In addition to role cookbooks... a single environment cookbook with a recipe per environment. Allows locking of roles and environments to specific versions and keeps most of the configuration logically together without any secret sauce.

daptiv_environments::production

# turn off dev_mode for the entire production environment
node.override['daptiv_site']['dev_mode'] = false

daptiv_sso_role::default

# base application recipe
include_recipe 'daptiv_site::sso'

# set some versioned role attributes (i.e. same value across all environments)
node.override['daptiv_site']['sso']['doc_root'] = 'd:/daptiv/sso'

# set some versioned environment specific attributes
include_recipe "daptiv_environments::#{node.chef_environment}"

sso role

name "sso"
description "Daptiv SSO login server role"
run_list(
  "recipe[daptiv_sso_role::default]"
)

Assumptions:

• We have a daptiv_environments cookbook which has a recipe for each and every environment. Each recipe contains all the environment specific attributes.
• We use roles 1:1 with a role cookbook and the role just includes the role cookbook in its runlist (and nothing else).
• Application cookbooks use regular attributes. Role cookbooks can set these attributes from data bags if needed.