cheffish 1.3.1 → 1.4.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (76) hide show
  1. checksums.yaml +4 -4
  2. data/LICENSE +201 -201
  3. data/README.md +120 -117
  4. data/Rakefile +23 -23
  5. data/lib/chef/provider/chef_acl.rb +439 -434
  6. data/lib/chef/provider/chef_client.rb +53 -48
  7. data/lib/chef/provider/chef_container.rb +55 -50
  8. data/lib/chef/provider/chef_data_bag.rb +55 -50
  9. data/lib/chef/provider/chef_data_bag_item.rb +278 -273
  10. data/lib/chef/provider/chef_environment.rb +83 -78
  11. data/lib/chef/provider/chef_group.rb +83 -78
  12. data/lib/chef/provider/chef_mirror.rb +169 -164
  13. data/lib/chef/provider/chef_node.rb +87 -82
  14. data/lib/chef/provider/chef_organization.rb +155 -150
  15. data/lib/chef/provider/chef_resolved_cookbooks.rb +46 -41
  16. data/lib/chef/provider/chef_role.rb +84 -79
  17. data/lib/chef/provider/chef_user.rb +59 -54
  18. data/lib/chef/provider/private_key.rb +225 -220
  19. data/lib/chef/provider/public_key.rb +88 -82
  20. data/lib/chef/resource/chef_acl.rb +69 -65
  21. data/lib/chef/resource/chef_client.rb +48 -44
  22. data/lib/chef/resource/chef_container.rb +22 -18
  23. data/lib/chef/resource/chef_data_bag.rb +22 -18
  24. data/lib/chef/resource/chef_data_bag_item.rb +121 -114
  25. data/lib/chef/resource/chef_environment.rb +77 -71
  26. data/lib/chef/resource/chef_group.rb +53 -49
  27. data/lib/chef/resource/chef_mirror.rb +52 -48
  28. data/lib/chef/resource/chef_node.rb +22 -18
  29. data/lib/chef/resource/chef_organization.rb +69 -64
  30. data/lib/chef/resource/chef_resolved_cookbooks.rb +35 -31
  31. data/lib/chef/resource/chef_role.rb +110 -104
  32. data/lib/chef/resource/chef_user.rb +56 -52
  33. data/lib/chef/resource/private_key.rb +48 -44
  34. data/lib/chef/resource/public_key.rb +25 -21
  35. data/lib/cheffish.rb +235 -233
  36. data/lib/cheffish/actor_provider_base.rb +131 -131
  37. data/lib/cheffish/basic_chef_client.rb +184 -184
  38. data/lib/cheffish/chef_provider_base.rb +246 -246
  39. data/lib/cheffish/chef_run.rb +162 -155
  40. data/lib/cheffish/chef_run_data.rb +19 -19
  41. data/lib/cheffish/chef_run_listener.rb +30 -30
  42. data/lib/cheffish/key_formatter.rb +113 -113
  43. data/lib/cheffish/merged_config.rb +94 -94
  44. data/lib/cheffish/recipe_dsl.rb +157 -157
  45. data/lib/cheffish/rspec.rb +8 -8
  46. data/lib/cheffish/rspec/chef_run_support.rb +83 -83
  47. data/lib/cheffish/rspec/matchers.rb +4 -4
  48. data/lib/cheffish/rspec/matchers/be_idempotent.rb +16 -16
  49. data/lib/cheffish/rspec/matchers/emit_no_warnings_or_errors.rb +15 -15
  50. data/lib/cheffish/rspec/matchers/have_updated.rb +37 -37
  51. data/lib/cheffish/rspec/matchers/partially_match.rb +63 -63
  52. data/lib/cheffish/rspec/recipe_run_wrapper.rb +59 -47
  53. data/lib/cheffish/rspec/repository_support.rb +108 -108
  54. data/lib/cheffish/server_api.rb +52 -52
  55. data/lib/cheffish/version.rb +3 -3
  56. data/lib/cheffish/with_pattern.rb +21 -21
  57. data/spec/functional/fingerprint_spec.rb +64 -64
  58. data/spec/functional/merged_config_spec.rb +19 -19
  59. data/spec/functional/server_api_spec.rb +13 -13
  60. data/spec/integration/chef_acl_spec.rb +879 -879
  61. data/spec/integration/chef_client_spec.rb +105 -105
  62. data/spec/integration/chef_container_spec.rb +33 -33
  63. data/spec/integration/chef_group_spec.rb +309 -309
  64. data/spec/integration/chef_mirror_spec.rb +491 -491
  65. data/spec/integration/chef_node_spec.rb +786 -786
  66. data/spec/integration/chef_organization_spec.rb +226 -226
  67. data/spec/integration/chef_role_spec.rb +78 -0
  68. data/spec/integration/chef_user_spec.rb +85 -85
  69. data/spec/integration/private_key_spec.rb +399 -399
  70. data/spec/integration/recipe_dsl_spec.rb +28 -28
  71. data/spec/integration/rspec/converge_spec.rb +183 -183
  72. data/spec/support/key_support.rb +29 -29
  73. data/spec/support/spec_support.rb +15 -15
  74. data/spec/unit/get_private_key_spec.rb +131 -131
  75. data/spec/unit/recipe_run_wrapper_spec.rb +37 -0
  76. metadata +8 -5
@@ -1,48 +1,53 @@
1
- require 'cheffish/actor_provider_base'
2
- require 'chef/resource/chef_client'
3
- require 'chef/chef_fs/data_handler/client_data_handler'
4
-
5
- class Chef::Provider::ChefClient < Cheffish::ActorProviderBase
6
-
7
- def whyrun_supported?
8
- true
9
- end
10
-
11
- def actor_type
12
- 'client'
13
- end
14
-
15
- def actor_path
16
- 'clients'
17
- end
18
-
19
- action :create do
20
- create_actor
21
- end
22
-
23
- action :delete do
24
- delete_actor
25
- end
26
-
27
- #
28
- # Helpers
29
- #
30
-
31
- def resource_class
32
- Chef::Resource::ChefClient
33
- end
34
-
35
- def data_handler
36
- Chef::ChefFS::DataHandler::ClientDataHandler.new
37
- end
38
-
39
- def keys
40
- {
41
- 'name' => :name,
42
- 'admin' => :admin,
43
- 'validator' => :validator,
44
- 'public_key' => :source_key
45
- }
46
- end
47
-
48
- end
1
+ require 'cheffish/actor_provider_base'
2
+ require 'chef/resource/chef_client'
3
+ require 'chef/chef_fs/data_handler/client_data_handler'
4
+
5
+ class Chef
6
+ class Provider
7
+ class ChefClient < Cheffish::ActorProviderBase
8
+ provides :chef_client
9
+
10
+ def whyrun_supported?
11
+ true
12
+ end
13
+
14
+ def actor_type
15
+ 'client'
16
+ end
17
+
18
+ def actor_path
19
+ 'clients'
20
+ end
21
+
22
+ action :create do
23
+ create_actor
24
+ end
25
+
26
+ action :delete do
27
+ delete_actor
28
+ end
29
+
30
+ #
31
+ # Helpers
32
+ #
33
+
34
+ def resource_class
35
+ Chef::Resource::ChefClient
36
+ end
37
+
38
+ def data_handler
39
+ Chef::ChefFS::DataHandler::ClientDataHandler.new
40
+ end
41
+
42
+ def keys
43
+ {
44
+ 'name' => :name,
45
+ 'admin' => :admin,
46
+ 'validator' => :validator,
47
+ 'public_key' => :source_key
48
+ }
49
+ end
50
+
51
+ end
52
+ end
53
+ end
@@ -1,50 +1,55 @@
1
- require 'cheffish/chef_provider_base'
2
- require 'chef/resource/chef_container'
3
- require 'chef/chef_fs/data_handler/container_data_handler'
4
-
5
- class Chef::Provider::ChefContainer < Cheffish::ChefProviderBase
6
-
7
- def whyrun_supported?
8
- true
9
- end
10
-
11
- action :create do
12
- if !@current_exists
13
- converge_by "create container #{new_resource.name} at #{rest.url}" do
14
- rest.post("containers", normalize_for_post(new_json))
15
- end
16
- end
17
- end
18
-
19
- action :delete do
20
- if @current_exists
21
- converge_by "delete container #{new_resource.name} at #{rest.url}" do
22
- rest.delete("containers/#{new_resource.name}")
23
- end
24
- end
25
- end
26
-
27
- def load_current_resource
28
- begin
29
- @current_exists = rest.get("containers/#{new_resource.name}")
30
- rescue Net::HTTPServerException => e
31
- if e.response.code == "404"
32
- @current_exists = false
33
- else
34
- raise
35
- end
36
- end
37
- end
38
-
39
- def new_json
40
- {}
41
- end
42
-
43
- def data_handler
44
- Chef::ChefFS::DataHandler::ContainerDataHandler.new
45
- end
46
-
47
- def keys
48
- { 'containername' => :name, 'containerpath' => :name }
49
- end
50
- end
1
+ require 'cheffish/chef_provider_base'
2
+ require 'chef/resource/chef_container'
3
+ require 'chef/chef_fs/data_handler/container_data_handler'
4
+
5
+ class Chef
6
+ class Provider
7
+ class ChefContainer < Cheffish::ChefProviderBase
8
+ provides :chef_container
9
+
10
+ def whyrun_supported?
11
+ true
12
+ end
13
+
14
+ action :create do
15
+ if !@current_exists
16
+ converge_by "create container #{new_resource.name} at #{rest.url}" do
17
+ rest.post("containers", normalize_for_post(new_json))
18
+ end
19
+ end
20
+ end
21
+
22
+ action :delete do
23
+ if @current_exists
24
+ converge_by "delete container #{new_resource.name} at #{rest.url}" do
25
+ rest.delete("containers/#{new_resource.name}")
26
+ end
27
+ end
28
+ end
29
+
30
+ def load_current_resource
31
+ begin
32
+ @current_exists = rest.get("containers/#{new_resource.name}")
33
+ rescue Net::HTTPServerException => e
34
+ if e.response.code == "404"
35
+ @current_exists = false
36
+ else
37
+ raise
38
+ end
39
+ end
40
+ end
41
+
42
+ def new_json
43
+ {}
44
+ end
45
+
46
+ def data_handler
47
+ Chef::ChefFS::DataHandler::ContainerDataHandler.new
48
+ end
49
+
50
+ def keys
51
+ { 'containername' => :name, 'containerpath' => :name }
52
+ end
53
+ end
54
+ end
55
+ end
@@ -1,50 +1,55 @@
1
- require 'cheffish/chef_provider_base'
2
- require 'chef/resource/chef_data_bag'
3
-
4
- class Chef::Provider::ChefDataBag < Cheffish::ChefProviderBase
5
-
6
- def whyrun_supported?
7
- true
8
- end
9
-
10
- action :create do
11
- if !current_resource_exists?
12
- converge_by "create data bag #{new_resource.name} at #{rest.url}" do
13
- rest.post("data", { 'name' => new_resource.name })
14
- end
15
- end
16
- end
17
-
18
- action :delete do
19
- if current_resource_exists?
20
- converge_by "delete data bag #{new_resource.name} at #{rest.url}" do
21
- rest.delete("data/#{new_resource.name}")
22
- end
23
- end
24
- end
25
-
26
- def load_current_resource
27
- begin
28
- @current_resource = json_to_resource(rest.get("data/#{new_resource.name}"))
29
- rescue Net::HTTPServerException => e
30
- if e.response.code == "404"
31
- @current_resource = not_found_resource
32
- else
33
- raise
34
- end
35
- end
36
- end
37
-
38
- #
39
- # Helpers
40
- #
41
- # Gives us new_json, current_json, not_found_json, etc.
42
-
43
- def resource_class
44
- Chef::Resource::ChefDataBag
45
- end
46
-
47
- def json_to_resource(json)
48
- Chef::Resource::ChefDataBag.new(json['name'], run_context)
49
- end
50
- end
1
+ require 'cheffish/chef_provider_base'
2
+ require 'chef/resource/chef_data_bag'
3
+
4
+ class Chef
5
+ class Provider
6
+ class ChefDataBag < Cheffish::ChefProviderBase
7
+ provides :chef_data_bag
8
+
9
+ def whyrun_supported?
10
+ true
11
+ end
12
+
13
+ action :create do
14
+ if !current_resource_exists?
15
+ converge_by "create data bag #{new_resource.name} at #{rest.url}" do
16
+ rest.post("data", { 'name' => new_resource.name })
17
+ end
18
+ end
19
+ end
20
+
21
+ action :delete do
22
+ if current_resource_exists?
23
+ converge_by "delete data bag #{new_resource.name} at #{rest.url}" do
24
+ rest.delete("data/#{new_resource.name}")
25
+ end
26
+ end
27
+ end
28
+
29
+ def load_current_resource
30
+ begin
31
+ @current_resource = json_to_resource(rest.get("data/#{new_resource.name}"))
32
+ rescue Net::HTTPServerException => e
33
+ if e.response.code == "404"
34
+ @current_resource = not_found_resource
35
+ else
36
+ raise
37
+ end
38
+ end
39
+ end
40
+
41
+ #
42
+ # Helpers
43
+ #
44
+ # Gives us new_json, current_json, not_found_json, etc.
45
+
46
+ def resource_class
47
+ Chef::Resource::ChefDataBag
48
+ end
49
+
50
+ def json_to_resource(json)
51
+ Chef::Resource::ChefDataBag.new(json['name'], run_context)
52
+ end
53
+ end
54
+ end
55
+ end
@@ -1,273 +1,278 @@
1
- require 'cheffish/chef_provider_base'
2
- require 'chef/resource/chef_data_bag_item'
3
- require 'chef/chef_fs/data_handler/data_bag_item_data_handler'
4
- require 'chef/encrypted_data_bag_item'
5
-
6
- class Chef::Provider::ChefDataBagItem < Cheffish::ChefProviderBase
7
-
8
- def whyrun_supported?
9
- true
10
- end
11
-
12
- action :create do
13
- differences = calculate_differences
14
-
15
- if current_resource_exists?
16
- if differences.size > 0
17
- description = [ "update data bag item #{new_resource.id} at #{rest.url}" ] + differences
18
- converge_by description do
19
- rest.put("data/#{new_resource.data_bag}/#{new_resource.id}", normalize_for_put(new_json))
20
- end
21
- end
22
- else
23
- description = [ "create data bag item #{new_resource.id} at #{rest.url}" ] + differences
24
- converge_by description do
25
- rest.post("data/#{new_resource.data_bag}", normalize_for_post(new_json))
26
- end
27
- end
28
- end
29
-
30
- action :delete do
31
- if current_resource_exists?
32
- converge_by "delete data bag item #{new_resource.id} at #{rest.url}" do
33
- rest.delete("data/#{new_resource.data_bag}/#{new_resource.id}")
34
- end
35
- end
36
- end
37
-
38
- def load_current_resource
39
- begin
40
- json = rest.get("data/#{new_resource.data_bag}/#{new_resource.id}")
41
- resource = Chef::Resource::ChefDataBagItem.new(new_resource.name, run_context)
42
- resource.raw_data json
43
- @current_resource = resource
44
- rescue Net::HTTPServerException => e
45
- if e.response.code == "404"
46
- @current_resource = not_found_resource
47
- else
48
- raise
49
- end
50
- end
51
-
52
- # Determine if data bag is encrypted and if so, what its version is
53
- first_real_key, first_real_value = (current_resource.raw_data || {}).select { |key, value| key != 'id' && !value.nil? }.first
54
- if first_real_value
55
- if first_real_value.is_a?(Hash) &&
56
- first_real_value['version'].is_a?(Integer) &&
57
- first_real_value['version'] > 0 &&
58
- first_real_value.has_key?('encrypted_data')
59
-
60
- current_resource.encrypt true
61
- current_resource.encryption_version first_real_value['version']
62
-
63
- decrypt_error = nil
64
-
65
- # Check if the desired secret is the one (which it generally should be)
66
-
67
- if new_resource.secret || new_resource.secret_path
68
- begin
69
- Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, new_secret).for_decrypted_item
70
- current_resource.secret new_secret
71
- rescue Chef::EncryptedDataBagItem::DecryptionFailure
72
- decrypt_error = $!
73
- end
74
- end
75
-
76
- # If the current secret doesn't work, look through the specified old secrets
77
-
78
- if !current_resource.secret
79
- old_secrets = []
80
- if new_resource.old_secret
81
- old_secrets += Array(new_resource.old_secret)
82
- end
83
- if new_resource.old_secret_path
84
- old_secrets += Array(new_resource.old_secret_path).map do |secret_path|
85
- Chef::EncryptedDataBagItem.load_secret(new_resource.old_secret_file)
86
- end
87
- end
88
- old_secrets.each do |secret|
89
- begin
90
- Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, secret).for_decrypted_item
91
- current_resource.secret secret
92
- rescue Chef::EncryptedDataBagItem::DecryptionFailure
93
- decrypt_error = $!
