We’ve been pushing the habi-chef pattern for some services that handle a divorce from system configuration in a really clean way. Our usual chef pattern for secret management is:
Chef runs with policy group X
Chef fetches secrets from Hashicorp Vault under namespace X
Chef compiles and launches.
Everything is awesome
As best I can tell I don’t have any way to set a habi-chef converge to assume a particular policy_group or send in any runtime attributes to identify the environment a node is converging in. Are these assumptions fact? Anyone have an approach here if not?