Answers: <p>You can create Chef data bags in two ways - by loading it from a json file on your disk, or by creating a new data bag which you then write content into (the two commands in the <a href="https://docs.chef.io/data_bags.html#using-knife" rel="nofollow noreferrer">doc</a>).</p>
  
  <p>Encrypted data bags are stored on the server, and anyone who wants to read them (a workstation or node) needs to download and decrypt it with the secret key that you pass directly or from a file (see the command flags <a href="https://docs.chef.io/data_bags.html#knife-options" rel="nofollow noreferrer">here</a>).</p>
  
  <p>Once you have stored your content (your secret key from openssl) in data bags, you can access them in recipes with <code>data_bag_item(bag_name, item, secret)</code> (again, see the <a href="https://docs.chef.io/dsl_recipe.html#data-bag-item" rel="nofollow noreferrer">docs</a> for sample code).</p>
  
  <p>Hope this helps!</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-05-16T11:25:48.033Z
Answers: The [`data_bag_item`](https://docs.chef.io/dsl_recipe.html#data-bag-item) in recipes DSL is the prefered way, it works with or without encryption, where your direct class access will fail on a clear text data bag (a pain to test then)
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-05-16T12:09:49.680Z
Answers: @Tensibai True, but EncryptedDataBagItem will work because OP specified storing secrets, and that *has* to be encrypted.
Answers: grumpyops
Answers: CC BY-SA 3.0
Answers: 2017-05-16T12:15:35.373Z
Answers: It is just code smell to call a class instead of using its DSL helper. I assume you don't write recipes with `Chef::Resource::File.new('whatever') do |fres|` but instead you do `file 'whatever' do`... that's the same thing here.
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-05-16T13:09:23.120Z
Answers: @Tensibai thanks for that, TIL. I've updated the answer, you learn something new every day :D
Answers: grumpyops
Answers: CC BY-SA 3.0
Answers: 2017-05-16T11:15:23.063Z
Answers: 2017-05-16T13:37:11.957Z
Answers: 2017-05-16T13:37:11.957Z
Answers: grumpyops
Answers: <p>I'm using the following ruby script to encrypt/decrypt chef data bags locally:
  <a href="https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd" rel="nofollow noreferrer">https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd</a></p>
  
  <p>to encrypt:</p>
  
  <p><code>ruby encrypt.rb PATH_TO_SECRET_FILE &lt; UNECRYPTED_DATA_BAG.json &gt; ENCRYPTED_DATA_BAG.json</code></p>
  
  <p>and to decrypt:</p>
  
  <p><code>ruby decrypt.rb PATH_TO_SECRET_FILE &lt; ENCRYPTED_DATA_BAG.json &gt; DECRYPTED_DATA_BAG.json</code></p>
  
Answers: CC BY-SA 3.0
Answers: 2017-05-11T12:43:25.760Z
Answers: What the interest over knife built in commands ?
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-05-11T17:45:22.313Z
Answers: yes I do have a file encrypt.rb file. if I encrypt it above procedure don't I need a secret file to decrypt it.@eyalzek
Answers: Sam
Answers: CC BY-SA 3.0
Answers: 2017-05-13T18:27:11.880Z
Answers: @Tensibai AFAIK knife commands are only relevant when you have a chef server and not for encrypting/decrypting JSON files locally (which is what I understood OP is interested in).
Answers: eyalzek
Answers: CC BY-SA 3.0
Answers: 2017-05-13T18:29:13.933Z
Answers: @Sam you need to generate the secret file, in the 2nd tutorial you linked to this is explained in the first paragraph using `openssl`: ```Create a random encryption key:
  openssl rand -base64 512 | tr -d '\r\n' > secret_key ```
Answers: eyalzek
Answers: CC BY-SA 3.0
Answers: 2017-05-13T18:29:59.883Z
Answers: Since chef 12.18 (I think) you can use knife-zero to build on disk databags.  But I misunderstood the goal of your script indeed,  sorry for that
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-05-11T10:27:12.110Z
Answers: 2017-05-11T10:27:12.110Z
Answers: eyalzek
Answers: <p>A data bag is stored on the chef server itself. My chef days are behind me, but you should be able to enter the data bag content either at the create step or the edit one.</p>
  
  <p>For the step 2, just execute the command that you copied:</p>
  
  <pre><code>knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-05-10T03:24:49.250Z
Answers: Thanks, I would like to ask is there any way that I can create databag independent to chef server. I mean creating databag locally @Michael
Answers: Sam
Answers: CC BY-SA 3.0
Answers: 2017-05-10T03:52:03.540Z
Answers: Once again my chef skills are a little out of date so I can't pinpoint you to the exact location, but once you find it, you can follow this part of the tutorial to create the databags manually: https://docs.chef.io/data_bags.html#manually
Answers: Michael Pereira
Answers: CC BY-SA 3.0
Answers: 2017-05-10T12:31:44.877Z
Answers: @Sam you can have local databags as test fixtures in kitchen.  There should be a way to make it work with chef-zero too, but I haven't played with that at all.
Answers: chicks
Answers: CC BY-SA 3.0
Answers: 2017-05-10T02:37:09.327Z
Answers: 2017-05-10T02:37:09.327Z
Answers: Michael Pereira
Body: <p>I am very new to <a href="/questions/tagged/chef" class="post-tag" title="show questions tagged &#39;chef&#39;" rel="tag">chef</a> and trying to secure passwords using databags. Unfortunately, I tried in different ways but unable to succeed. I followed different tutorials <a href="https://docs.chef.io/data_bags.html#encrypt-a-data-bag-item" rel="nofollow noreferrer">first</a> and <a href="https://www.devops.zone/provisioning/creating-encrypted-databag-chef/" rel="nofollow noreferrer">second</a>. I understood only two steps but later on I was unable to move forward. </p>
  