94
- end
95
- end
96
-
97
- # If we couldn't figure out the secret, emit a warning (this isn't a fatal flaw unless we
98
- # need to reuse one of the values from the data bag)
99
- if !current_resource.secret
100
- if decrypt_error
101
- Chef::Log.warn "Existing data bag is encrypted, but could not decrypt: #{decrypt_error.message}."
102
- else
103
- Chef::Log.warn "Existing data bag is encrypted, but no secret was specified."
104
- end
105
- end
106
- end
107
- end
108
- else
109
-
110
- # There are no encryptable values, so pretend encryption is the same as desired
111
-
112
- current_resource.encrypt new_resource.encrypt
113
- current_resource.encryption_version new_resource.encryption_version
114
- if new_resource.secret || new_resource.secret_path
115
- current_resource.secret new_secret
116
- end
117
- end
118
- end
119
-
120
- def new_json
121
- @new_json ||= begin
122
- if new_encrypt
123
- # Encrypt new stuff
124
- result = encrypt(new_decrypted, new_secret, new_resource.encryption_version)
125
- else
126
- result = new_decrypted
127
- end
128
- result
129
- end
130
- end
131
-
132
- def new_encrypt
133
- new_resource.encrypt.nil? ? current_resource.encrypt : new_resource.encrypt
134
- end
135
-
136
- def new_secret
137
- @new_secret ||= begin
138
- if new_resource.secret
139
- new_resource.secret
140
- elsif new_resource.secret_path
141
- Chef::EncryptedDataBagItem.load_secret(new_resource.secret_path)
142
- elsif new_resource.encrypt.nil?
143
- current_resource.secret
144
- else
145
- raise "Data bag item #{new_resource.name} has encryption on but no secret or secret_path is specified"
146
- end
147
- end
148
- end
149
-
150
- def decrypt(json, secret)
151
- Chef::EncryptedDataBagItem.new(json, secret).to_hash
152
- end
153
-
154
- def encrypt(json, secret, version)
155
- old_version = run_context.config[:data_bag_encrypt_version]
156
- run_context.config[:data_bag_encrypt_version] = version
157
- begin
158
- Chef::EncryptedDataBagItem.encrypt_data_bag_item(json, secret)
159
- ensure
160
- run_context.config[:data_bag_encrypt_version] = old_version
161
- end
162
- end
163
-
164
- # Get the desired (new) json pre-encryption, for comparison purposes
165
- def new_decrypted
166
- @new_decrypted ||= begin
167
- if new_resource.complete
168
- result = new_resource.raw_data || {}
169
- else
170
- result = current_decrypted.merge(new_resource.raw_data || {})
171
- end
172
- result['id'] = new_resource.id
173
- result = apply_modifiers(new_resource.raw_data_modifiers, result)
174
- end
175
- end
176
-
177
- # Get the current json decrypted, for comparison purposes
178
- def current_decrypted
179
- @current_decrypted ||= begin
180
- if current_resource.secret
181
- decrypt(current_resource.raw_data || { 'id' => new_resource.id }, current_resource.secret)
182
- elsif current_resource.encrypt
183
- raise "Could not decrypt current data bag item #{current_resource.name}"
184
- else
185
- current_resource.raw_data || { 'id' => new_resource.id }
186
- end
187
- end
188
- end
189
-
190
- # Figure out the differences between new and current
191
- def calculate_differences
192
- if new_encrypt
193
- if current_resource.encrypt
194
- # Both are encrypted, check if the encryption type is the same
195
- description = ''
196
- if new_secret != current_resource.secret
197
- description << ' with new secret'
198
- end
199
- if new_resource.encryption_version != current_resource.encryption_version
200
- description << " from v#{current_resource.encryption_version} to v#{new_resource.encryption_version} encryption"
201
- end
202
-
203
- if description != ''
204
- # Encryption is different, we're reencrypting
205
- differences = [ "re-encrypt#{description}"]
206
- else
207
- # Encryption is the same, we're just updating
208
- differences = []
209
- end
210
- else
211
- # New stuff should be encrypted, old is not. Encrypting.
