cheffish 1.3.1 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (76) hide show
  1. checksums.yaml +4 -4
  2. data/LICENSE +201 -201
  3. data/README.md +120 -117
  4. data/Rakefile +23 -23
  5. data/lib/chef/provider/chef_acl.rb +439 -434
  6. data/lib/chef/provider/chef_client.rb +53 -48
  7. data/lib/chef/provider/chef_container.rb +55 -50
  8. data/lib/chef/provider/chef_data_bag.rb +55 -50
  9. data/lib/chef/provider/chef_data_bag_item.rb +278 -273
  10. data/lib/chef/provider/chef_environment.rb +83 -78
  11. data/lib/chef/provider/chef_group.rb +83 -78
  12. data/lib/chef/provider/chef_mirror.rb +169 -164
  13. data/lib/chef/provider/chef_node.rb +87 -82
  14. data/lib/chef/provider/chef_organization.rb +155 -150
  15. data/lib/chef/provider/chef_resolved_cookbooks.rb +46 -41
  16. data/lib/chef/provider/chef_role.rb +84 -79
  17. data/lib/chef/provider/chef_user.rb +59 -54
  18. data/lib/chef/provider/private_key.rb +225 -220
  19. data/lib/chef/provider/public_key.rb +88 -82
  20. data/lib/chef/resource/chef_acl.rb +69 -65
  21. data/lib/chef/resource/chef_client.rb +48 -44
  22. data/lib/chef/resource/chef_container.rb +22 -18
  23. data/lib/chef/resource/chef_data_bag.rb +22 -18
  24. data/lib/chef/resource/chef_data_bag_item.rb +121 -114
  25. data/lib/chef/resource/chef_environment.rb +77 -71
  26. data/lib/chef/resource/chef_group.rb +53 -49
  27. data/lib/chef/resource/chef_mirror.rb +52 -48
  28. data/lib/chef/resource/chef_node.rb +22 -18
  29. data/lib/chef/resource/chef_organization.rb +69 -64
  30. data/lib/chef/resource/chef_resolved_cookbooks.rb +35 -31
  31. data/lib/chef/resource/chef_role.rb +110 -104
  32. data/lib/chef/resource/chef_user.rb +56 -52
  33. data/lib/chef/resource/private_key.rb +48 -44
  34. data/lib/chef/resource/public_key.rb +25 -21
  35. data/lib/cheffish.rb +235 -233
  36. data/lib/cheffish/actor_provider_base.rb +131 -131
  37. data/lib/cheffish/basic_chef_client.rb +184 -184
  38. data/lib/cheffish/chef_provider_base.rb +246 -246
  39. data/lib/cheffish/chef_run.rb +162 -155
  40. data/lib/cheffish/chef_run_data.rb +19 -19
  41. data/lib/cheffish/chef_run_listener.rb +30 -30
  42. data/lib/cheffish/key_formatter.rb +113 -113
  43. data/lib/cheffish/merged_config.rb +94 -94
  44. data/lib/cheffish/recipe_dsl.rb +157 -157
  45. data/lib/cheffish/rspec.rb +8 -8
  46. data/lib/cheffish/rspec/chef_run_support.rb +83 -83
  47. data/lib/cheffish/rspec/matchers.rb +4 -4
  48. data/lib/cheffish/rspec/matchers/be_idempotent.rb +16 -16
  49. data/lib/cheffish/rspec/matchers/emit_no_warnings_or_errors.rb +15 -15
  50. data/lib/cheffish/rspec/matchers/have_updated.rb +37 -37
  51. data/lib/cheffish/rspec/matchers/partially_match.rb +63 -63
  52. data/lib/cheffish/rspec/recipe_run_wrapper.rb +59 -47
  53. data/lib/cheffish/rspec/repository_support.rb +108 -108
  54. data/lib/cheffish/server_api.rb +52 -52
  55. data/lib/cheffish/version.rb +3 -3
  56. data/lib/cheffish/with_pattern.rb +21 -21
  57. data/spec/functional/fingerprint_spec.rb +64 -64
