chef-vault 3.4.0.pre.pre419 → 3.4.0.pre.pre420
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- metadata +1 -45
- data/.github/CODEOWNERS +0 -2
- data/.gitignore +0 -33
- data/.rspec +0 -2
- data/.rubocop.yml +0 -6
- data/.simplecov +0 -6
- data/.travis.yml +0 -19
- data/Changelog.md +0 -141
- data/DEMO.md +0 -60
- data/Gemfile +0 -12
- data/KNIFE_EXAMPLES.md +0 -256
- data/README.md +0 -333
- data/Rakefile +0 -50
- data/THEORY.md +0 -363
- data/UPGRADE.md +0 -55
- data/appveyor.yml +0 -32
- data/chef-vault.gemspec +0 -54
- data/features/clean.feature +0 -23
- data/features/clean_on_refresh.feature +0 -27
- data/features/clean_unknown_clients.feature +0 -45
- data/features/detect_and_warn_v1_vault.feature +0 -14
- data/features/isvault.feature +0 -29
- data/features/itemtype.feature +0 -24
- data/features/step_definitions/chef-databag.rb +0 -9
- data/features/step_definitions/chef-repo.rb +0 -72
- data/features/step_definitions/chef-vault.rb +0 -151
- data/features/step_definitions/chef_databagitem.rb +0 -9
- data/features/support/env.rb +0 -14
- data/features/vault_create.feature +0 -63
- data/features/vault_list.feature +0 -31
- data/features/vault_show.feature +0 -45
- data/features/vault_show_vaultname.feature +0 -21
- data/features/vault_update.feature +0 -18
- data/features/verify_id_matches.feature +0 -10
- data/features/wrong_private_key.feature +0 -13
- data/hooks/pre-commit +0 -43
- data/spec/chef-vault/actor_spec.rb +0 -247
- data/spec/chef-vault/certificate_spec.rb +0 -37
- data/spec/chef-vault/chef_api_spec.rb +0 -39
- data/spec/chef-vault/item_keys_spec.rb +0 -263
- data/spec/chef-vault/item_spec.rb +0 -360
- data/spec/chef-vault/user_spec.rb +0 -36
- data/spec/chef-vault_spec.rb +0 -65
- data/spec/spec_helper.rb +0 -91
- data/tasks/github_changelog_generator.rb +0 -30
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 51f3fb6cdb7f73d0ed2ba9d209af4aeb06f3e778
|
|
4
|
+
data.tar.gz: 42a7cf0de7e754f2f1ac91c091e59f50db8ba3fe
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: fc02ff8d9a92aec76fd0fa2957590030872f2f788693dbe63b46d865960718ba082ba8e51d010f636d80d888cfec5625fd8321160bff1d62772329122c114865
|
|
7
|
+
data.tar.gz: 27bb77d62cd0d5349667399a5bb16c334e124a0076f8b481680ddedb1f1d500eac97f1dd625ce3ba30499477f0df6ef0111895dc1c56652a275e478b30213bd5
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: chef-vault
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.4.0.pre.
|
|
4
|
+
version: 3.4.0.pre.pre420
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Thom May
|
|
@@ -102,43 +102,8 @@ executables:
|
|
|
102
102
|
extensions: []
|
|
103
103
|
extra_rdoc_files: []
|
|
104
104
|
files:
|
|
105
|
-
- ".github/CODEOWNERS"
|
|
106
|
-
- ".gitignore"
|
|
107
|
-
- ".rspec"
|
|
108
|
-
- ".rubocop.yml"
|
|
109
|
-
- ".simplecov"
|
|
110
|
-
- ".travis.yml"
|
|
111
|
-
- Changelog.md
|
|
112
|
-
- DEMO.md
|
|
113
|
-
- Gemfile
|
|
114
|
-
- KNIFE_EXAMPLES.md
|
|
115
105
|
- LICENSE
|
|
116
|
-
- README.md
|
|
117
|
-
- Rakefile
|
|
118
|
-
- THEORY.md
|
|
119
|
-
- UPGRADE.md
|
|
120
|
-
- appveyor.yml
|
|
121
106
|
- bin/chef-vault
|
|
122
|
-
- chef-vault.gemspec
|
|
123
|
-
- features/clean.feature
|
|
124
|
-
- features/clean_on_refresh.feature
|
|
125
|
-
- features/clean_unknown_clients.feature
|
|
126
|
-
- features/detect_and_warn_v1_vault.feature
|
|
127
|
-
- features/isvault.feature
|
|
128
|
-
- features/itemtype.feature
|
|
129
|
-
- features/step_definitions/chef-databag.rb
|
|
130
|
-
- features/step_definitions/chef-repo.rb
|
|
131
|
-
- features/step_definitions/chef-vault.rb
|
|
132
|
-
- features/step_definitions/chef_databagitem.rb
|
|
133
|
-
- features/support/env.rb
|
|
134
|
-
