As the title says I am working on planning a way to backup postgres using chef and vault. Idea is that we already encrypt the backups from postgres using a key (random binary string) and we would like to keep that going. We would like to store that string in Hashicorp Vault. My issue is I am not sure how to get it so that the key is made into a file then a few scripts are run. Then comes the issue that a more senior person wants these backups to only be weekly not every time the cookbook runs which if memory serves me right is every 24 hours.

I am not sure the best way to access the secrets in Vault from a chef cookbook. Nor have it run weekly.

I would have preferred to do this with cron jobs and bash scripts, but sadly that is not an option.

1 Answer 1


First chef runs as often as you configure it to do.

Second Chef is a configuration management system and not a crontab or an orchestration system.

Use chef to configure cron (that can not be not an option, try to find out why this is not considered) for your backup using consul-template to retrieve the secret from vault. Don't use Chef to run the backups because of the caveats you already mention.

However if you really want to shoot yourself in the foot, just add a guard on your backup command like this (604800 seconds is roughly 7 days):

not_if { (Time.now() - File.mtime("/path/to/your/backup/file.tgz") < 604800 }

  • Thanks, and I am not sure why cron has been crossed out. Will have to ask that one again. consul-template is just adding another layer of work isn't it? Is there not a way to have chef create a cronjob (might just go ahead with cron and tell them too hard to do differently) and the cronjob only have access to the secret when it run and no other time?
    – user8517
    Commented Jul 3, 2018 at 13:55
  • 1
    For that you'll set a secret within the cron job in clear text, what's consul-template aim to avoid is a permanent written secret on the machine.
    – Tensibai
    Commented Jul 3, 2018 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.