[chef] Re: RE: Best Practices for Retrieving Generated Passwords

[Andrea Campi < >]

Another option I've used (if you have some means of authenticating the client, e.g. own the network and can ensure IP addresses can't possibly be spoofed):

Have the "in-house provisioning application" generate passwords and serve a JSON (or other) file.

It's a rather simple matter to replace data bags uses with a method that consumes JSON.

This usually ends up reducing duplication, and makes it easy to enforce any kind of additional constraints you may have.

I will clean up and publish my consume_json cookbook if you are interested.

Andrea