Chef Vault with Test-Kitchen, Vagrant and Chef-Zer

问题:

I have an environment setup with Test-Kitchen v1.5.0, Vagrant v1.8.1. I have a recipe that uses chef vault to decrypt our encrypted passwords that our in our data_bags_path/passwords/pilot.json file.

I am using the solution here https://github.com/chef/chef-vault/issues/58 that daxgames provides towards the end of the page.

My .kitchen.yml:

---
driver:
  name: vagrant

provisioner:
  name: chef_zero
  require_chef_omnibus: 12.14.77
  roles_path: ../../roles
  environments_path: ../../environments
  data_bags_path: ../../data_bags
  client_rb:
    environment: lgrid2-dev
    node_name: "ltylapp400a"
    client_key: "/etc/chef/ltylapp400a.pem"

platforms:
  - name: centos-6.8
    driver:
    synced_folders:
      - ["/Users/212466756/.chef", "/etc/chef", "disabled:false"]

 suites:
   - name: ltylapp400a
     run_list:
       - role[lgrid-db]
     attributes:
       chef_client:

A snippet from my recipe that deals with chef-vault:

case node["customer_conf"]["status"]
when 'pilot'
  passwords = ChefVault::Item.load('passwords', 'pilot')
when 'production'
  passwords = ChefVault::Item.load('passwords', node[:hostname][1..3])
end

My directory structure for relevant data_bags:

data_bags
  --passwords
     --pilot.json
     --pilot_keys.json

The error I am getting is that my client.pem that vagrant generates at /etc/chef/ltylapp400a.pem can not decrypt the contents of that databag. Chef suggest that I run knife vault refresh, I am not connected to my chef server on my local machine so if I run this it will give an error about not having a chef server to connect to. My question is how I can add my new key that vagrant generated to the pilot_keys.json so that it is able to decrypt that data_bag?

The more detailed answers are better I am still somewhat new to chef, test-kitchen, etc...

回答1:

I was able to get this working, below are my results and conclusions. As I stated above my issue was I was unable to decrpyt the data_bag since I could not add the new key that vagrant created to the pilot_key.json file since I was not connected to the chef server and could not run a knife vault refresh/update. What I had to do was get the client.pem key from a server that already had access to the pilot.json data_bag. I used our utility server key since it will not be destroyed in the near future.

So on my local PC I have a .chef/ directory under my home directory, I have the client.pem key I copied from the utility server and I sync this with the /tmp/kitchen/ which acts as the /etc/chef directory in the test-kitchen environment.

---
driver:
  name: vagrant

provisioner:
  name: chef_zero
  require_chef_omnibus: 12.14.77
  roles_path: ../../roles
  environments_path: ../../environments
  data_bags_path: ../../data_bags
  client_rb:
    node_name: "utilityServer"
    client_key: "/tmp/kitchen/client.pem"       #The Chef::Vault needs a client.pem file to authenticate back to the data_bag to decrypt it, this needs to be stored at /tmp/kitchen/client.pem
    environment: dev
    no_proxy: 10.0.2.2

platforms:
  - name: centos-6.8
    driver:
    synced_folders:
    - ["~/.chef","/tmp/kitchen/","disabled:false"] # Allows the vagrant box to have  access to your .chef directory in your home directory. This is where you will store the client.pem for authentication.

suites:
  - name: lzzzdbx400a
    run_list:
      - role[lgrid-db]
attributes:

The data_bags/passwords/pilot_key.json looks like:

{
 "id": "pilot_keys",
 "admins": [
   "utilityServer"
 ],
 "clients": [
   "webserver",
   "database"
 ],
 "search_query":"*:*"
 "utilityServer":"key",
 "webserver":"key",
 "database": "key"
 }

Since the utilityServer key was already able to decrpyt the passwords/pilot data_bag it ran through fine during the next time I ran kitchen converge.

回答2:

During previously struggles with Kitchen and chef-vault I used the synced_folders method to access key. Revisited this topic I found another solution.

Kitchen Support To make this work in kitchen, just put a cleartext data bag in the data_bags folder that your kitchen run refers to (probably in test/integration/data_bags). Then the vault commands fall back into using that dummy data when you use chef_vault_item to retrieve it.

reference: http://hedge-ops.com/chef-vault-tutorial/