# Encrypted databag question

**URL:** <https://discourse.chef.io/t/encrypted-databag-question/2130>\
**Category:** Chef Infra (archive)\
**Created:** [October 21, 2011, 8:52pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130 "2011-10-21T20:52:59Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 21, 2011, 8:52pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/1 "2011-10-21T20:52:59Z")

</div>

Hi all -

In the example on the opscode wiki,  
[http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there’s an example  
on how to point to a non-standard place for your secret file:

mysql\_creds = Chef::EncryptedDataBagItem.load(“passwords”, “mysql”, secret)

I’m struggling a bit with the “secret” in the above statement. From what I  
can tell, that can be a path (string) to the place where the secret file  
is. But for the life of me, I can’t seem to get that to click. I keep  
getting a “bad decrypt” stacktrace.

Is that supposed to be a path or the contents of the file?

Any suggestions?

---

<div class="post-metadata">

**Author:** ![AJ\_Christensen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/aj_christensen/32/525_2.png) [@AJ\_Christensen](https://discourse.chef.io/u/AJ_Christensen)\
**Post date:** [October 21, 2011, 9:00pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/2 "2011-10-21T21:00:48Z")

</div>

Yo,

You can put the secret anywhere.

The third argument is a string to the path of the file containing the key.

If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
omit the third argument.

Here are the codes for loading the secret:  
[https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)

HTH

–AJ

On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:

> Hi all -
> 
> In the example on the opscode wiki,  
> [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an example  
> on how to point to a non-standard place for your secret file:
> 
> mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql", secret)
> 
> I'm struggling a bit with the "secret" in the above statement. From what I  
> can tell, that can be a path (string) to the place where the secret file  
> is. But for the life of me, I can't seem to get that to click. I keep  
> getting a "bad decrypt" stacktrace.
> 
> Is that supposed to be a path or the contents of the file?
> 
> Any suggestions?

---

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 21, 2011, 9:12pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/3 "2011-10-21T21:12:02Z")

</div>

Ok, that's what I _thought_ and have the path to the secret file like this:

passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",  
"C:/chef/secret")

And the "secret" file is right in that location as specified above.

But I keep getting the following -

DEBUG: OpenSSL::Cipher::CipherError: bad decrypt

Is there something wrong with the key or with chef being unable to find the  
key?

On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz) wrote:

> Yo,
> 
> You can put the secret anywhere.
> 
> The third argument is a string to the path of the file containing the key.
> 
> If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> omit the third argument.
> 
> Here are the codes for loading the secret:
> 
> [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> 
> HTH
> 
> –AJ
> 
> On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> 
> > Hi all -
> > 
> > In the example on the opscode wiki,  
> > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > example  
> > on how to point to a non-standard place for your secret file:
> > 
> > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > secret)
> > 
> > I'm struggling a bit with the "secret" in the above statement. From what  
> > I  
> > can tell, that can be a path (string) to the place where the secret file  
> > is. But for the life of me, I can't seem to get that to click. I keep  
> > getting a "bad decrypt" stacktrace.
> > 
> > Is that supposed to be a path or the contents of the file?
> > 
> > Any suggestions?

---

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 21, 2011, 9:13pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/4 "2011-10-21T21:13:43Z")

</div>

Even in debug mode - it doesn't say much more if I change the path to  
"C:/asdfasdfasdf" or some other value that doesn't exist.

On Fri, Oct 21, 2011 at 5:12 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:

> Ok, that's what I _thought_ and have the path to the secret file like this:
> 
> passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",  
> "C:/chef/secret")
> 
> And the "secret" file is right in that location as specified above.
> 
> But I keep getting the following -
> 
> DEBUG: OpenSSL::Cipher::CipherError: bad decrypt
> 
> Is there something wrong with the key or with chef being unable to find the  
> key?
> 
> On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)wrote:
> 
> > Yo,
> > 
> > You can put the secret anywhere.
> > 
> > The third argument is a string to the path of the file containing the key.
> > 
> > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > omit the third argument.
> > 
> > Here are the codes for loading the secret:
> > 
> > [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> > 
> > HTH
> > 
> > –AJ
> > 
> > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > 
> > > Hi all -
> > > 
> > > In the example on the opscode wiki,  
> > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > example  
> > > on how to point to a non-standard place for your secret file:
> > > 
> > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > secret)
> > > 
> > > I'm struggling a bit with the "secret" in the above statement. From  
> > > what I  
> > > can tell, that can be a path (string) to the place where the secret file  
> > > is. But for the life of me, I can't seem to get that to click. I keep  
> > > getting a "bad decrypt" stacktrace.
> > > 
> > > Is that supposed to be a path or the contents of the file?
> > > 
> > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![AJ\_Christensen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/aj_christensen/32/525_2.png) [@AJ\_Christensen](https://discourse.chef.io/u/AJ_Christensen)\
**Post date:** [October 21, 2011, 9:15pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/5 "2011-10-21T21:15:07Z")

</div>

Can you show me the stack trace?

