chef-encrypted-attributes 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e1bb2baddf0f4e35d5b5fb127fd7ce2df1c28612
-  data.tar.gz: 92504e332a6b3ae5a15746f727149fa7e6c9fcc2
+  metadata.gz: 81a47b4f918da2922455d6f7ad7b30905f62f4b4
+  data.tar.gz: 8addbdca43184f9f8667cb4892caeaa611dbbc29
 SHA512:
-  metadata.gz: 919dff2768d33583bdedcf661865091c494b0e6a9a5823fe0aebed15bfa2db812c9c82c5647084f811f93c6b688cb37d314b2686c949f7a6a38fe9685934dfef
-  data.tar.gz: f802b87b39e85e74b402acb3ffbae41f5d3c3e51e0eb862b3b09c4692dbc1551b0a37f57a9fced0f03f6b8007c0a56f028ccd17d3a043cb7e3fac34ee7953c82
+  metadata.gz: 7fbcf0de4167e824004e14ec8f8989f3faa3b802d27d470ac2fbd2c7fd16af34f706286b1b4a605f1427ab2db07f01a66994276b097b4dfa7a139d0255bd70e7
+  data.tar.gz: 2cc100fdfc8c09f5697a46d5c0765ef1815df93974da30ea154baafb4a76921797abe9a83e54edc9e688d02e793dcff82779ed2f307bc90e17aa19d9c0de200a

data/API.md

@@ -28,9 +28,9 @@ An exception is thrown if any error arises in the encryption process.
 
 ### Chef::EncryptedAttribute.update(hs [, config])
 
-Updates who can read the attribute. This is intended to be used to update to the new nodes returned by the `:client_search` or perhaps global configuration changes.
+Updates who can read the attribute. This is intended to be used to update to the new nodes returned by `:client_search` and `:node_search` or perhaps global configuration changes.
 
-For example, in case new nodes are added or some are removed, and the clients returned by `:client_search` are different, this `#update` method will decrypt the attribute and encrypt it again for the new nodes (or remove the old ones).
+For example, in case new nodes are added or some are removed, and the clients returned by `:client_search` or `:node_search` are different, this `#update` method will decrypt the attribute and encrypt it again for the new nodes (or remove the old ones).
 
 If an update is made, the shared secrets are regenerated.
 
@@ -109,6 +109,7 @@ Both `Chef::Config[:encrypted_attributes]` and method's `config` parameter shoul
  * OpenSSL `>= 1.0.1`.
 * `:partial_search` - Whether to use Chef Server partial search, enabled by default. It may not work in some old versions of Chef Server.
 * `:client_search` - Search query for clients allowed to read the encrypted attribute. Can be a simple string or an array of queries to be *OR*-ed.
+* `:node_search` - Search query for nodes allowed to read the encrypted attribute. Can be a simple string or an array of queries to be *OR*-ed.
 * `:users` - Array of user names to be allowed to read the encrypted attribute(s). `"*"` to allow access to all users. Keep in mind that only admin clients or admin users are allowed to read user public keys. It is **not recommended** to use this from cookbooks unless you know what you are doing.
 * `:keys` - raw RSA public keys to be allowed to read encrypted attributes(s), in PEM (string) format. Can be client public keys, user public keys or any other RSA public key.
 
@@ -148,6 +149,7 @@ This API uses some LRU caches to avoid making many requests to the Chef Server.
 This are the currently available caches:
 
 * `Chef::EncryptedAttribute::RemoteClients.cache` - Caches the `:client_search` query results (max_size: `1024`).
+* `Chef::EncryptedAttribute::RemoteNodes.cache` - Caches the `:node_search` query results (max_size: `1024`).
 * `Chef::EncryptedAttribute::RemoteUsers.cache` - Caches the Chef Users public keys (max_size: `1024`).
 * `Chef::EncryptedAttribute::RemoteNode.cache` - Caches the node (encrypted) attributes. Disabled by default (max_size: `0`).
 

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 This file is used to list changes made in each version of `chef-encrypted-attributes`.
 
