chef-vault 2.0.2 → 2.1.0

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    MzRkN2Y2YzI1NGEyZTg5NmFmOWQ0MGU3YWRkYmZmY2JjZTFhYjdkNA==
+    MzRiMDI2MTkzOTA2MzcxOTRmNWY0OWNjYmZlZjIzNjYyMDE0ZTdmMw==
   data.tar.gz: !binary |-
-    ZTk0MjhhOWZmNzE4YjM1YzNjMTMzNThmNDcyZWEwZDljYjU0MDMzYg==
+    YzllYTQ2OGQyYzcyYjFjOTE4NWYyNTlhOTEyMGNiZDBmOTFmYTMyZA==
 !binary "U0hBNTEy":
   metadata.gz: !binary |-
-    YjJmMzE5N2I2ODk5ZmNiNDRiMTVjMDRlN2FlMWVlOTRmN2Y0NDM5MjI2MDkz
-    MjYxZDY3NTc3OWUxZTIyY2VhNjc4MWZhZmE1MDcxMDJlZjMxNDZjOWQ0MWM5
-    YjllNjA2YTQwZDY0MjlhYzQzZTg5Y2RjZmZmZTM3NjVjYjQwMzY=
+    ZGM0NmM5Mzg2OTc1MmNlMzA1ZWQyZDY3N2VhYzViNGIzZTNiMjc3NmRhNDNm
+    ODM2M2NhMmExMDljMjc2ODIzMWM3NGJiNzZlODc3MTFjNWE5ZGYxNDQwNWZi
+    NGNhOWM4ZGRjN2JmMTYyYTVjYzJlNmZiZmY1ODI4MmU1NzI1Zjk=
   data.tar.gz: !binary |-
-    YTg1MDg0ZWNiZDVhNDQ3MzU2ZDBhOTI2MGIxYzRkODlhZGJlMGE2YjNlZDE3
-    ODcyOGFjYmZkMDAwOGI4YWQwYzY3ODYwYTkzMjI3Yzg5YmExM2UzOTQ5NGVk
-    ZTBhYWUxMTUxZDA0YjU1NzZmODcyNjQyODUyODBmM2MyZTQ1OTc=
+    YzE2MjY4MzY0N2U5ZjE3NzQ0NmY4YjMyM2Y4ZDI3Yjc5MDVhYTNmYWIwNzU4
+    NWIzOGUwNjMzMmE5NTEyOTk3Mzc2MmRhNjIzN2FjODM4Yzg2ODQ2ZDIwNDlj
+    NjIzNTdhN2E4MDQ0NDQ3MjE1NWU3MWQwODcxMGVlYzAxMDk0NTk=

data/Changelog.md

@@ -1,8 +1,13 @@
-## Unreleased
-
+## Planned (Unreleased)
 
 ## Released 
 
+## v2.1.0 / 2013-12-23
+* Update README to correct typos
+* Modify admin loading to fall back to clients endpoint if not found in users endpoint
+* Add --file to "knife encrypt update" & "knife encrypt create" to do file encryption in chef-vault.  It will create a key called "file-content" & "file-name"
+* When VALUES is not supplied print the whole vault item
+
 ## v2.0.2 / 2013-09-10
 * Modify written data bag json files in solo mode to be valid for the knife data bag from file command
 * Modify knife encrypt remove to automatically rotate keys

data/KNIFE_EXAMPLES.md

@@ -1,7 +1,7 @@
 # knife examples
 
 ## encrypt
-knife encrypt [create|update|remove|delete] [VAULT] [ITEM] [VALUES]
+knife encrypt [create|update|remove|delete] VAULT ITEM VALUES
 
 These are the commands that are used to take data in json format and encrypt that data into chef-vault style encrypted data bags in chef.
 
