{"action":"created","issue":{"url":"https://api.github.com/repos/Nordstrom/chef-vault/issues/49","labels_url":"https://api.github.com/repos/Nordstrom/chef-vault/issues/49/labels{/name}","comments_url":"https://api.github.com/repos/Nordstrom/chef-vault/issues/49/comments","events_url":"https://api.github.com/repos/Nordstrom/chef-vault/issues/49/events","html_url":"https://github.com/Nordstrom/chef-vault/pull/49","id":19775849,"number":49,"title":"expose secret key for initial host provisioning","user":{"login":"pburkholder","id":1211146,"avatar_url":"https://avatars.githubusercontent.com/u/1211146?v=3","gravatar_id":"","url":"https://api.github.com/users/pburkholder","html_url":"https://github.com/pburkholder","followers_url":"https://api.github.com/users/pburkholder/followers","following_url":"https://api.github.com/users/pburkholder/following{/other_user}","gists_url":"https://api.github.com/users/pburkholder/gists{/gist_id}","starred_url":"https://api.github.com/users/pburkholder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pburkholder/subscriptions","organizations_url":"https://api.github.com/users/pburkholder/orgs","repos_url":"https://api.github.com/users/pburkholder/repos","events_url":"https://api.github.com/users/pburkholder/events{/privacy}","received_events_url":"https://api.github.com/users/pburkholder/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2013-09-19T19:22:32Z","updated_at":"2015-06-10T02:00:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Nordstrom/chef-vault/pulls/49","html_url":"https://github.com/Nordstrom/chef-vault/pull/49","diff_url":"https://github.com/Nordstrom/chef-vault/pull/49.diff","patch_url":"https://github.com/Nordstrom/chef-vault/pull/49.patch"},"body":"This addresses the 'chicken-and-egg' problem that @jtimberman alludes to in http://jtimberman.housepub.org/blog/2013/09/10/managing-secrets-with-chef-vault/.  I'm only starting to test this in EC2, but I thought I should submit a PR for feedback sooner rather than later.\r\n\r\n## Using Shared Secrets\r\n\r\nWhen instantiating new nodes, you may need to access the vault\r\nwith the symmetric key in the same way would with a standard\r\nencrypted data bag, as in the following workflow:\r\n\r\n* Save the current vault secret to a file with 'knife encrypt expose key'\r\n* Encode the secret so it's available to node at launch, e.g. userdata.txt for EC2.\r\n* Launch node for initial provisioning, then wipe the secrets file from disk\r\n* Rekey the vault with 'knife encrypt rotate keys'\r\n* Update the vault ('knife encrypt update') with an updated node search so the new node has keys encrypted with its private key.\r\n\r\n#### Example Code\r\n\r\nRecipe:\r\n\r\n```ruby\r\npasswords = ChefVault::Item.load(\"password\", \"root\", \"/etc/chef/vault_secret\")\r\n```\r\n\r\nAnd for key management:\r\n\r\n```shell\r\nknife encrypt expose key password root --mode client --secret-file vault_secret\r\n# provision node with 'vault_secret'\r\nknife encrypt rotate keys password root --mode client\r\nknife encrypt update password root --search 'role:base' --mode client"},"comment":{"url":"https://api.github.com/repos/Nordstrom/chef-vault/issues/comments/110557269","html_url":"https://github.com/Nordstrom/chef-vault/pull/49#issuecomment-110557269","issue_url":"https://api.github.com/repos/Nordstrom/chef-vault/issues/49","id":110557269,"user":{"login":"pburkholder","id":1211146,"avatar_url":"https://avatars.githubusercontent.com/u/1211146?v=3","gravatar_id":"","url":"https://api.github.com/users/pburkholder","html_url":"https://github.com/pburkholder","followers_url":"https://api.github.com/users/pburkholder/followers","following_url":"https://api.github.com/users/pburkholder/following{/other_user}","gists_url":"https://api.github.com/users/pburkholder/gists{/gist_id}","starred_url":"https://api.github.com/users/pburkholder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pburkholder/subscriptions","organizations_url":"https://api.github.com/users/pburkholder/orgs","repos_url":"https://api.github.com/users/pburkholder/repos","events_url":"https://api.github.com/users/pburkholder/events{/privacy}","received_events_url":"https://api.github.com/users/pburkholder/received_events","type":"User","site_admin":false},"created_at":"2015-06-10T02:00:40Z","updated_at":"2015-06-10T02:00:40Z","body":"https://feedback.chef.io/forums/301644-chef-product-feedback/suggestions/8298918-chef-client-equivalent-of-knife-bootstrap-bootst -- feature request for provisioning"}}