cookbook 'encrypted_attributes', '= 0.5.0'
encrypted_attributes (9) Versions 0.5.0 Follow1
Installs and enables chef-encrypted-attributes gem: Chef plugin to add Node encrypted attributes support using client keys.
cookbook 'encrypted_attributes', '= 0.5.0', :supermarket
knife supermarket install encrypted_attributes
knife supermarket download encrypted_attributes
Description
Installs and enables chef-encrypted-attributes
gem: Chef plugin to add Node encrypted attributes support using client keys.
Requirements
Supported Platforms
This cookbook has been tested on the following platforms:
- Amazon Linux
- CentOS
- Debian
- Fedora
- FreeBSD
- RedHat
- Ubuntu
Please, let us know if you use it successfully on any other platform.
Required Cookbooks
Required Applications
- Ruby
1.9.3
or higher.
See also the requirements of the chef-encrypted-attributes
gem.
Attributes
Attribute | Default | Description |
---|---|---|
node['encrypted_attributes']['version'] |
calculated | chef-encrypted-attributes gem version to install. The latest stable version is installed by default. |
node['encrypted_attributes']['mirror'] |
nil |
chef-encrypted-attributes mirror to download the gem from. For cases where you do not want to use RubyGems. |
node['encrypted_attributes']['data_bag']['name'] |
'global' |
chef-encrypted-attributes user keys, data bag name. |
node['encrypted_attributes']['data_bag']['item'] |
'chef_users' |
chef-encrypted-attributes user keys, data bag item name. |
node['dev_mode'] |
calculated | If this is true , the Chef::EncryptedAttributesHelpers library will work with unencrypted attributes instead of encrypted attributes. For testing purposes. |
Recipes
encrypted_attributes::default
Installs and loads the chef-encrypted-attributes
gem.
encrypted_attributes::expose_key
Exposes the Client Public Key in attributes. This is a workaround for the Chef Clients Limitation problem. Should be included by all nodes that need to have read privileges on the attributes.
encrypted_attributes::users_data_bag
Configures chef-encrypted-attributes
Chef User keys reading them from a data bag. This is a workaround for the Chef Users Limitation problem.
Helper Libraries
See the Chef::EncryptedAttributesHelpers documentation.
Usage Examples
Including in a Cookbook Recipe
You can simply include it in a recipe:
include_recipe 'encrypted_attributes'
Don't forget to include the encrypted_attributes
cookbook as a dependency in the metadata.
# metadata.rb [...] depends 'encrypted_attributes'
Including in the Run List
Another alternative is to include the default recipe in your Run List:
{ "name": "ftp.onddo.com", [...] "run_list": [ [...] "recipe[encrypted_attributes]" ] }
encrypted_attributes::default Recipe Usage Example
include_recipe 'encrypted_attributes' self.class.send(:include, Opscode::OpenSSL::Password) # include the #secure_password method if Chef::EncryptedAttribute.exists?(node['myapp']['ftp_password']) # update with the new keys Chef::EncryptedAttribute.update(node.set['myapp']['ftp_password']) # read the password ftp_pass = Chef::EncryptedAttribute.load(node['myapp']['ftp_password']) else # create the password and save it ftp_pass = secure_password node.set['myapp']['ftp_password'] = Chef::EncryptedAttribute.create(ftp_pass) end # use `ftp_pass` for something here ...
You can also use the Chef::EncryptedAttributesHelpers
helpers to simplify its use:
include_recipe 'encrypted_attributes' self.class.send(:include, Chef::EncryptedAttributesHelpers) ftp_pass = encrypted_attribute_write(['myapp', 'ftp_password']) do self.class.send(:include, Opscode::OpenSSL::Password) secure_password end
Note: This example requires the openssl cookbook.
See the chef-encrypted-attributes
gem Usage section for more examples.
encrypted_attributes::users_data_bag Recipe Usage Example
This recipe should be called before using the encrypted attributes. It sets the Chef::Config[:encrypted_attributes][:keys]
option reading the keys from a data bag.
Before using this recipe, you must create the required data bag:
$ knife data bag create global_data chef_users
You should create a data bag item with the following format:
{ "id": "chef_users", "bob": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFA...", "alice": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFA..." }
The keys can be set in array of strings format if you prefer:
{ "id": "chef_users", "bob": [ "-----BEGIN PUBLIC KEY-----", "MIIBIjANBgkqhkiG9w0BAQEFA...", ... ], "alice": [ "-----BEGIN PUBLIC KEY-----", "MIIBIjANBgkqhkiG9w0BAQEFA...", ... ] }
You can retrieve user public keys with knife user show USER -a public_key -f json
.
Then, you can use this data bag to configure the Chef::Config[:encrypted_attributes][:keys]
chef-encrypted-attributes
configuration only by calling the recipe:
node.default['encrypted_attributes']['data_bag']['name'] = 'global_data' include_recipe 'encrypted_attributes::users_data_bag' # if Chef::EncryptedAttribute.exist?(...) # Chef::EncryptedAttribute.update(...) # else # node.set[...][...] = Chef::EncryptedAttribute.create(...) # ...
Note: This data bag does not need to be encrypted, because it only stores public keys.