@@ -20,7 +20,7 @@ Creat a vault called passwords and put an item called root in it with the given
 
 Creat a vault called passwords and put an item called root in it with the given values for username and password encrypted for admins admin1 & admin2
 
-    knife encrypt create passwords root "{username: 'root', password: 'mypassword'}" -A "admin1,admin2"    
+    knife encrypt create passwords root "{username: 'root', password: 'mypassword'}" -A "admin1,admin2"
 
 Note: A JSON file can be used in place of specifying the values on the command line, see global options below for details
 
@@ -134,7 +134,7 @@ Rotate the shared key for the vault passwords and item root.  The shared key is
 </table>
 
 ## decrypt
-knife decrypt [VAULT] [ITEM] [VALUES]
+knife decrypt VAULT ITEM [VALUES]
 
 These are the commands that are used to take a chef-vault encrypted item and decrypt the requested values.
 
@@ -142,6 +142,11 @@ These are the commands that are used to take a chef-vault encrypted item and dec
 * Item - The name of the item going in to the vault.  This is analogous to a chef data bag item id
 * Values - This is a comma list of values to decrypt from the vault item.  This is analogous to a list of hash keys.
 
+Decrypt the entire root item in the passwords vault and print in json
+format.
+
+    knife decrypt passwords root -Fjson
+
 Decrypt the username and password for the item root in the vault passwords.
 
     knife decrypt passwords root "username, password"
@@ -166,4 +171,11 @@ Decrypt the contents for the item user_pem in the vault certs.
     <td>solo</td>
     <td>"solo", "client"</td>
   </tr>
+  <tr>
+    <td>-F FORMAT</td>
+    <td>--format FORMAT</td>
+    <td>Format for output</td>
+    <td>summary</td>
+    <td>"summary", "json", "yaml", "pp"</td>
+  </tr>
 </table>

data/README.md

@@ -22,15 +22,15 @@ Depending on your system's configuration, you may need to run this command with
 ## KNIFE COMMANDS:
 See KNIFE_EXAMPLES.md for examples of commands
 
-NOTE: chef-vault 1.0 knife commands are not support!  Please use chef-vault 2.0 commands.
+NOTE: chef-vault 1.0 knife commands are not supported!  Please use chef-vault 2.0 commands.
 
 ### Encrypt
 
-    knife encrypt create [VAULT] [ITEM] [VALUES]
-    knife encrypt update [VAULT] [ITEM] [VALUES]
-    knife encrypt remove [VAULT] [ITEM] [VAULES]
-    knife encrypt delete [VAULT] [ITEM]
-    knife encrypt rotate keys [VAULT] [ITEM]
+    knife encrypt create VAULT ITEM VALUES
+    knife encrypt update VAULT ITEM VALUES
+    knife encrypt remove VAULT ITEM VALUES
+    knife encrypt delete VAULT ITEM
+    knife encrypt rotate keys VAULT ITEM
 
 <i>Global Options:</i>
 <table>
@@ -69,11 +69,17 @@ NOTE: chef-vault 1.0 knife commands are not support!  Please use chef-vault 2.0
     <td>nil</td>
     <td></td>
   </tr>
+  <tr>
+    <td>nil</td>
+    <td>--file FILE</td>
+    <td>File that chef-vault should encrypt.  It adds "file-content" & "file-name" keys to the vault item.  This is only valid in create & update</td>
+    <td>nil</td>
+    <td></td>
 </table>
 
 ### Decrypt
 
-    knife decrypt [VAULT] [ITEM] [VALUES]
+    knife decrypt VAULT ITEM [VALUES]
 
 <i>Global Options:</i>
 <table>
@@ -91,6 +97,13 @@ NOTE: chef-vault 1.0 knife commands are not support!  Please use chef-vault 2.0
     <td>solo</td>
     <td>"solo", "client"</td>
   </tr>
+  <tr>
+    <td>-F FORMAT</td>
+    <td>--format FORMAT</td>
+    <td>Format for output</td>
+    <td>summary</td>
+    <td>"summary", "json", "yaml", "pp"</td>
+  </tr>
 </table>
 
