Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms

Select Status

RSS

chef-secrets (13) Versions 0.5.0

Installs/Configures chef-vault with helpers

Policyfile
Berkshelf
Knife
cookbook 'chef-secrets', '= 0.5.0', :supermarket
cookbook 'chef-secrets', '= 0.5.0'
knife supermarket install chef-secrets
knife supermarket download chef-secrets
README
Dependencies
Quality 14%

chef-secrets cookbook

This cookbook aims to ease chef-vault interaction by providing additional helpers, and testing the functionality on a Linux and Windows box.

More info about chef-vault: https://github.com/chef-cookbooks/chef-vault

Usage pattern (with wrapper cookbooks)

Let us say you are using a cookbook that requires you to set a password in an attribute. This attribute is usually set in a wrapper cookbook which includes the original cookbook. By including this cookbook as well, you can set the attribute in the wrapper cookbook's attribute file like this:
ruby
secret['cookbook']['password'] = chef_vault_item_or_default('vault', 'item')

This will set the attribute default['cookbook']['password'] to the item from the vault. It will also set the attribute to SECRET at the end of the Chef run, therefore ensuring that the Chef Server will not contain the password in plaintext. If the item in the vault does not exist it will fail.

If you would like to default to a value in a testing environment, you can do:
```ruby
fallback = Mash.new({ key: 'fallback' }) if ENV['TEST_KITCHEN'] || defined?(ChefSpec) || Chef::Config[:local_mode]

secret['cookbook']['password'] = chef_vault_item_or_default('vault', 'item', fallback)

use it anywhere with node['cookbook']['password']['key']


Note that a chef-vault item will always be a hash, so it may be better to set the fallback to a similar hash as well.

## Caching

Accessing many secrets on high latency links can be very long.
`chef_vault_item_or_default` helper is able to cache for a few hours decrypted value on chef cache.

Call it with `chef_vault_item_or_default('vault', 'item', fallback, true)`.

Cached entry has a TTL set randomly between 1 and 12 hours. This is to avoid refreshing all secrets at the same time (defeating the purpose of having caching).


## Secret attributes

### Overview

Secret attributes are node attributes that are available only during the Chef run, but set to `SECRET` when saved and uploaded to the Chef Server. These attributes are actually default node attributes set through a helper method, so you may access them as you would access any default node attribute.

### Usage
Set a secret in cookbook attributes:
```ruby
secret['cookbook']['password'] = 'SuperSecretPassword'

Read it anywhere like a default node attribute:
ruby
Chef::Log.info("This is my password: #{node['cookbook']['password']}")

Note: Please don't accidentally save your secrets in the Chef log file :)

Call stack

When called with this syntax
ruby
secret['cookbook']['password'] = 'SuperSecretPassword'

actually calls
ruby
chef_secret_attribute_set(['cookbook', 'password'], 'SuperSecretPassword')

which in turn sets
ruby
default['cookbook']['password'] = 'SuperSecretPassword'

and will be cleared at the end by
ruby
chef_secret_attribute_clear(['cookbook', 'password'])

which sets
ruby
default['cookbook']['password'] = 'SECRET'

Additional chef-vault helpers

chef_vault_item_or_default

Get an item from the vault, or default to value if if the vault or item does not exist. If the default value is not specified, it will fail the Chef run.
ruby
chef_vault_item_or_default('vault', 'item', 'default')

chef_vault_item_is_vault?

Return true if item is a vault item. Note that unlike ChefVault::Item.vault?, this method returns false if the data bag does not exist.
ruby
chef_vault_item_is_vault?('vault', 'item')

Dependent cookbooks

chef-vault ~> 2.1

Contingent cookbooks

There are no cookbooks that are contingent upon this one.

Collaborator Number Metric
            

0.5.0 failed this metric

Failure: Cookbook has 0 collaborators. A cookbook must have at least 2 collaborators to pass this metric.

Contributing File Metric
            

0.5.0 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file

Foodcritic Metric
            

0.5.0 failed this metric

FC066: Ensure chef_version is set in metadata: chef-secrets/metadata.rb:1
FC067: Ensure at least one platform supported in metadata: chef-secrets/metadata.rb:1
Run with Foodcritic Version 11.2.0 with tags metadata,correctness ~FC031 ~FC045 and failure tags any

License Metric
            

0.5.0 failed this metric

chef-secrets does not have a valid open source license.
Acceptable licenses include Apache-2.0, apachev2, Apache 2.0, MIT, mit, GPL-2.0, gplv2, GNU Public License 2.0, GPL-3.0, gplv3, GNU Public License 3.0.

No Binaries Metric
            

0.5.0 passed this metric

Testing File Metric
            

0.5.0 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file

Version Tag Metric
            

0.5.0 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must include a tag that matches this cookbook version number