–AJ

On 22 October 2011 10:13, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:

> Even in debug mode - it doesn't say much more if I change the path to  
> "C:/asdfasdfasdf" or some other value that doesn't exist.
> 
> On Fri, Oct 21, 2011 at 5:12 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> 
> > Ok, that's what I _thought_ and have the path to the secret file like  
> > this:
> > 
> > passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",  
> > "C:/chef/secret")
> > 
> > And the "secret" file is right in that location as specified above.
> > 
> > But I keep getting the following -
> > 
> > DEBUG: OpenSSL::Cipher::CipherError: bad decrypt
> > 
> > Is there something wrong with the key or with chef being unable to find  
> > the key?
> > 
> > On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)  
> > wrote:
> > 
> > > Yo,
> > > 
> > > You can put the secret anywhere.
> > > 
> > > The third argument is a string to the path of the file containing the  
> > > key.
> > > 
> > > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > > omit the third argument.
> > > 
> > > Here are the codes for loading the secret:
> > > 
> > > [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> > > 
> > > HTH
> > > 
> > > –AJ
> > > 
> > > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > > 
> > > > Hi all -
> > > > 
> > > > In the example on the opscode wiki,  
> > > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > > example  
> > > > on how to point to a non-standard place for your secret file:
> > > > 
> > > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > > secret)
> > > > 
> > > > I'm struggling a bit with the "secret" in the above statement. From  
> > > > what I  
> > > > can tell, that can be a path (string) to the place where the secret  
> > > > file  
> > > > is. But for the life of me, I can't seem to get that to click. I keep  
> > > > getting a "bad decrypt" stacktrace.
> > > > 
> > > > Is that supposed to be a path or the contents of the file?
> > > > 
> > > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 21, 2011, 9:18pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/6 "2011-10-21T21:18:57Z")

</div>

[Fri, 21 Oct 2011 17:16:56 -0400] DEBUG: OpenSSL::Cipher::CipherError: bad  
decrypt  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted\_data\_bag\_item.rb:136:in  
`final' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted_data_bag_item.rb:136:in `cipher'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted\_data\_bag\_item.rb:102:in  
`decrypt_value' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted_data_bag_item.rb:63:in `'  
c:/chef/cache/cookbooks/edb\_demo/recipes/default.rb:13:in `from_file' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/cookbook_version.rb:578:in `load\_recipe'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/mixin/language\_include\_recipe.rb:40:in  
`include_recipe' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/mixin/language_include_recipe.rb:27:in `each'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/mixin/language\_include\_recipe.rb:27:in  
`include_recipe' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/run_context.rb:72:in `load'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/run\_context.rb:69:in  
`each' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/run_context.rb:69:in `load'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/client.rb:195:in  
`setup_run_context' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/client.rb:159:in `run'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application/client.rb:239:in  
`run_application' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application/client.rb:229:in `loop'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application/client.rb:229:in  
`run_application' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application.rb:67:in `run'  
C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/chef-client:26  
C:/buildtools/Ruby187/bin/chef-client:19:in `load'  
C:/buildtools/Ruby187/bin/chef-client:19  
[Fri, 21 Oct 2011 17:16:56 -0400] FATAL: OpenSSL::Cipher::CipherError: bad  
decrypt

On Fri, Oct 21, 2011 at 5:15 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz) wrote:

> Can you show me the stack trace?
> 
> –AJ
> 
> On 22 October 2011 10:13, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> 
> > Even in debug mode - it doesn't say much more if I change the path to  
> > "C:/asdfasdfasdf" or some other value that doesn't exist.
> > 
> > On Fri, Oct 21, 2011 at 5:12 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com)  
> > wrote:
> > 
> > > Ok, that's what I _thought_ and have the path to the secret file like  
> > > this:
> > > 
> > > passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",  
> > > "C:/chef/secret")
> > > 
> > > And the "secret" file is right in that location as specified above.
> > > 
> > > But I keep getting the following -
> > > 
> > > DEBUG: OpenSSL::Cipher::CipherError: bad decrypt
> > > 
> > > Is there something wrong with the key or with chef being unable to find  
> > > the key?
> > > 
> > > On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)  
> > > wrote:
> > > 
> > > > Yo,
> > > > 
> > > > You can put the secret anywhere.
> > > > 
> > > > The third argument is a string to the path of the file containing the  
> > > > key.
> > > > 
> > > > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > > > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > > > omit the third argument.
> > > > 
> > > > Here are the codes for loading the secret:
> 
> [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> 
> > > > HTH
> > > > 
> > > > –AJ
> > > > 
> > > > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > > > 
> > > > > Hi all -
> > > > > 
> > > > > In the example on the opscode wiki,  
> > > > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > > > example  
> > > > > on how to point to a non-standard place for your secret file:
> > > > > 
> > > > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > > > secret)
> > > > > 
> > > > > I'm struggling a bit with the "secret" in the above statement. From  
> > > > > what I  
> > > > > can tell, that can be a path (string) to the place where the secret  
> > > > > file  
> > > > > is. But for the life of me, I can't seem to get that to click. I  
> > > > > keep  
> > > > > getting a "bad decrypt" stacktrace.
> > > > > 
> > > > > Is that supposed to be a path or the contents of the file?
> > > > > 
> > > > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![AJ\_Christensen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/aj_christensen/32/525_2.png) [@AJ\_Christensen](https://discourse.chef.io/u/AJ_Christensen)\
**Post date:** [October 21, 2011, 9:22pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/7 "2011-10-21T21:22:23Z")

</div>

Did you use the same secret to encrypt the databag? Something bogus going on.

Can you use knife show to see the contents properly?

–AJ

On 22 October 2011 10:18, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:

> [Fri, 21 Oct 2011 17:16:56 -0400] DEBUG: OpenSSL::Cipher::CipherError: bad  
> decrypt  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted\_data\_bag\_item.rb:136:in  
> `final' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted_data_bag_item.rb:136:in `cipher'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted\_data\_bag\_item.rb:102:in  
> `decrypt_value' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/encrypted_data_bag_item.rb:63:in `'  
> c:/chef/cache/cookbooks/edb\_demo/recipes/default.rb:13:in `from_file' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/cookbook_version.rb:578:in `load\_recipe'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/mixin/language\_include\_recipe.rb:40:in  
> `include_recipe' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/mixin/language_include_recipe.rb:27:in `each'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/mixin/language\_include\_recipe.rb:27:in  
> `include_recipe' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/run_context.rb:72:in `load'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/run\_context.rb:69:in  
> `each' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/run_context.rb:69:in `load'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/client.rb:195:in  
> `setup_run_context' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/client.rb:159:in `run'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application/client.rb:239:in  
> `run_application' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application/client.rb:229:in `loop'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application/client.rb:229:in  
> `run_application' C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/../lib/chef/application.rb:67:in `run'  
> C:/buildtools/Ruby187/lib/ruby/gems/1.8/gems/chef-0.10.4/bin/chef-client:26  
> C:/buildtools/Ruby187/bin/chef-client:19:in `load'  
> C:/buildtools/Ruby187/bin/chef-client:19  
> [Fri, 21 Oct 2011 17:16:56 -0400] FATAL: OpenSSL::Cipher::CipherError: bad  
> decrypt
> 
> On Fri, Oct 21, 2011 at 5:15 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz) wrote:
> 
> > Can you show me the stack trace?
> > 
> > –AJ
> > 
> > On 22 October 2011 10:13, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > 
> > > Even in debug mode - it doesn't say much more if I change the path to  
> > > "C:/asdfasdfasdf" or some other value that doesn't exist.
> > > 
> > > On Fri, Oct 21, 2011 at 5:12 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com)  
> > > wrote:
> > > 
> > > > Ok, that's what I _thought_ and have the path to the secret file like  
> > > > this:
> > > > 
> > > > passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",  
> > > > "C:/chef/secret")
> > > > 
> > > > And the "secret" file is right in that location as specified above.
> > > > 
> > > > But I keep getting the following -
> > > > 
> > > > DEBUG: OpenSSL::Cipher::CipherError: bad decrypt
> > > > 
> > > > Is there something wrong with the key or with chef being unable to find  
> > > > the key?
> > > > 
> > > > On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)  
> > > > wrote:
> > > > 
> > > > > Yo,
> > > > > 
> > > > > You can put the secret anywhere.
> > > > > 
> > > > > The third argument is a string to the path of the file containing the  
> > > > > key.
> > > > > 
> > > > > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > > > > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > > > > omit the third argument.
> > > > > 
> > > > > Here are the codes for loading the secret:
> > > > > 
> > > > > [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> > > > > 
> > > > > HTH
> > > > > 
> > > > > –AJ
> > > > > 
> > > > > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > > > > 
> > > > > > Hi all -
> > > > > > 
> > > > > > In the example on the opscode wiki,  
> > > > > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > > > > example  
> > > > > > on how to point to a non-standard place for your secret file:
> > > > > > 
> > > > > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > > > > secret)
> > > > > > 
> > > > > > I'm struggling a bit with the "secret" in the above statement. From  
> > > > > > what I  
> > > > > > can tell, that can be a path (string) to the place where the secret  
> > > > > > file  
> > > > > > is. But for the life of me, I can't seem to get that to click. I  
> > > > > > keep  
> > > > > > getting a "bad decrypt" stacktrace.
> > > > > > 
> > > > > > Is that supposed to be a path or the contents of the file?
> > > > > > 
> > > > > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![werebus](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/werebus/32/24_2.png) [@werebus](https://discourse.chef.io/u/werebus)\
**Post date:** [October 21, 2011, 9:25pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/8 "2011-10-21T21:25:44Z")

