ChefEncryptedDataBags: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
(fix syntax highlight for ChefEncryptedDataBags) |
||
| Line 2: | Line 2: | ||
=Create data bag= | =Create data bag= | ||
<syntaxhighlight> | <syntaxhighlight lang=bash> | ||
$ openssl rand -base64 512 | tr -d '\r\n' > ~/encrypted_data_bag_secret | $ openssl rand -base64 512 | tr -d '\r\n' > ~/encrypted_data_bag_secret | ||
$ knife data bag create --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords | $ knife data bag create --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords | ||
| Line 12: | Line 12: | ||
=Example JSON contents= | =Example JSON contents= | ||
<syntaxhighlight> | <syntaxhighlight lang=json> | ||
{ | { | ||
"jenkins_invadelabs":{ | "jenkins_invadelabs":{ | ||
| Line 25: | Line 25: | ||
=Create / edit data bags= | =Create / edit data bags= | ||
<syntaxhighlight> | <syntaxhighlight lang=bash> | ||
knife data bag create --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords | knife data bag create --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords | ||
knife data bag edit --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords | knife data bag edit --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords | ||
| Line 39: | Line 39: | ||
=Add a private key to a databag= | =Add a private key to a databag= | ||
<syntaxhighlight> | <syntaxhighlight lang=bash> | ||
/usr/local/Cellar/gnu-sed/4.2.2/bin/gsed ':a;N;$!ba;s/\n/\\n/g' jenkins_is_rsa | /usr/local/Cellar/gnu-sed/4.2.2/bin/gsed ':a;N;$!ba;s/\n/\\n/g' jenkins_is_rsa | ||
copy output to knife data bag create <some data bag> | copy output to knife data bag create <some data bag> | ||
Latest revision as of 22:52, 24 January 2018
Raw notes, needs formatting, context...
Create data bag
$ openssl rand -base64 512 | tr -d '\r\n' > ~/encrypted_data_bag_secret
$ knife data bag create --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords
$ knife data bag edit --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords # do not mix up -s and --secret-file
Copy encrytped data bag to client
copy encrypted_data_bag_secret to chef-client:/etc/chef/encrypted_data_bag_secret
Example JSON contents
{
"jenkins_invadelabs":{
"install_plugins":{
"plugins_list":[
"git"
]
}
}
}
Create / edit data bags
knife data bag create --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords
knife data bag edit --editor /usr/bin/vi --secret-file ./encrypted_data_bag_secret jenkins passwords
[2016-08-21T21:41:00-07:00] INFO: template[/var/lib/jenkins/hudson.plugins.sonar.SonarGlobalConfiguration.xml] sending restart action to service[jenkins] (delayed)
Recipe: jenkins::_master_package
* service[jenkins] action restart[2016-08-21T21:41:00-07:00] INFO: Processing service[jenkins] action restart (jenkins::_master_package line 74)
[2016-08-21T21:41:00-07:00] DEBUG: Providers for generic service resource enabled on node include: [Chef::Provider::Service::Redhat, Chef::Provider::Service::Init]
[2016-08-21T21:41:00-07:00] DEBUG: Provider for action restart on resource service[jenkins] is Chef::Provider::Service::Redhat
[2016-08-21T21:41:00-07:00] DEBUG: service[jenkins] supports status, running
jenkins (pid 21599) is running...
Add a private key to a databag
/usr/local/Cellar/gnu-sed/4.2.2/bin/gsed ':a;N;$!ba;s/\n/\\n/g' jenkins_is_rsa
copy output to knife data bag create <some data bag>
flatten json file
cat inhouse_release_perms.erb | /usr/local/Cellar/gnu-sed/4.2.2/bin/gsed ':a;N;$!ba;s/\n//g'
no more than one space
/usr/local/Cellar/gnu-sed/4.2.2/bin/gsed ':a;N;$!ba;s/\n//g' | sed 's/ */ /g'
replace " with \"
/usr/local/Cellar/gnu-sed/4.2.2/bin/gsed ':a;N;$!ba;s/\n//g' | sed 's/ */ /g' | sed 's/"/\\"/g'