
+        knife_command.configure_chef
+        expect(knife_command.config[:opt_with_no_cli_key]).to eq("from-knife-default")
+        expect(knife_command.config_source(:opt_with_no_cli_key)).to eq(:config_default)
+      end
+
       context "verbosity is one" do
         let(:fake_config) { "/does/not/exist/knife.rb" }