+## 0.3.0:
+
+* gemspec: added the missing CONTRIBUTING.md file
+* README: replaced exist_on_node? by exist? in users_data_bag example
+* Added the required `:node_search` option (fixes the `"role:..."` examples).
+
 ## 0.2.0:
 
 * Deprecate `#exists?` methods in favor of `#exist?` methods

data/CONTRIBUTING.md

@@ -0,0 +1,13 @@
+Contributing
+============
+
+1. [Fork the repository on Github](https://help.github.com/articles/fork-a-repo).
+2. Create a named feature branch (`$ git checkout -b my-new-feature`).
+3. Write tests for your change (if applicable).
+4. Write your change.
+5. [Run the tests](TESTING.md), ensuring they all pass (`$ bundle exec rake`). Try as much as possible **not to reduce coverage**.
+6. Commit your change (`$ git commit -am 'Add some feature'`).
+7. Push to the branch (`$ git push origin my-new-feature`).
+8. [Submit a Pull Request using Github](https://help.github.com/articles/creating-a-pull-request).
+
+You can see the [TODO.md](TODO.md) file if you're looking for inspiration.

data/README.md

@@ -1,8 +1,8 @@
 # Chef-Encrypted-Attributes
 [![Gem Version](http://img.shields.io/gem/v/chef-encrypted-attributes.svg?style=flat)](http://badge.fury.io/rb/chef-encrypted-attributes)
 [![Dependency Status](http://img.shields.io/gemnasium/onddo/chef-encrypted-attributes.svg?style=flat)](https://gemnasium.com/onddo/chef-encrypted-attributes)
-[![Build Status](http://img.shields.io/travis/onddo/chef-encrypted-attributes.svg?style=flat)](https://travis-ci.org/onddo/chef-encrypted-attributes)
-[![Coverage Status](http://img.shields.io/coveralls/onddo/chef-encrypted-attributes.svg?style=flat)](https://coveralls.io/r/onddo/chef-encrypted-attributes?branch=master)
+[![Build Status](http://img.shields.io/travis/onddo/chef-encrypted-attributes/0.3.0.svg?style=flat)](https://travis-ci.org/onddo/chef-encrypted-attributes)
+[![Coverage Status](http://img.shields.io/coveralls/onddo/chef-encrypted-attributes/0.3.0.svg?style=flat)](https://coveralls.io/r/onddo/chef-encrypted-attributes?branch=0.3.0)
 
 [Chef](http://www.getchef.com) plugin to add Node encrypted attributes support using client keys.
 
@@ -12,7 +12,7 @@ We recommend using the [encrypted_attributes cookbook](http://community.opscode.
 
 Node attributes are encrypted using chef client and user keys with public key infrastructure (PKI). You can choose which clients, nodes or users will be able to read the attribute.
 
-Node clients with read access can be specified using a `client_search` query. In case new nodes are added or removed, the data will be re-encrypted in the next *Chef Run* of the encrypting node (using the `#update` method shown below).
+*Chef Nodes* with read access can be specified using a `node_search` query. In case new nodes are added or removed, the data will be re-encrypted in the next *Chef Run* of the encrypting node (using the `#update` method shown below). Similarly, a `client_search` query can be used to allow *Chef Clients* to read the attribute.
 
 ## Requirements
 
@@ -69,8 +69,11 @@ In this example we only need to save some data from the local node and read it f
 chef_gem "chef-encrypted-attributes"
 require "chef-encrypted-attributes"
 
+# Allow all admin clients to read the attributes encrypted by me
+Chef::Config[:encrypted_attributes][:client_search] = "admin:true"
+
 # Allow all webapp nodes to read the attributes encrypted by me
-Chef::Config[:encrypted_attributes][:client_search] = "role:webapp"
+Chef::Config[:encrypted_attributes][:node_search] = "role:webapp"
 
 if Chef::EncryptedAttribute.exist?(node["myapp"]["encrypted_data"])
   # when can used #load here as above if we need the `encrypted_data` outside this `if`
@@ -127,7 +130,7 @@ chef_users.delete("id") # remove the data bag "id" to avoid to confuse it with a
 Chef::Log.debug("Admin users able to read the Encrypted Attributes: #{chef_users.keys.inspect}")
 Chef::Config[:encrypted_attributes][:keys] = chef_users.values
 
-# if Chef::EncryptedAttribute.exist_on_node?(...)
+# if Chef::EncryptedAttribute.exist?(...)
 #   Chef::EncryptedAttribute.update(...)
 # else
 #   node.set[...][...] = Chef::EncryptedAttribute.create(...)
@@ -202,7 +205,7 @@ For example:
 
 ### knife encrypted attribute update
 
-Updates who can read the attribute (for `:client_search` changes).
+Updates who can read the attribute (for `:client_search` and `:node_search` changes).
 
