kitchen-encrypt-databags 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 25b93aca796f28856145603d1d03ecf927c19326
+  data.tar.gz: 46db614a82b4435bad0c6d32f5f92f6591d3d7c8
+SHA512:
+  metadata.gz: 570d86d80b452e54e5b8244f63e004127367e5e0d66ad7c109f2f8897faca5e85ce97e8279d057ea357c73280921aadf058f6322cd26e9a057bde52461df9b54
+  data.tar.gz: 979392efe2163dc96bb8a90f4c72795ea82d194399e20cb6ea8007614566a750c5bd600487fadb043c45460bbbdadb1802fc168b951d288cf9fe03eb780f85f0

data/lib/kitchen/provisioner/chef_zero_encrypt_databags.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+require "kitchen"
+require "kitchen/provisioner/chef_zero"
+require "chef/encrypted_data_bag_item"
+
+module Kitchen
+  module Provisioner
+    # This gem aims to extend the ChefZero provisioner from test-kitchen to automatically
+    # encrypt data bags when provisioning the test sandbox.
+    class ChefZeroEncryptDatabags < ChefZero
+      class DataBagEncryptionException < StandardError
+      end
+
+      def create_sandbox
+        super # call the original, which will insert databags
+        encrypt_data_bags
+      end
+
+      private
+
+      # Take the data bags that we have copied to the box, and encrypt each with the
+      # provided data bag secret key. This allows users to create unencrypted data bags
+      # for their tests that they can then use via Chef::EncryptedDataBagItem.load
+      #
+      # This will only target data bags at sandbox/data_bags/**/*.json, and will need to
+      # be run after the data bags have been copied into place.
+      def encrypt_data_bags
+        unless secret_key
+          raise DataBagEncryptionException, <<-MSG
+          Encrypting data bags requires an encrypted_data_bag_secret_key_path!
+          MSG
+        end
+
+        data_bag_files.each do |data_bag_file|
+          data_bag_enc = encrypt_data_bag(data_bag_file, secret_key)
+          File.write(data_bag_file, JSON.pretty_generate(data_bag_enc))
+        end
+      end
+
+      def data_bag_files
+        data_bags_glob = File.join(sandbox_path, "data_bags", "**", "*.json")
+        Dir.glob(data_bags_glob)
+      end
+
+      def encrypt_data_bag(data_bag_path, secret_key)
+        data_bag = JSON.parse(File.read(data_bag_path))
+        ::Chef::EncryptedDataBagItem.encrypt_data_bag_item(data_bag, secret_key)
+      rescue StandardError => err
+        raise DataBagEncryptionException, <<-MSG
+        Failed to encrypt data bag at #{data_bag_path} with error "#{err}"
+        MSG
+      end
+
+      def secret_key
+        @secret_key ||= begin
+          secret_key_path = config[:encrypted_data_bag_secret_key_path] || ""
+          # The strip is important- this is how Chef reads the secret file, and we'll need
+          # to do the same if Chef is to decrypt anything with this key
+          File.read(secret_key_path).strip if File.exist?(secret_key_path)
+        end
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,73 @@
+--- !ruby/object:Gem::Specification
+name: kitchen-encrypt-databags
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Lawrence Jones
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-01-14 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: chef
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.17'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.17'
+- !ruby/object:Gem::Dependency
+  name: test-kitchen
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.13'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.13'
+description: test-kitchen add-on
+email:
+- lawrjone@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/kitchen/provisioner/chef_zero_encrypt_databags.rb
+homepage: https://github.com/lawrencejones/kitchen-encrypt-databags
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.8
+signing_key: 
+specification_version: 4
+summary: automatically encrypt databags when provisioning sandbox
+test_files: []