 ## USAGE IN RECIPES
@@ -124,9 +137,11 @@ Do `chef-vault --help` for all available options
 
 ## License and Author:
 
-Author:: Kevin Moser (<kevin.moser@nordstrom.com>)  
-Copyright:: Copyright (c) 2013 Nordstrom, Inc.  
-License:: Apache License, Version 2.0  
+Author:: Kevin Moser - @moserke<br>
+Author:: Eli Klein - @eliklein<br>
+Author:: Joshua Timberman - @jtimberman<br>
+Copyright:: Copyright (c) 2013 Nordstrom, Inc.<br>
+License:: Apache License, Version 2.0
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

data/bin/chef-vault

@@ -44,7 +44,7 @@ options_config = {
   },
   values: {
     short: "a",
-    long: "vaules",
+    long: "values",
     description: "Values of item to decrypt in vault",
     default: nil,
     optional: false

data/lib/chef-vault/item.rb

@@ -14,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+require 'securerandom'
+
 class ChefVault::Item < Chef::DataBagItem
   attr_accessor :keys
   attr_accessor :encrypted_data_bag_item
@@ -42,16 +44,7 @@ class ChefVault::Item < Chef::DataBagItem
 
         case action
         when :add
-          begin
-            keys.add(ChefVault::ChefPatch::ApiClient.load(node.name), @secret, "clients")
-          rescue Net::HTTPServerException => http_error
-            if http_error.response.code == "404"
-              raise ChefVault::Exceptions::ClientNotFound,
-                    "#{node.name} is not a valid chef client and/or node"
-            else
-              raise http_error
-            end
-          end
+          keys.add(load_client(node.name), @secret, "clients")
         when :delete
           keys.delete(node.name, "clients")
         else
@@ -75,16 +68,7 @@ class ChefVault::Item < Chef::DataBagItem
         admin.strip!
         case action
         when :add
-          begin
-            keys.add(ChefVault::ChefPatch::User.load(admin), @secret, "admins")
-          rescue Net::HTTPServerException => http_error
-            if http_error.response.code == "404"
-              raise ChefVault::Exceptions::AdminNotFound,
-                    "#{admin} is not a valid chef admin"
-            else
-              raise http_error
-            end
-          end
+          keys.add(load_admin(admin), @secret, "admins")
         when :delete
           keys.delete(admin, "admins")
         else
@@ -131,8 +115,10 @@ class ChefVault::Item < Chef::DataBagItem
     reload_raw_data
   end
 
-  def generate_secret
-    OpenSSL::PKey::RSA.new(245).to_pem.lines.to_a[1..-2].join
+  def generate_secret(key_size=32)
+    # Defaults to 32 bytes, as this is the size that a Chef
+    # Encrypted Data Bag Item will digest all secrets down to anyway
+    SecureRandom.random_bytes(key_size)
   end
 
   def []=(key, value)
@@ -240,4 +226,39 @@ class ChefVault::Item < Chef::DataBagItem
 
     @raw_data
   end
+
+  def load_admin(admin)
+    begin
+      admin = ChefVault::ChefPatch::User.load(admin)
+    rescue Net::HTTPServerException => http_error
+      if http_error.response.code == "404"
+        begin
+          puts "WARNING: #{admin} not found in users, trying clients."
+          admin = load_client(admin)
+        rescue ChefVault::Exceptions::ClientNotFound
+          raise ChefVault::Exceptions::AdminNotFound,
+                "FATAL: Could not find #{admin} in users or clients!"
+        end
+      else
+        raise http_error
+      end
+    end
+
+    admin
+  end
+
+  def load_client(client)
+    begin
+      client = ChefVault::ChefPatch::ApiClient.load(client)
+    rescue Net::HTTPServerException => http_error
+      if http_error.response.code == "404"
+        raise ChefVault::Exceptions::ClientNotFound,
+              "#{client} is not a valid chef client and/or node"
+      else
+        raise http_error
+      end
+    end
+
+    client
+  end
 end

data/lib/chef-vault/version.rb

@@ -14,6 +14,6 @@
 # limitations under the License.
 
 class ChefVault
-  VERSION = "2.0.2"
+  VERSION = "2.1.0"
   MAJOR, MINOR, TINY = VERSION.split('.')
 end

data/lib/chef/knife/Decrypt.rb

@@ -25,19 +25,19 @@ class Decrypt < Chef::Knife
     include ChefVault::Mixin::Helper
   end
 
