chef 14.15.6 → 15.0.293

data/spec/unit/knife/bootstrap/train_connector_spec.rb

@@ -0,0 +1,216 @@
+#
+# Copyright:: Copyright (c) 2019 Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+require "ostruct"
+require "chef/knife/bootstrap/train_connector"
+
+describe Chef::Knife::Bootstrap::TrainConnector do
+  let(:protocol) { "mock" }
+  let(:family) { "unknown" }
+  let(:release) { "unknown" } # version
+  let(:name) { "unknown" }
+  let(:arch) { "x86_64" }
+  let(:connection_opts) { {} } # connection opts
+  let(:host_url) { "mock://user1@example.com" }
+  let(:mock_connection) { true }
+
+  subject do
+    # Example groups can still override by setting explicitly it in 'connection_opts'
+    tc = Chef::Knife::Bootstrap::TrainConnector.new(host_url, protocol, connection_opts)
+    tc
+  end
+
+  before(:each) do
+    if mock_connection
+      subject.connect!
+      subject.connection.mock_os(
+        family: family,
+        name: name,
+        release: release,
+        arch: arch
+      )
+    end
+  end
+
+  describe "platform helpers" do
+    context "on linux" do
+      let(:family) { "debian" }
+      let(:name) { "ubuntu" }
+      it "reports that it is linux and unix, because that is how train classifies it" do
+        expect(subject.unix?).to eq true
+        expect(subject.linux?).to eq true
+        expect(subject.windows?).to eq false
+      end
+    end
+    context "on unix" do
+      let(:family) { "os" }
+      let(:name) { "mac_os_x" }
+      it "reports only a unix OS" do
+        expect(subject.unix?).to eq true
+        expect(subject.linux?).to eq false
+        expect(subject.windows?).to eq false
+      end
+    end
+    context "on windows" do
+      let(:family) { "windows" }
+      let(:name) { "windows" }
+      it "reports only a windows OS" do
+        expect(subject.unix?).to eq false
+        expect(subject.linux?).to eq false
+        expect(subject.windows?).to eq true
+      end
+    end
+  end
+
+  describe "#connect!" do
+    it "establishes the connection to the remote host by waiting for it" do
+      expect(subject.connection).to receive(:wait_until_ready)
+      subject.connect!
+    end
+  end
+
+  describe "#initialize" do
+    let(:mock_connection) { false }
+
+    context "when provided target is a proper URL" do
+      let(:protocol) { "ssh" }
+      let(:host_url) { "mock://user1@localhost:2200" }
+      it "correctly configures the instance from the URL" do
+        expect(subject.config[:backend]).to eq "mock"
+        expect(subject.config[:port]).to eq 2200
+        expect(subject.config[:host]).to eq "localhost"
+        expect(subject.config[:user]).to eq "user1"
+      end
+
+      context "and conflicting options are given" do
+        let(:connection_opts) { { user: "user2", host: "example.com", port: 15 } }
+        it "resolves them from the URI" do
+          expect(subject.config[:backend]).to eq "mock"
+          expect(subject.config[:port]).to eq 2200
+          expect(subject.config[:host]).to eq "localhost"
+          expect(subject.config[:user]).to eq "user1"
+        end
+      end
+    end
+
+    context "when provided target is just a hostname" do
+      let(:host_url) { "localhost" }
+      let(:protocol) { "mock" }
+      it "correctly sets backend protocol from the default" do
+        expect(subject.config[:backend]).to eq "mock"
+      end
+
+      context "and options have been provided that are supported by the transport" do
+        let(:protocol) { "ssh" }
+        let(:connection_opts) { { port: 15, user: "user2" } }
+
+        it "sets hostname and transport from arguments and provided fields from options" do
+          expect(subject.config[:backend]).to eq "ssh"
+          expect(subject.config[:host]).to eq "localhost"
+          expect(subject.config[:user]).to eq "user2"
+          expect(subject.config[:port]).to eq 15
+        end
+
+      end
+
+    end
+
+    context "when provided target is just a an IP address" do
+      let(:host_url) { "127.0.0.1" }
+      let(:protocol) { "mock" }
+      it "correctly sets backend protocol from the default" do
+        expect(subject.config[:backend]).to eq "mock"
+      end
+    end
+  end
+
+  describe "#temp_dir" do
+    context "under windows" do
+      let(:family) { "windows" }
+      let(:name) { "windows" }
+
+      it "uses the windows command to create the temp dir" do
+        expected_command = Chef::Knife::Bootstrap::TrainConnector::MKTEMP_WIN_COMMAND
+        expect(subject).to receive(:run_command!).with(expected_command)
+          .and_return double("result", stdout: "C:/a/path")
+        expect(subject.temp_dir).to eq "C:/a/path"
+      end
+
+    end
+    context "under linux and unix-like" do
+      let(:family) { "debian" }
+      let(:name) { "ubuntu" }
+      it "uses the *nix command to create the temp dir and sets ownership to logged-in user" do
+        expected_command = Chef::Knife::Bootstrap::TrainConnector::MKTEMP_NIX_COMMAND
+        expect(subject).to receive(:run_command!).with(expected_command)
+          .and_return double("result", stdout: "/a/path")
+        expect(subject).to receive(:run_command!).with("chown user1 '/a/path'")
+        expect(subject.temp_dir).to eq "/a/path"
+      end
+
+    end
+  end
+  context "#upload_file_content!" do
+    it "creates a local file with expected content and uploads it" do
+      expect(subject).to receive(:upload_file!) do |local_path, remote_path|
+        expect(File.read(local_path)).to eq "test data"
+        expect(remote_path).to eq "/target/path"
+      end
+      subject.upload_file_content!("test data", "/target/path")
+    end
+  end
+
+  context "del_file" do
+    context "on windows" do
+      let(:family) { "windows" }
+      let(:name) { "windows" }
+      it "deletes the file with a windows command" do
+        expect(subject).to receive(:run_command!) do |cmd, &_handler|
+          expect(cmd).to match(/Test-Path "deleteme\.txt".*/)
+        end
+        subject.del_file!("deleteme.txt")
+      end
+    end
+    context "on unix-like" do
+      let(:family) { "debian" }
+      let(:name) { "ubuntu" }
+      it "deletes the file with a windows command" do
+        expect(subject).to receive(:run_command!) do |cmd, &_handler|
+          expect(cmd).to match(/rm -f "deleteme\.txt".*/)
+        end
+        subject.del_file!("deleteme.txt")
+      end
+    end
+  end
+
+  context "#run_command!" do
+    it "raises a RemoteExecutionFailed when the remote execution failed" do
+      command_result = double("results", stdout: "", stderr: "failed", exit_status: 1)
+      expect(subject).to receive(:run_command).and_return command_result
+
+      expect { subject.run_command!("test") }.to raise_error do |e|
+        expect(e.hostname).to eq subject.hostname
+        expect(e.class).to eq Chef::Knife::Bootstrap::RemoteExecutionFailed
+        expect(e.stderr).to eq "failed"
+        expect(e.stdout).to eq ""
+        expect(e.exit_status).to eq 1
+      end
+    end
+  end
+
+end

data/spec/unit/knife/bootstrap_spec.rb

@@ -22,33 +22,68 @@ Chef::Knife::Bootstrap.load_deps
 require "net/ssh"
 
 describe Chef::Knife::Bootstrap do
-  before do
-    allow(ChefConfig).to receive(:windows?) { false }
-  end
+  let(:bootstrap_template) { nil }
+  let(:stderr) { StringIO.new }
+  let(:bootstrap_cli_options) { [ ] }
+  let(:linux_test) { true }
+  let(:windows_test) { false }
+  let(:linux_test) { false }
+  let(:unix_test) { false }
+  let(:ssh_test) { false }
+
+  let(:connection) do
+    double("TrainConnector",
+                            windows?: windows_test,
+                            linux?: linux_test,
+                            unix?: unix_test) end
+
   let(:knife) do
     Chef::Log.logger = Logger.new(StringIO.new)
     Chef::Config[:knife][:bootstrap_template] = bootstrap_template unless bootstrap_template.nil?
 
     k = Chef::Knife::Bootstrap.new(bootstrap_cli_options)
-    k.merge_configs
-
     allow(k.ui).to receive(:stderr).and_return(stderr)
     allow(k).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(false)
+    allow(k).to receive(:connection).and_return connection
+    k.merge_configs
     k
   end
 
-  let(:stderr) { StringIO.new }
+  context "#check_license" do
+    let(:acceptor) { instance_double(LicenseAcceptance::Acceptor) }
 
-  let(:bootstrap_template) { nil }
+    before do
+      expect(LicenseAcceptance::Acceptor).to receive(:new).and_return(acceptor)
+    end
 
-  let(:bootstrap_cli_options) { [ ] }
+    describe "when a license is not required" do
+      it "does not set the chef_license" do
+        expect(acceptor).to receive(:license_required?).and_return(false)
+        knife.check_license
+        expect(Chef::Config[:chef_license]).to eq(nil)
+      end
+    end
 
-  it "should use chef-full as default template" do
-    expect(knife.bootstrap_template).to be_a_kind_of(String)
-    expect(File.basename(knife.bootstrap_template)).to eq("chef-full")
+    describe "when a license is required" do
+      it "sets the chef_license" do
+        expect(acceptor).to receive(:license_required?).and_return(true)
+        expect(acceptor).to receive(:id_from_mixlib).and_return("id")
+        expect(acceptor).to receive(:check_and_persist)
+        expect(acceptor).to receive(:acceptance_value).and_return("accept-no-persist")
+        knife.check_license
+        expect(Chef::Config[:chef_license]).to eq("accept-no-persist")
+      end
+    end
+  end
+
+  context "#bootstrap_template" do
+    it "should default to chef-full" do
+      expect(knife.bootstrap_template).to be_a_kind_of(String)
+      expect(File.basename(knife.bootstrap_template)).to eq("chef-full")
+    end
   end
 
