How to set Chef Vault variable in recipe - ruby

Question

Below is the command used to create the vault
knife vault create ldapuser user1 -A "admin,chef1.example.com" -J password.json -M client
Below is the command that shows content of the vault
knife vault show ldapuser user1
id: user1
password: secretp#ssword
username: james
Below is my recipe which includes the following at the very top
chef_gem 'chef-vault' do
compile_time true if respond_to?(:compile_time)
action :install
end
require 'chef-vault'
item = ChefVault::Item.load("ldapuser","user1")
execute 'setup ldap' do
command '/opt/ldap/bin/setup --hostname localhost --port 389 --bindDN cn="Directory Manager" --bindPassword item[password] --ldapport 389 --baseDN "dc=example,dc=com" --addBaseEntry --doNotStart --acceptLicense`
end
execute 'run ldap' do
command '/opt/ldap/bin/ldapmodify --hostname localhost --port 389 --bindDN cn="Directory Manager" --bindPassword item[password] --filename /opt/ldap.ldif
end
Unfortunately once setup is complete and i try to log into my ldap server, i get an invalid credentials error message.
I assume it has to do with how the variable for the bindPassword is defined in the execute block. I even tried logging in using item['password'] and that didnt work. However when i hard code the password (instead of using the vault) into my recipe, i am able to login without any issues.
I have searched everywhere and can't seem to find a solution that works. Please help!

Answer 1

String interpolation in Ruby looks like this: "something #{item['key']} else".
Important bits: use double quotes not single, put #{} around the expression, and make sure you correctly format the expression inside the #{}.

Answer 2

In this example I'm populating a auth.properties and a pem file from secrets from the chef-vault.
Full YouTube Demo Here: How to Create and use Chef-Vault
Default.rb recipe
chef_gem 'chef-vault' do
compile_time true if respond_to?(:compile_time)
end
require 'chef-vault'
secrets = ChefVault::Item.load("vault_demo", "dev_secrets" )
directory "/opt/your_project" do
action :create
end
template '/opt/your_project/auth.properties' do
source "auth.properties.erb"
variables({
sql_password: secrets['sql_password'],
application_password: secrets['application_password']
})
action :create
end
template '/opt/your_project/server.pem' do
source "server.pem.erb"
variables({
ssl_cert: Base64.decode64(secrets['ssl_cert'])
})
action :create
end
Here are the templates:
auth.properties.erb
ssl_password:<%= #sql_password %>
application_password:<%= #application_password %>
server.pem.erb
<%= #ssl_cert %>
Note that the pem file is being base64 decoded in the recipe because it has to be encoded to store in the vault