- features/vault_create.feature
|
|
135
|
-
- features/vault_list.feature
|
|
136
|
-
- features/vault_show.feature
|
|
137
|
-
- features/vault_show_vaultname.feature
|
|
138
|
-
- features/vault_update.feature
|
|
139
|
-
- features/verify_id_matches.feature
|
|
140
|
-
- features/wrong_private_key.feature
|
|
141
|
-
- hooks/pre-commit
|
|
142
107
|
- lib/chef-vault.rb
|
|
143
108
|
- lib/chef-vault/actor.rb
|
|
144
109
|
- lib/chef-vault/certificate.rb
|
|
@@ -166,15 +131,6 @@ files:
|
|
|
166
131
|
- lib/chef/knife/vault_rotate_keys.rb
|
|
167
132
|
- lib/chef/knife/vault_show.rb
|
|
168
133
|
- lib/chef/knife/vault_update.rb
|
|
169
|
-
- spec/chef-vault/actor_spec.rb
|
|
170
|
-
- spec/chef-vault/certificate_spec.rb
|
|
171
|
-
- spec/chef-vault/chef_api_spec.rb
|
|
172
|
-
- spec/chef-vault/item_keys_spec.rb
|
|
173
|
-
- spec/chef-vault/item_spec.rb
|
|
174
|
-
- spec/chef-vault/user_spec.rb
|
|
175
|
-
- spec/chef-vault_spec.rb
|
|
176
|
-
- spec/spec_helper.rb
|
|
177
|
-
- tasks/github_changelog_generator.rb
|
|
178
134
|
homepage: https://github.com/chef/chef-vault
|
|
179
135
|
licenses:
|
|
180
136
|
- Apache License, v2.0
|
data/.github/CODEOWNERS
DELETED
data/.gitignore
DELETED
|
@@ -1,33 +0,0 @@
|
|
|
1
|
-
" from https://github.com/github/gitignore/blob/master/Ruby.gitignore
|
|
2
|
-
*.gem
|
|
3
|
-
*.rbc
|
|
4
|
-
/.config
|
|
5
|
-
/coverage/
|
|
6
|
-
/InstalledFiles
|
|
7
|
-
/pkg/
|
|
8
|
-
/spec/reports/
|
|
9
|
-
/test/tmp/
|
|
10
|
-
/test/version_tmp/
|
|
11
|
-
/tmp/
|
|
12
|
-
|
|
13
|
-
## Documentation cache and generated files:
|
|
14
|
-
/.yardoc/
|
|
15
|
-
/_yardoc/
|
|
16
|
-
/doc/
|
|
17
|
-
/rdoc/
|
|
18
|
-
|
|
19
|
-
## Environment normalisation:
|
|
20
|
-
/.bundle/
|
|
21
|
-
/lib/bundler/man/
|
|
22
|
-
/binstubs/
|
|
23
|
-
|
|
24
|
-
# for a library or gem, you might want to ignore these files since the code is
|
|
25
|
-
# intended to run in multiple environments; otherwise, check them in:
|
|
26
|
-
Gemfile.lock
|
|
27
|
-
.ruby-version
|
|
28
|
-
.ruby-gemset
|
|
29
|
-
|
|
30
|
-
# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
|
|
31
|
-
.rvmrc
|
|
32
|
-
|
|
33
|
-
.chef
|
data/.rspec
DELETED
data/.rubocop.yml
DELETED
data/.simplecov
DELETED
data/.travis.yml
DELETED
|
@@ -1,19 +0,0 @@
|
|
|
1
|
-
language: ruby
|
|
2
|
-
branches:
|
|
3
|
-
only:
|
|
4
|
-
- master
|
|
5
|
-
rvm:
|
|
6
|
-
- 2.2.5
|
|
7
|
-
- 2.3.1
|
|
8
|
-
- 2.4.1
|
|
9
|
-
install: bundle install --binstubs --without changelog
|
|
10
|
-
before_install: gem install bundler
|
|
11
|
-
env: TRAVIS_BUILD=true
|
|
12
|
-
deploy:
|
|
13
|
-
provider: rubygems
|
|
14
|
-
api_key:
|
|
15
|
-
secure: NNbOEQWaX+67bsMd1A/BB5lxd2dDzx+4uYsKxSvhVvx34UixKoLRmPhGJr0WapndsXdnG+crPpx3gpseOfJ3u42uNHQI9ASsgOOgmEiJKcW/MO/IQReRI998+XH2A4QLfLQ4JIWjpl8KNZCJSCp7w1LnDV6imy7FSM0mWS+3Lzk=
|
|
16
|
-
gem: chef-vault
|
|
17
|
-
on:
|
|
18
|
-
repo: chef/chef-vault
|
|
19
|
-
branch: master
|
data/Changelog.md
DELETED
|
@@ -1,141 +0,0 @@
|
|
|
1
|
-
# Change Log
|
|
2
|
-
|
|
3
|
-
## [v3.3.0](https://github.com/chef/chef-vault/tree/v3.3.0) (2017-07-28)
|
|
4
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.2.0...v3.3.0)
|
|
5
|
-
|
|
6
|
-
**Closed issues:**
|
|
7
|
-
|
|
8
|
-
- With recreated nodes, existing keys are not updated [\#286](https://github.com/chef/chef-vault/issues/286)
|
|
9
|
-
|
|
10
|
-
## [v3.2.0](https://github.com/chef/chef-vault/tree/v3.2.0) (2017-07-11)
|
|
11
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.1.0...v3.2.0)
|
|
12
|
-
|
|
13
|
-
**Closed issues:**
|
|
14
|
-
|
|
15
|
-
- offline network installation of the chef-vault gem [\#279](https://github.com/chef/chef-vault/issues/279)
|
|
16
|
-
|
|
17
|
-