-  context "when using the chef-full default template" do
+  context "#render_template - when using the chef-full default template" do
     let(:rendered_template) do
       knife.merge_configs
       knife.render_template
@@ -72,7 +107,7 @@ describe Chef::Knife::Bootstrap do
         expect(knife).to receive(:read_secret).and_return("secrets")
         expect(rendered_template).to match("cat > /etc/chef/encrypted_data_bag_secret <<'EOP'")
         expect(rendered_template).to match('{"run_list":\[\]}')
-        expect(rendered_template).to match(/secrets/)
+        expect(rendered_template).to match(%r{secrets})
       end
     end
   end
@@ -92,7 +127,7 @@ describe Chef::Knife::Bootstrap do
       knife.render_template
     end
     it "configures the preinstall command in the bootstrap template correctly" do
-      expect(rendered_template).to match(/command/)
+      expect(rendered_template).to match(%r{command})
     end
   end
 
@@ -103,7 +138,7 @@ describe Chef::Knife::Bootstrap do
       knife.render_template
     end
     it "configures the https_proxy environment variable in the bootstrap template correctly" do
-      expect(rendered_template).to match(/https_proxy="1.1.1.1" export https_proxy/)
+      expect(rendered_template).to match(%r{https_proxy="1.1.1.1" export https_proxy})
     end
   end
 
@@ -114,7 +149,7 @@ describe Chef::Knife::Bootstrap do
       knife.render_template
     end
     it "configures the https_proxy environment variable in the bootstrap template correctly" do
-      expect(rendered_template).to match(/no_proxy="localserver" export no_proxy/)
+      expect(rendered_template).to match(%r{no_proxy="localserver" export no_proxy})
     end
   end
 
@@ -306,14 +341,15 @@ describe Chef::Knife::Bootstrap do
         jsonfile.close
       end
 
-      context "when --json-attributes and --json-attribute-file were both passed" do
-        it "raises a Chef::Exceptions::BootstrapCommandInputError with the proper error message" do
-          knife.parse_options(["-j", '{"foo":{"bar":"baz"}}'])
-          knife.parse_options(["--json-attribute-file", jsonfile.path])
-          knife.merge_configs
-          expect { knife.run }.to raise_error(Chef::Exceptions::BootstrapCommandInputError)
-          jsonfile.close
-        end
+      it "raises a Chef::Exceptions::BootstrapCommandInputError with the proper error message" do
+        knife.parse_options(["-j", '{"foo":{"bar":"baz"}}'])
+        knife.parse_options(["--json-attribute-file", jsonfile.path])
+        knife.merge_configs
+        allow(knife).to receive(:validate_name_args!)
+        expect(knife).to receive(:check_license)
+
+        expect { knife.run }.to raise_error(Chef::Exceptions::BootstrapCommandInputError)
+        jsonfile.close
       end
     end
   end
@@ -324,7 +360,7 @@ describe Chef::Knife::Bootstrap do
     it "should create a hint file when told to" do
       knife.parse_options(["--hint", "openstack"])
       knife.merge_configs
-      expect(knife.render_template).to match(%r{/etc/chef/ohai/hints/openstack.json})
+      expect(knife.render_template).to match(/\/etc\/chef\/ohai\/hints\/openstack.json/)
     end
 
     it "should populate a hint file with JSON when given a file to read" do
@@ -339,13 +375,16 @@ describe Chef::Knife::Bootstrap do
     subject(:knife) do
       k = described_class.new
       Chef::Config[:knife][:bootstrap_template] = template_file
+      allow(k).to receive(:connection).and_return connection
       k.parse_options(options)
       k.merge_configs
       k
     end
 
     let(:options) { ["--bootstrap-no-proxy", setting, "-s", "foo"] }
+
     let(:template_file) { File.expand_path(File.join(CHEF_SPEC_DATA, "bootstrap", "no_proxy.erb")) }
+
     let(:rendered_template) do
       knife.render_template
     end
@@ -354,7 +393,7 @@ describe Chef::Knife::Bootstrap do
       let(:setting) { "api.opscode.com" }
 
       it "renders the client.rb with a single FQDN no_proxy entry" do
-        expect(rendered_template).to match(/.*no_proxy\s*"api.opscode.com".*/)
+        expect(rendered_template).to match(%r{.*no_proxy\s*"api.opscode.com".*})
       end
     end
 
@@ -362,7 +401,7 @@ describe Chef::Knife::Bootstrap do
       let(:setting) { "api.opscode.com,172.16.10.*" }
 
       it "renders the client.rb with comma-separated FQDN and wildcard IP address no_proxy entries" do
-        expect(rendered_template).to match(/.*no_proxy\s*"api.opscode.com,172.16.10.\*".*/)
+        expect(rendered_template).to match(%r{.*no_proxy\s*"api.opscode.com,172.16.10.\*".*})
       end
     end
 
@@ -420,7 +459,7 @@ describe Chef::Knife::Bootstrap do
     it "creates a secret file" do
       expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(true)
       expect(knife).to receive(:read_secret).and_return(secret)
-      expect(rendered_template).to match(/#{secret}/)
+      expect(rendered_template).to match(%r{#{secret}})
     end
 
     it "renders the client.rb with an encrypted_data_bag_secret entry" do
@@ -463,11 +502,13 @@ describe Chef::Knife::Bootstrap do
       end
     end
 
-    it "doesn't create /etc/chef/trusted_certs if :trusted_certs_dir is empty" do
-      allow(Dir).to receive(:glob).and_call_original
-      expect(Dir).to receive(:glob).with(File.join(trusted_certs_dir, "*.{crt,pem}")).and_return([])
-      expect(rendered_template).not_to match(%r{mkdir -p /etc/chef/trusted_certs})
+    context "when :trusted_cets_dir is empty" do
+      let(:trusted_certs_dir) { Chef::Util::PathHelper.cleanpath(File.join(File.dirname(__FILE__), "../../data/trusted_certs_empty")) }
+      it "doesn't create /etc/chef/trusted_certs if :trusted_certs_dir is empty" do
+        expect(rendered_template).not_to match(%r{mkdir -p /etc/chef/trusted_certs})
+      end
     end
+
   end
 
   context "when doing fips things" do
@@ -528,9 +569,7 @@ describe Chef::Knife::Bootstrap do
     context "when client_d_dir is set" do
       let(:client_d_dir) do
         Chef::Util::PathHelper.cleanpath(
-          File.join(File.dirname(__FILE__), "../../data/client.d_00")
-        )
-      end
+          File.join(File.dirname(__FILE__), "../../data/client.d_00")) end
 
       it "creates /etc/chef/client.d" do
         expect(rendered_template).to match("mkdir -p /etc/chef/client\.d")
@@ -555,9 +594,7 @@ describe Chef::Knife::Bootstrap do
       context "a nested directory structure" do
         let(:client_d_dir) do
           Chef::Util::PathHelper.cleanpath(
-            File.join(File.dirname(__FILE__), "../../data/client.d_01")
-          )
-        end
+            File.join(File.dirname(__FILE__), "../../data/client.d_01")) end
         it "creates a file foo/bar.rb" do
           expect(rendered_template).to match("cat > /etc/chef/client.d/foo/bar.rb <<'EOP'")
           expect(rendered_template).to match("1 / 0")
@@ -566,14 +603,116 @@ describe Chef::Knife::Bootstrap do
     end
   end
 
-  describe "handling policyfile options" do
+  describe "#connection_protocol" do
+    let(:host_descriptor) { "example.com" }
+    let(:config) { {} }
+    let(:knife_connection_protocol) { nil }
+    before do
+      allow(knife).to receive(:config).and_return config
+      allow(knife).to receive(:host_descriptor).and_return host_descriptor
+      if knife_connection_protocol
+        Chef::Config[:knife][:connection_protocol] = knife_connection_protocol
+      end
+    end
+
+    context "when protocol is part of the host argument" do
+      let(:host_descriptor) { "winrm://myhost" }
+
+      it "returns the value provided by the host argument" do
+        expect(knife.connection_protocol).to eq "winrm"
+      end
+    end
+
+    context "when protocol is provided via the CLI flag" do
+      let(:config) { { connection_protocol: "winrm" } }
+      it "returns that value" do
+        expect(knife.connection_protocol).to eq "winrm"
+      end
+
+    end
+    context "when protocol is provided via the host argument and the CLI flag" do
+      let(:host_descriptor) { "ssh://example.com" }
+      let(:config) { { connection_protocol: "winrm" } }
+
+      it "returns the value provided by the host argument" do
+        expect(knife.connection_protocol).to eq "ssh"
+      end
+    end
+
+    context "when no explicit protocol is provided" do
+      let(:config) { {} }
+      let(:host_descriptor) { "example.com" }
+      let(:knife_connection_protocol) { "winrm" }
+      it "falls back to knife config" do
+        expect(knife.connection_protocol).to eq "winrm"
+      end
+      context "and there is no knife bootstrap_protocol" do
+        let(:knife_connection_protocol) { nil }
+        it "falls back to 'ssh'" do
+          expect(knife.connection_protocol).to eq "ssh"
+        end
+      end
+    end
+
+  end
+
+  describe "#validate_protocol!" do
+    let(:host_descriptor) { "example.com" }
+    let(:config) { {} }
+    let(:connection_protocol) { "ssh" }
+    before do
+      allow(knife).to receive(:config).and_return config
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+      allow(knife).to receive(:host_descriptor).and_return host_descriptor
+    end
+
+    context "when protocol is provided both in the URL and via --protocol" do
+
+      context "and they do not match" do
+        let(:connection_protocol) { "ssh" }
+        let(:config) { { connection_protocol: "winrm" } }
+        it "outputs an error and exits" do
+          expect(knife.ui).to receive(:error)
+          expect { knife.validate_protocol! }.to raise_error SystemExit
+        end
+      end
+
+      context "and they do match" do
+        let(:connection_protocol) { "winrm" }
+        let(:config) { { connection_protocol: "winrm" } }
+        it "returns true" do
+          expect(knife.validate_protocol!).to eq true
+        end
+      end
+    end
+
+    context "and the protocol is supported" do
+
+      Chef::Knife::Bootstrap::SUPPORTED_CONNECTION_PROTOCOLS.each do |proto|
+        let(:connection_protocol) { proto }
+        it "returns true for #{proto}" do
+          expect(knife.validate_protocol!).to eq true
+        end
+      end
+    end
+
+    context "and the protocol is not supported" do
+      let(:connection_protocol) { "invalid" }
+      it "outputs an error and exits" do
+        expect(knife.ui).to receive(:error).with(/Unsupported protocol '#{connection_protocol}'/)
+        expect { knife.validate_protocol! }.to raise_error SystemExit
+      end
+    end
+  end
+
+  describe "#validate_policy_options!" do
 
     context "when only policy_name is given" do
 
       let(:bootstrap_cli_options) { %w{ --policy-name my-app-server } }
 
       it "returns an error stating that policy_name and policy_group must be given together" do
-        expect { knife.validate_options! }.to raise_error(SystemExit)
+        expect { knife.validate_policy_options! }.to raise_error(SystemExit)
         expect(stderr.string).to include("ERROR: --policy-name and --policy-group must be specified together")
       end
 
