# How to use databag in template

**URL:** <https://discourse.chef.io/t/how-to-use-databag-in-template/14286>\
**Category:** Chef Infra (archive)\
**Created:** [January 10, 2019, 6:14pm UTC](https://discourse.chef.io/t/how-to-use-databag-in-template/14286 "2019-01-10T18:14:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marathiboy](https://avatars.discourse-cdn.com/v4/letter/m/258eb7/32.png) [@Marathiboy](https://discourse.chef.io/u/Marathiboy)\
**Post date:** [January 10, 2019, 6:14pm UTC](https://discourse.chef.io/t/how-to-use-databag-in-template/14286/1 "2019-01-10T18:14:35Z")

</div>

I have a generic recipe which just loops over templates The recipe do not and can not pass any variables to template, and currently template is getting everything directly from node attributes.

Now, I need to use databag as some of these node attributes are sensitive and must be moved to a databag.

How can I achieve this by still keeping my recipe generic? any code code sample to access data bag from template(erb) will be appreciated.

Thanks

M

---

<div class="post-metadata">

**Author:** ![simark](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/simark/32/2099_2.png) [@simark](https://discourse.chef.io/u/simark)\
**Post date:** [January 10, 2019, 8:14pm UTC](https://discourse.chef.io/t/how-to-use-databag-in-template/14286/2 "2019-01-10T20:14:50Z")

</div>

Hi @Marathiboy,

The databag was designed to store global attributes that are accessable by all nodes bootsrapped to the chef-server and by anyone who has the necessary pem files to authenticate to the chef-server.  
If you really want to keep secrets that are sensitive data you should atleast use encrypted databags  
[https://docs.chef.io/data\_bags.html](https://docs.chef.io/data_bags.html)  
or better, chef-vault  
[https://docs.chef.io/chef\_vault.html](https://docs.chef.io/chef_vault.html)

But back to the original question...  
You can overwrite the corresponding attributes in the recipe through the node object before starting the iteration over the templates:  
`node.default[your_attribute] = data_bag_item('bag_name', 'item')`

The problem with this solution that the node object now contains the sensitive data and it will be stored in plaintext on the chef-server at the end of the chef-cilent run.  
To avoid this you can blacklist the sensitive attributes  
[https://docs.chef.io/attributes.html#blacklist-attributes](https://docs.chef.io/attributes.html#blacklist-attributes)  
or better try using variable option in the templates resource and read the databag directly into the variable.

Hopes this help

---

<div class="post-metadata">

**Author:** ![gryte](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/gryte/32/2377_2.png) [@gryte](https://discourse.chef.io/u/gryte)\
**Post date:** [January 10, 2019, 9:37pm UTC](https://discourse.chef.io/t/how-to-use-databag-in-template/14286/3 "2019-01-10T21:37:32Z")

</div>

Here's an example of how I loop through an encrypted databag in an .erb template.

> <https://github.com/gryte/delugeserver/blob/master/templates/default/auth.erb>

---

<div class="post-metadata">

**Author:** ![Marathiboy](https://avatars.discourse-cdn.com/v4/letter/m/258eb7/32.png) [@Marathiboy](https://discourse.chef.io/u/Marathiboy)\
**Post date:** [January 11, 2019, 1:51pm UTC](https://discourse.chef.io/t/how-to-use-databag-in-template/14286/4 "2019-01-11T13:51:27Z")

</div>

Thanks

This helps!

M

---

<div class="post-metadata">

**Author:** ![danjcarrington](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/danjcarrington/32/2610_2.png) [@danjcarrington](https://discourse.chef.io/u/danjcarrington)\
**Post date:** [April 24, 2020, 5:27pm UTC](https://discourse.chef.io/t/how-to-use-databag-in-template/14286/5 "2020-04-24T17:27:34Z")

</div>

When I try to do this, I end up getting and error:

```
Chef::Mixin::Template::TemplateError
------------------------------------
uninitialized constant Chef::Databag

```

Is there something I need to do at the recipe level or somewhere else in order for this syntax to work properly?

Edit:

Just noticed I have "Databag" instead of "DataBag"

---

<div class="post-metadata">

**Author:** ![danjcarrington](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/danjcarrington/32/2610_2.png) [@danjcarrington](https://discourse.chef.io/u/danjcarrington)\
**Post date:** [April 24, 2020, 7:26pm UTC](https://discourse.chef.io/t/how-to-use-databag-in-template/14286/6 "2020-04-24T19:26:25Z")

</div>

I've gotten past the error after fixing the stupid syntax issue using lowercase. Now, I'm trying to figure out how to actually get to the data. I haven't been able to find how to drill down into the data bag and get the information I need.

So, my data bag is structured like this:

$ knife data bag show ldapservers corp-domain

> ```
> addc:
> ldapserver1
> ldapserver2
> dnsserver1: dnsserver1
> dnsserver2: dnsserver1
> id: corp-domain
> ntpservers:
> ntpserver1
> ntpserver1
> 
> ```

In my template, I have:

> \<% ldapservers = Chef::DataBag.load( 'ldapservers' ) %\>  
> \<% ldapservers.each do |dc| %\>  
> \<% adserver = Chef::DataBagItem.load( 'ldapservers', dc[0] ) %\>  
> adserver:\<%= adserver %\>  
> \<% end %\>

When I run the recipe, the 'adserver' gets resolved to:

> adserver: data\_bag\_item(corp-domain)

So, how do I reference the data bag to get the server names out so that I can populate templates for /etc/ntp.conf, /etc/resolv.conf and /etc/ldap.conf files?

Sorry...this stuff is very new to me. Thanks for any help!