## [v3.1.0](https://github.com/chef/chef-vault/tree/v3.1.0) (2017-07-04)
|
|
18
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.9.2...v3.1.0)
|
|
19
|
-
|
|
20
|
-
## [v2.9.2](https://github.com/chef/chef-vault/tree/v2.9.2) (2017-06-21)
|
|
21
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.0.3...v2.9.2)
|
|
22
|
-
|
|
23
|
-
**Implemented enhancements:**
|
|
24
|
-
|
|
25
|
-
- Assume all nodes matching the search query are valid nodes [\#272](https://github.com/chef/chef-vault/pull/272) ([kamaradclimber](https://github.com/kamaradclimber))
|
|
26
|
-
- Avoid re-encrypting key for all existing clients [\#269](https://github.com/chef/chef-vault/pull/269) ([kamaradclimber](https://github.com/kamaradclimber))
|
|
27
|
-
|
|
28
|
-
**Fixed bugs:**
|
|
29
|
-
|
|
30
|
-
- Fix fatal error during create [\#281](https://github.com/chef/chef-vault/pull/281) ([neclimdul](https://github.com/neclimdul))
|
|
31
|
-
- Avoid sparse key read for non sparse secrets [\#280](https://github.com/chef/chef-vault/pull/280) ([kamaradclimber](https://github.com/kamaradclimber))
|
|
32
|
-
- Make sure sparse mode is used on secrets where it is explicit [\#271](https://github.com/chef/chef-vault/pull/271) ([kamaradclimber](https://github.com/kamaradclimber))
|
|
33
|
-
|
|
34
|
-
## [v3.0.3](https://github.com/chef/chef-vault/tree/v3.0.3) (2017-05-03)
|
|
35
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.0.2...v3.0.3)
|
|
36
|
-
|
|
37
|
-
**Fixed bugs:**
|
|
38
|
-
|
|
39
|
-
- Reduce the search response limit from 100k to 10k [\#275](https://github.com/chef/chef-vault/pull/275) ([btm](https://github.com/btm))
|
|
40
|
-
- Replace edit\_data\(\) with edit\_hash\(\) in vault\_edit.rb [\#274](https://github.com/chef/chef-vault/pull/274) ([tmaczukin](https://github.com/tmaczukin))
|
|
41
|
-
|
|
42
|
-
## [v3.0.2](https://github.com/chef/chef-vault/tree/v3.0.2) (2017-04-20)
|
|
43
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.0.1...v3.0.2)
|
|
44
|
-
|
|
45
|
-
## [v3.0.1](https://github.com/chef/chef-vault/tree/v3.0.1) (2017-04-11)
|
|
46
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.0.0...v3.0.1)
|
|
47
|
-
|
|
48
|
-
**Fixed bugs:**
|
|
49
|
-
|
|
50
|
-
- Change the chef dependency to development only [\#266](https://github.com/chef/chef-vault/pull/266) ([thommay](https://github.com/thommay))
|
|
51
|
-
|
|
52
|
-
## [v3.0.0](https://github.com/chef/chef-vault/tree/v3.0.0) (2017-04-10)
|
|
53
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.9.1...v3.0.0)
|
|
54
|
-
|
|
55
|
-
**Implemented enhancements:**
|
|
56
|
-
|
|
57
|
-
- Vault creation, list, and destruction in sparse mode [\#252](https://github.com/chef/chef-vault/pull/252) ([rveznaver](https://github.com/rveznaver))
|
|
58
|
-
|
|
59
|
-
## [v2.9.1](https://github.com/chef/chef-vault/tree/v2.9.1) (2017-01-19)
|
|
60
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.0.0.rc2...v2.9.1)
|
|
61
|
-
|
|
62
|
-
## [v3.0.0.rc2](https://github.com/chef/chef-vault/tree/v3.0.0.rc2) (2016-12-05)
|
|
63
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v3.0.0.rc1...v3.0.0.rc2)
|
|
64
|
-
|
|
65
|
-
**Implemented enhancements:**
|
|
66
|
-
|
|
67
|
-
- Add feature to save each key in different data bag item [\#246](https://github.com/chef/chef-vault/pull/246) ([rveznaver](https://github.com/rveznaver))
|
|
68
|
-
- Enable testing with Chef Zero [\#244](https://github.com/chef/chef-vault/pull/244) ([rveznaver](https://github.com/rveznaver))
|
|
69
|
-
- Minimize the number of searches [\#243](https://github.com/chef/chef-vault/pull/243) ([thommay](https://github.com/thommay))
|
|
70
|
-
- Optimise queries when finding nodes [\#240](https://github.com/chef/chef-vault/pull/240) ([thommay](https://github.com/thommay))
|
|
71
|
-
|
|
72
|
-
**Fixed bugs:**
|
|
73
|
-
|
|
74
|
-
- Use solo\_legacy\_mode fully [\#242](https://github.com/chef/chef-vault/pull/242) ([thommay](https://github.com/thommay))
|
|
75
|
-
- Use legacy solo mode [\#241](https://github.com/chef/chef-vault/pull/241) ([thommay](https://github.com/thommay))
|
|
76
|
-
|
|
77
|
-
## [v3.0.0.rc1](https://github.com/chef/chef-vault/tree/v3.0.0.rc1) (2016-10-21)
|
|
78
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.9.0...v3.0.0.rc1)
|
|
79
|
-
|
|
80
|
-
**Implemented enhancements:**
|
|
81
|
-
|
|
82
|
-
- Removed deprecated knife commands [\#236](https://github.com/chef/chef-vault/pull/236) ([thommay](https://github.com/thommay))
|
|
83
|
-
- rename ChefKey to Actor [\#234](https://github.com/chef/chef-vault/pull/234) ([thommay](https://github.com/thommay))
|
|
84
|
-
- Move to using a logger for all user output [\#232](https://github.com/chef/chef-vault/pull/232) ([thommay](https://github.com/thommay))
|
|
85
|
-
- Add support for clients [\#227](https://github.com/chef/chef-vault/pull/227) ([svanharmelen](https://github.com/svanharmelen))
|
|
86
|
-
|
|
87
|
-
## [v2.9.0](https://github.com/chef/chef-vault/tree/v2.9.0) (2016-04-08)
|
|
88
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.8.0...v2.9.0)
|
|
89
|
-
|
|
90
|
-
**Implemented enhancements:**
|
|
91
|
-
|
|
92
|
-
- Feature - knife vault update - update item\_keys only when no value is provided [\#202](https://github.com/chef/chef-vault/pull/202) ([xakraz](https://github.com/xakraz))
|
|
93
|
-
|
|
94
|
-
**Fixed bugs:**
|
|
95
|
-
|
|
96
|
-
- knife vault refresh always updates the data bag item [\#193](https://github.com/chef/chef-vault/issues/193)
|
|
97
|
-
- Correct vault creation in solo mode [\#206](https://github.com/chef/chef-vault/pull/206) ([kamaradclimber](https://github.com/kamaradclimber))
|
|
98
|
-
- Only save keys on refresh operation [\#194](https://github.com/chef/chef-vault/pull/194) ([kamaradclimber](https://github.com/kamaradclimber))
|
|
99
|
-
|
|
100
|
-
## [v2.8.0](https://github.com/chef/chef-vault/tree/v2.8.0) (2016-02-09)
|
|
101
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.8.0.rc1...v2.8.0)
|
|
102
|
-
|
|
103
|
-
## [v2.8.0.rc1](https://github.com/chef/chef-vault/tree/v2.8.0.rc1) (2016-01-29)
|
|
104
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.7.1...v2.8.0.rc1)
|
|
105
|
-
|
|
106
|
-
## [v2.7.1](https://github.com/chef/chef-vault/tree/v2.7.1) (2016-01-25)
|
|
107
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.7.0...v2.7.1)
|
|
108
|
-
|
|
109
|
-
## [v2.7.0](https://github.com/chef/chef-vault/tree/v2.7.0) (2016-01-25)
|
|
110
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.6.1...v2.7.0)
|
|
111
|
-
|
|
112
|
-
## [v2.6.1](https://github.com/chef/chef-vault/tree/v2.6.1) (2015-05-28)
|
|
113
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.6.0...v2.6.1)
|
|
114
|
-
|
|
115
|
-
## [v2.6.0](https://github.com/chef/chef-vault/tree/v2.6.0) (2015-05-13)
|
|
116
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.5.0...v2.6.0)
|
|
117
|
-
|
|
118
|
-
## [v2.5.0](https://github.com/chef/chef-vault/tree/v2.5.0) (2015-02-09)
|
|
119
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.4.0...v2.5.0)
|
|
120
|
-
|
|
121
|
-
## [v2.4.0](https://github.com/chef/chef-vault/tree/v2.4.0) (2014-12-03)
|
|
122
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.3.0...v2.4.0)
|
|
123
|
-
|
|
124
|
-
## [v2.3.0](https://github.com/chef/chef-vault/tree/v2.3.0) (2014-10-22)
|
|
125
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.2.4...v2.3.0)
|
|
126
|
-
|
|
127
|
-
## [v2.2.4](https://github.com/chef/chef-vault/tree/v2.2.4) (2014-07-17)
|
|
128
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.2.3...v2.2.4)
|
|
129
|
-
|
|
130
|
-
## [v2.2.3](https://github.com/chef/chef-vault/tree/v2.2.3) (2014-06-24)
|
|
131
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.2.2...v2.2.3)
|
|
132
|
-
|
|
133
|
-
## [v2.2.2](https://github.com/chef/chef-vault/tree/v2.2.2) (2014-06-03)
|
|
134
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/v2.2.1...v2.2.2)
|
|
135
|
-
|
|
136
|
-
## [v2.2.1](https://github.com/chef/chef-vault/tree/v2.2.1) (2014-02-26)
|
|
137
|
-
[Full Changelog](https://github.com/chef/chef-vault/compare/e7d75c65441989ce915a30fc28782748c8a1ed1e...v2.2.1)
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
|
data/DEMO.md
DELETED
|
@@ -1,60 +0,0 @@
|
|
|
1
|
-
# A Short Demo of the Magic of Chef-Vault
|
|
2
|
-
|
|
3
|
-
##Set up the magic show from a shell on your own workstation
|
|
4
|
-
|
|
5
|
-
###Put the bunny in the hat
|
|
6
|
-
|
|
7
|
-
echo "bunny" > tophat
|
|
8
|
-
|
|
9
|
-
###Put the hat in the magic show
|
|
10
|
-
|
|
11
|
-
export assistant=aug24 #Change this to your chef id
|
|
12
|
-
export role=magician #Change this to the role you need to pass the secret to
|
|
13
|
-
|
|
14
|
-
knife vault create magicshow hat \ #Create a hat object in a data bag called magicshow
|
|
15
|
-
--mode client \ #Talk to the chef server rather than local
|
|
16
|
-
--file tophat \ #Use the hat (file) we put the bunny in
|
|
17
|
-
--search "role:${role}" \ #Encrypted for all *current* nodes with the magician role
|
|
18
|
-
--admins "${assistant}" #Encrypted for the assistant
|
|
19
|
-
|
|
20
|
-
###Check the magic show is on the chef server
|
|
21
|
-
|
|
22
|
-
knife data bag list
|
|
23
|
-
knife vault list
|
|
24
|
-
|
|
25
|
-
###Check the hat is there (and that nobody can see what's in it)
|
|
26
|
-
|
|
27
|
-
knife data bag show magicshow hat
|
|
28
|
-
|
|
29
|
-
###Check you can see what's in it
|
|
30
|
-
|
|
31
|
-
knife vault show magicshow hat file-content --mode client
|
|
32
|
-
|
|
33
|
-
##'Hop' on to a node with a role of 'magician'
|
|
34
|
-
|
|
35
|
-
###Install required software
|
|
36
|
-
|
|
37
|
-
sudo apt-get install ruby-dev --yes
|
|
38
|
-
sudo gem install chef-vault --no-ri --no-rdoc
|
|
39
|
-
|
|
40
|
-
###Get the bunny back out of the hat!
|
|
41
|
-
|
|
42
|
-
sudo chef-shell --client <<EOF
|
|
43
|
-
require 'chef-vault'
|
|
44
|
-
puts ChefVault::Item.load('magicshow', 'hat')['file-content']
|
|
45
|
-
EOF
|
|
46
|
-
|
|
47
|
-
If you are on a node which is not a magician, an exception will be thrown,
|
|
48
|
-
and the node cannot see what is in the hat.
|
|
49
|
-
|
|
50
|
-
#Finally, do a disappearing act.
|
|
51
|
-
|
|
52
|
-
###Make the hat disappear...
|
|
53
|
-
|
|
54
|
-
knife vault delete magicshow hat --mode client
|
|
55
|
-
|
|
56
|
-
###Make the entire magic show disappear...
|
|
57
|
-
|
|
58
|
-
knife data bag delete magicshow
|
|
59
|
-
|
|
60
|
-
###Thank you!
|
data/Gemfile
DELETED
|
@@ -1,12 +0,0 @@
|
|
|
1
|
-
source "https://rubygems.org/"
|
|
2
|
-
|
|
3
|
-
group :development do
|
|
4
|
-
gem "chefstyle", git: "https://github.com/chef/chefstyle.git"
|
|
5
|
-
gem "chef-zero"
|
|
6
|
-
end
|
|
7
|
-
|
|
8
|
-
group :changelog do
|
|
9
|
-
gem "github_changelog_generator", git: "https://github.com/chef/github-changelog-generator"
|
|
10
|
-
end
|
|
11
|
-
|
|
12
|
-
gemspec
|
data/KNIFE_EXAMPLES.md
DELETED
|
@@ -1,256 +0,0 @@
|
|
|
1
|
-
# knife examples
|
|
2
|
-
|
|
3
|
-
## vault
|
|
4
|
-
|
|
5
|
-
knife vault SUBCOMMAND VAULT ITEM VALUES
|
|
6
|
-
|
|
7
|
-
These are the commands that are used to take data in JSON format and encrypt that data into chef-vault style encrypted data bags in chef.