@@ -584,7 +723,7 @@ describe Chef::Knife::Bootstrap do
       let(:bootstrap_cli_options) { %w{ --policy-group staging } }
 
       it "returns an error stating that policy_name and policy_group must be given together" do
-        expect { knife.validate_options! }.to raise_error(SystemExit)
+        expect { knife.validate_policy_options! }.to raise_error(SystemExit)
         expect(stderr.string).to include("ERROR: --policy-name and --policy-group must be specified together")
       end
 
@@ -595,7 +734,7 @@ describe Chef::Knife::Bootstrap do
       let(:bootstrap_cli_options) { %w{ --policy-name my-app --policy-group staging --run-list cookbook } }
 
       it "returns an error stating that policyfile and run_list are exclusive" do
-        expect { knife.validate_options! }.to raise_error(SystemExit)
+        expect { knife.validate_policy_options! }.to raise_error(SystemExit)
         expect(stderr.string).to include("ERROR: Policyfile options and --run-list are exclusive")
       end
 
@@ -606,7 +745,7 @@ describe Chef::Knife::Bootstrap do
       let(:bootstrap_cli_options) { %w{ --policy-name my-app --policy-group staging } }
 
       it "passes options validation" do
-        expect { knife.validate_options! }.to_not raise_error
+        expect { knife.validate_policy_options! }.to_not raise_error
       end
 
       it "passes them into the bootstrap context" do
@@ -624,353 +763,1397 @@ describe Chef::Knife::Bootstrap do
     # Arguably a bug in the plugin: it shouldn't be setting this to nil, but it
     # worked before, so make it work now.
     context "when a plugin sets the run list option to nil" do
-
       before do
         knife.config[:run_list] = nil
       end
 
       it "passes options validation" do
-        expect { knife.validate_options! }.to_not raise_error
+        expect { knife.validate_policy_options! }.to_not raise_error
       end
-
     end
+  end
 
+  # TODO - this is the only cli option we validate the _option_ itself -
+  #        so we'll know if someone accidentally deletes or renames use_sudo_password
+  #        Is this worht keeping?  If so, then it seems we should expand it
+  #        to cover all options.
+  context "validating use_sudo_password option" do
+    it "use_sudo_password contains description and long params for help" do
+      expect(knife.options).to(have_key(:use_sudo_password)) \
+        && expect(knife.options[:use_sudo_password][:description].to_s).not_to(eq(""))\
+        && expect(knife.options[:use_sudo_password][:long].to_s).not_to(eq(""))
+    end
   end
 