-  banner "knife decrypt [VAULT] [ITEM] [VALUES] --mode MODE"
+  banner "knife decrypt VAULT ITEM [VALUES] --mode MODE"
 
   option :mode,
     :short => '-M MODE',
     :long => '--mode MODE',
-    :description => 'Chef mode to run in default - solo'  
+    :description => 'Chef mode to run in default - solo'
 
   def run
     vault = @name_args[0]
     item = @name_args[1]
     values = @name_args[2]
 
-    if vault && item && values
+    if vault && item
       set_mode(config[:mode])
 
       print_values(vault, item, values)
@@ -52,13 +52,20 @@ class Decrypt < Chef::Knife
   end
 
   def print_values(vault, item, values)
-    vault_item = ChefVault::Item.load(vault, item)
+    vault_item = ChefVault::Item.load(vault, item).raw_data
 
-    puts "#{vault}/#{item}"
+    if values
+      included_values = %W( id )
 
-    values.split(",").each do |value|
-      value.strip! # remove white space
-      puts("\t#{value}: #{vault_item[value]}")
+      values.split(",").each do |value|
+        value.strip! # remove white space
+        included_values << value
+      end
+
+      output(Hash[vault_item.find_all{|k,v| included_values.include?(k)}])
+    else
+      output(vault_item)
     end
-  end    
+  end
 end
+

data/lib/chef/knife/encrypt_create.rb

@@ -25,8 +25,8 @@ class EncryptCreate < Chef::Knife
     include ChefVault::Mixin::Helper
   end
 
-  banner "knife encrypt create [VAULT] [ITEM] [VALUES] "\
-        "--mode MODE --search SEARCH --admins ADMINS --json FILE"
+  banner "knife encrypt create VAULT ITEM VALUES "\
+        "--mode MODE --search SEARCH --admins ADMINS --json FILE --file FILE"
 
   option :mode,
     :short => '-M MODE',
@@ -48,6 +48,10 @@ class EncryptCreate < Chef::Knife
     :long => '--json FILE',
     :description => 'File containing JSON data to encrypt'
 
+  option :file,
+    :long => '--file FILE',
+    :description => 'File to be added to vault item as file-content'
+
   def run
     vault = @name_args[0]
     item = @name_args[1]
@@ -55,10 +59,11 @@ class EncryptCreate < Chef::Knife
     search = config[:search]
     admins = config[:admins]
     json_file = config[:json]
+    file = config[:file]
 
     set_mode(config[:mode])
 
-    if vault && item && (values || json_file) && (search || admins)
+    if vault && item && (values || json_file || file) && (search || admins)
       begin
         vault_item = ChefVault::Item.load(vault, item)
         raise ChefVault::Exceptions::ItemAlreadyExists,
@@ -68,10 +73,15 @@ class EncryptCreate < Chef::Knife
       rescue ChefVault::Exceptions::KeysNotFound,
              ChefVault::Exceptions::ItemNotFound
         vault_item = ChefVault::Item.new(vault, item)
-       
+
         merge_values(values, json_file).each do |key, value|
           vault_item[key] = value
-        end 
+        end
+
+        if file
+          vault_item["file-name"] = File.basename(file)
+          vault_item["file-content"] = File.open(file){ |file| file.read() }
+        end
 
         vault_item.clients(search) if search
         vault_item.admins(admins) if admins
@@ -88,4 +98,4 @@ class EncryptCreate < Chef::Knife
     exit 1
   end
 end
-  
+

data/lib/chef/knife/encrypt_delete.rb

@@ -25,7 +25,7 @@ class EncryptDelete < Chef::Knife
     include ChefVault::Mixin::Helper
   end
 
-  banner "knife encrypt delete [VAULT] [ITEM] --mode MODE"
+  banner "knife encrypt delete VAULT ITEM --mode MODE"
 
   option :mode,
     :short => '-M MODE',
@@ -45,8 +45,8 @@ class EncryptDelete < Chef::Knife
         rescue ChefVault::Exceptions::KeysNotFound,
                ChefVault::Exceptions::ItemNotFound
 