212
- differences = [ "encrypt with v#{new_resource.encryption_version} encryption" ]
213
- end
214
-
215
- # Get differences in the actual json
216
- if current_resource.secret
217
- json_differences(current_decrypted, new_decrypted, false, '', differences)
218
- elsif current_resource.encrypt
219
- # Encryption is different and we can't read the old values. Only allow the change
220
- # if we're overwriting the data bag item
221
- if !new_resource.complete
222
- raise "Cannot encrypt #{new_resource.name} due to failure to decrypt existing resource. Set 'complete true' to overwrite or add the old secret as old_secret / old_secret_path."
223
- end
224
- differences = [ "overwrite data bag item (cannot decrypt old data bag item)"]
225
- differences = (new_resource.raw_data.keys & current_resource.raw_data.keys).map { |key| "overwrite #{key}"}
226
- differences += (new_resource.raw_data.keys - current_resource.raw_data.keys).map { |key| "add #{key}"}
227
- differences += (current_resource.raw_data.keys - new_resource.raw_data.keys).map { |key| "remove #{key}" }
228
- else
229
- json_differences(current_decrypted, new_decrypted, false, '', differences)
230
- end
231
- else
232
- if current_resource.encrypt
233
- # New stuff should not be encrypted, old is. Decrypting.
234
- differences = [ "decrypt data bag item to plaintext" ]
235
- else
236
- differences = []
237
- end
238
- json_differences(current_decrypted, new_decrypted, true, '', differences)
239
- end
240
- differences
241
- end
242
-
243
- #
244
- # Helpers
245
- #
246
-
247
- def resource_class
248
- Chef::Resource::ChefDataBagItem
249
- end
250
-
251
- def data_handler
252
- Chef::ChefFS::DataHandler::DataBagItemDataHandler.new
253
- end
254
-
255
- def keys
256
- {
257
- 'id' => :id,
258
- 'data_bag' => :data_bag,
259
- 'raw_data' => :raw_data
260
- }
261
- end
262
-
263
- def not_found_resource
264
- resource = super
265
- resource.data_bag new_resource.data_bag
266
- resource
267
- end
268
-
269
- def fake_entry
270
- FakeEntry.new("#{new_resource.id}.json", FakeEntry.new(new_resource.data_bag))
271
- end
272
-
273
- end
1
+ require 'cheffish/chef_provider_base'
2
+ require 'chef/resource/chef_data_bag_item'
3
+ require 'chef/chef_fs/data_handler/data_bag_item_data_handler'
4
+ require 'chef/encrypted_data_bag_item'
5
+
6
+ class Chef
7
+ class Provider
8
+ class ChefDataBagItem < Cheffish::ChefProviderBase
9
+ provides :chef_data_bag_item
10
+
11
+ def whyrun_supported?
12
+ true
13
+ end
14
+
15
+ action :create do
16
+ differences = calculate_differences
17
+
18
+ if current_resource_exists?
19
+ if differences.size > 0
20
+ description = [ "update data bag item #{new_resource.id} at #{rest.url}" ] + differences
21
+ converge_by description do
22
+ rest.put("data/#{new_resource.data_bag}/#{new_resource.id}", normalize_for_put(new_json))
23
+ end
24
+ end
25
+ else
26
+ description = [ "create data bag item #{new_resource.id} at #{rest.url}" ] + differences
27
+ converge_by description do
28
+ rest.post("data/#{new_resource.data_bag}", normalize_for_post(new_json))
29
+ end
30
+ end
31
+ end
32
+
33
+ action :delete do
34
+ if current_resource_exists?
