Downloaded 16 times
![Chef Vault: A Deep Dive @nellshamrell
Using a Vault in a Recipe
chef_gem ‘chef-vault’ do
compile_time true if respond_to?(:compile_time)
end
require ‘chef-vault’
vault = chef_vault_item(“my_vault”, “my_item”)
node.set[‘database’][‘password’] = vault[‘password’]
recipe.rb](https://image.slidesharecdn.com/chefvaultfinal-170524205010/85/Chef-Vault-A-Deep-Dive-81-320.jpg)
Uploaded byNell Shamrell-Harrington
Chef Vault: A Deep Dive
The document discusses Chef Vault, a tool for managing encrypted information across nodes, emphasizing the balance between security and usability. It covers its functionality, including creating, editing, and destroying vaults, as well as key management challenges like key rotation and user access. Alternatives to Chef Vault, like Hashicorp Vault and Citadel, are also mentioned, highlighting different use case considerations in selecting a secrets management tool.
More Related Content
Chef Vault: A Deep Dive
- 1. Chef Vault: ADeep Dive Nell Shamrell-Harrington @nellshamrell Chef Conf 2017
- 2. What do Ido when I need to share static information among my nodes?
- 3. Chef Vault: ADeep Dive @nellshamrell App Node 1 App Node 2
- 4. Chef Vault: ADeep Dive @nellshamrell Database App Node 1 App Node 2
- 5. Chef Vault: ADeep Dive @nellshamrell Load Balancer Database App Node 1 App Node 2
- 6. Chef Vault: ADeep Dive @nellshamrell Load Balancer Database App Node 1 App Node 2
- 7. Chef Vault: ADeep Dive @nellshamrell Load Balancer Database App Node 1 App Node 2App Node 3
- 8. Use a databag!
- 9. What if thatinformation needs to be encrypted?
- 10. It’s a littlemore complicated…
- 11. Secrets management systems mustfind a balance between security and usability
- 12. Preventing unauthorized access isonly half of managing security
- 13. Security must alsoenable authorized users to access what they need when they need it
- 14. A system thatis secure but unusable is inherently insecure
- 15. When choosing asecret management tool, you must understand…
- 16. 1. Your ownenvironment
- 17. 1. Your ownenvironment 2. The capabilities and limits of the tool
- 18. No tool isone size fits all.
- 19. We will focuson Chef Vault, but we will also explore alternatives
- 20. Chef Vault: ADeep Dive @nellshamrell • Sr. Software Engineer at Chef • Core maintainer of Supermarket and Habitat • Co-host of Foodfight Podcast • @nellshamrell • nshamrell@chef.io Nell Shamrell-Harrington
- 21.
- 22. Chef Vault: ADeep Dive @nellshamrell Load Balancer Database App Node 1 App Node 2App Node 3
- 23. Chef Vault: ADeep Dive @nellshamrell Encrypted Data bags $ cat my_item.json {“db_password”:“some_password”} Workstation JSON file with data
- 24. Chef Vault: ADeep Dive @nellshamrell $ openssl rand -base64 512 | tr -d 'rn' > my_key Workstation Generates a key Encrypted Data bags
- 25. Chef Vault: ADeep Dive @nellshamrell $ Workstation my_key Encrypted Data bags
- 26. Chef Vault: ADeep Dive @nellshamrell my_databag $ knife data bag from file my_databag my_item.json Workstation my_key my_item_info my_item Creates data bag Encrypted Data bags
- 27. Chef Vault: ADeep Dive @nellshamrell $ knife data bag from file my_databag my_item.json --secret-file /path/to/my_key Workstation my_key my_databag my_item my_key Encrypted Data bags Key to encrypt data bag
