# Data bag problems when upgrading from 10.12 to 10.14 and up

**URL:** <https://discourse.chef.io/t/data-bag-problems-when-upgrading-from-10-12-to-10-14-and-up/3517>\
**Category:** Chef Infra (archive)\
**Created:** [January 23, 2013, 7:45am UTC](https://discourse.chef.io/t/data-bag-problems-when-upgrading-from-10-12-to-10-14-and-up/3517 "2013-01-23T07:45:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kallen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallen/32/1049_2.png) [@Kallen](https://discourse.chef.io/u/Kallen)\
**Post date:** [January 23, 2013, 7:45am UTC](https://discourse.chef.io/t/data-bag-problems-when-upgrading-from-10-12-to-10-14-and-up/3517/1 "2013-01-23T07:45:29Z")

</div>

hiya.

i’m trying to upgrade my chef clients from chef-full-0.10.10-1 to 10.18, and  
i just discovered a problem pulling values out of an encrypted data bag when  
upgrading. during my tests, my example recipe (below) works with  
chef-full-0.10.10-1 and chef-10.12.0-1, but breaks when i try chef-10.14.4-2  
(and 10.16 and 10.18).

is this a known bug? or, do i need to do something differently?

here’s a brief recipe that illustrates what’s happening:

aws\_creds = Chef::EncryptedDataBagItem.load(“secrets”,“aws-creds-quux”)  
grab\_cert = "MEEP\_X509\_SERVERCERT"  
grab\_key = "MEEP\_X509\_PRIVATEKEY"  
grab\_access = "MEEP\_AWS\_ACCESS\_KEY\_ID"  
grab\_secret = “MEEP\_AWS\_SECRET\_ACCESS\_KEY”

x509\_cert = aws\_creds["#{grab\_cert}"]  
x509\_key = aws\_creds["#{grab\_key}"]  
aws\_access = aws\_creds["#{grab\_access}"]  
aws\_secret = aws\_creds["#{grab\_secret}"]  
Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.class} ")  
Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.inspect} ")  
Chef::Log.debug(“HIGGS-BOSON: AWS CERT pulled out of data bag is #{x509\_cert}”)  
Chef::Log.debug(“HIGGS-BOSON: AWS KEY pulled out of data bag is #{x509\_key}”)  
Chef::Log.debug(“HIGGS-BOSON: AWS ACCESS pulled out of data bag is #{aws\_access}”)  
Chef::Log.debug(“HIGGS-BOSON: AWS SECRET pulled out of data bag is #{aws\_secret}”)

here’s the logging results when the client runs 10.14. pardon the ugly data bag  
inspection … snipped for brevity.

