Setting chef vault variable in template.erb

Question

I have a vault item defined as the following in my recipe

item = ChefVault::Item.load("user","password")

How do i call this this in my template.erb? I tried the following which isn't working

ROOTPASSWORD= <%= @node["testcookbook"]["user"]["password"] %>

My vault item looks like this:

$ knife vault show user password
id:       password
pass: xxxxxxxxxx
username: chefuser

I generally do something like this within a recipe

ROOTPASSWORD #{item['pass']}

however I don't think that would work within a template.

Mrigesh Priyadarshi · Accepted Answer · 2016-08-20T13:44:45.670

6

There are two options to solve that problem though the second one should be preferred as that keeps your sensitive data private.

Suppose, if your vault look like this:

knife vault show user password
id:       password
pass: xxxxxxxxxx
username: chefuser

Then, you can approach like following:

Save as Node Attribute

First, if you want to set the password on node object and make it visible, then you can do something like below:

In recipe:

node.default["testcookbook"]["user"]["password"] = ChefVault::Item.load("user","password")['pass']

template '/tmp/template' do
  source 'template.erb'
  owner 'root'
  group 'root'
  mode '0644'
end

In Template:

ROOTPASSWORD= <%= node["testcookbook"]["user"]["password"] %>

Pass Data to the Template using `variables`

Second, if you don't want to set the password on node object and let it visible in chef run logs, then you can do something like below:-

template '/tmp/template' do
  source 'template.erb'
  owner 'root'
  group 'root'
  mode '0644'
  sensitive true
  variables( {:password => ChefVault::Item.load("user","password")['pass']})
end

In Template:

ROOTPASSWORD= <%= @password %>

edited Aug 20 '16 at 13:44

answered Aug 19 '16 at 03:28

Mrigesh Priyadarshi

940
9
15

3

Thanks for taking the time to explain it using code. I strongly vote for the second option. If you save it as a node attribute anyways, there's no need to have it in chef-vault. – StephenKing Aug 19 '16 at 06:18
Couldn't agree more! – Mrigesh Priyadarshi Aug 19 '16 at 06:21
Good to hear. I suggest to clarify that a bit more in your posting. People might copy&paste that without thinking or reading the discussion below. Btw. you can indicate your consensus by [upvoting comments](http://meta.stackexchange.com/questions/17364/how-does-comment-voting-and-flagging-work). – StephenKing Aug 19 '16 at 06:43
Thank you Mrigesh- I edited the initial question for clarity. – jebjeb Aug 19 '16 at 15:14
@jebjeb - Updated the solution. – Mrigesh Priyadarshi Aug 20 '16 at 13:45
Thank you Mrigesh. You solution worked perfectly. I have learned a lot. Thank you once again – jebjeb Aug 21 '16 at 17:16

Setting chef vault variable in template.erb

1 Answers1

Save as Node Attribute

Pass Data to the Template using variables

Pass Data to the Template using `variables`