[chef] Re: Re: Re: Encrypted Databags are a Code Smell

[Ranjib Dey < >]

no not really.  % of raw ruby code inside a recipe but outside resources is a smell, irrespective of context. less you have better it is. we have several such smells (another would be  searching 'recipes:foo'). what i meant is this is not bad, in fact it can be a blessing at times.

remember if you take the encrypted data bag route, you would be able to run chef zero as it is (and now chef-zero integration is in master), which does not support client certs.

On Mon, Sep 16, 2013 at 2:02 PM, Mike < " target="_blank"> > wrote:

> So yes, they can be smell, but it depends,  

This statement can apply to pretty much anything, ever.

If your use case doesn't map to the tool you're using, that's fine. Find something that works for you. 

Nobody is here telling you that you must use one thing or another - rather most people here are sharing "what works for me" approaches, thus delivering some of the best ideas that get discussed openly, and better ideas come from them, sometimes.

Definitely a summit topic to discuss. And don't talk about my feet smelling, either.

-M

On Mon, Sep 16, 2013 at 4:53 PM, Ranjib Dey < " target="_blank"> > wrote:

i dont think encrypted data bag in itself is a code smell. Depending upon the context they may be. The fact that we need to store secrets in raw text files is smell (in one extreme). Tools (like s3cmd, knife , aws command line tools etc) that expect un encrypted secrets can be run against ephemeral configuration files. But thats another extreme. Between them there are myriad of options, encrypted data bag is one of them. if you plan to take snapshot of your entire chef infra, you'll need to backup and store the databags too, and if they hold secrets its better to store them encrypted in the restore/backup tapes. Albeit chef-valult is a better option, but it requires more house keeping. You'll be storing multiple encrypted copies of same data, each corresponding to one client. these things comes with great deal of network traffic cost as well.

So yes, they can be smell, but it depends, 

On Mon, Sep 16, 2013 at 11:54 AM, Booker Bense < " target="_blank"> > wrote:

I'm finally catching up with my backlog of Food Fight episodes and the one on secrets got me thinking a bit and I wrote up my thoughts here. 

http://fredthemagicwonderdog.blogspot.com/2013/09/chef-encrypted-data-bags-are-code-smell.html

The more I think about it, the more I think encrypted data bags aren't the solution. 

- Booker C. Bense