1

I am using encrypted data bags within Chef and I want to add a condition within my Chef recipe as follows: 

If (test kitchen) then
  encryptkey = data_bag_item("tokens", "encryptkey")

If ( not test kitchen ) then
  secret = Chef::EncryptedDataBagItem.load_secret("/etc/chef/encrypted_data_bag_secret")
  encryptkey = Chef::EncryptedDataBagItem.load("tokens", "encryptkey", secret)

I have added data_bags_path and encrypted_data_bag_secret_key_path within kitchen.yml as follows:

provisioner:
  name: chef_zero
  chef_omnibus_url: omni-url/chef/install.sh
  roles_path: 'test/integration/default/roles'
  data_bags_path: "test/integration/default/data_bags"
  encrypted_data_bag_secret_key_path: "test/integration/default/encrypted_data_bag_secret"
StephenKing
  • 36,187
  • 11
  • 83
  • 112
meallhour
  • 13,921
  • 21
  • 60
  • 117
  • See https://github.com/test-kitchen/test-kitchen/issues/458 for chef's official non-answer. – chicks Apr 17 '18 at 21:02

2 Answers2

2

Use the attributes in your kitchen.yaml.

  suites:
  - name: default
    data_bags_path: 'databags'
    run_list:
      - recipe[x::y]
    attributes: {'kitchen' : 'true' }

Inside your recipe put if condition using the value of node['chef-mode'].

if node['kitchen'] == 'true'
    #something
else
   #else 
end
Shamik
  • 1,591
  • 2
  • 16
  • 36
0

Just use data_bag_item("tokens", "encryptkey") for both. It will take care of decryption for you automatically.

coderanger
  • 52,400
  • 4
  • 52
  • 75
  • But, if it is not kitchen test and the recipe is running directly on the server node, then how the node will know about the secret encryption key. Remember, in case of kitchen test I specifying the encryption key as `encrypted_data_bag_secret_key_path: "test/integration/default/encrypted_data_bag_secret"` within `kitchen.yml ` – meallhour Jul 10 '16 at 17:53
  • 1
    The path to the secret is configured in your `client.rb` but what you have there is the default I'm pretty sure. Chef handles loading the secret for you internally. – coderanger Jul 10 '16 at 19:28
  • I am getting this error `ERROR: No secret specified and no secret found at /etc/chef/encrypted_data_bag_secret` when I use `data_bag_item("tokens", "encryptkey")` – meallhour Jul 11 '16 at 15:56
  • do you think i should do `data_bag_item("tokens", "encryptkey", "secret")` instead? – meallhour Jul 11 '16 at 16:47
  • Is your secret in that file? If not, put it there. – coderanger Jul 12 '16 at 01:24