Using Chef::EncryptedAttributesHelpers to Encrypt MySQL Passwords
In the following example we use the official mysql cookbook and its mysql_service
resource to save the passwords encrypted in these attributes:
node['myapp']['mysql']['server_root_password']
node['myapp']['mysql']['server_debian_password']
node['myapp']['mysql']['server_repl_password']
# Include the #secure_password method from the openssl cookbook self.class.send(:include, Opscode::OpenSSL::Password) # Install Encrypted Attributes gem include_recipe 'encrypted_attributes' # Include the Encrypted Attributes cookbook helpers self.class.send(:include, Chef::EncryptedAttributesHelpers) # We can use an attribute to enable or disable encryption (recommended for tests) # self.encrypted_attributes_enabled = node['myapp']['encrypt_attributes'] # Encrypted Attributes will be generated randomly and saved in in the # node['myapp']['mysql'] attribute encrypted. def generate_mysql_password(user) key = "server_#{user}_password" encrypted_attribute_write(['myapp', 'mysql', key]) { secure_password } end # Generate the encrypted passwords mysql_root_password = generate_mysql_password('root') mysql_debian_password = generate_mysql_password('debian') mysql_repl_password = generate_mysql_password('repl') mysql_service node['mysql']['service_name'] do version node['mysql']['version'] port node['mysql']['port'] data_dir node['mysql']['data_dir'] server_root_password mysql_root_password server_debian_password mysql_debian_password server_repl_password mysql_repl_password allow_remote_root node['mysql']['allow_remote_root'] remove_anonymous_users node['mysql']['remove_anonymous_users'] remove_test_database node['mysql']['remove_test_database'] root_network_acl node['mysql']['root_network_acl'] action :create end
Testing
See TESTING.md.
Contributing
Please do not hesitate to open an issue with any questions or problems.
See CONTRIBUTING.md.
TODO
See TODO.md.
License and Author
Author: | Xabier de Zuazo (xabier@onddo.com) |
Copyright: | Copyright (c) 2014, Onddo Labs, SL. (www.onddo.com) |
License: | Apache License, Version 2.0 |
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
encrypted_attributes CHANGELOG
This file is used to list changes made in each version of the encrypted_attributes
cookbook.
v0.5.0 (2014-12-15)
- Add
::expose_key
recipe. - Update to work with
chef-encrypted-attributes
gem0.4.0
.- Use
build-essential
and install gem depends only when required. - Add
Chef::EncryptedAttributesRequirements
class. - Install gem dependencies explicitly.
- Use
- Fix gem specific and prerelease versions install.
- Fix integration tests for Chef
12.0.0
and12.0.1
. -
encrypted_attributes_test
: Save the attribute as normal. - kitchen: Add suites for previous gem, Chef
11.12
,11.16
and Chef12
. - Update to RuboCop
0.28.0
. - travis.yml: Use the new build env.
- Gemfile: Use fixed foodcritic and RuboCop versions.
- Add Ruby documentation, integrated with yard and inch.
- Move
Chef::EncryptedAttributesHelpers
documentation to gem docs.
- Move
- README: Add inch-ci documentation badge.
v0.4.0 (2014-11-08)
- Allow
Chef::EncryptedAttributesHelpers
to be used from LWRPs. - Enable apt compile time update, required by
build-essential
. - FreeBSD compiletime attribute changed to
compiletime_portsnap
. - Add more unit tests: coverage 100%.
- Integrate tests with coveralls.io.
- Integrate tests with
should_not
gem. - Fix new RuboCop offenses.
- Update to ChefSpec
4.1
. - Update .kitchen.cloud.yml file.
- TESTING.md:
- Add Guarfile requirements.
- Use DO access token and some titles changed.
v0.3.0 (2014-10-21)
- Add FreeBSD support
- Berksfile, Rakefile and Guarfile, generic templates copied
- Added
rubocop.yml
with AllCops:Include - README:
- Add an example to encrypt MySQL passwords
- Always include encrypted_attributes recipe to force compile time build-essentials
- Use single quotes in examples
- Use markdown for tables
- Add LICENSE file
- kitchen.yml: remove empty attributes key
- License headers homogenized
v0.2.2 (2014-10-02)
- Added platform support documentation
-
kitchen.yml
file updated - Rakefile: rubocop enabled
- Gemfile:
- Replaced vagrant by vagrant-wrapper
- Added vagrant-wrapper version with pessimistic operator
- Berkshelf updated to 3.1
- Guardfile added
- TODO: use checkboxes
v0.2.1 (2014-08-28)
- EncryptedAttributesHelpers bugfix: avoid
#node.save
on chef-solo - EncryptedAttributesHelpers: some code duplication removed
- README: added gemnasium and codeclimate badges
v0.2.0 (2014-08-26)
-
encrypted_attributes_test::default
:node#save
unless chef-solo - Gemfile:
- RSpec
~> 2.14.0
to avoiduninitialized constant RSpec::Matchers::BuiltIn::RaiseError::MatchAliases
error - Updates: ChefSpec
4
and foodcritic4
- Added chef-encrypted-attributes gem for unit tests
- Gemfile clean up
- RSpec
- README:
- README file split in multiple files
- Replace community links by Supermarket links
- Fixed
::users_data_bag
example using#exist?
instead of#exists_on_node?
- Added a link to
chef-encrypted-attributes
gem requirements - Multiple small fixes and improvements
-
::default
: avoid gem install error when no version is specified - Install
gcc
dependency (build-essential
cookbook) - Added
Chef::EncryptedAttributesHelpers
helper library- Added
EncryptedAttributesHelpers
unit tests
- Added
- Added RuboCop checking, all offenses fixed
- TODO: added verify gem task
- test/kitchen directory removed
v0.1.0 (2014-05-22)
- Initial release of
encrypted_attributes
Foodcritic Metric
0.5.0 passed this metric
0.5.0 passed this metric