     $ knife encrypted attribute update NODE ATTRIBUTE (options)
 
@@ -212,7 +215,7 @@ For example:
 
     $ knife encrypted attribute update ftp.example.com myapp.ftp_password \
         --client-search admin:true \
-        --client-search role:webapp \
+        --node-search role:webapp \
         -U bob -U alice
 
 ### knife encrypted attribute edit
@@ -230,7 +233,7 @@ For example:
     $ export EDITOR=vi
     $ knife encrypted attribute edit ftp.example.com myapp.ftp_password \
         --client-search admin:true \
-        --client-search role:webapp \
+        --node-search role:webapp \
         -U bob -U alice
 
 ### knife encrypted attribute delete
@@ -274,6 +277,13 @@ For example:
     <td>&nbsp;</td>
     <td>create, edit, update</td>
   </tr>
+  <tr>
+    <td>-N</td>
+    <td>--node-search</td>
+    <td>Node search query. Can be specified multiple times</td>
+    <td>&nbsp;</td>
+    <td>create, edit, update</td>
+  </tr>
   <tr>
     <td>-U</td>
     <td>--user</td>

data/TODO.md

@@ -2,7 +2,7 @@ TODO
 ====
 
 * knife encrypted attribute create/edit from file.
-* Save config inside encrypted data: `:client_search` and `:keys` (including user keys).
+* Save config inside encrypted data: `:client_search`, `:node_search` and `:keys` (including user keys).
 * Chef internal node attribute integration monkey-patch. It may require some `EncryptedMash` class rewrite or adding some methods.
 * Support for Chef `< 11.4` (add `JSONCompat#map_to_rb_obj`, disable `Chef::User` for `< 11.2`, ...).
 * Test with Chef `10`.

data/lib/chef/encrypted_attribute.rb

@@ -20,10 +20,10 @@ require 'chef/encrypted_attribute/config'
 require 'chef/encrypted_attribute/encrypted_mash'
 require 'chef/config'
 require 'chef/mash'
-require 'chef/api_client'
 
 require 'chef/encrypted_attribute/local_node'
 require 'chef/encrypted_attribute/remote_node'
+require 'chef/encrypted_attribute/remote_nodes'
 require 'chef/encrypted_attribute/remote_clients'
 require 'chef/encrypted_attribute/remote_users'
 require 'chef/encrypted_attribute/encrypted_mash/version0'
@@ -68,7 +68,7 @@ class Chef
 
     def create_on_node(name, attr_ary, value)
       # read the client public key
-      node_public_key = Chef::ApiClient.load(name).public_key
+      node_public_key = RemoteClients.get_public_key(name)
 
       # create the encrypted attribute
       enc_attr = self.create(value, [ node_public_key ])
@@ -93,7 +93,7 @@ class Chef
 
     def update_on_node(name, attr_ary)
       # read the client public key
-      node_public_key = Chef::ApiClient.load(name).public_key
+      node_public_key = RemoteClients.get_public_key(name)
 
       # update the encrypted attribute
       remote_node = RemoteNode.new(name)
@@ -111,7 +111,11 @@ class Chef
     protected
 
     def remote_client_keys
-      RemoteClients.get_public_keys(config.client_search, config.partial_search)
+      RemoteClients.search_public_keys(config.client_search, config.partial_search)
+    end
+
+    def remote_node_keys
+      RemoteNodes.search_public_keys(config.node_search, config.partial_search)
     end
 
     def remote_user_keys
@@ -119,7 +123,7 @@ class Chef
     end
 
     def target_keys(keys=nil)
-      target_keys = config.keys + remote_client_keys + remote_user_keys
+      target_keys = config.keys + remote_client_keys + remote_node_keys + remote_user_keys
       target_keys += keys if keys.kind_of?(Array)
       target_keys
     end

data/lib/chef/encrypted_attribute/config.rb

@@ -27,6 +27,7 @@ class Chef
         :version,
         :partial_search,
         :client_search,
+        :node_search,
         :users,
         :keys,
       ].freeze
@@ -69,6 +70,19 @@ class Chef
         )
       end
 
+      def node_search(arg=nil)
+        unless arg.nil? or not arg.kind_of?(String)
+          arg = [ arg ]
+        end
+        set_or_return(
+          :node_search,
+          arg,
+          :kind_of => Array,
+          :default => [],
+          :callbacks => config_search_array_callbacks
+        )
+      end
+
       def users(arg=nil)
         set_or_return(
           :users,

data/lib/chef/encrypted_attribute/exceptions.rb

@@ -30,6 +30,7 @@ class Chef
 
     class InsufficientPrivileges < StandardError; end
     class UserNotFound < StandardError; end
+    class ClientNotFound < StandardError; end
 
     class SearchFailure < StandardError; end
     class SearchFatalError < StandardError; end

data/lib/chef/encrypted_attribute/remote_clients.rb

@@ -16,6 +16,9 @@
 # limitations under the License.
 #
 
+require 'chef/api_client'
+
+require 'chef/encrypted_attribute/exceptions'
 require 'chef/encrypted_attribute/search_helper'
 require 'chef/encrypted_attribute/cache_lru'
 