[2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS Chef::EncryptedDataBagItem  
[2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS #\<Chef::EncryptedDataBagItem:0x00000002f8e358 @enc\_hash=data\_bag\_item[“secrets”, “aws-creds-quux”,  
{“BOOP\_X509\_SERVERCERT”=\>“z8qqqqqqqqqqqqqqqqqqqnr9mWxzzzzzzzzzzzzzz/sPYH7Cyw/\nQ9ftouk8RRRRRRRRRRRRF9Ryl/fmkkkkkkkkkkkkkkkkkkkkk0EFegz\nenmy1K2/VZph1kdE7DXxxxSNIP\n”, “MEEP\_AWS\_SECRET\_ACCESS\_KEY”=\>“OJ9xxxxxxxxxxZFxxxxxxxxxxwMxxxxxxxxxxxux/rdPpxxxxxxxxxxoffff\ne2ec\n”,  
“id”=\>“aws-creds-quux”, “BOOP\_AWS\_SECRET\_ACCESS\_KEY”=\>“m1xxxxxxxxxxrKpwh/dixxxxxxxxxxZkuxxxxxxxxxxpoxxxxxxxxxx1cr4\nEpmQ\n”, “MEEP\_AWS\_ACCESS\_KEY\_ID”=\>“vtxxxxxxxxxxdCg/0xxxxxxxxxxloZxxxxxxxxxxx5hQ=\n”, “BOOP\_X509\_PRIVATEKEY”=\>“NU99999999999999999999A6IEMUUKf7IccccccccccccccccccvtodL\nTy444444444444lQnePuuuuuuuuuuuuuuuuuuuuuuuDbuFB/hws\nSNIPxxxxxCHEXXjDk+oHWWWWWWefXHgQ999999SNIP\n”,  
“MEEP\_X509\_PRIVATEKEY”=\>“xa99999999999999999999dI0sfAjoDW999999999999999999998SPWBoAu\nC9qLxxxxxxxxxxxxxxxxxxxK+AN58y9999999999999999999999\n  
NDYFZjeNqDY8rAsnnnnnnnnipppppppBA=\n”, “MEEP\_X509\_SERVERCERT”=\>“LkuXuuuuuuuuuuuuuuuuuuuuuuEkyjjxxxxxxxxjD0GRCyH\nfZSfffffffffRrZxxxxxxSNIPxx=”\>  
[2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CERT pulled out of data bag is  
[2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS KEY pulled out of data bag is  
[2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS ACCESS pulled out of data bag is AKIsuperthankforaskingXX  
[2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS SECRET pulled out of data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ

above, you can see i’m getting no value for x509\_cert and x509\_key, but i am for  
aws\_access and aws\_secret. i tossed a couple more lines into the recipe to look  
at #{x509\_cert.class} and #{x509\_cert.inspect}, and i can see it’s an empty  
String; it’s not nil.

when i run chef client 0.10.10 or 10.12, i get this:

[Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS CERT pulled out of data bag is MIIDjjCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
[Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS KEY pulled out of data bag is MIICXQyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy  
[Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS ACCESS pulled out of data bag is AKIsuperthankforaskingXX  
[Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS SECRET pulled out of data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ

the result i get works because i use x509\_cert and x509\_key to populate x509  
certs via a template. (but i do wonder why only the content of each is printed  
in the log up to the first newline.)

thanks!  
kallen

---

<div class="post-metadata">

**Author:** ![Jake\_Vanderdray](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jake_vanderdray/32/613_2.png) [@Jake\_Vanderdray](https://discourse.chef.io/u/Jake_Vanderdray)\
**Post date:** [January 23, 2013, 10:29am UTC](https://discourse.chef.io/t/data-bag-problems-when-upgrading-from-10-12-to-10-14-and-up/3517/2 "2013-01-23T10:29:23Z")

</div>

Hi Kallen,

I don't know the exact details of the problem, but my colleagues ran into  
this and it apparently comes down to a change in the default yaml parser.  
Ultimately you'll need to re-create your encrypted data bags, but in the  
short-term you can add this to /etc/chef/client.rb in order to force newer  
versions of chef to use the old yaml parser.

YAML::ENGINE.yamler = 'syck'

Hope that helps,  
Jake.

On Wed, Jan 23, 2013 at 2:45 AM, [kallen@groknaut.net](mailto:kallen@groknaut.net) wrote:

> hiya.
> 
> i'm trying to upgrade my chef clients from chef-full-0.10.10-1 to 10.18,  
> and  
> i just discovered a problem pulling values out of an encrypted data bag  
> when  
> upgrading. during my tests, my example recipe (below) works with  
> chef-full-0.10.10-1 and chef-10.12.0-1, but breaks when i try  
> chef-10.14.4-2  
> (and 10.16 and 10.18).
> 
> is this a known bug? or, do i need to do something differently?
> 
> here's a brief recipe that illustrates what's happening:
> 
> aws\_creds = Chef::EncryptedDataBagItem.load("secrets","aws-creds-quux")  
> grab\_cert = "MEEP\_X509\_SERVERCERT"  
> grab\_key = "MEEP\_X509\_PRIVATEKEY"  
> grab\_access = "MEEP\_AWS\_ACCESS\_KEY\_ID"  
> grab\_secret = "MEEP\_AWS\_SECRET\_ACCESS\_KEY"
> 
> x509\_cert = aws\_creds["#{grab\_cert}"]  
> x509\_key = aws\_creds["#{grab\_key}"]  
> aws\_access = aws\_creds["#{grab\_access}"]  
> aws\_secret = aws\_creds["#{grab\_secret}"]  
> Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.class} ")  
> Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.inspect} ")  
> Chef::Log.debug("HIGGS-BOSON: AWS CERT pulled out of data bag is  
> #{x509\_cert}")  
> Chef::Log.debug("HIGGS-BOSON: AWS KEY pulled out of data bag is  
> #{x509\_key}")  
> Chef::Log.debug("HIGGS-BOSON: AWS ACCESS pulled out of data bag is  
> #{aws\_access}")  
> Chef::Log.debug("HIGGS-BOSON: AWS SECRET pulled out of data bag is  
> #{aws\_secret}")
> 
> here's the logging results when the client runs 10.14. pardon the ugly  
> data bag  
> inspection ... snipped for brevity.
> 
> [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS  
> Chef::EncryptedDataBagItem  
> [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS  
> #\<Chef::EncryptedDataBagItem:0x00000002f8e358  
> @enc\_hash=data\_bag\_item["secrets", "aws-creds-quux",  
> {"BOOP\_X509\_SERVERCERT"=\>"z8qqqqqqqqqqqqqqqqqqqnr9mWxzzzzzzzzzzzzzz/sPYH7Cyw/\nQ9ftouk8RRRRRRRRRRRRF9Ryl/fmkkkkkkkkkkkkkkkkkkkkk0EFegz\nenmy1K2/VZph1kdE7DXxxxSNIP\n",  
> "MEEP\_AWS\_SECRET\_ACCESS\_KEY"=\>"OJ9xxxxxxxxxxZFxxxxxxxxxxwMxxxxxxxxxxxux/rdPpxxxxxxxxxxoffff\ne2ec\n",  
> "id"=\>"aws-creds-quux",  
> "BOOP\_AWS\_SECRET\_ACCESS\_KEY"=\>"m1xxxxxxxxxxrKpwh/dixxxxxxxxxxZkuxxxxxxxxxxpoxxxxxxxxxx1cr4\nEpmQ\n",  
> "MEEP\_AWS\_ACCESS\_KEY\_ID"=\>"vtxxxxxxxxxxdCg/0xxxxxxxxxxloZxxxxxxxxxxx5hQ=\n",  
> "BOOP\_X509\_PRIVATEKEY"=\>"NU99999999999999999999A6IEMUUKf7IccccccccccccccccccvtodL\nTy444444444444lQnePuuuuuuuuuuuuuuuuuuuuuuuDbuFB/hws\nSNIPxxxxxCHEXXjDk+oHWWWWWWefXHgQ999999SNIP\n",
> 
> "MEEP\_X509\_PRIVATEKEY"=\>"xa99999999999999999999dI0sfAjoDW999999999999999999998SPWBoAu\nC9qLxxxxxxxxxxxxxxxxxxxK+AN58y9999999999999999999999\n  
> NDYFZjeNqDY8rAsnnnnnnnnipppppppBA=\n",  
> "MEEP\_X509\_SERVERCERT"=\>"LkuXuuuuuuuuuuuuuuuuuuuuuuEkyjjxxxxxxxxjD0GRCyH\nfZSfffffffffRrZxxxxxxSNIPxx="\>  
> [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CERT pulled out of  
> data bag is  
> [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS KEY pulled out of data  
> bag is  
> [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS ACCESS pulled out of  
> data bag is AKIsuperthankforaskingXX  
> [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS SECRET pulled out of  
> data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ
> 
> above, you can see i'm getting no value for x509\_cert and x509\_key, but i  
> am for  
> aws\_access and aws\_secret. i tossed a couple more lines into the recipe to  
> look  
> at #{x509\_cert.class} and #{x509\_cert.inspect}, and i can see it's an empty  
> String; it's not nil.
> 
> when i run chef client 0.10.10 or 10.12, i get this:
> 
> [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS CERT pulled out  
> of data bag is MIIDjjCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
> [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS KEY pulled out  
> of data bag is MIICXQyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy  
> [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS ACCESS pulled  
> out of data bag is AKIsuperthankforaskingXX  
> [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS SECRET pulled  
> out of data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ
> 
> the result i get works because i use x509\_cert and x509\_key to populate  
> x509  
> certs via a template. (but i do wonder why only the content of each is  
> printed  
> in the log up to the first newline.)
> 
> thanks!  
> kallen

