Class: Chef::EncryptedDataBagItem
- Inherits:
-
Object
- Object
- Chef::EncryptedDataBagItem
- Defined in:
- lib/chef/encrypted_data_bag_item.rb,
lib/chef/encrypted_data_bag_item/decryptor.rb,
lib/chef/encrypted_data_bag_item/encryptor.rb,
lib/chef/encrypted_data_bag_item/assertions.rb,
lib/chef/encrypted_data_bag_item/check_encrypted.rb,
lib/chef/encrypted_data_bag_item/decryption_failure.rb,
lib/chef/encrypted_data_bag_item/encryption_failure.rb,
lib/chef/encrypted_data_bag_item/unsupported_cipher.rb,
lib/chef/encrypted_data_bag_item/encrypted_data_bag_item_assertions.rb,
lib/chef/encrypted_data_bag_item/unsupported_encrypted_data_bag_item_format.rb,
lib/chef/encrypted_data_bag_item/unacceptable_encrypted_data_bag_item_format.rb
Overview
- Author
-
Seth Falcon (<[email protected]>)
- Copyright
-
Copyright © Chef Software Inc.
- License
-
Apache License, Version 2.0
Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Defined Under Namespace
Modules: Assertions, CheckEncrypted, Decryptor, Encryptor Classes: DecryptionFailure, EncryptedDataBagRequirementsFailure, EncryptionFailure, UnacceptableEncryptedDataBagItemFormat, UnsupportedCipher, UnsupportedEncryptedDataBagItemFormat
Constant Summary collapse
- ALGORITHM =
"aes-256-cbc".freeze
- AEAD_ALGORITHM =
"aes-256-gcm".freeze
Class Method Summary collapse
- .encrypt_data_bag_item(plain_hash, secret) ⇒ Object
-
.load(data_bag, name, secret = nil) ⇒ Object
Synopsis.
- .load_secret(path = nil) ⇒ Object
Instance Method Summary collapse
- #[](key) ⇒ Object
- #[]=(key, value) ⇒ Object
-
#initialize(enc_hash, secret) ⇒ EncryptedDataBagItem
constructor
Synopsis.
- #to_h ⇒ Object (also: #to_hash)
Constructor Details
#initialize(enc_hash, secret) ⇒ EncryptedDataBagItem
Synopsis
EncryptedDataBagItem.new(hash, secret)
Args
enc_hash
-
The encrypted hash to be decrypted
secret
-
The raw secret key
Description
Create a new encrypted data bag item for reading (decryption)
68 69 70 71 |
# File 'lib/chef/encrypted_data_bag_item.rb', line 68 def initialize(enc_hash, secret) @enc_hash = enc_hash @secret = secret end |
Class Method Details
.encrypt_data_bag_item(plain_hash, secret) ⇒ Object
92 93 94 95 96 97 98 99 100 101 |
# File 'lib/chef/encrypted_data_bag_item.rb', line 92 def self.encrypt_data_bag_item(plain_hash, secret) plain_hash.inject({}) do |h, (key, val)| h[key] = if key != "id" Encryptor.new(val, secret).for_encrypted_item else val end h end end |
.load(data_bag, name, secret = nil) ⇒ Object
Synopsis
EncryptedDataBagItem.load(data_bag, name, secret = nil)
Args
data_bag
-
The name of the data bag to fetch
name
-
The name of the data bag item to fetch
secret
-
The raw secret key. If the
secret
is nil, the value of the file atChef::Config[:encrypted_data_bag_secret]
is loaded. Seeload_secret
for more information.
Description
Loads and decrypts the data bag item with the given name.
123 124 125 126 127 |
# File 'lib/chef/encrypted_data_bag_item.rb', line 123 def self.load(data_bag, name, secret = nil) raw_hash = Chef::DataBagItem.load(data_bag, name) secret ||= load_secret new(raw_hash, secret) end |
.load_secret(path = nil) ⇒ Object
129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 |
# File 'lib/chef/encrypted_data_bag_item.rb', line 129 def self.load_secret(path = nil) require "open-uri" unless defined?(OpenURI) path ||= Chef::Config[:encrypted_data_bag_secret] unless path raise ArgumentError, "No secret specified and no secret found at #{Chef::Config.platform_specific_path(ChefConfig::Config.etc_chef_dir) + "/encrypted_data_bag_secret"}" end secret = case path when %r{^\w+://} # We have a remote key begin Kernel.open(path).read.strip rescue Errno::ECONNREFUSED raise ArgumentError, "Remote key not available from '#{path}'" rescue OpenURI::HTTPError raise ArgumentError, "Remote key not found at '#{path}'" end else unless File.exist?(path) raise Errno::ENOENT, "file not found '#{path}'" end IO.read(path).strip end if secret.size < 1 raise ArgumentError, "invalid zero length secret in '#{path}'" end secret end |
Instance Method Details
#[](key) ⇒ Object
73 74 75 76 77 78 79 80 |
# File 'lib/chef/encrypted_data_bag_item.rb', line 73 def [](key) value = @enc_hash[key] if key == "id" || value.nil? value else Decryptor.for(value, @secret).for_decrypted_item end end |
#[]=(key, value) ⇒ Object
82 83 84 |
# File 'lib/chef/encrypted_data_bag_item.rb', line 82 def []=(key, value) raise ArgumentError, "assignment not supported for #{self.class}" end |
#to_h ⇒ Object Also known as: to_hash
86 87 88 |
# File 'lib/chef/encrypted_data_bag_item.rb', line 86 def to_h @enc_hash.keys.inject({}) { |hash, key| hash[key] = self[key]; hash } end |