</div>

I'm pretty sure that the 3rd argument is actually the encryption secret  
itself (see slightly higher  
up[https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L90-95](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L90-95)in  
the same file) If you want to use a file location other than the  
default, I think you're supposed to say so in your chef  
config[http://wiki.opscode.com/display/chef/Chef+Configuration+Settings](http://wiki.opscode.com/display/chef/Chef+Configuration+Settings)  
.

-Matt Moretti

On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz) wrote:

> Yo,
> 
> You can put the secret anywhere.
> 
> The third argument is a string to the path of the file containing the key.
> 
> If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> omit the third argument.
> 
> Here are the codes for loading the secret:
> 
> [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> 
> HTH
> 
> –AJ
> 
> On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> 
> > Hi all -
> > 
> > In the example on the opscode wiki,  
> > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > example  
> > on how to point to a non-standard place for your secret file:
> > 
> > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > secret)
> > 
> > I'm struggling a bit with the "secret" in the above statement. From what  
> > I  
> > can tell, that can be a path (string) to the place where the secret file  
> > is. But for the life of me, I can't seem to get that to click. I keep  
> > getting a "bad decrypt" stacktrace.
> > 
> > Is that supposed to be a path or the contents of the file?
> > 
> > Any suggestions?

---

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 21, 2011, 9:36pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/9 "2011-10-21T21:36:50Z")

</div>

Well, that worked, but I'm not sure I'm really jazzed by that solution.

I was able to update my client.rb file to point to the exact file the secret  
was in and it worked.

But, what if different cookbooks have different secret files?

Either way, the secret file isn't bad/borked...

So is there a way to set the default in the recipe or is it too late by  
then?

On Fri, Oct 21, 2011 at 5:25 PM, Matthew Moretti [werebus@gmail.com](mailto:werebus@gmail.com) wrote:

> I'm pretty sure that the 3rd argument is actually the encryption secret  
> itself (see slightly higher up[https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L90-95](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L90-95)in the same file) If you want to use a file location other than the  
> default, I think you're supposed to say so in your chef config[http://wiki.opscode.com/display/chef/Chef+Configuration+Settings](http://wiki.opscode.com/display/chef/Chef+Configuration+Settings)  
> .
> 
> -Matt Moretti
> 
> On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)wrote:
> 
> > Yo,
> > 
> > You can put the secret anywhere.
> > 
> > The third argument is a string to the path of the file containing the key.
> > 
> > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > omit the third argument.
> > 
> > Here are the codes for loading the secret:
> > 
> > [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> > 
> > HTH
> > 
> > –AJ
> > 
> > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > 
> > > Hi all -
> > > 
> > > In the example on the opscode wiki,  
> > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > example  
> > > on how to point to a non-standard place for your secret file:
> > > 
> > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > secret)
> > > 
> > > I'm struggling a bit with the "secret" in the above statement. From  
> > > what I  
> > > can tell, that can be a path (string) to the place where the secret file  
> > > is. But for the life of me, I can't seem to get that to click. I keep  
> > > getting a "bad decrypt" stacktrace.
> > > 
> > > Is that supposed to be a path or the contents of the file?
> > > 
> > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![werebus](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/werebus/32/24_2.png) [@werebus](https://discourse.chef.io/u/werebus)\
**Post date:** [October 21, 2011, 10:01pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/10 "2011-10-21T22:01:31Z")