  58. data/spec/functional/merged_config_spec.rb +19 -19
  59. data/spec/functional/server_api_spec.rb +13 -13
  60. data/spec/integration/chef_acl_spec.rb +879 -879
  61. data/spec/integration/chef_client_spec.rb +105 -105
  62. data/spec/integration/chef_container_spec.rb +33 -33
  63. data/spec/integration/chef_group_spec.rb +309 -309
  64. data/spec/integration/chef_mirror_spec.rb +491 -491
  65. data/spec/integration/chef_node_spec.rb +786 -786
  66. data/spec/integration/chef_organization_spec.rb +226 -226
  67. data/spec/integration/chef_role_spec.rb +78 -0
  68. data/spec/integration/chef_user_spec.rb +85 -85
  69. data/spec/integration/private_key_spec.rb +399 -399
  70. data/spec/integration/recipe_dsl_spec.rb +28 -28
  71. data/spec/integration/rspec/converge_spec.rb +183 -183
  72. data/spec/support/key_support.rb +29 -29
  73. data/spec/support/spec_support.rb +15 -15
  74. data/spec/unit/get_private_key_spec.rb +131 -131
  75. data/spec/unit/recipe_run_wrapper_spec.rb +37 -0
  76. metadata +8 -5
@@ -1,48 +1,53 @@
1
- require 'cheffish/actor_provider_base'
2
- require 'chef/resource/chef_client'
3
- require 'chef/chef_fs/data_handler/client_data_handler'
4
-
5
- class Chef::Provider::ChefClient < Cheffish::ActorProviderBase
6
-
7
- def whyrun_supported?
8
- true
9
- end
10
-
11
- def actor_type
12
- 'client'
13
- end
14
-
15
- def actor_path
16
- 'clients'
17
- end
18
-
19
- action :create do
20
- create_actor
21
- end
22
-
23
- action :delete do
24
- delete_actor
25
- end
26
-
27
- #
28
- # Helpers
29
- #
30
-
31
- def resource_class
32
- Chef::Resource::ChefClient
33
- end
34
-
35
- def data_handler
36
- Chef::ChefFS::DataHandler::ClientDataHandler.new
37
- end
38
-
39
- def keys
40
- {
41
- 'name' => :name,
42
- 'admin' => :admin,
43
- 'validator' => :validator,
44
- 'public_key' => :source_key
45
- }
46
- end
47
-
48
- end
1
+ require 'cheffish/actor_provider_base'
2
+ require 'chef/resource/chef_client'
3
+ require 'chef/chef_fs/data_handler/client_data_handler'
4
+
5
+ class Chef
6
+ class Provider
7
+ class ChefClient < Cheffish::ActorProviderBase
8
+ provides :chef_client
9
+
10
+ def whyrun_supported?
11
+ true
12
+ end
13
+
14
+ def actor_type
15
+ 'client'
16
+ end
17
+
18
+ def actor_path
19
+ 'clients'
20
+ end
21
+
22
+ action :create do
23
+ create_actor
24
+ end
25
+
26
+ action :delete do
27
+ delete_actor
28
+ end
29
+
30
+ #
31
+ # Helpers
32
+ #
33
+
34
+ def resource_class
35
+ Chef::Resource::ChefClient
36
+ end
37
+
38
+ def data_handler
39
+ Chef::ChefFS::DataHandler::ClientDataHandler.new
40
+ end
41
+
42
+ def keys
43
+ {
44
+ 'name' => :name,
45
+ 'admin' => :admin,
46
+ 'validator' => :validator,
47
+ 'public_key' => :source_key
48
+ }
49
+ end
50
+
51
+ end
52
+ end
53
+ end
@@ -1,50 +1,55 @@
1
- require 'cheffish/chef_provider_base'
2
- require 'chef/resource/chef_container'
3
- require 'chef/chef_fs/data_handler/container_data_handler'
4
-
5
- class Chef::Provider::ChefContainer < Cheffish::ChefProviderBase
6
-
7
- def whyrun_supported?
8
- true
9
- end
10
-
11
- action :create do
12
- if !@current_exists
13
- converge_by "create container #{new_resource.name} at #{rest.url}" do
14
- rest.post("containers", normalize_for_post(new_json))
15
- end
16
- end
17
- end
18
-
19
- action :delete do
20
- if @current_exists
21
- converge_by "delete container #{new_resource.name} at #{rest.url}" do
22
- rest.delete("containers/#{new_resource.name}")
23
- end
24
- end
25
- end
26
-
27
- def load_current_resource
28
- begin
29
- @current_exists = rest.get("containers/#{new_resource.name}")
30
- rescue Net::HTTPServerException => e
31
- if e.response.code == "404"
32
- @current_exists = false
33
- else
34
- raise
35
- end
36
- end
37
- end
38
-
39
- def new_json
40
- {}
41
- end
42
-
43
- def data_handler
44
- Chef::ChefFS::DataHandler::ContainerDataHandler.new
45
- end
46
-
47
- def keys
48
- { 'containername' => :name, 'containerpath' => :name }
49
- end
50
- end
1
+ require 'cheffish/chef_provider_base'
2
+ require 'chef/resource/chef_container'
3
+ require 'chef/chef_fs/data_handler/container_data_handler'
4
+
5
+ class Chef
6
+ class Provider
7
+ class ChefContainer < Cheffish::ChefProviderBase
8
+ provides :chef_container
9
+
10
+ def whyrun_supported?
11
+ true
12
+ end
13
+
14
+ action :create do
15
+ if !@current_exists
16
+ converge_by "create container #{new_resource.name} at #{rest.url}" do
17
+ rest.post("containers", normalize_for_post(new_json))
18
+ end
19
+ end
20
+ end
21
+
22
+ action :delete do
23
+ if @current_exists
24
+ converge_by "delete container #{new_resource.name} at #{rest.url}" do
25
+ rest.delete("containers/#{new_resource.name}")
26
+ end
27
+ end
28
+ end
29
+
30
+ def load_current_resource
31
+ begin
32
+ @current_exists = rest.get("containers/#{new_resource.name}")
33
+ rescue Net::HTTPServerException => e
34
+ if e.response.code == "404"
35
+ @current_exists = false
36
+ else
37
+ raise
38
+ end
39
+ end
40
+ end
41
+
42
+ def new_json
43
+ {}
44
+ end
45
+
46
+ def data_handler
47
+ Chef::ChefFS::DataHandler::ContainerDataHandler.new
48
+ end
49
+
50
+ def keys
51
+ { 'containername' => :name, 'containerpath' => :name }
52
+ end
53
+ end
54
+ end
55
+ end
@@ -1,50 +1,55 @@
1
- require 'cheffish/chef_provider_base'
2
- require 'chef/resource/chef_data_bag'
3
-
4
- class Chef::Provider::ChefDataBag < Cheffish::ChefProviderBase
5
-
6
- def whyrun_supported?
7
- true
8
- end
9
-
10
- action :create do
11
- if !current_resource_exists?
12
- converge_by "create data bag #{new_resource.name} at #{rest.url}" do
13
- rest.post("data", { 'name' => new_resource.name })
14
- end
15
- end
16
- end
17
-
18
- action :delete do
19
- if current_resource_exists?
20
- converge_by "delete data bag #{new_resource.name} at #{rest.url}" do
21
- rest.delete("data/#{new_resource.name}")
22
- end
23
- end
24
- end
25
-
26
- def load_current_resource
27
- begin
28
- @current_resource = json_to_resource(rest.get("data/#{new_resource.name}"))
29
- rescue Net::HTTPServerException => e
30
- if e.response.code == "404"
31
- @current_resource = not_found_resource
32
- else
33
- raise
34
- end
35
- end
36
- end
37
-
38
- #
39
- # Helpers
40
- #
41
- # Gives us new_json, current_json, not_found_json, etc.
42
-
43
- def resource_class
44
- Chef::Resource::ChefDataBag
45
- end
46
-
47
- def json_to_resource(json)
48
- Chef::Resource::ChefDataBag.new(json['name'], run_context)
49
- end
50
- end
1
+ require 'cheffish/chef_provider_base'
2
+ require 'chef/resource/chef_data_bag'
3
+
4
+ class Chef
5
+ class Provider
6
+ class ChefDataBag < Cheffish::ChefProviderBase
7
+ provides :chef_data_bag
8
+
9
+ def whyrun_supported?
10
+ true
11
+ end
12
+
13
+ action :create do
14
+ if !current_resource_exists?
15
+ converge_by "create data bag #{new_resource.name} at #{rest.url}" do
16
+ rest.post("data", { 'name' => new_resource.name })
17
+ end
18
+ end
19
+ end
20
+
21
+ action :delete do
22
+ if current_resource_exists?
23
+ converge_by "delete data bag #{new_resource.name} at #{rest.url}" do
24
+ rest.delete("data/#{new_resource.name}")
25
+ end
26
+ end
27
+ end
28
+
29
+ def load_current_resource
30
+ begin
31
+ @current_resource = json_to_resource(rest.get("data/#{new_resource.name}"))
32
+ rescue Net::HTTPServerException => e
33
+ if e.response.code == "404"
34
+ @current_resource = not_found_resource
35
+ else
36
+ raise
37
+ end
38
+ end
39
+ end
40
+
41
+ #
42
+ # Helpers
43
+ #
44
+ # Gives us new_json, current_json, not_found_json, etc.
45
+
46
+ def resource_class
47
+ Chef::Resource::ChefDataBag
48
+ end
49
+
50
+ def json_to_resource(json)
51
+ Chef::Resource::ChefDataBag.new(json['name'], run_context)
52
+ end
53
+ end
54
+ end
55
+ end
@@ -1,273 +1,278 @@
1
- require 'cheffish/chef_provider_base'
2
- require 'chef/resource/chef_data_bag_item'
3
- require 'chef/chef_fs/data_handler/data_bag_item_data_handler'
4
- require 'chef/encrypted_data_bag_item'
5
-
6
- class Chef::Provider::ChefDataBagItem < Cheffish::ChefProviderBase
7
-
8
- def whyrun_supported?
9
- true
10
- end
11
-
12
- action :create do
13
- differences = calculate_differences
14
-
15
- if current_resource_exists?
16
- if differences.size > 0
17
- description = [ "update data bag item #{new_resource.id} at #{rest.url}" ] + differences
18
- converge_by description do
19
- rest.put("data/#{new_resource.data_bag}/#{new_resource.id}", normalize_for_put(new_json))
20
- end
21
- end
22
- else
23
- description = [ "create data bag item #{new_resource.id} at #{rest.url}" ] + differences
24
- converge_by description do
25
- rest.post("data/#{new_resource.data_bag}", normalize_for_post(new_json))
26
- end
27
- end
28
- end
29
-
30
- action :delete do
31
- if current_resource_exists?
32
- converge_by "delete data bag item #{new_resource.id} at #{rest.url}" do
33
- rest.delete("data/#{new_resource.data_bag}/#{new_resource.id}")
34
- end
35
- end
36
- end
37
-
38
- def load_current_resource
39
- begin
40
- json = rest.get("data/#{new_resource.data_bag}/#{new_resource.id}")
41
- resource = Chef::Resource::ChefDataBagItem.new(new_resource.name, run_context)
42
- resource.raw_data json
43
- @current_resource = resource
44
- rescue Net::HTTPServerException => e
45
- if e.response.code == "404"
46
- @current_resource = not_found_resource
47
- else
48
- raise
49
- end
50
- end
51
-
52
- # Determine if data bag is encrypted and if so, what its version is
53
- first_real_key, first_real_value = (current_resource.raw_data || {}).select { |key, value| key != 'id' && !value.nil? }.first
54
- if first_real_value
55
- if first_real_value.is_a?(Hash) &&
56
- first_real_value['version'].is_a?(Integer) &&
57
- first_real_value['version'] > 0 &&
58
- first_real_value.has_key?('encrypted_data')
59
-
60
- current_resource.encrypt true
61
- current_resource.encryption_version first_real_value['version']
62
-
63
- decrypt_error = nil
64
-
65
- # Check if the desired secret is the one (which it generally should be)
66
-
67
- if new_resource.secret || new_resource.secret_path
68
- begin
69
- Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, new_secret).for_decrypted_item
70
- current_resource.secret new_secret
71
- rescue Chef::EncryptedDataBagItem::DecryptionFailure
72
- decrypt_error = $!
73
- end
74
- end
75
-
76
- # If the current secret doesn't work, look through the specified old secrets
77
-
78
- if !current_resource.secret
79
- old_secrets = []
80
- if new_resource.old_secret
81
- old_secrets += Array(new_resource.old_secret)
82
- end
83
- if new_resource.old_secret_path
84
- old_secrets += Array(new_resource.old_secret_path).map do |secret_path|
85
- Chef::EncryptedDataBagItem.load_secret(new_resource.old_secret_file)
86
- end
87
- end
88
- old_secrets.each do |secret|
89
- begin
90
- Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, secret).for_decrypted_item
91
- current_resource.secret secret
92
- rescue Chef::EncryptedDataBagItem::DecryptionFailure
93
- decrypt_error = $!
94
- end
95
- end
96
-
97
- # If we couldn't figure out the secret, emit a warning (this isn't a fatal flaw unless we
98
- # need to reuse one of the values from the data bag)
99
- if !current_resource.secret
100
- if decrypt_error
101
- Chef::Log.warn "Existing data bag is encrypted, but could not decrypt: #{decrypt_error.message}."
102
- else
103
- Chef::Log.warn "Existing data bag is encrypted, but no secret was specified."
104
- end
105
- end
106
- end
107
- end
108
- else
109
-
110
- # There are no encryptable values, so pretend encryption is the same as desired
111
-
112
- current_resource.encrypt new_resource.encrypt
113
- current_resource.encryption_version new_resource.encryption_version
114
- if new_resource.secret || new_resource.secret_path
115
- current_resource.secret new_secret
116
- end
117
- end
118
- end
119
-
120
- def new_json
121
- @new_json ||= begin
122
- if new_encrypt
123
- # Encrypt new stuff
124
- result = encrypt(new_decrypted, new_secret, new_resource.encryption_version)
125
- else
126
- result = new_decrypted
127
- end
128
- result
129
- end
130
- end
131
-
132
- def new_encrypt
133
- new_resource.encrypt.nil? ? current_resource.encrypt : new_resource.encrypt
134
- end
135
-
136
- def new_secret
137
- @new_secret ||= begin
138
- if new_resource.secret
139
- new_resource.secret
140
- elsif new_resource.secret_path
141
- Chef::EncryptedDataBagItem.load_secret(new_resource.secret_path)
142
- elsif new_resource.encrypt.nil?
143
- current_resource.secret
144
- else
145
- raise "Data bag item #{new_resource.name} has encryption on but no secret or secret_path is specified"
146
- end
147
- end
148
- end
149
-
150
- def decrypt(json, secret)
151
- Chef::EncryptedDataBagItem.new(json, secret).to_hash
152
- end
153
-
154
- def encrypt(json, secret, version)
155
- old_version = run_context.config[:data_bag_encrypt_version]
156
- run_context.config[:data_bag_encrypt_version] = version
157
- begin
158
- Chef::EncryptedDataBagItem.encrypt_data_bag_item(json, secret)
159
- ensure
160
- run_context.config[:data_bag_encrypt_version] = old_version
161
- end
162
- end
163
-
164
- # Get the desired (new) json pre-encryption, for comparison purposes
165
- def new_decrypted
166
- @new_decrypted ||= begin
167
- if new_resource.complete
168
- result = new_resource.raw_data || {}
169
- else
170
- result = current_decrypted.merge(new_resource.raw_data || {})
171
- end
172
- result['id'] = new_resource.id
173
- result = apply_modifiers(new_resource.raw_data_modifiers, result)
174
- end
175
- end
176
-
177
- # Get the current json decrypted, for comparison purposes
178
- def current_decrypted
179
- @current_decrypted ||= begin
180
- if current_resource.secret
181
- decrypt(current_resource.raw_data || { 'id' => new_resource.id }, current_resource.secret)
182
- elsif current_resource.encrypt
183
- raise "Could not decrypt current data bag item #{current_resource.name}"
184
- else
185
- current_resource.raw_data || { 'id' => new_resource.id }
186
- end
187
- end
188
- end
189
-
190
- # Figure out the differences between new and current
191
- def calculate_differences
192
- if new_encrypt
193
- if current_resource.encrypt
194
- # Both are encrypted, check if the encryption type is the same
195
- description = ''
196
- if new_secret != current_resource.secret
197
- description << ' with new secret'
198
- end
199
- if new_resource.encryption_version != current_resource.encryption_version
200
- description << " from v#{current_resource.encryption_version} to v#{new_resource.encryption_version} encryption"
201
- end
202
-
203
- if description != ''
204
- # Encryption is different, we're reencrypting
205
- differences = [ "re-encrypt#{description}"]
206
- else
207
- # Encryption is the same, we're just updating
208
- differences = []
209
- end
210
- else
211
- # New stuff should be encrypted, old is not. Encrypting.