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [January 23, 2013, 3:20pm UTC](https://discourse.chef.io/t/data-bag-problems-when-upgrading-from-10-12-to-10-14-and-up/3517/3 "2013-01-23T15:20:44Z")

</div>

See this ticket:  
[http://tickets.opscode.com/browse/CHEF-3393](http://tickets.opscode.com/browse/CHEF-3393)

This is one of the reasons we changed the encrypted data bag item format in Chef 11.

FYI, Chef 10.18+ can read encrypted data bag items you create with Chef 11's knife command so you could potentially upgrade knife on your workstation without upgrading chef on your servers.

--  
Daniel DeLeo

On Wednesday, January 23, 2013 at 2:29 AM, Jake Vanderdray wrote:

> Hi Kallen,
> 
> I don't know the exact details of the problem, but my colleagues ran into this and it apparently comes down to a change in the default yaml parser. Ultimately you'll need to re-create your encrypted data bags, but in the short-term you can add this to /etc/chef/client.rb in order to force newer versions of chef to use the old yaml parser.
> 
> YAML::ENGINE.yamler = 'syck'
> 
> Hope that helps,  
> Jake.
> 
> On Wed, Jan 23, 2013 at 2:45 AM, \<[kallen@groknaut.net](mailto:kallen@groknaut.net) ([mailto:kallen@groknaut.net](mailto:kallen@groknaut.net))\> wrote:
> 
> > hiya.
> > 
> > i'm trying to upgrade my chef clients from chef-full-0.10.10-1 to 10.18, and  
> > i just discovered a problem pulling values out of an encrypted data bag when  
> > upgrading. during my tests, my example recipe (below) works with  
> > chef-full-0.10.10-1 and chef-10.12.0-1, but breaks when i try chef-10.14.4-2  
> > (and 10.16 and 10.18).
> > 
> > is this a known bug? or, do i need to do something differently?
> > 
> > here's a brief recipe that illustrates what's happening:
> > 
> > aws\_creds = Chef::EncryptedDataBagItem.load("secrets","aws-creds-quux")  
> > grab\_cert = "MEEP\_X509\_SERVERCERT"  
> > grab\_key = "MEEP\_X509\_PRIVATEKEY"  
> > grab\_access = "MEEP\_AWS\_ACCESS\_KEY\_ID"  
> > grab\_secret = "MEEP\_AWS\_SECRET\_ACCESS\_KEY"
> > 
> > x509\_cert = aws\_creds["#{grab\_cert}"]  
> > x509\_key = aws\_creds["#{grab\_key}"]  
> > aws\_access = aws\_creds["#{grab\_access}"]  
> > aws\_secret = aws\_creds["#{grab\_secret}"]  
> > Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.class} ")  
> > Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.inspect} ")  
> > Chef::Log.debug("HIGGS-BOSON: AWS CERT pulled out of data bag is #{x509\_cert}")  
> > Chef::Log.debug("HIGGS-BOSON: AWS KEY pulled out of data bag is #{x509\_key}")  
> > Chef::Log.debug("HIGGS-BOSON: AWS ACCESS pulled out of data bag is #{aws\_access}")  
> > Chef::Log.debug("HIGGS-BOSON: AWS SECRET pulled out of data bag is #{aws\_secret}")
> > 
> > here's the logging results when the client runs 10.14. pardon the ugly data bag  
> > inspection ... snipped for brevity.
> > 
> > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS Chef::EncryptedDataBagItem  
> > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS #\<Chef::EncryptedDataBagItem:0x00000002f8e358 @enc\_hash=data\_bag\_item["secrets", "aws-creds-quux",  