</div>

Well, I haven't tried it (and I'm by no means an expert), but you could use  
the a combination of that 3rd option and file IO, I guess.

secret = IO.read("C:/chef/secret")  
mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql", secret)

Something in the back of my mind says there's a problem with what I'm  
suggesting, but I can't quite put my finger on it. I suspect that there  
should be a way to use the Chef libraries to read the data in from a  
cookbook file directly. Does anybody else have any thoughts?

-Matt

On Fri, Oct 21, 2011 at 5:36 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:

> Well, that worked, but I'm not sure I'm really jazzed by that solution.
> 
> I was able to update my client.rb file to point to the exact file the  
> secret was in and it worked.
> 
> But, what if different cookbooks have different secret files?
> 
> Either way, the secret file isn't bad/borked...
> 
> So is there a way to set the default in the recipe or is it too late by  
> then?
> 
> On Fri, Oct 21, 2011 at 5:25 PM, Matthew Moretti [werebus@gmail.com](mailto:werebus@gmail.com)wrote:
> 
> > I'm pretty sure that the 3rd argument is actually the encryption secret  
> > itself (see slightly higher up[https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L90-95](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L90-95)in the same file) If you want to use a file location other than the  
> > default, I think you're supposed to say so in your chef config[http://wiki.opscode.com/display/chef/Chef+Configuration+Settings](http://wiki.opscode.com/display/chef/Chef+Configuration+Settings)  
> > .
> > 
> > -Matt Moretti
> > 
> > On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)wrote:
> > 
> > > Yo,
> > > 
> > > You can put the secret anywhere.
> > > 
> > > The third argument is a string to the path of the file containing the  
> > > key.
> > > 
> > > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > > omit the third argument.
> > > 
> > > Here are the codes for loading the secret:
> > > 
> > > [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> > > 
> > > HTH
> > > 
> > > –AJ
> > > 
> > > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > > 
> > > > Hi all -
> > > > 
> > > > In the example on the opscode wiki,  
> > > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > > example  
> > > > on how to point to a non-standard place for your secret file:
> > > > 
> > > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > > secret)
> > > > 
> > > > I'm struggling a bit with the "secret" in the above statement. From  
> > > > what I  
> > > > can tell, that can be a path (string) to the place where the secret  
> > > > file  
> > > > is. But for the life of me, I can't seem to get that to click. I keep  
> > > > getting a "bad decrypt" stacktrace.
> > > > 
> > > > Is that supposed to be a path or the contents of the file?
> > > > 
> > > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 21, 2011, 10:25pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/11 "2011-10-21T22:25:33Z")

</div>

I was thinking more along the lines of something like:

Chef::Config[:encrypted\_data\_bag\_secret "C:/chef/encrypted\_data\_bag\_secret"]

Is there no way to explicitly set the chef config objects/values from inside  
a recipe?

If I do read in the contents of the file (like you suggest below) I get the  
same bad decrypt error.

I tried several other options (like using a file object instead and passing  
in the path result) and keep getting the same bad decrypt error.

On Fri, Oct 21, 2011 at 6:01 PM, Matthew Moretti [werebus@gmail.com](mailto:werebus@gmail.com) wrote:

> Well, I haven't tried it (and I'm by no means an expert), but you could use  
> the a combination of that 3rd option and file IO, I guess.
> 
> secret = IO.read("C:/chef/secret")
> 
> mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql", secret)
> 
> Something in the back of my mind says there's a problem with what I'm  
> suggesting, but I can't quite put my finger on it. I suspect that there  
> should be a way to use the Chef libraries to read the data in from a  
> cookbook file directly. Does anybody else have any thoughts?
> 
> -Matt
> 
> On Fri, Oct 21, 2011 at 5:36 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com)wrote:
> 
> > Well, that worked, but I'm not sure I'm really jazzed by that solution.
> > 
> > I was able to update my client.rb file to point to the exact file the  
> > secret was in and it worked.
> > 
> > But, what if different cookbooks have different secret files?
> > 
> > Either way, the secret file isn't bad/borked...
> > 
> > So is there a way to set the default in the recipe or is it too late by  
> > then?
> > 
> > On Fri, Oct 21, 2011 at 5:25 PM, Matthew Moretti [werebus@gmail.com](mailto:werebus@gmail.com)wrote:
> > 
> > > I'm pretty sure that the 3rd argument is actually the encryption secret  
> > > itself (see slightly higher up[https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L90-95](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L90-95)in the same file) If you want to use a file location other than the  
> > > default, I think you're supposed to say so in your chef config[http://wiki.opscode.com/display/chef/Chef+Configuration+Settings](http://wiki.opscode.com/display/chef/Chef+Configuration+Settings)  
> > > .
> > > 
> > > -Matt Moretti
> > > 
> > > On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)wrote:
> > > 
> > > > Yo,
> > > > 
> > > > You can put the secret anywhere.
> > > > 
> > > > The third argument is a string to the path of the file containing the  
> > > > key.
> > > > 
> > > > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > > > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > > > omit the third argument.
> > > > 
> > > > Here are the codes for loading the secret:
> > > > 
> > > > [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> > > > 
> > > > HTH
> > > > 
> > > > –AJ
> > > > 
> > > > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > > > 
> > > > > Hi all -
> > > > > 
> > > > > In the example on the opscode wiki,  
> > > > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > > > example  
> > > > > on how to point to a non-standard place for your secret file:
> > > > > 
> > > > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > > > secret)
> > > > > 
> > > > > I'm struggling a bit with the "secret" in the above statement. From  
> > > > > what I  
> > > > > can tell, that can be a path (string) to the place where the secret  
> > > > > file  
> > > > > is. But for the life of me, I can't seem to get that to click. I  
> > > > > keep  
> > > > > getting a "bad decrypt" stacktrace.
> > > > > 
> > > > > Is that supposed to be a path or the contents of the file?
> > > > > 
> > > > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 21, 2011, 11:01pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/12 "2011-10-21T23:01:30Z")

</div>

Ok, maybe this is again overkill, but I got it working like this:

secret =  
Chef::EncryptedDataBagItem.load\_secret("C:/chef/encrypted\_data\_bag\_secret")

passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",secret)

That works just fine.

Thoughts? This seems pretty wonky...

On Fri, Oct 21, 2011 at 6:25 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:

> I was thinking more along the lines of something like:
> 
> Chef::Config[:encrypted\_data\_bag\_secret  
> "C:/chef/encrypted\_data\_bag\_secret"]
> 
> Is there no way to explicitly set the chef config objects/values from  
> inside a recipe?
> 
> If I do read in the contents of the file (like you suggest below) I get the  
> same bad decrypt error.
> 
> I tried several other options (like using a file object instead and passing  
> in the path result) and keep getting the same bad decrypt error.
> 
> On Fri, Oct 21, 2011 at 6:01 PM, Matthew Moretti [werebus@gmail.com](mailto:werebus@gmail.com)wrote:
> 
> > Well, I haven't tried it (and I'm by no means an expert), but you could  
> > use the a combination of that 3rd option and file IO, I guess.
> > 
> > secret = IO.read("C:/chef/secret")
> > 
> > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > secret)
> > 
> > Something in the back of my mind says there's a problem with what I'm  
> > suggesting, but I can't quite put my finger on it. I suspect that there  
> > should be a way to use the Chef libraries to read the data in from a  
> > cookbook file directly. Does anybody else have any thoughts?
> > 
> > -Matt
> > 
> > On Fri, Oct 21, 2011 at 5:36 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com)wrote:
> > 
> > > Well, that worked, but I'm not sure I'm really jazzed by that solution.
> > > 
> > > I was able to update my client.rb file to point to the exact file the  
> > > secret was in and it worked.
> > > 
> > > But, what if different cookbooks have different secret files?
> > > 
> > > Either way, the secret file isn't bad/borked...
> > > 
> > > So is there a way to set the default in the recipe or is it too late by  
> > > then?
> > > 
> > > On Fri, Oct 21, 2011 at 5:25 PM, Matthew Moretti [werebus@gmail.com](mailto:werebus@gmail.com)wrote:
> > > 
> > > > I'm pretty sure that the 3rd argument is actually the encryption secret  
> > > > itself (see slightly higher up[https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L90-95](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L90-95)in the same file) If you want to use a file location other than the  
> > > > default, I think you're supposed to say so in your chef config[http://wiki.opscode.com/display/chef/Chef+Configuration+Settings](http://wiki.opscode.com/display/chef/Chef+Configuration+Settings)  
> > > > .
> > > > 
> > > > -Matt Moretti
> > > > 
> > > > On Fri, Oct 21, 2011 at 5:00 PM, AJ Christensen [aj@junglist.gen.nz](mailto:aj@junglist.gen.nz)wrote:
> > > > 
> > > > > Yo,
> > > > > 
> > > > > You can put the secret anywhere.
> > > > > 
> > > > > The third argument is a string to the path of the file containing the  
> > > > > key.
> > > > > 
> > > > > If you put your key in /etc/chef/encrypted\_data\_bag\_secret, the  
> > > > > default value of Chef::Config[:encrypted\_data\_bag\_secret], you can  
> > > > > omit the third argument.
> > > > > 
> > > > > Here are the codes for loading the secret:
> > > > > 
> > > > > [https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted\_data\_bag\_item.rb#L105-127](https://github.com/opscode/chef/blob/master/chef/lib/chef/encrypted_data_bag_item.rb#L105-127)
> > > > > 
> > > > > HTH
> > > > > 
> > > > > –AJ
> > > > > 
> > > > > On 22 October 2011 09:52, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:
> > > > > 
> > > > > > Hi all -
> > > > > > 
> > > > > > In the example on the opscode wiki,  
> > > > > > [http://wiki.opscode.com/display/chef/Encrypted+Data+Bags](http://wiki.opscode.com/display/chef/Encrypted+Data+Bags) there's an  
> > > > > > example  
> > > > > > on how to point to a non-standard place for your secret file:
> > > > > > 
> > > > > > mysql\_creds = Chef::EncryptedDataBagItem.load("passwords", "mysql",  
> > > > > > secret)
> > > > > > 
> > > > > > I'm struggling a bit with the "secret" in the above statement. From  
> > > > > > what I  
> > > > > > can tell, that can be a path (string) to the place where the secret  
> > > > > > file  
> > > > > > is. But for the life of me, I can't seem to get that to click. I  
> > > > > > keep  
> > > > > > getting a "bad decrypt" stacktrace.
> > > > > > 
> > > > > > Is that supposed to be a path or the contents of the file?
> > > > > > 
> > > > > > Any suggestions?

---

<div class="post-metadata">

**Author:** ![Seth\_Falcon\_01](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/seth_falcon_01/32/429_2.png) [@Seth\_Falcon\_01](https://discourse.chef.io/u/Seth_Falcon_01)\
**Post date:** [October 23, 2011, 3:46pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/13 "2011-10-23T15:46:15Z")

</div>

Hi Maven User,

On Fri, Oct 21, 2011 at 4:01 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com) wrote:

> Ok, maybe this is again overkill, but I got it working like this:
> 
> secret =  
> Chef::EncryptedDataBagItem.load\_secret("C:/chef/encrypted\_data\_bag\_secret")
> 
> passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",secret)
> 
> That works just fine.
> 
> Thoughts? This seems pretty wonky...

The current design is that EncryptedDataBagItem.load takes the  
encryption secret itself, not a path to a file. If an encryption  
secret is not specified, one is loaded via  
Chef::Config[:encrypted\_data\_bag\_secret].

The thinking was to keep the storage of the secret decoupled from the  
function to load/decrypt. I can see that taking a path instead of the  
secret might increase convenience. The downside is it would prevent  
one from obtaining the secret in other ways.

The secret is sensitive to trailing new lines and other whitespace.  
EncryptedDataBagItem.load\_secret is doing two things for you: (1)  
calling IO.read(path).strip which takes care of the trailing newline,  
and (2) inspecting the specified path and loading data from a URL if  
that is what was specified.