35
+ converge_by "delete data bag item #{new_resource.id} at #{rest.url}" do
36
+ rest.delete("data/#{new_resource.data_bag}/#{new_resource.id}")
37
+ end
38
+ end
39
+ end
40
+
41
+ def load_current_resource
42
+ begin
43
+ json = rest.get("data/#{new_resource.data_bag}/#{new_resource.id}")
44
+ resource = Chef::Resource::ChefDataBagItem.new(new_resource.name, run_context)
45
+ resource.raw_data json
46
+ @current_resource = resource
47
+ rescue Net::HTTPServerException => e
48
+ if e.response.code == "404"
49
+ @current_resource = not_found_resource
50
+ else
51
+ raise
52
+ end
53
+ end
54
+
55
+ # Determine if data bag is encrypted and if so, what its version is
56
+ first_real_key, first_real_value = (current_resource.raw_data || {}).select { |key, value| key != 'id' && !value.nil? }.first
57
+ if first_real_value
58
+ if first_real_value.is_a?(Hash) &&
59
+ first_real_value['version'].is_a?(Integer) &&
60
+ first_real_value['version'] > 0 &&
61
+ first_real_value.has_key?('encrypted_data')
62
+
63
+ current_resource.encrypt true
64
+ current_resource.encryption_version first_real_value['version']
65
+
66
+ decrypt_error = nil
67
+
68
+ # Check if the desired secret is the one (which it generally should be)
69
+
70
+ if new_resource.secret || new_resource.secret_path
71
+ begin
72
+ Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, new_secret).for_decrypted_item
73
+ current_resource.secret new_secret
74
+ rescue Chef::EncryptedDataBagItem::DecryptionFailure
75
+ decrypt_error = $!
76
+ end
77
+ end
78
+
79
+ # If the current secret doesn't work, look through the specified old secrets
80
+
81
+ if !current_resource.secret
82
+ old_secrets = []
83
+ if new_resource.old_secret
84
+ old_secrets += Array(new_resource.old_secret)
85
+ end
86
+ if new_resource.old_secret_path
87
+ old_secrets += Array(new_resource.old_secret_path).map do |secret_path|
88
+ Chef::EncryptedDataBagItem.load_secret(new_resource.old_secret_file)
89
+ end
90
+ end
91
+ old_secrets.each do |secret|
92
+ begin
93
+ Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, secret).for_decrypted_item
94
+ current_resource.secret secret
95
+ rescue Chef::EncryptedDataBagItem::DecryptionFailure
96
+ decrypt_error = $!
97
+ end
98
+ end
99
+
100
+ # If we couldn't figure out the secret, emit a warning (this isn't a fatal flaw unless we
101
+ # need to reuse one of the values from the data bag)
102
+ if !current_resource.secret
103
+ if decrypt_error
104
+ Chef::Log.warn "Existing data bag is encrypted, but could not decrypt: #{decrypt_error.message}."
105
+ else
106
+ Chef::Log.warn "Existing data bag is encrypted, but no secret was specified."
107
+ end
108
+ end
109
+ end
110
+ end
111
+ else
112
+
113
+ # There are no encryptable values, so pretend encryption is the same as desired
114
+
115
+ current_resource.encrypt new_resource.encrypt
116
+ current_resource.encryption_version new_resource.encryption_version
117
+ if new_resource.secret || new_resource.secret_path
118
+ current_resource.secret new_secret
119
+ end
120
+ end
121
+ end
122
+
123
+ def new_json
124
+ @new_json ||= begin
125
+ if new_encrypt
126
+ # Encrypt new stuff
127
+ result = encrypt(new_decrypted, new_secret, new_resource.encryption_version)
128
+ else
129
+ result = new_decrypted
130
+ end
131
+ result
132
+ end
133
+ end
134
+
135
+ def new_encrypt
136
+ new_resource.encrypt.nil? ? current_resource.encrypt : new_resource.encrypt
137
+ end
138
+
139
+ def new_secret
140
+ @new_secret ||= begin
141
+ if new_resource.secret
142
+ new_resource.secret
143
+ elsif new_resource.secret_path
144
+ Chef::EncryptedDataBagItem.load_secret(new_resource.secret_path)
145
+ elsif new_resource.encrypt.nil?
