class Kitchen::Provisioner::ChefZeroEncryptDatabags

This gem aims to extend the ChefZero provisioner from test-kitchen to automatically encrypt data bags when provisioning the test sandbox.

Public Instance Methods

create_sandbox() click to toggle source
Calls superclass method
# File lib/kitchen/provisioner/chef_zero_encrypt_databags.rb, line 16
def create_sandbox
  super # call the original, which will insert databags
  encrypt_data_bags
end

Private Instance Methods

data_bag_files() click to toggle source
# File lib/kitchen/provisioner/chef_zero_encrypt_databags.rb, line 42
def data_bag_files
  data_bags_glob = File.join(sandbox_path, "data_bags", "**", "*.json")
  Dir.glob(data_bags_glob)
end
encrypt_data_bag(data_bag_path, secret_key) click to toggle source
# File lib/kitchen/provisioner/chef_zero_encrypt_databags.rb, line 47
      def encrypt_data_bag(data_bag_path, secret_key)
        data_bag_content = ERB.new(File.read(data_bag_path)).result
        data_bag = JSON.parse(data_bag_content)
        ::Chef::EncryptedDataBagItem.encrypt_data_bag_item(data_bag, secret_key)
      rescue StandardError => err
        raise DataBagEncryptionException, <<-MSG
        Failed to encrypt data bag at #{data_bag_path} with error "#{err}"
        MSG
      end
encrypt_data_bags() click to toggle source

Take the data bags that we have copied to the box, and encrypt each with the provided data bag secret key. This allows users to create unencrypted data bags for their tests that they can then use via Chef::EncryptedDataBagItem.load

This will only target data bags at sandbox/data_bags/*/.json, and will need to be run after the data bags have been copied into place.

# File lib/kitchen/provisioner/chef_zero_encrypt_databags.rb, line 29
      def encrypt_data_bags
        unless secret_key
          raise DataBagEncryptionException, <<-MSG
          Encrypting data bags requires an encrypted_data_bag_secret_key_path!
          MSG
        end

        data_bag_files.each do |data_bag_file|
          data_bag_enc = encrypt_data_bag(data_bag_file, secret_key)
          File.write(data_bag_file, JSON.pretty_generate(data_bag_enc))
        end
      end
secret_key() click to toggle source
# File lib/kitchen/provisioner/chef_zero_encrypt_databags.rb, line 57
def secret_key
  @secret_key ||= begin
    secret_key_path = config[:encrypted_data_bag_secret_key_path] || ""
    # The strip is important- this is how Chef reads the secret file, and we'll need
    # to do the same if Chef is to decrypt anything with this key
    File.read(secret_key_path).strip if File.exist?(secret_key_path)
  end
end