So Matthew's suggestion to use IO.read just needed an extra .strip:

secret = IO.read("C:/chef/secret").strip

> > > On Fri, Oct 21, 2011 at 5:36 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com)  
> > > wrote:
> > > 
> > > > Well, that worked, but I'm not sure I'm really jazzed by that solution.
> > > > 
> > > > I was able to update my client.rb file to point to the exact file the  
> > > > secret was in and it worked.
> > > > 
> > > > But, what if different cookbooks have different secret files?

I can imagine wanting to use more than one encrypted data bag item  
each with its own secret on the same node. To achieve that with the  
current code you will need to use two steps to load as you've done.

I think it would be better to keep cookbooks decoupled from secrets. A  
recipe might require one or more encrypted data bag items, but ideally  
the secret used is data driven so that dev, preprod, and prod can all  
use the same cookbook with different shared secrets.

I'd be interested to hear more details on how you and others are using  
encrypted data bag items with a focus on what the encryption is  
protecting against.

- seth

--  
Seth Falcon | Development Lead | Opscode | @sfalcon

---

<div class="post-metadata">

**Author:** ![Maven\_User](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Maven\_User](https://discourse.chef.io/u/Maven_User)\
**Post date:** [October 24, 2011, 2:21pm UTC](https://discourse.chef.io/t/encrypted-databag-question/2130/14 "2011-10-24T14:21:50Z")

</div>

Awesome - thanks for the reply.

Might I suggest adding this information to the various wiki pages? I'm sure  
someone else will fall into this as well.

It really reads that the third argument can either be the contents of the  
secret OR the path to the secret file.

Maybe I misread the actual method as well as it seemed to do different  
things depending on if it was passed a path or not.

What we're doing is hiding staging and production passwords (only) and I'll  
likely put in a fork that makes sure that if the env is NOT prod or stage,  
then get the passwords (likely from another databag or from the environment  
definition.

On Sun, Oct 23, 2011 at 11:46 AM, Seth Falcon [seth@opscode.com](mailto:seth@opscode.com) wrote:

> Hi Maven User,
> 
> On Fri, Oct 21, 2011 at 4:01 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com)  
> wrote:
> 
> > Ok, maybe this is again overkill, but I got it working like this:
> > 
> > secret =
> 
> Chef::EncryptedDataBagItem.load\_secret("C:/chef/encrypted\_data\_bag\_secret")
> 
> > passwords = Chef::EncryptedDataBagItem.load("prod", "passwords",secret)
> > 
> > That works just fine.
> > 
> > Thoughts? This seems pretty wonky...
> 
> The current design is that EncryptedDataBagItem.load takes the  
> encryption secret itself, not a path to a file. If an encryption  
> secret is not specified, one is loaded via  
> Chef::Config[:encrypted\_data\_bag\_secret].
> 
> The thinking was to keep the storage of the secret decoupled from the  
> function to load/decrypt. I can see that taking a path instead of the  
> secret might increase convenience. The downside is it would prevent  
> one from obtaining the secret in other ways.
> 
> The secret is sensitive to trailing new lines and other whitespace.  
> EncryptedDataBagItem.load\_secret is doing two things for you: (1)  
> calling IO.read(path).strip which takes care of the trailing newline,  
> and (2) inspecting the specified path and loading data from a URL if  
> that is what was specified.
> 
> So Matthew's suggestion to use IO.read just needed an extra .strip:
> 
> secret = IO.read("C:/chef/secret").strip
> 
> > > > On Fri, Oct 21, 2011 at 5:36 PM, Maven User [maven.2.user@gmail.com](mailto:maven.2.user@gmail.com)  
> > > > wrote:
> > > > 
> > > > > Well, that worked, but I'm not sure I'm really jazzed by that  
> > > > > solution.
> > > > > 
> > > > > I was able to update my client.rb file to point to the exact file the  
> > > > > secret was in and it worked.
> > > > > 
> > > > > But, what if different cookbooks have different secret files?
> 
> I can imagine wanting to use more than one encrypted data bag item  
> each with its own secret on the same node. To achieve that with the  
> current code you will need to use two steps to load as you've done.
> 
> I think it would be better to keep cookbooks decoupled from secrets. A  
> recipe might require one or more encrypted data bag items, but ideally  
> the secret used is data driven so that dev, preprod, and prod can all  
> use the same cookbook with different shared secrets.
> 
> I'd be interested to hear more details on how you and others are using  
> encrypted data bag items with a focus on what the encryption is  
> protecting against.
> 
> - seth
> 
> --  
> Seth Falcon | Development Lead | Opscode | @sfalcon