-               raise ChefVault::Exceptions::ItemNotFound,
-                     "#{vault}/#{item} not found."
+          raise ChefVault::Exceptions::ItemNotFound,
+                "#{vault}/#{item} not found."
         end
       end
     else
@@ -59,4 +59,4 @@ class EncryptDelete < Chef::Knife
     exit 1
   end
 end
-  
+

data/lib/chef/knife/encrypt_remove.rb

@@ -25,7 +25,7 @@ class EncryptRemove < Chef::Knife
     include ChefVault::Mixin::Helper
   end
 
-  banner "knife encrypt remove [VAULT] [ITEM] [VALUES] "\
+  banner "knife encrypt remove VAULT ITEM VALUES "\
         "--mode MODE --search SEARCH --admins ADMINS"
 
   option :mode,
@@ -73,9 +73,9 @@ class EncryptRemove < Chef::Knife
           remove_items.each do |key|
             key.strip!
             vault_item.remove(key)
-          end 
+          end
         end
-        
+
         vault_item.clients(search, :delete) if search
         vault_item.admins(admins, :delete) if admins
 
@@ -97,4 +97,4 @@ class EncryptRemove < Chef::Knife
     exit 1
   end
 end
-  
+

data/lib/chef/knife/encrypt_rotate_keys.rb

@@ -1,4 +1,4 @@
-# Description: Chef-Vault EncryptRotateSecret class
+# Description: Chef-Vault EncryptRotateKeys class
 # Copyright 2013, Nordstrom, Inc.
 
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -25,7 +25,7 @@ class EncryptRotateKeys < Chef::Knife
     include ChefVault::Mixin::Helper
   end
 
-  banner "knife rotate secret [VAULT] [ITEM] --mode MODE"
+  banner "knife encrypt rotate keys VAULT ITEM --mode MODE"
 
   option :mode,
     :short => '-M MODE',
@@ -59,4 +59,4 @@ class EncryptRotateKeys < Chef::Knife
     exit 1
   end
 end
-  
+

data/lib/chef/knife/encrypt_update.rb

@@ -25,8 +25,8 @@ class EncryptUpdate < Chef::Knife
     include ChefVault::Mixin::Helper
   end
 
-  banner "knife encrypt update [VAULT] [ITEM] [VALUES] "\
-        "--mode MODE --search SEARCH --admins ADMINS --json FILE"
+  banner "knife encrypt update VAULT ITEM VALUES "\
+        "--mode MODE --search SEARCH --admins ADMINS --json FILE --file FILE"
 
   option :mode,
     :short => '-M MODE',
@@ -48,6 +48,10 @@ class EncryptUpdate < Chef::Knife
     :long => '--json FILE',
     :description => 'File containing JSON data to encrypt'
 
+  option :file,
+    :long => '--file FILE',
+    :description => 'File to be added to vault item as file-content'
+
   def run
     vault = @name_args[0]
     item = @name_args[1]
@@ -55,16 +59,22 @@ class EncryptUpdate < Chef::Knife
     search = config[:search]
     admins = config[:admins]
     json_file = config[:json]
+    file = config[:file]
 
     set_mode(config[:mode])
 
-    if vault && item && ((values || json_file) || (search || admins))
+    if vault && item && ((values || json_file || file) || (search || admins))
       begin
         vault_item = ChefVault::Item.load(vault, item)
 
         merge_values(values, json_file).each do |key, value|
           vault_item[key] = value
-        end 
+        end
+
+        if file
+          vault_item["file-name"] = File.basename(file)
+          vault_item["file-content"] = File.open(file){ |file| file.read() }
+        end
 
         vault_item.clients(search) if search
         vault_item.admins(admins) if admins
@@ -87,4 +97,4 @@ class EncryptUpdate < Chef::Knife
     exit 1
   end
 end
-  
+

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chef-vault
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.1.0
 platform: ruby
 authors:
 - Kevin Moser
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-09-10 00:00:00.000000000 Z
+date: 2013-12-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef