# Auto copy encrypted\_data\_bag\_secret on the node not working

**URL:** <https://discourse.chef.io/t/auto-copy-encrypted-data-bag-secret-on-the-node-not-working/3544>\
**Category:** Chef Infra (archive)\
**Created:** [January 29, 2013, 11:31am UTC](https://discourse.chef.io/t/auto-copy-encrypted-data-bag-secret-on-the-node-not-working/3544 "2013-01-29T11:31:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![millisami\_r](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/millisami_r/32/418_2.png) [@millisami\_r](https://discourse.chef.io/u/millisami_r)\
**Post date:** [January 29, 2013, 11:31am UTC](https://discourse.chef.io/t/auto-copy-encrypted-data-bag-secret-on-the-node-not-working/3544/1 "2013-01-29T11:31:04Z")

</div>

Ohai Chefs!

In my chef-repo’s knife.rb file, I’ve the following config for `encrypted_data_bag_secret`

```
......
# Encrypted data bag secret file
knife[:encrypted_data_bag_secret] = "/Users/millisami/.chef/encrypted_data_bag_secret"
......

```

And this is the snippet of the default chef-full distro:

```
<% if @chef_config[:encrypted_data_bag_secret] -%>
(
cat <<'EOP'
<%= encrypted_data_bag_secret %>
EOP
) > /tmp/encrypted_data_bag_secret
awk NF /tmp/encrypted_data_bag_secret > /etc/chef/encrypted_data_bag_secret
rm /tmp/encrypted_data_bag_secret
<% end -%>

```

But when bootstrapping, the file is not created on the node. Debugging around when I print the value of `@chef_config[:encrypted_data_bag_secret]` is `nil` and so does the `<%= encrypted_data_bag_secret %>` erb call.

Then I changed the config var to `knife_config[:encrypted_data_bag_secret]` and the `File.read..` and the file location and the contents is also set properly.

```
<% if knife_config[:encrypted_data_bag_secret] -%>
(
cat <<'EOP'
<%= File.read(knife_config[:encrypted_data_bag_secret]) %>
EOP
) > /tmp/encrypted_data_bag_secret
awk NF /tmp/encrypted_data_bag_secret > /etc/chef/encrypted_data_bag_secret
rm /tmp/encrypted_data_bag_secret
<% end -%>

```

But still when issuing the bootstrap command, the file is not getting created at node’s `/etc/chef/encrypted_data_bag_secret` ?

What might be the cause?

* * *

@millisami  
~ Sachin Sagar Rai  
Ruby on Rails Developer  
[http://tfm.com.np](http://tfm.com.np)  
[http://nepalonrails.com](http://nepalonrails.com) ([http://nepalonrails.tumblr.com](http://nepalonrails.tumblr.com))  
Sent with Sparrow ([http://www.sparrowmailapp.com/?sig](http://www.sparrowmailapp.com/?sig))

---

<div class="post-metadata">

**Author:** ![tmatilai](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tmatilai/32/377_2.png) [@tmatilai](https://discourse.chef.io/u/tmatilai)\
**Post date:** [January 29, 2013, 1:54pm UTC](https://discourse.chef.io/t/auto-copy-encrypted-data-bag-secret-on-the-node-not-working/3544/2 "2013-01-29T13:54:17Z")

</div>

On Tue, Jan 29, 2013 at 8:31 AM, Sachin Sagar Rai [millisami@gmail.com](mailto:millisami@gmail.com) wrote:

> In my chef-repo's knife.rb file, I've the following config for  
> `encrypted_data_bag_secret`
> 
> ```
> ......
> # Encrypted data bag secret file
> knife[:encrypted_data_bag_secret] =
> 
> ```
> 
> "/Users/millisami/.chef/encrypted\_data\_bag\_secret"

This should be just:  
encrypted\_data\_bag\_secret "/Users/millisami/.chef/encrypted\_data\_bag\_secret"

> And this is the snippet of the default chef-full distro:
> 
> ```
> <% if @chef_config[:encrypted_data_bag_secret] -%>
> (
> cat <<'EOP'
> <%= encrypted_data_bag_secret %>
> EOP
> ) > /tmp/encrypted_data_bag_secret
> awk NF /tmp/encrypted_data_bag_secret >
> 
> ```
> 
> /etc/chef/encrypted\_data\_bag\_secret  
> rm /tmp/encrypted\_data\_bag\_secret  
> \<% end -%\>

Btw, the version in the latest releases is a bit simpler and avoids  
the hardcoded (and thus insecure) /tmp paths.

--  
Cheers,

- Teemu