This question already has an answer here:
-
Git authentication in Chef
6 answers
I am new to all this but I am guessing I will be using SSH keys ... but how?
git '/home/vagrant/foo' do
repository 'me@repo.domain.com:/usr/git/app.git'
reference 'master'
action :sync
user "vagrant"
group "vagrant"
end
Here what worked for me:
1 - Generate a SSH key pair (public + private)
The public key you will add to your git
repo
2 - Generate a key for encryption
openssl rand -base64 512 > encrypted_data_bag_secret
3 - Create an encrypted data bag with knife
$ knife data bag create private_keys git_key --secret-file encrypted_data_bag_secret
This will open your favorite editor (vim), you will then needs to add your private key:
{
"name": "data_bag_item_private_keys_git_key",
"json_class": "Chef::DataBagItem",
"chef_type": "data_bag_item",
"data_bag": "private_keys",
"raw_data": {
"id": "git_key",
"private": "Add HERE you private key, replace the newlines by \n" <===== this is going to be a very long string of caracters
}
}
IMPORTANT: Replace the newlines of your private key by \n
4 - In your recipe:
secret = Chef::EncryptedDataBagItem.load_secret("/vagrant/encrypted_data_bag_secret")
git_key = Chef::EncryptedDataBagItem.load( "private_keys", "git_key", secret)
#git_key = Chef::DataBagItem.load( "private_keys_not_encrypted", "git_key")
file "/home/otto/.ssh/id_rsa" do
content git_key['private']
owner "otto"
group "otto"
mode 00600
action [:delete, :create]
end
5 - Look inside your encrypted data bag
$ knife data bag show private_keys git_key
id: git_key
private:
cipher: aes-256-cbc
encrypted_data: osuRPsasdfasdfasdfasdfaKutAXYrklKwn+zAgtlQZsFZNRKCyDf1Lc
2jtRZeGye0WHEKbVCtO7+arpytY7jNA4prOsK6iF1+cJsKcIBDtiNuurt80V
ljGJ5RNfvAtW5HJb2P7Sw75RyQQruKha0fsbyWTKwyssXnXZbmGxEFb+Vz4m
vEiU0tVk7/M04zAw34beEfnmAKNAae4TAgrlYg8bdQcxBi6zIdj5AW1VGBsh
xaxFdfEXvNcSwMBX9w3Yyj7xVzI7fj3QHqnJl/p4VKhwoOlCahbJqh3A72xc
l0mg0aPYfASulVuLm6U+KywzonOOVqXpeNYPtz+bW5v6Wa4cIM3aJ0JcObDw
BNqe0goDRHjz6YJBKW9RT5EiRJPZbdNWJaEZhEawW/e9lyLq/A44sZhC+m0I
...
[FILTERED]
...
6RA/9XxH7pGJpJtxVYGWSQB1diHcpaT1Vg7RT48L7WZJjJcK0ZQHYZpXfIB2
jUfIM3VY3ceD12unbZPI6FifdFq74qlr0fF4WM6V7WhJTgx3V3xCYLkjnhD9
9mchWqaBa9oYNoflSR0vl21j2gywDG0LPI5bbgTU+Gu5A+XsGirW/FYfKS28
08+B64Qvep0axtocs3GN2hOb
iv: dTFABrasdfasdfaLh5bNIJeUWQ==
version: 1
6 - Add your public key to your node
cookbook_file "/home/otto/.ssh/id_rsa.pub" do
source "id_rsa.pub" <=== Contains the public key
mode "0644"
end
cookbook_file "/home/otto/.ssh/known_hosts" do
source "known_hosts" <=== BitBucket host
mode "0644"
end
7 - Verify you can connect to BitBucket
$ ssh -T git@bitbucket.org
The authenticity of host 'bitbucket.org ([FILTERED])' can't be established.
RSA key fingerprint is [FILTERED].
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'bitbucket.org,[FILTERED]' (RSA) to the list of known hosts.
authenticated via a deploy key.
You can use git or hg to connect to Bitbucket. Shell access is disabled.
IMPORTANT: At the end of this command, you will have the known_hosts
file that you need to add to your cookbook. Copy it to files/default
folder of your cookbook.
After this I was about to git clone
my repository.
I think I have documented exactly what I have done, but feel free to drop your questions.