146
+ current_resource.secret
147
+ else
148
+ raise "Data bag item #{new_resource.name} has encryption on but no secret or secret_path is specified"
149
+ end
150
+ end
151
+ end
152
+
153
+ def decrypt(json, secret)
154
+ Chef::EncryptedDataBagItem.new(json, secret).to_hash
155
+ end
156
+
157
+ def encrypt(json, secret, version)
158
+ old_version = run_context.config[:data_bag_encrypt_version]
159
+ run_context.config[:data_bag_encrypt_version] = version
160
+ begin
161
+ Chef::EncryptedDataBagItem.encrypt_data_bag_item(json, secret)
162
+ ensure
163
+ run_context.config[:data_bag_encrypt_version] = old_version
164
+ end
165
+ end
166
+
167
+ # Get the desired (new) json pre-encryption, for comparison purposes
168
+ def new_decrypted
169
+ @new_decrypted ||= begin
170
+ if new_resource.complete
171
+ result = new_resource.raw_data || {}
172
+ else
173
+ result = current_decrypted.merge(new_resource.raw_data || {})
174
+ end
175
+ result['id'] = new_resource.id
176
+ result = apply_modifiers(new_resource.raw_data_modifiers, result)
177
+ end
178
+ end
179
+
180
+ # Get the current json decrypted, for comparison purposes
181
+ def current_decrypted
182
+ @current_decrypted ||= begin
183
+ if current_resource.secret
184
+ decrypt(current_resource.raw_data || { 'id' => new_resource.id }, current_resource.secret)
185
+ elsif current_resource.encrypt
186
+ raise "Could not decrypt current data bag item #{current_resource.name}"
187
+ else
188
+ current_resource.raw_data || { 'id' => new_resource.id }
189
+ end
190
+ end
191
+ end
192
+
193
+ # Figure out the differences between new and current
194
+ def calculate_differences
195
+ if new_encrypt
196
+ if current_resource.encrypt
197
+ # Both are encrypted, check if the encryption type is the same
198
+ description = ''
199
+ if new_secret != current_resource.secret
200
+ description << ' with new secret'
201
+ end
202
+ if new_resource.encryption_version != current_resource.encryption_version
203
+ description << " from v#{current_resource.encryption_version} to v#{new_resource.encryption_version} encryption"
204
+ end
205
+
206
+ if description != ''
207
+ # Encryption is different, we're reencrypting
208
+ differences = [ "re-encrypt#{description}"]
209
+ else
210
+ # Encryption is the same, we're just updating
211
+ differences = []
212
+ end
213
+ else
214
+ # New stuff should be encrypted, old is not. Encrypting.
215
+ differences = [ "encrypt with v#{new_resource.encryption_version} encryption" ]
216
+ end
217
+
218
+ # Get differences in the actual json
219
+ if current_resource.secret
220
+ json_differences(current_decrypted, new_decrypted, false, '', differences)
221
+ elsif current_resource.encrypt
222
+ # Encryption is different and we can't read the old values. Only allow the change
223
+ # if we're overwriting the data bag item
224
+ if !new_resource.complete
225
+ raise "Cannot encrypt #{new_resource.name} due to failure to decrypt existing resource. Set 'complete true' to overwrite or add the old secret as old_secret / old_secret_path."
226
+ end
227
+ differences = [ "overwrite data bag item (cannot decrypt old data bag item)"]
228
+ differences = (new_resource.raw_data.keys & current_resource.raw_data.keys).map { |key| "overwrite #{key}"}
229
+ differences += (new_resource.raw_data.keys - current_resource.raw_data.keys).map { |key| "add #{key}"}
230
+ differences += (current_resource.raw_data.keys - new_resource.raw_data.keys).map { |key| "remove #{key}" }
231
+ else
232
+ json_differences(current_decrypted, new_decrypted, false, '', differences)
233
+ end
234
+ else
235
+ if current_resource.encrypt
236
+ # New stuff should not be encrypted, old is. Decrypting.
237
+ differences = [ "decrypt data bag item to plaintext" ]
238
+ else
239
+ differences = []
240
+ end
241
+ json_differences(current_decrypted, new_decrypted, true, '', differences)
242
+ end
243
+ differences
244
+ end
245
+
246
+ #
247
+ # Helpers
248
+ #
249
+
250
+ def resource_class
251
+ Chef::Resource::ChefDataBagItem
252
+ end
253
+
254
+ def data_handler
255
+ Chef::ChefFS::DataHandler::DataBagItemDataHandler.new
256
+ end
257
+
258
+ def keys
259
+ {
260
+ 'id' => :id,
261
+ 'data_bag' => :data_bag,
262
+ 'raw_data' => :raw_data
263
+ }
264
+ end
265
+
266
+ def not_found_resource
267
+ resource = super
268
+ resource.data_bag new_resource.data_bag
269
+ resource
270
+ end
271
+
272
+ def fake_entry
273
+ FakeEntry.new("#{new_resource.id}.json", FakeEntry.new(new_resource.data_bag))
274
+ end
275
+
276
+ end
277
+ end
278
+ end