- 28. Chef Vault: ADeep Dive @nellshamrell $ my_key Workstation my_key my_databag my_item Encrypted Data bags
- 29. Chef Vault: ADeep Dive @nellshamrell $ knife data bag show my_databage my_item —secret-file /path/to/my_key Workstation my_key my_key my_databag my_item Encrypted Data bags Shows data bag
- 30. Chef Vault: ADeep Dive @nellshamrell $ knife data bag show my_databage my_item —secret-file /path/to/my_key Workstation my_key my_key my_databag my_item Encrypted Data bags Key to decrypt data bag
- 31. Chef Vault: ADeep Dive @nellshamrell Workstation my_key my_databag my_item my_item_info $ knife data bag show my_databage my_item —secret-file /path/to/my_key Encrypted Data bags
- 32. Chef Vault: ADeep Dive @nellshamrell workstation_1 workstation_2 workstation_3 my_databag my_item Encrypted Data bags
- 33. Chef Vault: ADeep Dive @nellshamrell workstation_1 workstation_2 workstation_3 my_key my_key my_key my_databag my_item Encrypted Data bags
- 34. Chef Vault: ADeep Dive @nellshamrell workstation_1 workstation_2 workstation_3 my_key my_key my_key node_1 my_key node_2 my_key node_3 my_key my_databag my_item Encrypted Data bags
- 35. Chef Vault: ADeep Dive @nellshamrell • Limited by need to distribute and share a key Encrypted Data bags
- 36. Chef Vault: ADeep Dive @nellshamrell • Limited by need to distribute and share a key • What if someone leaves? Encrypted Data bags
- 37. Chef Vault: ADeep Dive @nellshamrell • Limited by need to distribute and share a key • What if someone leaves? • If the key is compromised on one node/workstation, data is compromised for all nodes/workstations Encrypted Data bags
- 38. Key rotation ishard…
- 39. …but it’s notimpossible
- 40. Chef Vault isone approach to solving this problem
- 41. Chef Vault: ADeep Dive @nellshamrell • Originally created by Nordstrom Chefs! Chef Vault
- 42. Chef Vault: ADeep Dive @nellshamrell • Originally created by Nordstrom Chefs! • Ownership transferred to Chef in 2015 Chef Vault
- 43. Chef Vault: ADeep Dive @nellshamrell • Originally created by Nordstrom Chefs! • Ownership transferred to Chef in 2015 • Completely open source • https://github.com/chef/chef-vault Chef Vault
- 44. Chef Vault: ADeep Dive @nellshamrell Chef Vault Chef Server
- 45. Chef Vault: ADeep Dive @nellshamrell Chef Server node_2 node_1 Chef Vault
- 46. Chef Vault: ADeep Dive @nellshamrell Chef Server node_1 node_2 node_1_client node_2_client Chef Vault
- 47. Chef Vault: ADeep Dive @nellshamrell Chef Server node_1 node_2 key_1 key_2 Chef Vault node_1_client node_2_client
- 48. Chef Vault: ADeep Dive @nellshamrell Chef Server node_1 node_2 key_1.pub key_2.pub key_1 key_2 Chef Vault node_1_client node_2_client
- 49. Chef Vault: ADeep Dive @nellshamrell Chef Server user_1 user_2 Chef Vault
- 50. Chef Vault: ADeep Dive @nellshamrell Chef Server user_1 user_2 user_1 user_2 Chef Vault
- 51. Chef Vault: ADeep Dive @nellshamrell Chef Server user_1 user_2 user_1 user_2 key_3 key_4 Chef Vault
- 52. Chef Vault: ADeep Dive @nellshamrell Chef Server user_1 user_2 user_1 user_2 key_3.pub key_4.pub key_3 key_4 Chef Vault