> > {"BOOP\_X509\_SERVERCERT"=\>"z8qqqqqqqqqqqqqqqqqqqnr9mWxzzzzzzzzzzzzzz/sPYH7Cyw/\nQ9ftouk8RRRRRRRRRRRRF9Ryl/fmkkkkkkkkkkkkkkkkkkkkk0EFegz\nenmy1K2/VZph1kdE7DXxxxSNIP\n", "MEEP\_AWS\_SECRET\_ACCESS\_KEY"=\>"OJ9xxxxxxxxxxZFxxxxxxxxxxwMxxxxxxxxxxxux/rdPpxxxxxxxxxxoffff\ne2ec\n",  
> > "id"=\>"aws-creds-quux", "BOOP\_AWS\_SECRET\_ACCESS\_KEY"=\>"m1xxxxxxxxxxrKpwh/dixxxxxxxxxxZkuxxxxxxxxxxpoxxxxxxxxxx1cr4\nEpmQ\n", "MEEP\_AWS\_ACCESS\_KEY\_ID"=\>"vtxxxxxxxxxxdCg/0xxxxxxxxxxloZxxxxxxxxxxx5hQ=\n", "BOOP\_X509\_PRIVATEKEY"=\>"NU99999999999999999999A6IEMUUKf7IccccccccccccccccccvtodL\nTy444444444444lQnePuuuuuuuuuuuuuuuuuuuuuuuDbuFB/hws\nSNIPxxxxxCHEXXjDk+oHWWWWWWefXHgQ999999SNIP\n",  
> > "MEEP\_X509\_PRIVATEKEY"=\>"xa99999999999999999999dI0sfAjoDW999999999999999999998SPWBoAu\nC9qLxxxxxxxxxxxxxxxxxxxK+AN58y9999999999999999999999\n  
> > NDYFZjeNqDY8rAsnnnnnnnnipppppppBA=\n", "MEEP\_X509\_SERVERCERT"=\>"LkuXuuuuuuuuuuuuuuuuuuuuuuEkyjjxxxxxxxxjD0GRCyH\nfZSfffffffffRrZxxxxxxSNIPxx="\>  
> > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CERT pulled out of data bag is  
> > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS KEY pulled out of data bag is  
> > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS ACCESS pulled out of data bag is AKIsuperthankforaskingXX  
> > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS SECRET pulled out of data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ
> > 
> > above, you can see i'm getting no value for x509\_cert and x509\_key, but i am for  
> > aws\_access and aws\_secret. i tossed a couple more lines into the recipe to look  
> > at #{x509\_cert.class} and #{x509\_cert.inspect}, and i can see it's an empty  
> > String; it's not nil.
> > 
> > when i run chef client 0.10.10 or 10.12, i get this:
> > 
> > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS CERT pulled out of data bag is MIIDjjCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
> > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS KEY pulled out of data bag is MIICXQyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy  
> > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS ACCESS pulled out of data bag is AKIsuperthankforaskingXX  
> > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS SECRET pulled out of data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ
> > 
> > the result i get works because i use x509\_cert and x509\_key to populate x509  
> > certs via a template. (but i do wonder why only the content of each is printed  
> > in the log up to the first newline.)
> > 
> > thanks!  
> > kallen

---

<div class="post-metadata">

**Author:** ![Kallen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallen/32/1049_2.png) [@Kallen](https://discourse.chef.io/u/Kallen)\
**Post date:** [January 23, 2013, 7:25pm UTC](https://discourse.chef.io/t/data-bag-problems-when-upgrading-from-10-12-to-10-14-and-up/3517/4 "2013-01-23T19:25:04Z")

</div>

thanks all. i'll give one or both of these a shot. time to switch contexts  
now...

