chef recipe [yum installed packages exclude for yum.conf]

default.rb

template "/etc/yum.conf" do
  node[:excludes] = []
  source "yum.conf.erb"
  owner  "root"
  mode   0644
  node[:yum][:exclude].each do |exclude|
    if `rpm -qa | grep #{exclude}` =~ /#{exclude}/  then
       node[:excludes].push(exclude)
    end
  end
end

yum.conf.erb

[main]
cachedir=/var/cache/yum/$basearch/$releasever
keepcache=0
debuglevel=2
logfile=/var/log/yum.log
exactarch=1
obsoletes=1
gpgcheck=1
plugins=1
installonly_limit=5
bugtracker_url=http://bugs.centos.org/set_project.php?project_id=16&ref=http://bugs.centos.org/bug_report_page.php?category=yum
distroverpkg=centos-release

#  This is the default, if you make this bigger yum won't see if the metadata
# is newer on the remote and so you'll "gain" the bandwidth of not having to
# download the new metadata and "pay" for it by yum not having correct
# information.
#  It is esp. important, to have correct metadata, for distributions like
# Fedora which don't keep old packages around. If you don't like this checking
# interupting your command line usage, it's much better to have something
# manually check the metadata once an hour (yum-updatesd will do this).
# metadata_expire=90m

# PUT YOUR REPOS HERE OR IN separate files named file.repo
# in /etc/yum.repos.d

<% if node[:excludes] then %>
exclude=<%= node[:excludes].join(", ") %>
<% end %>