212
- differences = [ "encrypt with v#{new_resource.encryption_version} encryption" ]
213
- end
214
-
215
- # Get differences in the actual json
216
- if current_resource.secret
217
- json_differences(current_decrypted, new_decrypted, false, '', differences)
218
- elsif current_resource.encrypt
219
- # Encryption is different and we can't read the old values. Only allow the change
220
- # if we're overwriting the data bag item
221
- if !new_resource.complete
222
- raise "Cannot encrypt #{new_resource.name} due to failure to decrypt existing resource. Set 'complete true' to overwrite or add the old secret as old_secret / old_secret_path."
223
- end
224
- differences = [ "overwrite data bag item (cannot decrypt old data bag item)"]
225
- differences = (new_resource.raw_data.keys & current_resource.raw_data.keys).map { |key| "overwrite #{key}"}
226
- differences += (new_resource.raw_data.keys - current_resource.raw_data.keys).map { |key| "add #{key}"}
227
- differences += (current_resource.raw_data.keys - new_resource.raw_data.keys).map { |key| "remove #{key}" }
228
- else
229
- json_differences(current_decrypted, new_decrypted, false, '', differences)
230
- end
231
- else
232
- if current_resource.encrypt
233
- # New stuff should not be encrypted, old is. Decrypting.
234
- differences = [ "decrypt data bag item to plaintext" ]
235
- else
236
- differences = []
237
- end
238
- json_differences(current_decrypted, new_decrypted, true, '', differences)
239
- end
240
- differences
241
- end
242
-
243
- #
244
- # Helpers
245
- #
246
-
247
- def resource_class
248
- Chef::Resource::ChefDataBagItem
249
- end
250
-
251
- def data_handler
252
- Chef::ChefFS::DataHandler::DataBagItemDataHandler.new
253
- end
254
-
255
- def keys
256
- {
257
- 'id' => :id,
258
- 'data_bag' => :data_bag,
259
- 'raw_data' => :raw_data
260
- }
261
- end
262
-
263
- def not_found_resource
264
- resource = super
265
- resource.data_bag new_resource.data_bag
266
- resource
267
- end
268
-
269
- def fake_entry
270
- FakeEntry.new("#{new_resource.id}.json", FakeEntry.new(new_resource.data_bag))
271
- end
272
-
273
- end
1
+ require 'cheffish/chef_provider_base'
2
+ require 'chef/resource/chef_data_bag_item'
3
+ require 'chef/chef_fs/data_handler/data_bag_item_data_handler'
4
+ require 'chef/encrypted_data_bag_item'
5
+
6
+ class Chef
7
+ class Provider
8
+ class ChefDataBagItem < Cheffish::ChefProviderBase
9
+ provides :chef_data_bag_item
10
+
11
+ def whyrun_supported?
12
+ true
13
+ end
14
+
15
+ action :create do
16
+ differences = calculate_differences
17
+
18
+ if current_resource_exists?
19
+ if differences.size > 0
20
+ description = [ "update data bag item #{new_resource.id} at #{rest.url}" ] + differences
21
+ converge_by description do
22
+ rest.put("data/#{new_resource.data_bag}/#{new_resource.id}", normalize_for_put(new_json))
23
+ end
24
+ end
25
+ else
26
+ description = [ "create data bag item #{new_resource.id} at #{rest.url}" ] + differences
27
+ converge_by description do
28
+ rest.post("data/#{new_resource.data_bag}", normalize_for_post(new_json))
29
+ end
30
+ end
31
+ end
32
+
33
+ action :delete do
34
+ if current_resource_exists?
35
+ converge_by "delete data bag item #{new_resource.id} at #{rest.url}" do
36
+ rest.delete("data/#{new_resource.data_bag}/#{new_resource.id}")
37
+ end
38
+ end
39
+ end
40
+
41
+ def load_current_resource
42
+ begin
43
+ json = rest.get("data/#{new_resource.data_bag}/#{new_resource.id}")
44
+ resource = Chef::Resource::ChefDataBagItem.new(new_resource.name, run_context)
45
+ resource.raw_data json
46
+ @current_resource = resource
47
+ rescue Net::HTTPServerException => e
48
+ if e.response.code == "404"
49
+ @current_resource = not_found_resource
50
+ else
51
+ raise
52
+ end
53
+ end
54
+
55
+ # Determine if data bag is encrypted and if so, what its version is
56
+ first_real_key, first_real_value = (current_resource.raw_data || {}).select { |key, value| key != 'id' && !value.nil? }.first
57
+ if first_real_value
58
+ if first_real_value.is_a?(Hash) &&
59
+ first_real_value['version'].is_a?(Integer) &&
60
+ first_real_value['version'] > 0 &&
61
+ first_real_value.has_key?('encrypted_data')
62
+
63
+ current_resource.encrypt true
64
+ current_resource.encryption_version first_real_value['version']
65
+
66
+ decrypt_error = nil
67
+
68
+ # Check if the desired secret is the one (which it generally should be)
69
+
70
+ if new_resource.secret || new_resource.secret_path
71
+ begin
72
+ Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, new_secret).for_decrypted_item
73
+ current_resource.secret new_secret
74
+ rescue Chef::EncryptedDataBagItem::DecryptionFailure
75
+ decrypt_error = $!
76
+ end
77
+ end
78
+
79
+ # If the current secret doesn't work, look through the specified old secrets
80
+
81
+ if !current_resource.secret
82
+ old_secrets = []
83
+ if new_resource.old_secret
84
+ old_secrets += Array(new_resource.old_secret)
85
+ end
86
+ if new_resource.old_secret_path
87
+ old_secrets += Array(new_resource.old_secret_path).map do |secret_path|
88
+ Chef::EncryptedDataBagItem.load_secret(new_resource.old_secret_file)
89
+ end
90
+ end
91
+ old_secrets.each do |secret|
92
+ begin
93
+ Chef::EncryptedDataBagItem::Decryptor.for(first_real_value, secret).for_decrypted_item
94
+ current_resource.secret secret
95
+ rescue Chef::EncryptedDataBagItem::DecryptionFailure
96
+ decrypt_error = $!
97
+ end
98
+ end
99
+
100
+ # If we couldn't figure out the secret, emit a warning (this isn't a fatal flaw unless we
101
+ # need to reuse one of the values from the data bag)
102
+ if !current_resource.secret
103
+ if decrypt_error
104
+ Chef::Log.warn "Existing data bag is encrypted, but could not decrypt: #{decrypt_error.message}."
105
+ else
106
+ Chef::Log.warn "Existing data bag is encrypted, but no secret was specified."
107
+ end
108
+ end
109
+ end
110
+ end
111
+ else
112
+
113
+ # There are no encryptable values, so pretend encryption is the same as desired
114
+
115
+ current_resource.encrypt new_resource.encrypt
116
+ current_resource.encryption_version new_resource.encryption_version
117
+ if new_resource.secret || new_resource.secret_path
118
+ current_resource.secret new_secret
119
+ end
120
+ end
121
+ end
122
+
123
+ def new_json
124
+ @new_json ||= begin
125
+ if new_encrypt
126
+ # Encrypt new stuff
127
+ result = encrypt(new_decrypted, new_secret, new_resource.encryption_version)
128
+ else
129
+ result = new_decrypted
130
+ end
131
+ result
132
+ end
133
+ end
134
+
135
+ def new_encrypt
136
+ new_resource.encrypt.nil? ? current_resource.encrypt : new_resource.encrypt
137
+ end
138
+
139
+ def new_secret
140
+ @new_secret ||= begin
141
+ if new_resource.secret
142
+ new_resource.secret
143
+ elsif new_resource.secret_path
144
+ Chef::EncryptedDataBagItem.load_secret(new_resource.secret_path)
145
+ elsif new_resource.encrypt.nil?
146
+ current_resource.secret
147
+ else
148
+ raise "Data bag item #{new_resource.name} has encryption on but no secret or secret_path is specified"
149
+ end
150
+ end
151
+ end
152
+
153
+ def decrypt(json, secret)
154
+ Chef::EncryptedDataBagItem.new(json, secret).to_hash
155
+ end
156
+
157
+ def encrypt(json, secret, version)
158
+ old_version = run_context.config[:data_bag_encrypt_version]
159
+ run_context.config[:data_bag_encrypt_version] = version
160
+ begin
161
+ Chef::EncryptedDataBagItem.encrypt_data_bag_item(json, secret)
162
+ ensure
163
+ run_context.config[:data_bag_encrypt_version] = old_version
164
+ end
165
+ end
166
+
167
+ # Get the desired (new) json pre-encryption, for comparison purposes
168
+ def new_decrypted
169
+ @new_decrypted ||= begin
170
+ if new_resource.complete
171
+ result = new_resource.raw_data || {}
172
+ else
173
+ result = current_decrypted.merge(new_resource.raw_data || {})
174
+ end
175
+ result['id'] = new_resource.id
176
+ result = apply_modifiers(new_resource.raw_data_modifiers, result)
177
+ end
178
+ end
179
+
180
+ # Get the current json decrypted, for comparison purposes
181
+ def current_decrypted
182
+ @current_decrypted ||= begin
183
+ if current_resource.secret
184
+ decrypt(current_resource.raw_data || { 'id' => new_resource.id }, current_resource.secret)
185
+ elsif current_resource.encrypt
186
+ raise "Could not decrypt current data bag item #{current_resource.name}"
187
+ else
188
+ current_resource.raw_data || { 'id' => new_resource.id }
189
+ end
190
+ end
191
+ end
192
+
193
+ # Figure out the differences between new and current
194
+ def calculate_differences
195
+ if new_encrypt
196
+ if current_resource.encrypt
197
+ # Both are encrypted, check if the encryption type is the same
198
+ description = ''
199
+ if new_secret != current_resource.secret
200
+ description << ' with new secret'
201
+ end
202
+ if new_resource.encryption_version != current_resource.encryption_version
203
+ description << " from v#{current_resource.encryption_version} to v#{new_resource.encryption_version} encryption"
204
+ end
205
+
206
+ if description != ''
207
+ # Encryption is different, we're reencrypting
208
+ differences = [ "re-encrypt#{description}"]
209
+ else
210
+ # Encryption is the same, we're just updating
211
+ differences = []
212
+ end
213
+ else
214
+ # New stuff should be encrypted, old is not. Encrypting.
215
+ differences = [ "encrypt with v#{new_resource.encryption_version} encryption" ]
216
+ end
217
+
218
+ # Get differences in the actual json
219
+ if current_resource.secret
220
+ json_differences(current_decrypted, new_decrypted, false, '', differences)
221
+ elsif current_resource.encrypt
222
+ # Encryption is different and we can't read the old values. Only allow the change
223
+ # if we're overwriting the data bag item
224
+ if !new_resource.complete
225
+ raise "Cannot encrypt #{new_resource.name} due to failure to decrypt existing resource. Set 'complete true' to overwrite or add the old secret as old_secret / old_secret_path."
226
+ end
227
+ differences = [ "overwrite data bag item (cannot decrypt old data bag item)"]
228
+ differences = (new_resource.raw_data.keys & current_resource.raw_data.keys).map { |key| "overwrite #{key}"}
229
+ differences += (new_resource.raw_data.keys - current_resource.raw_data.keys).map { |key| "add #{key}"}
230
+ differences += (current_resource.raw_data.keys - new_resource.raw_data.keys).map { |key| "remove #{key}" }
231
+ else
232
+ json_differences(current_decrypted, new_decrypted, false, '', differences)
233
+ end
234
+ else
235
+ if current_resource.encrypt
236
+ # New stuff should not be encrypted, old is. Decrypting.
237
+ differences = [ "decrypt data bag item to plaintext" ]
238
+ else
239
+ differences = []
240
+ end
241
+ json_differences(current_decrypted, new_decrypted, true, '', differences)
242
+ end
243
+ differences
244
+ end
245
+
246
+ #
247
+ # Helpers
248
+ #
249
+
250
+ def resource_class
251
+ Chef::Resource::ChefDataBagItem
252
+ end
253
+
254
+ def data_handler
255
+ Chef::ChefFS::DataHandler::DataBagItemDataHandler.new
256
+ end
257
+
258
+ def keys
259
+ {
260
+ 'id' => :id,
261
+ 'data_bag' => :data_bag,
262
+ 'raw_data' => :raw_data
263
+ }
264
+ end
265
+
266
+ def not_found_resource
267
+ resource = super
268
+ resource.data_bag new_resource.data_bag
269
+ resource
270
+ end
271
+
272
+ def fake_entry
273
+ FakeEntry.new("#{new_resource.id}.json", FakeEntry.new(new_resource.data_bag))
274
+ end
275
+
276
+ end
277
+ end
278
+ end