@@ -28,7 +31,18 @@ class Chef
         @@cache ||= Chef::EncryptedAttribute::CacheLru.new
       end
 
-      def self.get_public_keys(search='*:*', partial_search=true)
+      def self.get_public_key(name)
+        Chef::ApiClient.load(name).public_key
+      rescue Net::HTTPServerException => e
+        case e.response.code
+        when '404' # Not Found
+          raise ClientNotFound, "Chef Client not found: \"#{name}\"."
+        else
+          raise e
+        end
+      end
+
+      def self.search_public_keys(search='*:*', partial_search=true)
         escaped_query = escape_query(search)
         if cache.has_key?(escaped_query)
           cache[escaped_query]

data/lib/chef/encrypted_attribute/remote_nodes.rb

@@ -0,0 +1,48 @@
+#
+# Author:: Xabier de Zuazo (<xabier@onddo.com>)
+# Copyright:: Copyright (c) 2014 Onddo Labs, SL. (www.onddo.com)
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'chef/encrypted_attribute/exceptions'
+require 'chef/encrypted_attribute/search_helper'
+require 'chef/encrypted_attribute/cache_lru'
+require 'chef/encrypted_attribute/remote_clients'
+
+class Chef
+  class EncryptedAttribute
+    class RemoteNodes
+      extend ::Chef::EncryptedAttribute::SearchHelper
+
+      def self.cache
+        @@cache ||= Chef::EncryptedAttribute::CacheLru.new
+      end
+
+      def self.search_public_keys(search='*:*', partial_search=true)
+        escaped_query = escape_query(search)
+        if cache.has_key?(escaped_query)
+          cache[escaped_query]
+        else
+          cache[escaped_query] = search(:node, search, {
+            'name' => [ 'name' ]
+          }, 1000, partial_search).map do |node|
+            RemoteClients.get_public_key(node['name'])
+          end.compact
+        end
+      end
+
+    end
+  end
+end

data/lib/chef/encrypted_attribute/version.rb

@@ -18,6 +18,6 @@
 
 class Chef
   class EncryptedAttribute
-    VERSION = '0.2.0'
+    VERSION = '0.3.0'
   end
 end

data/lib/chef/knife/core/encrypted_attribute_editor_options.rb

@@ -52,6 +52,15 @@ class Chef
                 Chef::Config[:knife][:encrypted_attributes][:client_search] << i
               }
 
+            option :encrypted_attribute_node_search,
+              :short => '-N NODE_SEARCH_QUERY',
+              :long => '--node-search NODE_SEARCH_QUERY',
+              :description => 'Node search query. Can be specified multiple times',
+              :proc => lambda { |i|
+                Chef::Config[:knife][:encrypted_attributes][:node_search] = [] unless Chef::Config[:knife][:encrypted_attributes][:node_search].kind_of?(Array)
+                Chef::Config[:knife][:encrypted_attributes][:node_search] << i
+              }
+
             option :encrypted_attribute_users,
               :short => '-U USER',
               :long => '--encrypted-attribute-user USER',

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chef-encrypted-attributes
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Onddo Labs, SL.
@@ -30,7 +30,7 @@ cert_chain:
   cYe8PqNEkky7ugvF4zU3sB6TW+96XasuwDv1uJmyr35LF15U6Cs83+osMbAKJTmG
   /vqKzw==
   -----END CERTIFICATE-----
-date: 2014-08-12 00:00:00.000000000 Z
+date: 2014-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: yajl-ruby
@@ -166,6 +166,7 @@ extra_rdoc_files: []
 files:
 - API.md
 - CHANGELOG.md
+- CONTRIBUTING.md
 - INTERNAL.md
 - LICENSE
 - README.md
@@ -185,6 +186,7 @@ files:
 - lib/chef/encrypted_attribute/local_node.rb
 - lib/chef/encrypted_attribute/remote_clients.rb
 - lib/chef/encrypted_attribute/remote_node.rb
+- lib/chef/encrypted_attribute/remote_nodes.rb
 - lib/chef/encrypted_attribute/remote_users.rb
 - lib/chef/encrypted_attribute/search_helper.rb
 - lib/chef/encrypted_attribute/version.rb