-  describe "#validate_bootstrap_version_options!" do
-    describe "chef-14 or lower" do
-      before do
-        stub_const("Chef::VERSION", "14.0")
+  context "#connection_opts" do
+    let(:connection_protocol) { "ssh" }
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+    context "behavioral test: " do
+      let(:expected_connection_opts) do
+        { base_opts: true,
+          ssh_identity_opts: true,
+          ssh_opts: true,
+          gateway_opts: true,
+          host_verify_opts: true,
+          sudo_opts: true,
+          winrm_opts: true }
+      end
+
+      it "queries and merges only expected configurations" do
+        expect(knife).to receive(:base_opts).and_return({ base_opts: true })
+        expect(knife).to receive(:host_verify_opts).and_return({ host_verify_opts: true })
+        expect(knife).to receive(:gateway_opts).and_return({ gateway_opts: true })
+        expect(knife).to receive(:sudo_opts).and_return({ sudo_opts: true })
+        expect(knife).to receive(:winrm_opts).and_return({ winrm_opts: true })
+        expect(knife).to receive(:ssh_opts).and_return({ ssh_opts: true })
+        expect(knife).to receive(:ssh_identity_opts).and_return({ ssh_identity_opts: true })
+        expect(knife.connection_opts).to match expected_connection_opts
+      end
+    end
+
+    context "functional test: " do
+      context "when protocol is winrm" do
+        let(:connection_protocol) { "winrm" }
+        # context "and neither CLI nor Chef::Config config entries have been provided"
+        # end
+        context "and all supported values are provided as Chef::Config entries" do
+          before do
+            # Set everything to easily identifiable and obviously fake values
+            # to verify that Chef::Config is being sourced instead of knife.config
+            Chef::Config[:knife][:max_wait] = 9999
+            Chef::Config[:knife][:winrm_user] = "winbob"
+            Chef::Config[:knife][:winrm_port] = 9999
+            Chef::Config[:knife][:ca_trust_file] = "trust.me"
+            Chef::Config[:knife][:kerberos_realm] = "realm"
+            Chef::Config[:knife][:kerberos_service] = "service"
+            Chef::Config[:knife][:winrm_auth_method] = "kerberos" # default is negotiate
+            Chef::Config[:knife][:winrm_basic_auth_only] = true
+            Chef::Config[:knife][:winrm_no_verify_cert] = true
+            Chef::Config[:knife][:session_timeout] = 9999
+            Chef::Config[:knife][:winrm_ssl] = true
+            Chef::Config[:knife][:winrm_ssl_peer_fingerprint] = "ABCDEF"
+          end
+
+          context "and unsupported Chef::Config options are given in Chef::Config, not in CLI" do
+            before do
+              Chef::Config[:knife][:connection_password] = "blah"
+              Chef::Config[:knife][:winrm_password] = "blah"
+            end
+            it "does not include the corresponding option in the connection options" do
+              expect(knife.connection_opts.key?(:password)).to eq false
+            end
+          end
+
+          context "and no CLI options have been given" do
+            before do
+              knife.config = {}
+            end
+            let(:expected_result) do
+              {
+                logger: Chef::Log, # not configurable
+                ca_trust_file: "trust.me",
+                max_wait_until_ready: 9999,
+                operation_timeout: 9999,
+                ssl_peer_fingerprint: "ABCDEF",
+                winrm_transport: "kerberos",
+                winrm_basic_auth_only: true,
+                user: "winbob",
+                port: 9999,
+                self_signed: true,
+                ssl: true,
+                kerberos_realm: "realm",
+                kerberos_service: "service",
+              }
+            end
+
+            it "generates a config hash using the Chef::Config values" do
+              expect(knife.connection_opts).to match expected_result
+            end
+
+          end
+
+          context "and some CLI options have been given" do
+            let(:expected_result) do
+              {
+                logger: Chef::Log, # not configurable
+                ca_trust_file: "no trust",
+                max_wait_until_ready: 9999,
+                operation_timeout: 60,
+                ssl_peer_fingerprint: "ABCDEF",
+                winrm_transport: "kerberos",
+                winrm_basic_auth_only: true,
+                user: "microsoftbob",
+                port: 12,
+                self_signed: true,
+                ssl: true,
+                kerberos_realm: "realm",
+                kerberos_service: "service",
+                password: "lobster",
+              }
+            end
+
+            before do
+              knife.config[:ca_trust_file] = "no trust"
+              knife.config[:connection_user] = "microsoftbob"
+              knife.config[:connection_port] = 12
+              knife.config[:winrm_port] = "13" # indirectly verify we're not looking for the wrong CLI flag
+              knife.config[:connection_password] = "lobster"
+            end
+
+            it "generates a config hash using the CLI options when available and falling back to Chef::Config values" do
+              expect(knife.connection_opts).to match expected_result
+            end
+          end
+
+          context "and all CLI options have been given" do
+            before do
+              # We'll force kerberos vi knife.config because it
+              # causes additional options to populate - make sure
+              # Chef::Config is different so we can be sure that we didn't
+              # pull in the Chef::Config value
+              Chef::Config[:knife][:winrm_auth_method] = "negotiate"
+              knife.config[:connection_password] = "blue"
+              knife.config[:max_wait] = 1000
+              knife.config[:connection_user] = "clippy"
+              knife.config[:connection_port] = 1000
+              knife.config[:winrm_port] = 1001 # We should not see this value get used
+
+              knife.config[:ca_trust_file] = "trust.the.internet"
+              knife.config[:kerberos_realm] = "otherrealm"
+              knife.config[:kerberos_service] = "otherservice"
+              knife.config[:winrm_auth_method] = "kerberos" # default is negotiate
+              knife.config[:winrm_basic_auth_only] = false
+              knife.config[:winrm_no_verify_cert] = false
+              knife.config[:session_timeout] = 1000
+              knife.config[:winrm_ssl] = false
+              knife.config[:winrm_ssl_peer_fingerprint] = "FEDCBA"
+            end
+            let(:expected_result) do
+              {
+                logger: Chef::Log, # not configurable
+                ca_trust_file: "trust.the.internet",
+                max_wait_until_ready: 1000,
+                operation_timeout: 1000,
+                ssl_peer_fingerprint: "FEDCBA",
+                winrm_transport: "kerberos",
+                winrm_basic_auth_only: false,
+                user: "clippy",
+                port: 1000,
+                self_signed: false,
+                ssl: false,
+                kerberos_realm: "otherrealm",
+                kerberos_service: "otherservice",
+                password: "blue",
+              }
+            end
+            it "generates a config hash using the CLI options and pulling nothing from Chef::Config" do
+              expect(knife.connection_opts).to match expected_result
+            end
+          end
+        end # with underlying Chef::Config values
+
+        context "and no values are provided from Chef::Config or CLI" do
+          before do
+            # We will use knife's actual config since these tests
+            # have assumptions based on CLI default values
+            knife.merge_configs
+          end
+          let(:expected_result) do
+            {
+              logger: Chef::Log,
+              operation_timeout: 60,
+              self_signed: false,
+              ssl: false,
+              ssl_peer_fingerprint: nil,
+              winrm_basic_auth_only: false,
+              winrm_transport: "negotiate",
+            }
+          end
+          it "populates appropriate defaults" do
+            expect(knife.connection_opts).to match expected_result
+          end
+        end
+      end # winrm
+
+      context "when protocol is ssh" do
+        let(:connection_protocol) { "ssh" }
+        # context "and neither CLI nor Chef::Config config entries have been provided"
+        # end
+        context "and all supported values are provided as Chef::Config entries" do
+          before do
+            # Set everything to easily identifiable and obviously fake values
+            # to verify that Chef::Config is being sourced instead of knife.config
+            Chef::Config[:knife][:max_wait] = 9999
+            Chef::Config[:knife][:session_timeout] = 9999
+            Chef::Config[:knife][:ssh_user] = "sshbob"
+            Chef::Config[:knife][:ssh_port] = 9999
+            Chef::Config[:knife][:host_key_verify] = false
+            Chef::Config[:knife][:ssh_gateway_identity] = "/gateway.pem"
+            Chef::Config[:knife][:ssh_gateway] = "admin@mygateway.local:1234"
+            Chef::Config[:knife][:ssh_identity_file] = "/identity.pem"
+            Chef::Config[:knife][:use_sudo_password] = false # We have no password.
+          end
+
+          context "and no CLI options have been given" do
+            before do
+              knife.config = {}
+            end
+            let(:expected_result) do
+              {
+                logger: Chef::Log, # not configurable
+                max_wait_until_ready: 9999,
+                connection_timeout: 9999,
+                user: "sshbob",
+                bastion_host: "mygateway.local",
+                bastion_port: 1234,
+                bastion_user: "admin",
+                forward_agent: false,
+                keys_only: true,
+                key_files: ["/identity.pem", "/gateway.pem"],
+                sudo: false,
+                verify_host_key: false,
+                port: 9999,
+                non_interactive: true,
+              }
+            end
+
+            it "generates a correct config hash using the Chef::Config values" do
+              expect(knife.connection_opts).to match expected_result
+            end
+          end
+
+          context "and unsupported Chef::Config options are given in Chef::Config, not in CLI" do
+            before do
+              Chef::Config[:knife][:password] = "blah"
+              Chef::Config[:knife][:ssh_password] = "blah"
+              Chef::Config[:knife][:preserve_home] = true
+              Chef::Config[:knife][:use_sudo] = true
+              Chef::Config[:knife][:ssh_forward_agent] = "blah"
+            end
+            it "does not include the corresponding option in the connection options" do
+              expect(knife.connection_opts.key?(:password)).to eq false
+              expect(knife.connection_opts.key?(:ssh_forward_agent)).to eq false
+              expect(knife.connection_opts.key?(:use_sudo)).to eq false
+              expect(knife.connection_opts.key?(:preserve_home)).to eq false
+            end
+          end
+
+          context "and some CLI options have been given" do
+            before do
+              knife.config[:connection_user] = "sshalice"
+              knife.config[:connection_port] = 12
+              knife.config[:ssh_port] = "13" # canary to indirectly verify we're not looking for the wrong CLI flag
+              knife.config[:connection_password] = "feta cheese"
+              knife.config[:max_wait] = 150
+              knife.config[:session_timeout] = 120
+              knife.config[:use_sudo] = true
+              knife.config[:use_sudo_pasword] = true
+              knife.config[:ssh_forward_agent] = true
+            end
+
+            let(:expected_result) do
+              {
+                logger: Chef::Log, # not configurable
+                max_wait_until_ready: 150, # cli
+                connection_timeout: 120, # cli
+                user: "sshalice", # cli
+                password: "feta cheese", # cli
+                bastion_host: "mygateway.local", # Config
+                bastion_port: 1234,              # Config
+                bastion_user: "admin",           # Config
+                forward_agent: true, # cli
+                keys_only: false, # implied false from config password present
+                key_files: ["/identity.pem", "/gateway.pem"], # Config
+                sudo: true, # ccli
+                verify_host_key: false, # Config
+                port: 12, # cli
+                non_interactive: true,
+              }
+            end
+
+            it "generates a config hash using the CLI options when available and falling back to Chef::Config values" do
+              expect(knife.connection_opts).to match expected_result
+            end
+          end
+
+          context "and all CLI options have been given" do
+            before do
+              knife.config[:max_wait] = 150
+              knife.config[:session_timeout] = 120
+              knife.config[:connection_user] = "sshroot"
+              knife.config[:connection_port] = 1000
+              knife.config[:connection_password] = "blah"
+              knife.config[:forward_agent] = true
+              knife.config[:use_sudo] = true
+              knife.config[:use_sudo_password] = true
+              knife.config[:preserve_home] = true
+              knife.config[:use_sudo_pasword] = true
+              knife.config[:ssh_forward_agent] = true
+              knife.config[:ssh_verify_host_key] = true
+              knife.config[:ssh_gateway_identity] = "/gateway-identity.pem"
+              knife.config[:ssh_gateway] = "me@example.com:10"
+              knife.config[:ssh_identity_file] = "/my-identity.pem"
+
+              # We'll set these as canaries - if one of these values shows up
+              # in a failed test, then the behavior of not pulling from these keys
+              # out of knife.config is broken:
+              knife.config[:ssh_user] = "do not use"
+              knife.config[:ssh_port] = 1001
+            end
+            let(:expected_result) do
+              {
+                logger: Chef::Log, # not configurable
+                max_wait_until_ready: 150,
+                connection_timeout: 120,
+                user: "sshroot",
+                password: "blah",
+                port: 1000,
+                bastion_host: "example.com",
+                bastion_port: 10,
+                bastion_user: "me",
+                forward_agent: true,
+                keys_only: false,
+                key_files: ["/my-identity.pem", "/gateway-identity.pem"],
+                sudo: true,
+                sudo_options: "-H",
+                sudo_password: "blah",
+                verify_host_key: true,
+                non_interactive: true,
+              }
+            end
+            it "generates a config hash using the CLI options and pulling nothing from Chef::Config" do
+              expect(knife.connection_opts).to match expected_result
+            end
+          end
+        end
+        context "and no values are provided from Chef::Config or CLI" do
+          before do
+            # We will use knife's actual config since these tests
+            # have assumptions based on CLI default values
+            knife.merge_configs
+          end
+
+          let(:expected_result) do
+            {
+              forward_agent: false,
+              key_files: [],
+              logger: Chef::Log,
+              keys_only: false,
+              sudo: false,
+              verify_host_key: "always",
+              non_interactive: true,
+              connection_timeout: 60,
+            }
+          end
+          it "populates appropriate defaults" do
+            expect(knife.connection_opts).to match expected_result
+          end
+        end
+
+      end # ssh
+    end # functional tests
+
+  end # connection_opts
+
+  context "#base_opts" do
+    let(:connection_protocol) { nil }
+
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+
+    context "when determining knife config keys for user and port" do
+      let(:connection_protocol) { "fake" }
+      it "uses the protocol name to resolve the knife config keys" do
+        allow(knife).to receive(:config_value).with(:max_wait)
+
+        expect(knife).to receive(:config_value).with(:connection_port, :fake_port)
+        expect(knife).to receive(:config_value).with(:connection_user, :fake_user)
+        knife.base_opts
       end
+    end
 
-      context "when bootstrap version not given" do
-        it "passes the validation" do
-          knife.config[:bootstrap_version] = nil
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+    context "for all protocols" do
+      context "when password is provided" do
+        before do
+          knife.config[:connection_port] = 250
+          knife.config[:connection_user] = "test"
+          knife.config[:connection_password] = "opscode"
+        end
+
+        let(:expected_opts) do
+          {
+            port: 250,
+            user: "test",
+            logger: Chef::Log,
+            password: "opscode",
+          }
         end
+        it "generates the correct options" do
+          expect(knife.base_opts).to eq expected_opts
+        end
+
       end
 
-      context "when bootstrap version is given" do
-        it "passes the validation for chef 14.12.0 bootstrap version" do
-          knife.config[:bootstrap_version] = "14.12.0"
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+      context "when password is not provided" do
+        before do
+          knife.config[:connection_port] = 250
+          knife.config[:connection_user] = "test"
         end
 
-        it "passes the validation for chef 13.12.0 bootstrap version" do
-          knife.config[:bootstrap_version] = "13.12.0"
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+        let(:expected_opts) do
+          {
+            port: 250,
+            user: "test",
+            logger: Chef::Log,
+          }
         end
+        it "generates the correct options" do
+          expect(knife.base_opts).to eq expected_opts
+        end
+      end
+    end
+  end
+
+  context "#host_verify_opts" do
+    let(:connection_protocol) { nil }
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
 
-        it "raise an error for latest bootstrap version" do
-          knife.config[:bootstrap_version] = "latest"
-          expect { knife.validate_bootstrap_version_options! }.to raise_error(SystemExit)
+    context "for winrm" do
+      let(:connection_protocol) { "winrm" }
+      it "returns the expected configuration" do
+        knife.config[:winrm_no_verify_cert] = true
+        expect(knife.host_verify_opts).to eq( { self_signed: true } )
+      end
+      it "provides a correct default when no option given" do
+        expect(knife.host_verify_opts).to eq( { self_signed: false } )
+      end
+    end
+
+    context "for ssh" do
+      let(:connection_protocol) { "ssh" }
+      it "returns the expected configuration" do
+        knife.config[:ssh_verify_host_key] = false
+        expect(knife.host_verify_opts).to eq( { verify_host_key: false } )
+      end
+      it "provides a correct default when no option given" do
+        expect(knife.host_verify_opts).to eq( { verify_host_key: "always" } )
+      end
+    end
+  end
+
+  # TODO - test keys_only, password, config source behavior
+  context "#ssh_identity_opts" do
+    let(:connection_protocol) { nil }
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+
+    context "for winrm" do
+      let(:connection_protocol) { "winrm" }
+      it "returns an empty hash" do
+        expect(knife.ssh_identity_opts).to eq({})
+      end
+    end
+
+    context "for ssh" do
+      let(:connection_protocol) { "ssh" }
+      context "when an identity file is specified" do
+        before do
+          knife.config[:ssh_identity_file] = "/identity.pem"
+        end
+        it "generates the expected configuration" do
+          expect(knife.ssh_identity_opts).to eq({
+            key_files: [ "/identity.pem" ],
+            keys_only: true,
+          })
+        end
+        context "and a password is also specified" do
+          before do
+            knife.config[:connection_password] = "blah"
+          end
+          it "generates the expected configuration (key, keys_only false)" do
+            expect(knife.ssh_identity_opts).to eq({
+              key_files: [ "/identity.pem" ],
+              keys_only: false,
+            })
+          end
         end
 
-        it "raise an error for chef 15.0+ bootstrap version" do
-          knife.config[:bootstrap_version] = "15.0.1"
-          expect { knife.validate_bootstrap_version_options! }.to raise_error(SystemExit)
+        context "and a gateway is not specified" do
+          context "but a gateway identity file is specified" do
+            it "does not include the gateway identity file in keys" do
+              expect(knife.ssh_identity_opts).to eq({
+                key_files: ["/identity.pem"],
+                keys_only: true,
+              })
+            end
+
+          end
+
         end
 
-        it "raise an error for chef 15.1+ bootstrap version" do
-          knife.config[:bootstrap_version] = "15.1"
-          expect { knife.validate_bootstrap_version_options! }.to raise_error(SystemExit)
+        context "and a gatway is specified" do
+          before do
+            knife.config[:ssh_gateway] = "example.com"
+          end
+          context "and a gateway identity file is not specified" do
+            it "config includes only identity file and not gateway identity" do
+              expect(knife.ssh_identity_opts).to eq({
+                key_files: [ "/identity.pem" ],
+                keys_only: true,
+              })
+            end
+          end
+
+          context "and a gateway identity file is also specified" do
+            before do
+              knife.config[:ssh_gateway_identity] = "/gateway.pem"
+            end
+
+            it "generates the expected configuration (both keys, keys_only true)" do
+              expect(knife.ssh_identity_opts).to eq({
+                key_files: [ "/identity.pem", "/gateway.pem" ],
+                keys_only: true,
+              })
+            end
+          end
         end
       end
 
-      context "when prerelease option is given" do
-        it "raise an error" do
-          knife.config[:prerelease] = true
-          expect { knife.validate_bootstrap_version_options! }.to raise_error(SystemExit)
+      context "when no identity file is specified" do
+        it "generates the expected configuration (no keys, keys_only false)" do
+          expect(knife.ssh_identity_opts).to eq( {
+            key_files: [ ],
+            keys_only: false,
+          })
+        end
+        context "and a gateway with gateway identity file is specified" do
+          before do
+            knife.config[:ssh_gateway] = "host"
+            knife.config[:ssh_gateway_identity] = "/gateway.pem"
+          end
+
+          it "generates the expected configuration (gateway key, keys_only false)" do
+            expect(knife.ssh_identity_opts).to eq({
+              key_files: [ "/gateway.pem" ],
+              keys_only: false,
+            })
+          end
         end
       end
     end
+  end
 
-    describe "chef-15+" do
-      before do
-        stub_const("Chef::VERSION", "15.0")
+  context "#gateway_opts" do
+    let(:connection_protocol) { nil }
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+
+    context "for winrm" do
+      let(:connection_protocol) { "winrm" }
+      it "returns an empty hash" do
+        expect(knife.gateway_opts).to eq({})
       end
+    end
 
-      context "when bootstrap version not given" do
-        it "passes the validation" do
-          knife.config[:bootstrap_version] = nil
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+    context "for ssh" do
+      let(:connection_protocol) { "ssh" }
+      context "and ssh_gateway with hostname, user and port provided" do
+        before do
+          knife.config[:ssh_gateway] = "testuser@gateway:9021"
+        end
+        it "returns a proper bastion host config subset" do
+          expect(knife.gateway_opts).to eq({
+            bastion_user: "testuser",
+            bastion_host: "gateway",
+            bastion_port: 9021,
+          })
+        end
+      end
+      context "and ssh_gateway with only hostname is given" do
+        before do
+          knife.config[:ssh_gateway] = "gateway"
+        end
+        it "returns a proper bastion host config subset" do
+          expect(knife.gateway_opts).to eq({
+            bastion_user: nil,
+            bastion_host: "gateway",
+            bastion_port: nil,
+          })
         end
       end
+      context "and ssh_gateway with hostname and user is is given" do
+        before do
+          knife.config[:ssh_gateway] = "testuser@gateway"
+        end
+        it "returns a proper bastion host config subset" do
+          expect(knife.gateway_opts).to eq({
+            bastion_user: "testuser",
+            bastion_host: "gateway",
+            bastion_port: nil,
+          })
+        end
+      end
+
+      context "and ssh_gateway with hostname and port is is given" do
+        before do
+          knife.config[:ssh_gateway] = "gateway:11234"
+        end
+        it "returns a proper bastion host config subset" do
+          expect(knife.gateway_opts).to eq({
+            bastion_user: nil,
+            bastion_host: "gateway",
+            bastion_port: 11234,
+          })
+        end
+      end
+
+      context "and ssh_gateway is not provided" do
+        it "returns an empty hash" do
+          expect(knife.gateway_opts).to eq({})
+        end
+      end
+    end
+  end
+
+  context "#sudo_opts" do
+    let(:connection_protocol) { nil }
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+
+    context "for winrm" do
+      let(:connection_protocol) { "winrm" }
+      it "returns an empty hash" do
+        expect(knife.sudo_opts).to eq({})
+      end
+    end
+
+    context "for ssh" do
+      let(:connection_protocol) { "ssh" }
+      context "when use_sudo is set" do
+        before do
+          knife.config[:use_sudo] = true
+        end
+
+        it "returns a config that enables sudo" do
+          expect(knife.sudo_opts).to eq( { sudo: true } )
+        end
+
+        context "when use_sudo_password is also set" do
+          before do
+            knife.config[:use_sudo_password] = true
+            knife.config[:connection_password] = "opscode"
+          end
+          it "includes :connection_password value in a sudo-enabled configuration" do
+            expect(knife.sudo_opts).to eq({
+              sudo: true,
+              sudo_password: "opscode",
+            })
+          end
+        end
 
-      context "when bootstrap version is given" do
-        it "passes the validation for chef 14.12.0 bootstrap version" do
-          knife.config[:bootstrap_version] = "14.12.0"
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+        context "when preserve_home is set" do
+          before do
+            knife.config[:preserve_home] = true
+          end
+          it "enables sudo with sudo_option to preserve home" do
+            expect(knife.sudo_opts).to eq({
+              sudo_options: "-H",
+              sudo: true,
+            })
+          end
         end
+      end
 
-        it "passes the validation for chef 15.2 bootstrap version" do
-          knife.config[:bootstrap_version] = "15.2"
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+      context "when use_sudo is not set" do
+        before do
+          knife.config[:use_sudo_password] = true
+          knife.config[:preserve_home] = true
         end
+        it "returns configuration for sudo off, ignoring other related options" do
+          expect(knife.sudo_opts).to eq( { sudo: false } )
+        end
+      end
+    end
+  end
+
+  context "#ssh_opts" do
+    let(:connection_protocol) { nil }
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
 
-        it "passes the validation for chef 16.2 bootstrap version" do
-          knife.config[:bootstrap_version] = "16.2"
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+    context "for ssh" do
+      let(:connection_protocol) { "ssh" }
+      context "when ssh_forward_agent has a value" do
+        before do
+          knife.config[:ssh_forward_agent] = true
+        end
+        it "returns a configuration hash with forward_agent set to true. non-interactive is always true" do
+          expect(knife.ssh_opts).to eq({ forward_agent: true, non_interactive: true, connection_timeout: 60 })
+        end
+      end
+      context "when ssh_forward_agent is not set" do
+        it "returns a configuration hash with forward_agent set to false. non-interactive is always true" do
+          expect(knife.ssh_opts).to eq({ forward_agent: false, non_interactive: true, connection_timeout: 60 })
+        end
+      end
+      context "when session_timeout has a value" do
+        before do
+          knife.config[:session_timeout] = 120
+        end
+        it "returns a configuration hash with connection_timeout value." do
+          expect(knife.ssh_opts).to eq({ forward_agent: false, non_interactive: true, connection_timeout: 120 })
         end
       end
 
-      context "when prerelease option is given" do
-        it "passes the validation" do
-          knife.config[:prerelease] = true
-          expect { knife.validate_bootstrap_version_options! }.to_not raise_error
+      context "when session_timeout is not set" do
+        it "returns a configuration hash with connection_timeout default value." do
+          expect(knife.ssh_opts).to eq({ forward_agent: false, non_interactive: true, connection_timeout: 60 })
         end
       end
     end
+
+    context "for winrm" do
+      let(:connection_protocol) { "winrm" }
+      it "returns an empty has because ssh is not winrm" do
+        expect(knife.ssh_opts).to eq({})
+      end
+    end
+
   end
 
-  describe "when configuring the underlying knife ssh command" do
-    context "from the command line" do
-      let(:knife_ssh) do
-        knife.name_args = ["foo.example.com"]
-        knife.config[:ssh_user]      = "rooty"
-        knife.config[:ssh_port]      = "4001"
-        knife.config[:ssh_password]  = "open_sesame"
-        Chef::Config[:knife][:ssh_user] = nil
-        Chef::Config[:knife][:ssh_port] = nil
-        knife.config[:forward_agent] = true
-        knife.config[:ssh_identity_file] = "~/.ssh/me.rsa"
-        allow(knife).to receive(:render_template).and_return("")
-        knife.knife_ssh
+  context "#winrm_opts" do
+    let(:connection_protocol) { nil }
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+
+    context "for winrm" do
+      let(:connection_protocol) { "winrm" }
+      let(:expected) do
+        {
+        winrm_transport: "negotiate",
+        winrm_basic_auth_only: false,
+        ssl: false,
+        ssl_peer_fingerprint: nil,
+        operation_timeout: 60,
+      } end
+
+      it "generates a correct configuration hash with expected defaults" do
+        expect(knife.winrm_opts).to eq expected
       end
 