  <ol>
  <li>I created secret key using openssl</li>
  <li>In link1 step 2 says <code>knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key</code>
  but I don't know where it is creating the databag.</li>
  </ol>
  
  <p>Can some one guide me from step two? I am trying to secure my database password. I got stuck after creating secret file. </p>
  
Comments: CC BY-SA 3.0
Comments: 2017-05-11T12:00:26.183Z
Comments: Take the tour at https://learn.chef.io that sounds like a basis misconception
Comments: Tensibai
Tags: <chef>
Title: Unable to create databags in chef
UserDisplayName: Sam
ThreadText: # Unable to create databags in chef
  
  (Asked by: username_0 on 2017-05-09)
  
  I am very new to [chef](/questions/tagged/chef "show questions tagged 'chef'") and trying to secure passwords using databags. Unfortunately, I tried in different ways but unable to succeed. I followed different tutorials [first](https://docs.chef.io/data_bags.html#encrypt-a-data-bag-item) and [second](https://www.devops.zone/provisioning/creating-encrypted-databag-chef/). I understood only two steps but later on I was unable to move forward.
  
  1. I created secret key using openssl
  2. In link1 step 2 says `knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key`
     but I don't know where it is creating the databag.
  
  Can some one guide me from step two? I am trying to secure my database password. I got stuck after creating secret file.
  
  **Tags:** chef
  
  > **Comments:**
  > **username_1**: Take the tour at https://learn.chef.io that sounds like a basis misconception  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2017-05-16. Score: 2
  
  You can create Chef data bags in two ways - by loading it from a json file on your disk, or by creating a new data bag which you then write content into (the two commands in the [doc](https://docs.chef.io/data_bags.html#using-knife)).
  
  Encrypted data bags are stored on the server, and anyone who wants to read them (a workstation or node) needs to download and decrypt it with the secret key that you pass directly or from a file (see the command flags [here](https://docs.chef.io/data_bags.html#knife-options)).
  
  Once you have stored your content (your secret key from openssl) in data bags, you can access them in recipes with `data_bag_item(bag_name, item, secret)` (again, see the [docs](https://docs.chef.io/dsl_recipe.html#data-bag-item) for sample code).
  
  Hope this helps!
  
  > **Comments:**
  > **username_1**: The [`data_bag_item`](https://docs.chef.io/dsl_recipe.html#data-bag-item) in recipes DSL is the prefered way, it works with or without encryption, where your direct class access will fail on a clear text data bag (a pain to test then)  
  > **username_2**: @username_1 True, but EncryptedDataBagItem will work because OP specified storing secrets, and that *has* to be encrypted.  
  > **username_1**: It is just code smell to call a class instead of using its DSL helper. I assume you don't write recipes with `Chef::Resource::File.new('whatever') do |fres|` but instead you do `file 'whatever' do`... that's the same thing here.  
  > **username_2**: @username_1 thanks for that, TIL. I've updated the answer, you learn something new every day :D  
  
  ---
  
  ### Answer by username_3 on 2017-05-11. Score: 2
  
  I'm using the following ruby script to encrypt/decrypt chef data bags locally:
  <https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd>
  
  to encrypt:
  
  `ruby encrypt.rb PATH_TO_SECRET_FILE < UNECRYPTED_DATA_BAG.json > ENCRYPTED_DATA_BAG.json`
  
  and to decrypt:
  
  `ruby decrypt.rb PATH_TO_SECRET_FILE < ENCRYPTED_DATA_BAG.json > DECRYPTED_DATA_BAG.json`
  
  > **Comments:**
  > **username_1**: What the interest over knife built in commands ?  
  > **username_0**: yes I do have a file encrypt.rb file. if I encrypt it above procedure don't I need a secret file to decrypt it.@username_3  
  > **username_3**: @username_1 AFAIK knife commands are only relevant when you have a chef server and not for encrypting/decrypting JSON files locally (which is what I understood OP is interested in).  
  > **username_3**: @username_0 you need to generate the secret file, in the 2nd tutorial you linked to this is explained in the first paragraph using `openssl`: ```Create a random encryption key: openssl rand -base64 512 | tr -d '\r\n' > secret_key ```  
  > **username_1**: Since chef 12.18 (I think) you can use knife-zero to build on disk databags.  But I misunderstood the goal of your script indeed,  sorry for that  
  
  ---
  
  ### Answer by username_4 on 2017-05-10. Score: 1
  
  A data bag is stored on the chef server itself. My chef days are behind me, but you should be able to enter the data bag content either at the create step or the edit one.
  
  For the step 2, just execute the command that you copied:
  
  ```
  knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key
  
  ```
  
  > **Comments:**
  > **username_0**: Thanks, I would like to ask is there any way that I can create databag independent to chef server. I mean creating databag locally @username_4  
  > **username_4**: Once again my chef skills are a little out of date so I can't pinpoint you to the exact location, but once you find it, you can follow this part of the tutorial to create the databags manually: https://docs.chef.io/data_bags.html#manually  
  > **username_5**: @username_0 you can have local databags as test fixtures in kitchen.  There should be a way to make it work with chef-zero too, but I haven't played with that at all.  
  
  ---
  
  