Chef and Vault

gistfile1.txt

  # Retrieve a secret, either from the env or from Vault
  def self.secret(node, path)
    # First, try in the environment
    secret = AiHelper.environment_secret(node, path)
    if secret.nil? || secret == 'IN_VAULT'
      secret = AiHelper.vault_secret(node, path)
    end
    secret
  end

  # Retrieve a secret in the environment (or nil)
  def self.environment_secret(node, path)
    path_array = path.split('/')
    possible_secret = node
    path_array.each do |p|
      next if possible_secret.nil?
      possible_secret = possible_secret[p]
    end
    possible_secret
  end

  # Retrieve a secret from Hashicorp Vault
  def self.vault_secret(node, path, environment: nil)
    # The full vault path will be e.g. secret/dev/my/secret
    environment ||= node.chef_environment
    vault_path = 'secret/' + environment + '/' + path
    require 'vault'
    Vault.address = node['vault']['url']
    Vault.token = File.read('/etc/chef/vault_token')
    Vault.ssl_verify = true
    secret = Vault.logical.read(vault_path)
    secret.data[:value]
  end