-      it "configures the hostname" do
-        expect(knife_ssh.name_args.first).to eq("foo.example.com")
+      context "with ssl_peer_fingerprint" do
+        let(:ssl_peer_fingerprint_expected) do
+          expected.merge({ ssl_peer_fingerprint: "ABCD" })
+        end
+
+        before do
+          knife.config[:winrm_ssl_peer_fingerprint] = "ABCD"
+        end
+
+        it "generates a correct options hash with ssl_peer_fingerprint from the config provided" do
+          expect(knife.winrm_opts).to eq ssl_peer_fingerprint_expected
+        end
       end
 
-      it "configures the ssh user" do
-        expect(knife_ssh.config[:ssh_user]).to eq("rooty")
+      context "with winrm_ssl" do
+        let(:ssl_expected) do
+          expected.merge({ ssl: true })
+        end
+        before do
+          knife.config[:winrm_ssl] = true
+        end
+
+        it "generates a correct options hash with ssl from the config provided" do
+          expect(knife.winrm_opts).to eq ssl_expected
+        end
       end
 
-      it "configures the ssh password" do
-        expect(knife_ssh.config[:ssh_password]).to eq("open_sesame")
+      context "with winrm_auth_method" do
+        let(:winrm_auth_method_expected) do
+          expected.merge({ winrm_transport: "freeaccess" })
+        end
+
+        before do
+          knife.config[:winrm_auth_method] = "freeaccess"
+        end
+
+        it "generates a correct options hash with winrm_transport from the config provided" do
+          expect(knife.winrm_opts).to eq winrm_auth_method_expected
+        end
       end
 
-      it "configures the ssh port" do
-        expect(knife_ssh.config[:ssh_port]).to eq("4001")
+      context "with ca_trust_file" do
+        let(:ca_trust_expected) do
+          expected.merge({ ca_trust_file: "/trust.me" })
+        end
+        before do
+          knife.config[:ca_trust_file] = "/trust.me"
+        end
+
+        it "generates a correct options hash with ca_trust_file from the config provided" do
+          expect(knife.winrm_opts).to eq ca_trust_expected
+        end
       end
 
-      it "configures the ssh agent forwarding" do
-        expect(knife_ssh.config[:forward_agent]).to eq(true)
+      context "with kerberos auth" do
+        let(:kerberos_expected) do
+          expected.merge({
+            kerberos_service: "testsvc",
+            kerberos_realm: "TESTREALM",
+            winrm_transport: "kerberos",
+          })
+        end
+
+        before do
+          knife.config[:winrm_auth_method] = "kerberos"
+          knife.config[:kerberos_service] = "testsvc"
+          knife.config[:kerberos_realm] = "TESTREALM"
+        end
+
+        it "generates a correct options hash containing kerberos auth configuration from the config provided" do
+          expect(knife.winrm_opts).to eq kerberos_expected
+        end
       end
 
-      it "configures the ssh identity file" do
-        expect(knife_ssh.config[:ssh_identity_file]).to eq("~/.ssh/me.rsa")
+      context "with winrm_basic_auth_only" do
+        before do
+          knife.config[:winrm_basic_auth_only] = true
+        end
+        let(:basic_auth_expected) do
+          expected.merge( { winrm_basic_auth_only: true } )
+        end
+        it "generates a correct options hash containing winrm_basic_auth_only from the config provided" do
+          expect(knife.winrm_opts).to eq basic_auth_expected
+        end
       end
     end
 
-    context "validating use_sudo_password" do
-      before do
-        knife.config[:ssh_password] = "password"
-        allow(knife).to receive(:render_template).and_return("")
+    context "for ssh" do
+      let(:connection_protocol) { "ssh" }
+      it "returns an empty hash because ssh is not winrm" do
+        expect(knife.winrm_opts).to eq({})
       end
+    end
+  end
+  describe "#run" do
+    before do
+      allow(knife.client_builder).to receive(:client_path).and_return("/key.pem")
+    end
 
-      it "use_sudo_password contains description and long params for help" do
-        expect(knife.options).to(have_key(:use_sudo_password)) \
-          && expect(knife.options[:use_sudo_password][:description].to_s).not_to(eq(""))\
-          && expect(knife.options[:use_sudo_password][:long].to_s).not_to(eq(""))
+    it "performs the steps we expect to run a bootstrap" do
+      expect(knife).to receive(:check_license)
+      expect(knife).to receive(:verify_deprecated_flags!).ordered
+      expect(knife).to receive(:validate_name_args!).ordered
+      expect(knife).to receive(:validate_protocol!).ordered
+      expect(knife).to receive(:validate_first_boot_attributes!).ordered
+      expect(knife).to receive(:validate_winrm_transport_opts!).ordered
+      expect(knife).to receive(:validate_policy_options!).ordered
+      expect(knife).to receive(:winrm_warn_no_ssl_verification).ordered
+      expect(knife).to receive(:warn_on_short_session_timeout).ordered
+      expect(knife).to receive(:register_client).ordered
+      expect(knife).to receive(:connect!).ordered
+      expect(knife).to receive(:render_template).and_return "content"
+      expect(knife).to receive(:upload_bootstrap).with("content").and_return "/remote/path.sh"
+      expect(knife).to receive(:perform_bootstrap).with("/remote/path.sh")
+      expect(connection).to receive(:del_file!) # Make sure cleanup happens
+
+      knife.run
+
+      # Post-run verify expected state changes (not many directly in #run)
+      expect(knife.bootstrap_context.client_pem).to eq "/key.pem"
+      expect($stdout.sync).to eq true
+    end
+  end
+
+  describe "#verify_deprecated_flags!" do
+    before do
+      Chef::Config[:silence_deprecation_warnings] = false
+    end
+
+    context "when a deprecated CLI flag is given on the CLI" do
+      let(:bootstrap_cli_options) { %w{--ssh-user sshuser} }
+      it "maps the key value to the new key and points the human to the new flag" do
+        expect(knife.ui).to receive(:warn).with(/You provided --ssh-user. This flag is deprecated. Please use '--connection-user USERNAME' instead./)
+        knife.verify_deprecated_flags!
+        expect(knife.config[:connection_user]).to eq "sshuser"
       end
+    end
 
-      it "uses the password from --ssh-password for sudo when --use-sudo-password is set" do
-        knife.config[:use_sudo] = true
-        knife.config[:use_sudo_password] = true
-        expect(knife.ssh_command).to include("echo \'#{knife.config[:ssh_password]}\' | sudo -S")
+    context "when a deprecated CLI flag is given on the CLI, along with its replacement" do
+      let(:bootstrap_cli_options) { %w{--connection-user a --ssh-user b} }
+
+      it "informs the human that both are provided and exits" do
+        expect(knife.ui).to receive(:error).with(/You provided both --connection-user and --ssh-user.*Please use.*/m)
+        expect { knife.verify_deprecated_flags! }.to raise_error SystemExit
       end
+    end
 
-      it "should not honor --use-sudo-password when --use-sudo is not set" do
-        knife.config[:use_sudo] = false
-        knife.config[:use_sudo_password] = true
-        expect(knife.ssh_command).not_to include("echo #{knife.config[:ssh_password]} | sudo -S")
+    context "when a deprecated boolean CLI flag is given on the CLI, and its non-boolean replacement is used" do
+      let(:bootstrap_cli_options) { %w{--prerelease} }
+      it "correctly maps the old boolean value to the new value" do
+        expect(knife.ui).to receive(:warn)
+        knife.verify_deprecated_flags!
+        expect(knife.config[:channel]).to eq "current"
       end
     end
+  end
 
-    context "from the knife config file" do
-      let(:knife_ssh) do
-        knife.name_args = ["config.example.com"]
-        Chef::Config[:knife][:ssh_user] = "curiosity"
-        Chef::Config[:knife][:ssh_port] = "2430"
-        Chef::Config[:knife][:forward_agent] = true
-        Chef::Config[:knife][:ssh_identity_file] = "~/.ssh/you.rsa"
-        Chef::Config[:knife][:ssh_gateway] = "towel.blinkenlights.nl"
-        Chef::Config[:knife][:ssh_gateway_identity] = "~/.ssh/gateway.rsa"
-        Chef::Config[:knife][:host_key_verify] = true
-        allow(knife).to receive(:render_template).and_return("")
-        knife.config = {}
-        knife.merge_configs
-        knife.knife_ssh
+  describe "#register_client" do
+    let(:vault_handler_mock) { double("ChefVaultHandler") }
+    let(:client_builder_mock) { double("ClientBuilder") }
+    let(:node_name) { nil }
+    before do
+      allow(knife).to receive(:chef_vault_handler).and_return vault_handler_mock
+      allow(knife).to receive(:client_builder).and_return client_builder_mock
+      knife.config[:chef_node_name] = node_name
+    end
+
+    shared_examples_for "creating the client locally" do
+      context "when a valid node name is present" do
+        let(:node_name) { "test" }
+        before do
+          allow(client_builder_mock).to receive(:client).and_return "client"
+        end
+
+        it "runs client_builder and vault_handler" do
+          expect(client_builder_mock).to receive(:run)
+          expect(vault_handler_mock).to receive(:run).with("client")
+          knife.register_client
+        end
       end
 
-      it "configures the ssh user" do
-        expect(knife_ssh.config[:ssh_user]).to eq("curiosity")
+      context "when no valid node name is present" do
+        let(:node_name) { nil }
+        it "shows an error and exits" do
+          expect(knife.ui).to receive(:error)
+          expect { knife.register_client }.to raise_error(SystemExit)
+        end
+      end
+    end
+    context "when chef_vault_handler says we're using vault" do
+      let(:vault_handler_mock) { double("ChefVaultHandler") }
+      before do
+        allow(vault_handler_mock).to receive(:doing_chef_vault?).and_return true
       end
+      it_behaves_like "creating the client locally"
+    end
 
-      it "configures the ssh port" do
-        expect(knife_ssh.config[:ssh_port]).to eq("2430")
+    context "when an non-existant validation key is specified in chef config" do
+      before do
+        Chef::Config[:validation_key] = "/blah"
+        allow(vault_handler_mock).to receive(:doing_chef_vault?).and_return false
+        allow(File).to receive(:exist?).with(/\/blah/).and_return false
       end
+      it_behaves_like "creating the client locally"
+    end
 
-      it "configures the ssh agent forwarding" do
-        expect(knife_ssh.config[:forward_agent]).to eq(true)
+    context "when a valid validation key is given and we're doing old-style client creation" do
+      before do
+        Chef::Config[:validation_key] = "/blah"
+        allow(File).to receive(:exist?).with(/\/blah/).and_return true
+        allow(vault_handler_mock).to receive(:doing_chef_vault?).and_return false
       end
 
-      it "configures the ssh identity file" do
-        expect(knife_ssh.config[:ssh_identity_file]).to eq("~/.ssh/you.rsa")
+      it "shows a message" do
+        expect(knife.ui).to receive(:info)
+        knife.register_client
       end
+    end
+  end
+
+  describe "#perform_bootstrap" do
+    let(:exit_status) { 0 }
+    let(:result_mock) { double("result", exit_status: exit_status, stderr: "A message") }
 
-      it "configures the ssh gateway" do
-        expect(knife_ssh.config[:ssh_gateway]).to eq("towel.blinkenlights.nl")
+    before do
+      allow(connection).to receive(:hostname).and_return "testhost"
+    end
+    it "runs the remote script and logs the output" do
+      expect(knife.ui).to receive(:info).with(/Bootstrapping.*/)
+      expect(knife).to receive(:bootstrap_command)
+        .with("/path.sh")
+        .and_return("sh /path.sh")
+      expect(connection)
+        .to receive(:run_command)
+        .with("sh /path.sh")
+        .and_yield("output here")
+        .and_return result_mock
+
+      expect(knife.ui).to receive(:msg).with(/testhost/)
+      knife.perform_bootstrap("/path.sh")
+    end
+    context "when the remote command fails" do
+      let(:exit_status) { 1 }
+      it "shows an error and exits" do
+        expect(knife.ui).to receive(:info).with(/Bootstrapping.*/)
+        expect(knife).to receive(:bootstrap_command)
+          .with("/path.sh")
+          .and_return("sh /path.sh")
+        expect(connection).to receive(:run_command).with("sh /path.sh").and_return result_mock
+        expect { knife.perform_bootstrap("/path.sh") }.to raise_error(SystemExit)
       end
+    end
+  end
 
-      it "configures the ssh gateway identity" do
-        expect(knife_ssh.config[:ssh_gateway_identity]).to eq("~/.ssh/gateway.rsa")
+  describe "#connect!" do
+    context "in the normal case" do
+      it "connects using the connection_opts and notifies the operator of progress" do
+        expect(knife.ui).to receive(:info).with(/Connecting to.*/)
+        expect(knife).to receive(:connection_opts).and_return( { opts: "here" })
+        expect(knife).to receive(:do_connect).with( { opts: "here" } )
+        knife.connect!
       end
+    end
 
-      it "configures the host key verify mode" do
-        expect(knife_ssh.config[:host_key_verify]).to eq(true)
+    context "when a non-auth-failure occurs" do
+      let(:expected_error) { RuntimeError.new }
+      before do
+        allow(knife).to receive(:do_connect).and_raise(expected_error)
+      end
+      it "re-raises the exception" do
+        expect { knife.connect! }.to raise_error(expected_error)
       end
     end
 
-    describe "when falling back to password auth when host key auth fails" do
-      let(:knife_ssh_with_password_auth) do
-        knife.name_args = ["foo.example.com"]
-        knife.config[:ssh_user] = "rooty"
-        knife.config[:ssh_identity_file] = "~/.ssh/me.rsa"
-        allow(knife).to receive(:render_template).and_return("")
-        k = knife.knife_ssh
-        allow(k).to receive(:get_password).and_return("typed_in_password")
-        allow(knife).to receive(:knife_ssh).and_return(k)
-        knife.knife_ssh_with_password_auth
+    context "when an auth failure occurs" do
+      let(:expected_error) do
+        e = Train::Error.new
+        actual = Net::SSH::AuthenticationFailed.new
+        # Simulate train's nested error - they wrap
+        # ssh/network errors in a TrainError.
+        allow(e).to receive(:cause).and_return(actual)
+        e
       end
 
-      it "prompts the user for a password " do
-        expect(knife_ssh_with_password_auth.config[:ssh_password]).to eq("typed_in_password")
+      before do
+        require "net/ssh"
       end
 
-      it "configures knife not to use the identity file that didn't work previously" do
-        expect(knife_ssh_with_password_auth.config[:ssh_identity_file]).to be_nil
+      context "and password auth was used" do
+        before do
+          allow(connection).to receive(:password_auth?).and_return true
+        end
+
+        it "re-raises the error so as not to resubmit the same failing password" do
+          expect(knife).to receive(:do_connect).and_raise(expected_error)
+          expect { knife.connect! }.to raise_error(expected_error)
+        end
+      end
+
+      context "and password auth was not used" do
+        before do
+          allow(connection).to receive(:password_auth?).and_return false
+          allow(connection).to receive(:user).and_return "testuser"
+        end
+
+        it "warns, prompts for password, then reconnects with a password-enabled configuration using the new password" do
+          question_mock = double("question")
+          expect(knife).to receive(:do_connect).and_raise(expected_error)
+          expect(knife.ui).to receive(:warn).with(/Failed to auth.*/)
+          expect(knife.ui).to receive(:ask).and_yield(question_mock).and_return("newpassword")
+          # Ensure that we set echo off to prevent showing password on the screen
+          expect(question_mock).to receive(:echo=).with false
+          expect(knife).to receive(:do_connect) do |opts|
+            expect(opts[:password]).to eq "newpassword"
+          end
+          knife.connect!
+        end
       end
     end
   end
 
   it "verifies that a server to bootstrap was given as a command line arg" do
     knife.name_args = nil
+    expect(knife).to receive(:check_license)
     expect { knife.run }.to raise_error(SystemExit)
     expect(stderr.string).to match(/ERROR:.+FQDN or ip/)
   end
 
-  describe "when running the bootstrap" do
-    let(:knife_ssh) do
-      knife.name_args = ["foo.example.com"]
-      knife.config[:chef_node_name] = "foo.example.com"
-      knife.config[:ssh_user] = "rooty"
-      knife.config[:ssh_identity_file] = "~/.ssh/me.rsa"
-      allow(knife).to receive(:render_template).and_return("")
-      knife_ssh = knife.knife_ssh
-      allow(knife).to receive(:knife_ssh).and_return(knife_ssh)
-      knife_ssh
+  describe "#bootstrap_context" do
+    context "under Windows" do
+      let(:windows_test) { true }
+      it "creates a WindowsBootstrapContext" do
+        require "chef/knife/core/windows_bootstrap_context"
+        expect(knife.bootstrap_context.class).to eq Chef::Knife::Core::WindowsBootstrapContext
+      end
     end
-    let(:client) { Chef::ApiClient.new }
 
-    context "when running with a configured and present validation key" do
-      before do
-        # this tests runs the old code path where we have a validation key, so we need to pass that check
-        allow(File).to receive(:exist?).with(File.expand_path(Chef::Config[:validation_key])).and_return(true)
+    context "under linux" do
+      let(:linux_test) { true }
+      it "creates a BootstrapContext" do
+        require "chef/knife/core/bootstrap_context"
+        expect(knife.bootstrap_context.class).to eq Chef::Knife::Core::BootstrapContext
       end
+    end
+  end
 
-      it "configures the underlying ssh command and then runs it" do
-        expect(knife_ssh).to receive(:run)
-        knife.run
-      end
+  describe "#config_value" do
+    before do
+      knife.config[:test_key_a] = "a from cli"
+      knife.config[:test_key_b] = "b from cli"
+      Chef::Config[:knife][:test_key_a] = "a from Chef::Config"
+      Chef::Config[:knife][:test_key_c] = "c from Chef::Config"
+      Chef::Config[:knife][:alt_test_key_c] = "alt c from Chef::Config"
+    end
 
-      it "falls back to password based auth when auth fails the first time" do
-        allow(knife).to receive(:puts)
+    it "returns CLI value when key is only provided by the CLI" do
+      expect(knife.config_value(:test_key_b)).to eq "b from cli"
+    end
 
-        fallback_knife_ssh = knife_ssh.dup
-        expect(knife_ssh).to receive(:run).and_raise(Net::SSH::AuthenticationFailed.new("no ssh for you"))
-        allow(knife).to receive(:knife_ssh_with_password_auth).and_return(fallback_knife_ssh)
-        expect(fallback_knife_ssh).to receive(:run)
-        knife.run
-      end
+    it "returns CLI value when key is provided by CLI and Chef::Config" do
+      expect(knife.config_value(:test_key_a)).to eq "a from cli"
+    end
+
+    it "returns Chef::Config value whent he key is only provided by Chef::Config" do
+      expect(knife.config_value(:test_key_c)).to eq "c from Chef::Config"
+    end
 
-      it "raises the exception if config[:ssh_password] is set and an authentication exception is raised" do
-        knife.config[:ssh_password] = "password"
-        expect(knife_ssh).to receive(:run).and_raise(Net::SSH::AuthenticationFailed)
-        expect { knife.run }.to raise_error(Net::SSH::AuthenticationFailed)
+    it "returns the Chef::Config value from the alternative key when the CLI key is not set" do
+      expect(knife.config_value(:test_key_c, :alt_test_key_c)).to eq "alt c from Chef::Config"
+    end
+
+    it "returns the default value when the key is not provided by CLI or Chef::Config" do
+      expect(knife.config_value(:missing_key, :missing_key, "found")).to eq "found"
+    end
+  end
+
+  describe "#upload_bootstrap" do
+    before do
+      allow(connection).to receive(:temp_dir).and_return(temp_dir)
+      allow(connection).to receive(:normalize_path) { |a| a }
+    end
+
+    let(:content) { "bootstrap script content" }
+    context "under Windows" do
+      let(:windows_test) { true }
+      let(:temp_dir) { "C:/Temp/bootstrap" }
+      it "creates a bat file in the temp dir provided by connection, using given content" do
+        expect(connection).to receive(:upload_file_content!).with(content, "C:/Temp/bootstrap/bootstrap.bat")
+        expect(knife.upload_bootstrap(content)).to eq "C:/Temp/bootstrap/bootstrap.bat"
       end
+    end
 
-      it "creates the client and adds chef-vault items if vault_list is set" do
-        knife.config[:bootstrap_vault_file] = "/not/our/responsibility/to/check/if/this/exists"
-        expect(knife_ssh).to receive(:run)
-        expect(knife.client_builder).to receive(:run)
-        expect(knife.client_builder).to receive(:client).and_return(client)
-        expect(knife.chef_vault_handler).to receive(:run).with(client)
-        knife.run
+    context "under Linux" do
+      let(:linux_test) { true }
+      let(:temp_dir) { "/tmp/bootstrap" }
+      it "creates a 'sh file in the temp dir provided by connection, using given content" do
+        expect(connection).to receive(:upload_file_content!).with(content, "/tmp/bootstrap/bootstrap.sh")
+        expect(knife.upload_bootstrap(content)).to eq "/tmp/bootstrap/bootstrap.sh"
       end
+    end
+  end
 
-      it "creates the client and adds chef-vault items if vault_items is set" do
-        knife.config[:bootstrap_vault_json] = '{ "vault" => "item" }'
-        expect(knife_ssh).to receive(:run)
-        expect(knife.client_builder).to receive(:run)
-        expect(knife.client_builder).to receive(:client).and_return(client)
-        expect(knife.chef_vault_handler).to receive(:run).with(client)
-        knife.run
+  describe "#bootstrap_command" do
+    context "under Windows" do
+      let(:windows_test) { true }
+      it "prefixes the command to run under cmd.exe" do
+        expect(knife.bootstrap_command("autoexec.bat")).to eq "cmd.exe /C autoexec.bat"
       end
 
-      it "does old-style validation without creating a client key if vault_list+vault_items is not set" do
-        expect(File).to receive(:exist?).with(File.expand_path(Chef::Config[:validation_key])).and_return(true)
-        expect(knife_ssh).to receive(:run)
-        expect(knife.client_builder).not_to receive(:run)
-        expect(knife.chef_vault_handler).not_to receive(:run)
-        knife.run
+    end
+    context "under Linux" do
+      let(:linux_test) { true }
+      it "prefixes the command to run under sh" do
+        expect(knife.bootstrap_command("bootstrap")).to eq "sh bootstrap"
       end
+    end
+  end
 
-      it "raises an exception if the config[:chef_node_name] is not present" do
-        knife.config[:chef_node_name] = nil
+  describe "#default_bootstrap_template" do
+    context "under Windows" do
+      let(:windows_test) { true }
+      it "is windows-chef-client-msi" do
+        expect(knife.default_bootstrap_template).to eq "windows-chef-client-msi"
+      end
 
-        expect { knife.run }.to raise_error(SystemExit)
+    end
+    context "under Linux" do
+      let(:linux_test) { true }
+      it "is chef-full" do
+        expect(knife.default_bootstrap_template).to eq "chef-full"
       end
     end
+  end
 
-    context "when the validation key is not present" do
-      before do
-        # this tests runs the old code path where we have a validation key, so we need to pass that check
-        allow(File).to receive(:exist?).with(File.expand_path(Chef::Config[:validation_key])).and_return(false)
+  describe "#do_connect" do
+    let(:host_descriptor) { "example.com" }
+    let(:connection) { double("TrainConnector") }
+    let(:connector_mock) { double("TargetResolver", targets: [ connection ]) }
+    before do
+      allow(knife).to receive(:host_descriptor).and_return host_descriptor
+    end
+
+    it "creates a TrainConnector and connects it" do
+      expect(Chef::Knife::Bootstrap::TrainConnector).to receive(:new).and_return connection
+      expect(connection).to receive(:connect!)
+      knife.do_connect({})
+    end
+  end
+
+  describe "validate_winrm_transport_opts!" do
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+
+    context "when using ssh" do
+      let(:connection_protocol) { "ssh" }
+      it "returns true" do
+        expect(knife.validate_winrm_transport_opts!).to eq true
       end
+    end
+    context "when using winrm" do
+      let(:connection_protocol) { "winrm" }
+      context "with plaintext auth" do
+        before do
+          knife.config[:winrm_auth_method] = "plaintext"
+        end
+        context "with ssl" do
+          before do
+            knife.config[:winrm_ssl] = true
+          end
+          it "will not error because we won't send anything in plaintext regardless" do
+            expect(knife.validate_winrm_transport_opts!).to eq true
+          end
+        end
+        context "without ssl" do
+          before do
+            knife.config[:winrm_ssl] = false
+          end
+          context "and no validation key exists" do
+            before do
+              Chef::Config[:validation_key] = "validation_key.pem"
+              allow(File).to receive(:exist?).with(/.*validation_key.pem/).and_return false
+            end
+
+            it "will error because we will generate and send a client key over the wire in plaintext" do
+              expect { knife.validate_winrm_transport_opts! }.to raise_error(SystemExit)
+            end
 
-      it "creates the client (and possibly adds chef-vault items)" do
-        expect(knife_ssh).to receive(:run)
-        expect(knife.client_builder).to receive(:run)
-        expect(knife.client_builder).to receive(:client).and_return(client)
-        expect(knife.chef_vault_handler).to receive(:run).with(client)
-        knife.run
+          end
+          context "and a validation key exists" do
+            before do
+              Chef::Config[:validation_key] = "validation_key.pem"
+              allow(File).to receive(:exist?).with(/.*validation_key.pem/).and_return true
+            end
+            # TODO - don't we still send validation key?
+            it "will not error because we don not send client key over the wire" do
+              expect(knife.validate_winrm_transport_opts!).to eq true
+            end
+          end
+        end
       end
 
-      it "raises an exception if the config[:chef_node_name] is not present" do
-        knife.config[:chef_node_name] = nil
+      context "with other auth" do
+        before do
+          knife.config[:winrm_auth_method] = "kerberos"
+        end
+
+        context "and no validation key exists" do
+          before do
+
+            Chef::Config[:validation_key] = "validation_key.pem"
+            allow(File).to receive(:exist?).with(/.*validation_key.pem/).and_return false
+          end
+
+          it "will not error because we're not using plaintext auth" do
+            expect(knife.validate_winrm_transport_opts!).to eq true
+          end
+        end
+        context "and a validation key exists" do
+          before do
+            Chef::Config[:validation_key] = "validation_key.pem"
+            allow(File).to receive(:exist?).with(/.*validation_key.pem/).and_return true
+          end
+
+          it "will not error because a client key won't be sent over the wire in plaintext when a validation key is present" do
+            expect(knife.validate_winrm_transport_opts!).to eq true
+          end
+        end
 
-        expect { knife.run }.to raise_error(SystemExit)
       end
+
     end
 
-    context "when the validation_key is nil" do
-      before do
-        # this tests runs the old code path where we have a validation key, so we need to pass that check for some plugins
-        Chef::Config[:validation_key] = nil
+  end
+
+  describe "#winrm_warn_no_ssl_verification" do
+    before do
+      allow(knife).to receive(:connection_protocol).and_return connection_protocol
+    end
+
+    context "when using ssh" do
+      let(:connection_protocol) { "ssh" }
+      it "does not issue a warning" do
+        expect(knife.ui).to_not receive(:warn)
+        knife.winrm_warn_no_ssl_verification
       end
+    end
+    context "when using winrm" do
+      let(:connection_protocol) { "winrm" }
+      context "winrm_no_verify_cert is set" do
+        before do
+          knife.config[:winrm_no_verify_cert] = true
+        end
+
+        context "and ca_trust_file is present" do
+          before do
+            knife.config[:ca_trust_file] = "file"
+          end
 
-      it "creates the client and does not run client_builder or the chef_vault_handler" do
-        expect(knife_ssh).to receive(:run)
-        expect(knife.client_builder).not_to receive(:run)
-        expect(knife.chef_vault_handler).not_to receive(:run)
-        knife.run
+          it "does not issue a warning" do
+            expect(knife.ui).to_not receive(:warn)
+            knife.winrm_warn_no_ssl_verification
+          end
+        end
+
+        context "and winrm_ssl_peer_fingerprint is present" do
+          before do
+            knife.config[:winrm_ssl_peer_fingerprint] = "ABCD"
+          end
+          it "does not issue a warning" do
+            expect(knife.ui).to_not receive(:warn)
+            knife.winrm_warn_no_ssl_verification
+          end
+        end
+        context "and neither ca_trust_file nor winrm_ssl_peer_fingerprint is present" do
+          it "issues a warning" do
+            expect(knife.ui).to receive(:warn)
+            knife.winrm_warn_no_ssl_verification
+          end
+        end
       end
     end
   end
 
-  describe "specifying ssl verification" do
+  describe "#warn_on_short_session_timeout" do
+    let(:session_timeout) { 0 }
+    before do
+      allow(knife).to receive(:config).and_return(session_timeout: session_timeout)
+    end
 
+    context "timeout is more than 15" do
+      let(:session_timeout) { 16 }
+      it "does not issue a warning" do
+        expect(knife.ui).to_not receive(:warn)
+        knife.warn_on_short_session_timeout
+      end
+    end
+    context "timeout is 15 or less" do
+      let(:session_timeout) { 15 }
+      it "issues a warning" do
+        expect(knife.ui).to receive(:warn)
+        knife.warn_on_short_session_timeout
+      end
+    end
   end
 end