secrets_merger.rb

secret  = Chef::EncryptedDataBagItem.load_secret(Chef::Config[:encrypted_data_bag_secret])
secrets_bag = Chef::EncryptedDataBagItem.load('app-secrets', node['app']['name'], secret)

secrets_bag.to_hash.each do |key, value|
  node.default['app'][key] = case value
                             when Hash
                               Chef::Mixin::DeepMerge.merge(node['app'][key], value)
                             else
                               value
                             end
end