Passing secret as an Chef attribute while using encrypted databags

Question

I have already created a databag item which is existing on the chef server.
Now, I am trying to retrieve value of that databag item in Chef recipe
For that purpose, I am creating Chef Databag and trying to pass the secret as an attribute:

secret = Chef::EncryptedDataBagItem.load_secret("#{node['secret']}")
masterkey = Chef::EncryptedDataBagItem.load("databag_secrets", "databag_masterkey", secret)

I have declared node['secret'] as follows in the attribute section:

default['secret']="lTW4d+2Wfjlf1gZ42x3qsJh4/GcwqTc5+kS62qKeAHrhzTiL/Bxp+hq3itwudNfUFggCOEaMTsR+Q/qgjx6unKNvKWMKIdCeNM8I4jCUeT2VDaU6C1VxIMrVqfpUmInLuHOaUpVdlnlejkeLBL2KzH5vA8Xx5t2eACBRvrHacTwORMgVr/pnSKBcSzC/wXGoc7bGk7kTd6SaswRfZHnOowxfs2xkGJOFbzyTLZNAqkrJJurBq/ycYGRK2J3ycNyTwISfVgG9YAvP6prHKPsWTp3JgOWNIeZ9ZMSKUy8Lh0vopluXJhSd1WC6ltNcHxSb"

I am getting the following error:

ERROR: FFI_Yajl::ParseError: lexical error: invalid character inside string.
          S62qKeAHrhzTiL/Bxp+hq3itwudNfU
                                        FggCOEaMTsR+Q/qgjx6
                     (right here) ------^

Please let me know if it is allowed to pass secret as an attribute in Chef. If yes, how should I do that? If not, what is the best way to pass secret in a secure way?

This literally defeats the point of encrypted data bags. Don't do it. — coderanger

Martin Martin · Accepted Answer · 2016-05-18T18:16:21

According to the documentation, #load_secret should be passed a path to a file containing the secret. If you don't want to put the secret in a file (this is the preferred way), you can pass the secret to every #load call (as shown here):

Chef::EncryptedDataBagItem.load(data_bag, name, secret = nil)

Passing secret as an Chef attribute while using encrypted databags

1 Answers