|
|
8
|
-
|
|
9
|
-
* vault - This is the name of the vault in which to store the encrypted item. This is analogous to a chef data bag name
|
|
10
|
-
* item - The name of the item going in to the vault. This is analogous to a chef data bag item id
|
|
11
|
-
* values - This is the JSON clear text data to be stored in the vault encrypted. This is analogous to a chef data bag item data
|
|
12
|
-
|
|
13
|
-
## vault commands
|
|
14
|
-
|
|
15
|
-
### create
|
|
16
|
-
Create a vault called passwords and put an item called root in it with the given values for username and password encrypted for clients role:webserver, client1 & client2 and admins admin1 & admin2
|
|
17
|
-
|
|
18
|
-
knife vault create passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver" -C "client1,client2" -A "admin1,admin2"
|
|
19
|
-
|
|
20
|
-
Create a vault called passwords and put an item called root in it with the given values for username and password encrypted for clients role:webserver and admins admin1 & admin2
|
|
21
|
-
|
|
22
|
-
knife vault create passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver" -A "admin1,admin2"
|
|
23
|
-
|
|
24
|
-
Create a vault called passwords and put an item called root in it with the given values for username and password encrypted for clients role:webserver, client1 & client2
|
|
25
|
-
|
|
26
|
-
knife vault create passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver" -C "client1,client2"
|
|
27
|
-
|
|
28
|
-
Create a vault called passwords and put an item called root in it with the given values for username and password encrypted for clients role:webserver
|
|
29
|
-
|
|
30
|
-
knife vault create passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver"
|
|
31
|
-
|
|
32
|
-
Create a vault called passwords and put an item called root in it with the given values for username and password encrypted for clients client1 & client2
|
|
33
|
-
|
|
34
|
-
knife vault create passwords root '{"username": "root", "password": "mypassword"}' -C "client1,client2"
|
|
35
|
-
|
|
36
|
-
Create a vault called passwords and put an item called root in it with the given values for username and password encrypted for admins admin1 & admin2
|
|
37
|
-
|
|
38
|
-
knife vault create passwords root '{"username": "root", "password": "mypassword"}' -A "admin1,admin2"
|
|
39
|
-
|
|
40
|
-
Create a vault called passwords and put an item called root in it encrypted for admins admin1 & admin2. *Leaving the data off the command-line will pop an editor to fill out the data*
|
|
41
|
-
|
|
42
|
-
knife vault create passwords root -A "admin1,admin2"
|
|
43
|
-
|
|
44
|
-
Note: A JSON file can be used in place of specifying the values on the command line, see global options below for details
|
|
45
|
-
|
|
46
|
-
### update
|
|
47
|
-
|
|
48
|
-
Update the values in username and password in the vault passwords and item root. Will overwrite existing values if values already exist!
|
|
49
|
-
|
|
50
|
-
knife vault update passwords root '{"username": "root", "password": "mypassword"}'
|
|
51
|
-
|
|
52
|
-
Update the values in username and password in the vault passwords and item root and add role:webserver, client1 & client2 to the encrypted clients and admin1 & admin2 to the encrypted admins. Will overwrite existing values if values already exist!
|
|
53
|
-
|
|
54
|
-
knife vault update passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver" -C "client1,client2" -A "admin1,admin2"
|
|
55
|
-
|
|
56
|
-
Update the values in username and password in the vault passwords and item root and add role:webserver to the encrypted clients and admin1 & admin2 to the encrypted admins. Will overwrite existing values if values already exist!
|
|
57
|
-
|
|
58
|
-
knife vault update passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver" -A "admin1,admin2"
|
|
59
|
-
|
|
60
|
-
Update the values in username and password in the vault passwords and item root and add role:webserver to the encrypted clients. Will overwrite existing values if values already exist!
|
|
61
|
-
|
|
62
|
-
knife vault update passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver"
|
|
63
|
-
|
|
64
|
-
Update the values in username and password in the vault passwords and item root and add client1 & client2 to the encrypted clients. Will overwrite existing values if values already exist!
|
|
65
|
-
|
|
66
|
-
knife vault update passwords root '{"username": "root", "password": "mypassword"}' -C "client1,client2"
|
|
67
|
-
|
|
68
|
-
Update the values in username and password in the vault passwords and item root and add admin1 & admin2 to the encrypted admins. Will overwrite existing values if values already exist!
|
|
69
|
-
|
|
70
|
-
knife vault update passwords root '{"username": "root", "password": "mypassword"}' -A "admin1,admin2"
|
|
71
|
-
|
|
72
|
-
Add role:webserver to encrypted clients for the vault passwords and item root.
|
|
73
|
-
|
|
74
|
-
knife vault update passwords root -S "role:webserver"
|
|
75
|
-
|
|
76
|
-
Add client1 & client2 to encrypted clients for the vault passwords and item root.
|
|
77
|
-
|
|
78
|
-
knife vault update passwords root -C "client1,client2"
|
|
79
|
-
|
|
80
|
-
Add admin1 & admin2 to encrypted admins for the vault passwords and item root.
|
|
81
|
-
|
|
82
|
-
knife vault update passwords root -A "admin1,admin2"
|
|
83
|
-
|
|
84
|
-
Add admin1 & admin2 to encrypted admins and role:webserver, client1 & client2 to encrypted clients for the vault passwords and item root.
|
|
85
|
-
|
|
86
|
-
knife vault update passwords root -S "role:webserver" -C "client1,client2" -A "admin1,admin2"
|
|
87
|
-
|
|
88
|
-
Add admin1 & admin2 to encrypted admins and role:webserver to encrypted clients for the vault passwords and item root.
