1

我正在尝试从厨师食谱中读取加密数据包，但遇到了一些问题。

我以这种方式创造了秘密

openssl rand -base64 512 > test/integration/default/encrypted_data_bag_secret
knife data bag from file test ../data_bags/system_user/poweruser.json --secret-file test/integration/default/encrypted_data_bag_secret
knife data bag show test ccbuildub -Fj > ../data_bags/test/poweruser.json

如您所见，我将加密版本放在单独的数据包中以进行测试。生成的数据包是这样的：

{
  "id": "poweruser",
  "username": {
    "encrypted_data": "48y/E3yzDWXvbD/J72tZuvS5jpDwnA8RvI6bJhnQHFU=\n",
    "iv": "O+WKxIAXH1pDTBqGluGCsw==\n",
    "version": 1,
    "cipher": "aes-256-cbc"
  },
  "password": {
    "encrypted_data": "JHHSoaIm9b8FxCOfTfrQRb0YmoabCcTcXXx/0nwU/j3gQCXd1kEHbxpEHZMB\n92A6\n",
    "iv": "Cn5ct0xt4PKHptz+WmbFmw==\n",
    "version": 1,
    "cipher": "aes-256-cbc"
  },
  "domain": {
    "encrypted_data": "bhFJ9FRTlIuo1s7JZEs79SkNSxDw+9OJtBxkpMdoxOorYqxBbo6lZA3+BP3u\njWk1\n",
    "iv": "BvOD0l4ohTwOJka74rlFVw==\n",
    "version": 1,
    "cipher": "aes-256-cbc"
  }
}

然后我正在使用这个片段处理我的食谱：

ruby_block "do something" do
    block do
        secret = Chef::EncryptedDataBagItem.load_secret(Chef::Config[:encrypted_data_bag_secret])
        decryptedObject = Chef::EncryptedDataBagItem.load("test","poweruser")
        print "DECRYPT : " + decryptedObject.to_s
       [...]
    end
end

当我尝试使用此食谱运行厨房时，出现此错误：

[2016-11-24T11:32:23+00:00] ERROR: ruby_block[do something] (SPMLinuxBuilder::mountTiny line 11) had an error: Net::HTTPServerException: 404 "Not Found"

Stacktrace 本身并没有真正的帮助：

>>>> Caused by Net::HTTPServerException: 404 "Not Found"
/opt/chef/embedded/lib/ruby/2.3.0/net/http/response.rb:120:in `error!'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/http.rb:150:in `request'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/http.rb:115:in `get'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/data_bag_item.rb:155:in `load'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/encrypted_data_bag_item.rb:123:in `load'
/tmp/kitchen/cache/cookbooks/SPMLinuxBuilder/recipes/mountTiny.rb:14:in `block (2 levels) in from_file'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/provider/ruby_block.rb:35:in `block in action_run'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/mixin/why_run.rb:52:in `add_action'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/provider.rb:176:in `converge_by'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/provider/ruby_block.rb:34:in `action_run'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/provider.rb:145:in `run_action'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/resource.rb:622:in `run_action'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/runner.rb:69:in `run_action'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/runner.rb:97:in `block (2 levels) in converge'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/runner.rb:97:in `each'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/runner.rb:97:in `block in converge'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/resource_collection/resource_list.rb:94:in `block in execute_each_resource'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/resource_collection/stepable_iterator.rb:114:in `call_iterator_block'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/resource_collection/stepable_iterator.rb:85:in `step'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/resource_collection/stepable_iterator.rb:103:in `iterate'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/resource_collection/stepable_iterator.rb:55:in `each_with_index'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/resource_collection/resource_list.rb:92:in `execute_each_resource'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/runner.rb:96:in `converge'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/client.rb:669:in `block in converge'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/client.rb:664:in `catch'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/client.rb:664:in `converge'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/client.rb:703:in `converge_and_save'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/client.rb:283:in `run'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application.rb:294:in `block in fork_chef_client'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application.rb:282:in `fork'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application.rb:282:in `fork_chef_client'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application.rb:247:in `block in run_chef_client'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/local_mode.rb:44:in `with_server_connectivity'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application.rb:235:in `run_chef_client'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application/client.rb:464:in `sleep_then_run_chef_client'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application/client.rb:451:in `block in interval_run_chef_client'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application/client.rb:450:in `loop'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application/client.rb:450:in `interval_run_chef_client'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application/client.rb:434:in `run_application'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application.rb:59:in `run'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/lib/chef/application/solo.rb:226:in `run'
/opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.16.42/bin/chef-solo:25:in `<top (required)>'
/opt/chef/bin/chef-solo:54:in `load'
/opt/chef/bin/chef-solo:54:in `<main>'[vagrant@default-centos-72 ~]$ exit

我知道这个秘密是正确的（如果我打印出来它包含与我的秘密文件完全相同的值）并且数据包是正确的（如果我尝试使用search( :test, "id:poweruser").first我会获得加密的值）

我可以尝试获取有关错误的更多信息并解决它？

谢谢，米歇尔。

4

2 回答 2

1

  1. 为什么要读取 ruby​​_block 内的数据包？您必须从主要上下文中阅读它，如https://docs.chef.io/data_bags.html#load-with-recipe-dsl中所述

  2. 404错误表示服务器上不存在数据包。（可能是由#1引起的）

  3. 如果您使用默认的机密文件位置，则读取加密数据包是完全透明的。你可以坚持使用data_bagordata_bag_item方法。

如果未指定“secret”，则 chef-client 将在 client.rb 文件中 encrypted_data_bag_secret 设置指定的路径中查找密钥。

见https://docs.chef.io/data_bags.html

于 2016-11-24T12:50:56.667 回答
0

您可以从厨师食谱中读取数据包，如下所示：Chef::EncryptedDataBagItem.load('data_bag_name','data_bag_item_name')

于 2016-11-28T20:52:17.163 回答