On Wed, 23 Jan 2013, Daniel DeLeo wrote:

> See this ticket:  
> [http://tickets.opscode.com/browse/CHEF-3393](http://tickets.opscode.com/browse/CHEF-3393)
> 
> This is one of the reasons we changed the encrypted data bag item format in Chef 11.
> 
> FYI, Chef 10.18+ can read encrypted data bag items you create with Chef 11's knife command so you could potentially upgrade knife on your workstation without upgrading chef on your servers.
> 
> --  
> Daniel DeLeo
> 
> On Wednesday, January 23, 2013 at 2:29 AM, Jake Vanderdray wrote:
> 
> > Hi Kallen,
> > 
> > I don't know the exact details of the problem, but my colleagues ran into this and it apparently comes down to a change in the default yaml parser. Ultimately you'll need to re-create your encrypted data bags, but in the short-term you can add this to /etc/chef/client.rb in order to force newer versions of chef to use the old yaml parser.
> > 
> > YAML::ENGINE.yamler = 'syck'
> > 
> > Hope that helps,  
> > Jake.
> > 
> > On Wed, Jan 23, 2013 at 2:45 AM, \<[kallen@groknaut.net](mailto:kallen@groknaut.net) ([mailto:kallen@groknaut.net](mailto:kallen@groknaut.net))\> wrote:
> > 
> > > hiya.
> > > 
> > > i'm trying to upgrade my chef clients from chef-full-0.10.10-1 to 10.18, and  
> > > i just discovered a problem pulling values out of an encrypted data bag when  
> > > upgrading. during my tests, my example recipe (below) works with  
> > > chef-full-0.10.10-1 and chef-10.12.0-1, but breaks when i try chef-10.14.4-2  
> > > (and 10.16 and 10.18).
> > > 
> > > is this a known bug? or, do i need to do something differently?
> > > 
> > > here's a brief recipe that illustrates what's happening:
> > > 
> > > aws\_creds = Chef::EncryptedDataBagItem.load("secrets","aws-creds-quux")  
> > > grab\_cert = "MEEP\_X509\_SERVERCERT"  
> > > grab\_key = "MEEP\_X509\_PRIVATEKEY"  
> > > grab\_access = "MEEP\_AWS\_ACCESS\_KEY\_ID"  
> > > grab\_secret = "MEEP\_AWS\_SECRET\_ACCESS\_KEY"
> > > 
> > > x509\_cert = aws\_creds["#{grab\_cert}"]  
> > > x509\_key = aws\_creds["#{grab\_key}"]  
> > > aws\_access = aws\_creds["#{grab\_access}"]  
> > > aws\_secret = aws\_creds["#{grab\_secret}"]  
> > > Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.class} ")  
> > > Chef::Log.debug("HIGGS-BOSON: AWS CREDS #{aws\_creds.inspect} ")  
> > > Chef::Log.debug("HIGGS-BOSON: AWS CERT pulled out of data bag is #{x509\_cert}")  
> > > Chef::Log.debug("HIGGS-BOSON: AWS KEY pulled out of data bag is #{x509\_key}")  
> > > Chef::Log.debug("HIGGS-BOSON: AWS ACCESS pulled out of data bag is #{aws\_access}")  
> > > Chef::Log.debug("HIGGS-BOSON: AWS SECRET pulled out of data bag is #{aws\_secret}")
> > > 
> > > here's the logging results when the client runs 10.14. pardon the ugly data bag  
> > > inspection ... snipped for brevity.
> > > 
> > > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS Chef::EncryptedDataBagItem  
> > > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CREDS #\<Chef::EncryptedDataBagItem:0x00000002f8e358 @enc\_hash=data\_bag\_item["secrets", "aws-creds-quux",  
> > > {"BOOP\_X509\_SERVERCERT"=\>"z8qqqqqqqqqqqqqqqqqqqnr9mWxzzzzzzzzzzzzzz/sPYH7Cyw/\nQ9ftouk8RRRRRRRRRRRRF9Ryl/fmkkkkkkkkkkkkkkkkkkkkk0EFegz\nenmy1K2/VZph1kdE7DXxxxSNIP\n", "MEEP\_AWS\_SECRET\_ACCESS\_KEY"=\>"OJ9xxxxxxxxxxZFxxxxxxxxxxwMxxxxxxxxxxxux/rdPpxxxxxxxxxxoffff\ne2ec\n",  
> > > "id"=\>"aws-creds-quux", "BOOP\_AWS\_SECRET\_ACCESS\_KEY"=\>"m1xxxxxxxxxxrKpwh/dixxxxxxxxxxZkuxxxxxxxxxxpoxxxxxxxxxx1cr4\nEpmQ\n", "MEEP\_AWS\_ACCESS\_KEY\_ID"=\>"vtxxxxxxxxxxdCg/0xxxxxxxxxxloZxxxxxxxxxxx5hQ=\n", "BOOP\_X509\_PRIVATEKEY"=\>"NU99999999999999999999A6IEMUUKf7IccccccccccccccccccvtodL\nTy444444444444lQnePuuuuuuuuuuuuuuuuuuuuuuuDbuFB/hws\nSNIPxxxxxCHEXXjDk+oHWWWWWWefXHgQ999999SNIP\n",  
> > > "MEEP\_X509\_PRIVATEKEY"=\>"xa99999999999999999999dI0sfAjoDW999999999999999999998SPWBoAu\nC9qLxxxxxxxxxxxxxxxxxxxK+AN58y9999999999999999999999\n  
> > > NDYFZjeNqDY8rAsnnnnnnnnipppppppBA=\n", "MEEP\_X509\_SERVERCERT"=\>"LkuXuuuuuuuuuuuuuuuuuuuuuuEkyjjxxxxxxxxjD0GRCyH\nfZSfffffffffRrZxxxxxxSNIPxx="\>  
> > > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS CERT pulled out of data bag is  
> > > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS KEY pulled out of data bag is  
> > > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS ACCESS pulled out of data bag is AKIsuperthankforaskingXX  
> > > [2013-01-23T06:18:32+00:00] DEBUG: HIGGS-BOSON: AWS SECRET pulled out of data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ
> > > 
> > > above, you can see i'm getting no value for x509\_cert and x509\_key, but i am for  
> > > aws\_access and aws\_secret. i tossed a couple more lines into the recipe to look  
> > > at #{x509\_cert.class} and #{x509\_cert.inspect}, and i can see it's an empty  
> > > String; it's not nil.
> > > 
> > > when i run chef client 0.10.10 or 10.12, i get this:
> > > 
> > > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS CERT pulled out of data bag is MIIDjjCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  
> > > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS KEY pulled out of data bag is MIICXQyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy  
> > > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS ACCESS pulled out of data bag is AKIsuperthankforaskingXX  
> > > [Wed, 23 Jan 2013 06:17:34 +0000] DEBUG: HIGGS-BOSON: AWS SECRET pulled out of data bag is Z1DbeverlyhillbillieslexnLKzKF4xxxxxxnNQ
> > > 
> > > the result i get works because i use x509\_cert and x509\_key to populate x509  
> > > certs via a template. (but i do wonder why only the content of each is printed  
> > > in the log up to the first newline.)
> > > 
> > > thanks!  
> > > kallen