I am very new to and trying to secure passwords using databags. Unfortunately, I tried in different ways but unable to succeed. I followed different tutorials first and second. I understood only two steps but later on I was unable to move forward.

  1. I created secret key using openssl
  2. In link1 step 2 says knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key but I don't know where it is creating the databag.

Can some one guide me from step two? I am trying to secure my database password. I got stuck after creating secret file.

  • 1
    Take the tour at learn.chef.io that sounds like a basis misconception – Tensibai May 11 '17 at 12:00

I'm using the following ruby script to encrypt/decrypt chef data bags locally: https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd

to encrypt:


and to decrypt:


  • 1
    What the interest over knife built in commands ? – Tensibai May 11 '17 at 12:43
  • yes I do have a file encrypt.rb file. if I encrypt it above procedure don't I need a secret file to decrypt it.@eyalzek – Sam May 11 '17 at 17:45
  • @Tensibai AFAIK knife commands are only relevant when you have a chef server and not for encrypting/decrypting JSON files locally (which is what I understood OP is interested in). – eyalzek May 13 '17 at 18:27
  • @Sam you need to generate the secret file, in the 2nd tutorial you linked to this is explained in the first paragraph using openssl: Create a random encryption key: openssl rand -base64 512 | tr -d '\r\n' > secret_key – eyalzek May 13 '17 at 18:29
  • Since chef 12.18 (I think) you can use knife-zero to build on disk databags. But I misunderstood the goal of your script indeed, sorry for that – Tensibai May 13 '17 at 18:29

You can create Chef data bags in two ways - by loading it from a json file on your disk, or by creating a new data bag which you then write content into (the two commands in the doc).

Encrypted data bags are stored on the server, and anyone who wants to read them (a workstation or node) needs to download and decrypt it with the secret key that you pass directly or from a file (see the command flags here).

Once you have stored your content (your secret key from openssl) in data bags, you can access them in recipes with data_bag_item(bag_name, item, secret) (again, see the docs for sample code).

Hope this helps!

  • The data_bag_item in recipes DSL is the prefered way, it works with or without encryption, where your direct class access will fail on a clear text data bag (a pain to test then) – Tensibai May 16 '17 at 11:25
  • @Tensibai True, but EncryptedDataBagItem will work because OP specified storing secrets, and that has to be encrypted. – grumpyops May 16 '17 at 12:09
  • 1
    It is just code smell to call a class instead of using its DSL helper. I assume you don't write recipes with Chef::Resource::File.new('whatever') do |fres| but instead you do file 'whatever' do... that's the same thing here. – Tensibai May 16 '17 at 12:15
  • 1
    @Tensibai thanks for that, TIL. I've updated the answer, you learn something new every day :D – grumpyops May 16 '17 at 13:09

A data bag is stored on the chef server itself. My chef days are behind me, but you should be able to enter the data bag content either at the create step or the edit one.

For the step 2, just execute the command that you copied:

knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key
  • Thanks, I would like to ask is there any way that I can create databag independent to chef server. I mean creating databag locally @Michael – Sam May 10 '17 at 3:24
  • Once again my chef skills are a little out of date so I can't pinpoint you to the exact location, but once you find it, you can follow this part of the tutorial to create the databags manually: docs.chef.io/data_bags.html#manually – Michael Pereira May 10 '17 at 3:52
  • @Sam you can have local databags as test fixtures in kitchen. There should be a way to make it work with chef-zero too, but I haven't played with that at all. – chicks May 10 '17 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.