|
|
89
|
-
|
|
90
|
-
knife vault update passwords root -S "role:webserver" -A "admin1,admin2"
|
|
91
|
-
|
|
92
|
-
Add admin1 & admin2 to encrypted admins and client1 & client2 to encrypted clients for the vault passwords and item root.
|
|
93
|
-
|
|
94
|
-
knife vault update passwords root -C "client1,client2" -A "admin1,admin2"
|
|
95
|
-
|
|
96
|
-
Note: A JSON file can be used in place of specifying the values on the command line, see global options below for details
|
|
97
|
-
|
|
98
|
-
### remove
|
|
99
|
-
|
|
100
|
-
Remove the values in username and password from the vault passwords and item root.
|
|
101
|
-
|
|
102
|
-
knife vault remove passwords root '{"username": "root", "password": "mypassword"}'
|
|
103
|
-
|
|
104
|
-
Remove the values in username and password from the vault passwords and item root and remove role:webserver, client1 & client2 from the encrypted clients and admin1 & admin2 from the encrypted admins.
|
|
105
|
-
|
|
106
|
-
knife vault remove passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver" -C "client1,client2" -A "admin1,admin2"
|
|
107
|
-
|
|
108
|
-
Remove the values in username and password from the vault passwords and item root and remove role:webserver from the encrypted clients and admin1 & admin2 from the encrypted admins.
|
|
109
|
-
|
|
110
|
-
knife vault remove passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver" -A "admin1,admin2"
|
|
111
|
-
|
|
112
|
-
Remove the values in username and password from the vault passwords and item root and remove client1 & client2 from the encrypted clients and admin1 & admin2 from the encrypted admins.
|
|
113
|
-
|
|
114
|
-
knife vault remove passwords root '{"username": "root", "password": "mypassword"}' -C "client1,client2" -A "admin1,admin2"
|
|
115
|
-
|
|
116
|
-
Remove the values in username and password from the vault passwords and item root and remove role:webserver from the encrypted clients.
|
|
117
|
-
|
|
118
|
-
knife vault remove passwords root '{"username": "root", "password": "mypassword"}' -S "role:webserver"
|
|
119
|
-
|
|
120
|
-
Remove the values in username and password from the vault passwords and item root and remove client1 & client2 from the encrypted clients.
|
|
121
|
-
|
|
122
|
-
knife vault remove passwords root '{"username": "root", "password": "mypassword"}' -C "client1,client2"
|
|
123
|
-
|
|
124
|
-
Remove the values in username and password from the vault passwords and item root and remove admin1 & admin2 from the encrypted admins.
|
|
125
|
-
|
|
126
|
-
knife vault remove passwords root '{"username": "root", "password": "mypassword"}' -A "admin1,admin2"
|
|
127
|
-
|
|
128
|
-
Remove admin1 & admin2 from encrypted admins and role:webserver, client1 & client2 from encrypted clients for the vault passwords and item root.
|
|
129
|
-
|
|
130
|
-
knife vault remove passwords root -S "role:webserver" -C "client1,client2" -A "admin1,admin2"
|
|
131
|
-
|
|
132
|
-
Remove admin1 & admin2 from encrypted admins and role:webserver from encrypted clients for the vault passwords and item root.
|
|
133
|
-
|
|
134
|
-
knife vault remove passwords root -S "role:webserver" -A "admin1,admin2"
|
|
135
|
-
|
|
136
|
-
Remove role:webserver from encrypted clients for the vault passwords and item root.
|
|
137
|
-
|
|
138
|
-
knife vault remove passwords root -S "role:webserver"
|
|
139
|
-
|
|
140
|
-
Remove client1 & client2 from encrypted clients for the vault passwords and item root.
|
|
141
|
-
|
|
142
|
-
knife vault remove passwords root -C "client1,client2"
|
|
143
|
-
|
|
144
|
-
Remove admin1 & admin2 from encrypted admins for the vault passwords and item root.
|
|
145
|
-
|
|
146
|
-
knife vault remove passwords root -A "admin1,admin2"
|
|
147
|
-
|
|
148
|
-
### delete
|
|
149
|
-
|
|
150
|
-
Delete the item root from the vault passwords
|
|
151
|
-
|
|
152
|
-
knife vault delete passwords root
|
|
153
|
-
|
|
154
|
-
### show
|
|
155
|
-
|
|
156
|
-
knife vault show VAULT [ITEM] [VALUES]
|
|
157
|
-
|
|
158
|
-
These are the commands that are used to decrypt a chef-vault encrypted item and show the requested values.
|
|
159
|
-
|
|
160
|
-
* vault - This is the name of the vault in which to store the encrypted item. This is analogous to a chef data bag name
|
|
161
|
-
* item - The name of the item going in to the vault. This is analogous to a chef data bag item id
|
|
162
|
-
* values - This is a comma list of values to decrypt from the vault item. This is analogous to a list of hash keys.
|
|
163
|
-
|
|
164
|
-
Show the items in a vault
|
|
165
|
-
|
|
166
|
-
knife vault show passwords
|
|
167
|
-
|
|
168
|
-
Show the entire root item in the passwords vault and print in JSON format.
|
|
169
|
-
|
|
170
|
-
knife vault show passwords root -Fjson
|
|
171
|
-
|
|
172
|
-
Show the entire root item in the passwords vault and print in JSON format, including the search query, clients, and admins.
