Skip to content

Instantly share code, notes, and snippets.

@dustinmm80

dustinmm80/conjurenv_chef.sh

Created April 20, 2015 20:20
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dustinmm80/519f497d2387f423094e to your computer and use it in GitHub Desktop.
Save dustinmm80/519f497d2387f423094e to your computer and use it in GitHub Desktop.
Download ZIP
An example of pulling secrets at Chef runtime with Conjur
Raw
conjurenv_chef.sh
# First, let's define some secrets we want to pass to Chef
cat << SECRETS > /etc/chef.secrets
DB_PASSWORD: !var db/postgres/customers/password # exports value as env var
SSL_CERT: !tmp certs/ssl/mydomain # creates temporary file and exports path as env var
SECRETS
# In our recipe we can use ENV['DB_PASSWORD'] and ENV['SSL_CERT'] where secrets are needed
# We have the Conjur CLI on the machine, so we can use conjur env
# This pattern works with any tool that accepts environment variables
conjur env run -c /etc/chef.secrets -- chef-client
# Once chef-client exits, the environment variables are no longer on the machine.
# They will be fetched again for the next run.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment