Chef-zero Convergence issue using encrypted data bags & hashicorp vault

Hello,

We are using chef-zero. Challenge is to securely store secret key such that it can be remotely accessed during chef run. I am using hashicorp vault to store private secret keys. Written a cookbook that uses auth backend to remotely call and retrieve secret key to store in a file (say key.pem) on node file system. Now i have my data bags encrypted. I have included vault recipe in my application cookbook to run & create key.pem before logic for decryption of data bag. During chef zero run, it throws error saying

================================================================================←[0m
Recipe Compile Error in /tmp/kitchen/cache/cookbooks/app_mriskjenkins/recipes/default.rb←[0m
================================================================================←[0m
←[0m
Errno::ENOENT←[0m
-------------←[0m
No such file or directory - file not found '/var/.chef/key.pem’←[0m
←[0m

can someone help whats happening and how to fix?

I am guessing you are using a ‘file’ resource to write /var/.chef/key.pem, and using data_bag_item(…) to read the data bag.

If so, the file resource is being executed at ‘converge’ time, whereas the data_bag_item call is happening at ‘compile’ time, before the key file has been written.

You can force the file resource to execute in the compile phase with something like:

file '/var/.chef/key.pem' do
    action :nothing
end.run_action(:create)

If this isn’t the problem, can you share some relevant bits of your recipe?

Depending on what the recipe looks like, lazy evaluation might work as
well.

...

On Tue, Mar 15, 2016 at 10:55 AM, Christine Draper < noreply@chef.discourse.org> wrote:

Christine_Draper https://discourse.chef.io/users/christine_draper
March 15

I am guessing you are using a ‘file’ resource to write /var/.chef/key.pem,
and using data_bag_item(…) to read the data bag.

If so, the file resource is being executed at ‘converge’ time, whereas the
data_bag_item call is happening at ‘compile’ time, before the key file has
been written.

You can force the file resource to execute in the compile phase with
something like:

file ‘/var/.chef/key.pem’ do
action :nothing
end.run_action(:create)

If this isn’t the problem, can you share some relevant bits of your recipe?

Visit Topic
https://discourse.chef.io/t/chef-zero-convergence-issue-using-encrypted-data-bags-hashicorp-vault/7978/2
or reply to this email to respond

To stop receiving notifications for this particular topic, click here
https://discourse.chef.io/t/chef-zero-convergence-issue-using-encrypted-data-bags-hashicorp-vault/7978/unsubscribe.
To unsubscribe from these emails, change your user preferences
https://discourse.chef.io/my/preferences