|
|
173
|
-
|
|
174
|
-
knife vault show passwords root -Fjson -p all
|
|
175
|
-
|
|
176
|
-
Show the username and password for the item root in the vault passwords.
|
|
177
|
-
|
|
178
|
-
knife vault show passwords root "username, password"
|
|
179
|
-
|
|
180
|
-
Show the contents for the item user_pem in the vault certs.
|
|
181
|
-
|
|
182
|
-
knife vault show certs user_pem "contents"
|
|
183
|
-
|
|
184
|
-
### edit
|
|
185
|
-
|
|
186
|
-
knife vault edit VAULT ITEM
|
|
187
|
-
|
|
188
|
-
These are the commands that are used to edit a chef-vault encrypted item.
|
|
189
|
-
|
|
190
|
-
* Vault - This is the name of the vault in which to store the encrypted item. This is analogous to a chef data bag name
|
|
191
|
-
* Item - The name of the item going in to the vault. This is analogous to a chef data bag item id
|
|
192
|
-
|
|
193
|
-
Decrypt the entire root item in the passwords vault and open it in json format in your $EDITOR. Writing and exiting out the editor will save and encrypt the vault item.
|
|
194
|
-
|
|
195
|
-
knife vault edit passwords root
|
|
196
|
-
|
|
197
|
-
### download
|
|
198
|
-
|
|
199
|
-
Decrypt and download an encrypted file to the specified path.
|
|
200
|
-
|
|
201
|
-
knife vault download certs user_pem ~/downloaded_user_pem
|
|
202
|
-
|
|
203
|
-
### rotate keys
|
|
204
|
-
|
|
205
|
-
Rotate the shared key for the vault passwords and item root. The shared key is that which is used for the chef encrypted data bag item.
|
|
206
|
-
|
|
207
|
-
knife vault rotate keys passwords root
|
|
208
|
-
|
|
209
|
-
To remove clients which have been deleted from Chef but not from the vault, add the --clean-unknown-clients switch:
|
|
210
|
-
|
|
211
|
-
knife vault rotate keys passwords root --clean-unknown-clients
|
|
212
|
-
|
|
213
|
-
### rotate all keys
|
|
214
|
-
|
|
215
|
-
Rotate the shared key for all vaults and items. The shared key is that which is used for the chef encrypted data bag item.
|
|
216
|
-
|
|
217
|
-
knife vault rotate all keys
|
|
218
|
-
|
|
219
|
-
To remove clients which have been deleted from Chef but not from the vault, add the --clean-unknown-clients switch:
|
|
220
|
-
|
|
221
|
-
knife vault rotate keys passwords root --clean-unknown-clients
|
|
222
|
-
|
|
223
|
-
### refresh
|
|
224
|
-
|
|
225
|
-
This command reads the search_query in the vault item, performs the search, and reapplies the results.
|
|
226
|
-
|
|
227
|
-
knife vault refresh VAULT ITEM
|
|
228
|
-
|
|
229
|
-
To remove clients which have been deleted from Chef but not from the vault, add the --clean-unknown-clients switch:
|
|
230
|
-
|
|
231
|
-
knife vault refresh passwords root --clean-unknown-clients
|
|
232
|
-
|
|
233
|
-
### isvault
|
|
234
|
-
|
|
235
|
-
This command checks if the given item is a vault or not, and exit with a status of 0 if it is and 1 if it is not.
|
|
236
|
-
|
|
237
|
-
knife vault isvault VAULT ITEM
|
|
238
|
-
|
|
239
|
-
### itemtype
|
|
240
|
-
|
|
241
|
-
This command outputs the type of the data bag item: normal, encrypted or vault
|
|
242
|
-
|
|
243
|
-
knife vault itemtype VAULT ITEM
|
|
244
|
-
|
|
245
|
-
### global options
|
|
246
|
-
|
|
247
|
-
Short | Long | Description | Default | Valid Values | Sub-Commands
|
|
248
|
-
------|------|-------------|---------|--------------|-------------
|
|
249
|
-
-M MODE | --mode MODE | Chef mode to run in. Can be set in knife.rb | solo | solo, client | all
|
|
250
|
-
-S SEARCH | --search SEARCH | Chef Server SOLR Search Of Nodes | | | create, remove , update
|
|
251
|
-
-A ADMINS | --admins ADMINS | Chef clients or users to be vault admins, can be comma list | | | create, remove, update
|
|
252
|
-
-J FILE | --json FILE | JSON file to be used for values, will be merged with VALUES if VALUES is passed | | | create, update
|
|
253
|
-
| --file FILE | File that chef-vault should encrypt. It adds "file-content" & "file-name" keys to the vault item | | | create, update
|
|
254
|
-
-p DATA | --print DATA | Print extra vault data | | search, clients, admins, all | show
|
|
255
|
-
-F FORMAT | --format FORMAT | Format for decrypted output | summary | summary, json, yaml, pp | show
|
|
256
|
-
| --clean-unknown-clients | Remove unknown clients during key rotation | | | refresh, remove, rotate
|