- 53. Chef Vault: ADeep Dive @nellshamrell my_vault my_item Chef Vault
- 54. Chef Vault: ADeep Dive @nellshamrell my_vault my_item shared_key Chef Vault
- 55. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 node_1 shared_key Chef Vault
- 56. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 key_3 node_1 key_1 shared_key Chef Vault
- 57. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 key_3 node_1 shared_key copy shared_key copy key_1 shared_key Chef Vault
- 58. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 key_3 node_1 shared_key copy shared_key copy key_1key_3 key_1 shared_key Chef Vault
- 59. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 key_3 node_1 shared_key copy shared_key copy key_1 key_1 shared_key Decrypts Chef Vault
- 60. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 key_3 node_1 shared_key copy shared_key copy key_1 key_1 Chef Vault Decrypts
- 61. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 key_3 node_1 shared_key copy shared_key copy key_1 Chef Vault Decrypts
- 62. Chef Vault: ADeep Dive @nellshamrell my_vault my_item user_1 key_3 node_1 shared_key copy shared_key copy key_1 Chef Vault Decrypts
- 63. Chef Vault useslayers of encryption to balance security and usability
- 64. Chef Vault: ADeep Dive @nellshamrell Chef Server node_1 node_2 user_1 user_2 Chef Vault
- 65. Chef Vault: ADeep Dive @nellshamrell Creating a Vault Workstation $ gem install chef-vault Installs Chef Vault
- 66. Chef Vault: ADeep Dive @nellshamrell Creating a Vault Workstation $ knife vault create my_vault my_item Creates vault
- 67. Chef Vault: ADeep Dive @nellshamrell Creating a Vault $ knife vault create my_vault my_item -A “user_1,user_2” Workstation Users with access to vault
- 68. Chef Vault: ADeep Dive @nellshamrell Creating a Vault $ knife vault create my_vault my_item -A “user_1,user_2,node_1,node_2” Workstation Nodes with access to vault
- 69. Chef Vault: ADeep Dive @nellshamrell Creating a Vault $ knife vault create my_vault my_item -A “user_1,user_2,node_1,node_2” -M client Workstation Mode (client or solo)
- 70. Chef Vault: ADeep Dive @nellshamrell Creating a Vault $ knife vault create my_vault my_item -A “user_1,user_2,node_1,node_2” -M client -J ./ my_item.json Workstation File with data
- 71. Chef Vault: ADeep Dive @nellshamrell Creating a Vault Workstation my_vault my_item $ knife vault create my_vault my_item -A “user_1,user_2,node_1,node_2” -M client -J ./ my_item.json
- 72. Chef Vault: ADeep Dive @nellshamrell Creating a Vault Workstation my_vault my_item my_item_keys Authorized keys $ knife vault create my_vault my_item -A “user_1,user_2,node_1,node_2” -M client -J ./ my_item.json
- 73. Chef Vault: ADeep Dive @nellshamrell Creating a Vault $ knife vault show my_vault my_item Workstation my_vault my_item my_item_keys Shows vault
- 74. Chef Vault: ADeep Dive @nellshamrell Viewing a Vault $ knife vault show my_vault my_item db_password: some_password id: my_item Workstation
- 75. Chef Vault: ADeep Dive @nellshamrell Viewing a Vault $ knife vault show my_vault my_item db_password: cipher: aes-256-cbc encrypted_data: dsiBtNHX8Sbis42yKuYBvbdNXPpu8bQfJrS20op7zoys fR8roFlzp VHyoaG2 4yb3 Unauthorized Workstation
- 76.
- 77. Chef Vault: ADeep Dive @nellshamrell Using a Vault in a Recipe metadata.rb gem ‘chef-vault’
- 78. Chef Vault: ADeep Dive @nellshamrell Using a Vault in a Recipe recipe.rb chef_gem ‘chef-vault’ do compile_time true if respond_to?(:compile_time) end
- 79. Chef Vault: ADeep Dive @nellshamrell Using a Vault in a Recipe chef_gem ‘chef-vault’ do compile_time true if respond_to?(:compile_time) end require ‘chef-vault’ recipe.rb
- 80. Chef Vault: ADeep Dive @nellshamrell Using a Vault in a Recipe chef_gem ‘chef-vault’ do compile_time true if respond_to?(:compile_time) end require ‘chef-vault’ vault = chef_vault_item(“my_vault”, “my_item”) recipe.rb
- 81. Chef Vault: ADeep Dive @nellshamrell Using a Vault in a Recipe chef_gem ‘chef-vault’ do compile_time true if respond_to?(:compile_time) end require ‘chef-vault’ vault = chef_vault_item(“my_vault”, “my_item”) node.set[‘database’][‘password’] = vault[‘password’] recipe.rb
- 82. Maintaining a ChefVault
- 83. Chef Vault: ADeep Dive @nellshamrell Editing a Vault $ knife vault edit my_vault my_item Workstation my_vault my_item my_item_keys Edits vault
- 84. Chef Vault: ADeep Dive @nellshamrell Adding a User or Node $ knife vault update my_vault my_keys -A “new- username” Workstation my_vault my_item my_item_keys Adds user/node
- 85. Chef Vault: ADeep Dive @nellshamrell Removing a User or Node $ knife vault remove my_vault my_item -A “some_user” Workstation my_vault my_item my_item_keys Remove user/node
- 86. Chef Vault: ADeep Dive @nellshamrell Refreshing Keys $ knife vault refresh my_vault my_item Workstation my_vault my_item my_item_keys Refresh user/node keys
- 87. Chef Vault: ADeep Dive @nellshamrell Destroying a Vault $ knife vault delete my_vault my_item Workstation my_vault my_item my_item_keys Destroys vault item
- 88. Chef Vault: ADeep Dive @nellshamrell Destroying a Vault $ knife vault delete my_vault my_item Workstation my_vault
- 89. Chef Vault: ADeep Dive @nellshamrell Destroying a Vault $ knife data bag delete my_vault Workstation my_vault Destroys vault
- 90. Chef Vault: ADeep Dive @nellshamrell Destroying a Vault $ knife data bag delete my_vault Workstation
- 91.
- 92. Chef Vault: ADeep Dive @nellshamrell Load Balancer Postgres DB App Node App Node App Node Redis Cache Supermarket Production
- 93. Chef Vault: ADeep Dive @nellshamrell Load Balancer Postgres DB App Node App Node App Node Redis Cache Supermarket Staging
- 94. Chef Vault: ADeep Dive @nellshamrell apps
- 95. Chef Vault: ADeep Dive @nellshamrell apps supermarket_staging supermarket_prod
- 96. Chef Vault: ADeep Dive @nellshamrell apps supermarket_staging supermarket_prod supermarket_staging_keys supermarket_prod_keys
- 97. Limits of ChefVault
- 98. Chef Vault: ADeep Dive @nellshamrell • Adding new nodes requires human intervention • Not compatible with autoscaling groups Chef Vault
- 99. Chef Vault: ADeep Dive @nellshamrell • Adding new nodes requires human intervention • Not compatible with autoscaling groups • Could theoretically have one node keep all keys and distribute those - but that is a major security risk Chef Vault
- 100. Chef Vault: ADeep Dive @nellshamrell • No audit logs of access Chef Vault
- 101.
- 102. Chef Vault: ADeep Dive @nellshamrell • Alternatives • Hashicorp Vault (https:// www.vaultproject.io) Chef Vault
- 103. Chef Vault: ADeep Dive @nellshamrell • Alternatives • Hashicorp Vault (https:// www.vaultproject.io) • Citadel (https://github.com/poise/ citadel) Chef Vault
- 104. Which tool isbest?
- 105. It depends onyour needs…
- 106. Chef Vault: ADeep Dive @nellshamrell • Where is your infrastructure? (Citadel is AWS only) Considerations
- 107. Chef Vault: ADeep Dive @nellshamrell • Where is your infrastructure? (Citadel is AWS only) • Do you need autoscaling groups? (Chef Vault is not a good fit) Considerations
- 108. Chef Vault: ADeep Dive @nellshamrell • Where is your infrastructure? (Citadel is AWS only) • Do you need autoscaling groups? (Chef Vault is not a good fit) • Do you want dynamic secrets? (Hashicorp vault is your best bet) Considerations
- 109. Key rotation ishard…
- 110. …but it’s notimpossible
- 111. Encrypted information systems mustfind a balance between security and accessibility
- 112. Chef Vault: ADeep Dive @nellshamrell • Sr. Software Engineer at Chef • Core maintainer of Supermarket and Habitat • Co-host of Foodfight Podcast • @nellshamrell • nshamrell@chef.io Nell Shamrell-Harrington