How do I authenticate when I do a git clone with Chef? [duplicate]

Question

I am new to all this but I am guessing I will be using SSH keys ... but how?

git '/home/vagrant/foo' do
    repository '[email protected]:/usr/git/app.git'

    reference 'master'
    action :sync

    user "vagrant"
    group "vagrant"
end

Davisdavison

Answer 1

Here what worked for me:

1 - Generate a SSH key pair (public + private)

The public key you will add to your git repo

2 - Generate a key for encryption

openssl rand -base64 512 > encrypted_data_bag_secret

3 - Create an encrypted data bag with knife

$ knife data bag create private_keys git_key --secret-file encrypted_data_bag_secret

This will open your favorite editor (vim), you will then needs to add your private key:

{
  "name": "data_bag_item_private_keys_git_key",
  "json_class": "Chef::DataBagItem",
  "chef_type": "data_bag_item",
  "data_bag": "private_keys",
  "raw_data": {
    "id": "git_key",
    "private": "Add HERE you private key, replace the newlines by \n"     <===== this is going to be a very long string of caracters
  }
}

IMPORTANT: Replace the newlines of your private key by \n

4 - In your recipe:

secret = Chef::EncryptedDataBagItem.load_secret("/vagrant/encrypted_data_bag_secret")
git_key = Chef::EncryptedDataBagItem.load( "private_keys", "git_key", secret)
#git_key = Chef::DataBagItem.load( "private_keys_not_encrypted", "git_key")
file "/home/otto/.ssh/id_rsa" do
  content git_key['private'] 
  owner "otto"
  group "otto"
  mode 00600
  action [:delete, :create]
end

5 - Look inside your encrypted data bag

$ knife data bag show private_keys git_key
id:      git_key
private:
  cipher:         aes-256-cbc
  encrypted_data: osuRPsasdfasdfasdfasdfaKutAXYrklKwn+zAgtlQZsFZNRKCyDf1Lc
  2jtRZeGye0WHEKbVCtO7+arpytY7jNA4prOsK6iF1+cJsKcIBDtiNuurt80V
  ljGJ5RNfvAtW5HJb2P7Sw75RyQQruKha0fsbyWTKwyssXnXZbmGxEFb+Vz4m
  vEiU0tVk7/M04zAw34beEfnmAKNAae4TAgrlYg8bdQcxBi6zIdj5AW1VGBsh
  xaxFdfEXvNcSwMBX9w3Yyj7xVzI7fj3QHqnJl/p4VKhwoOlCahbJqh3A72xc
  l0mg0aPYfASulVuLm6U+KywzonOOVqXpeNYPtz+bW5v6Wa4cIM3aJ0JcObDw
  BNqe0goDRHjz6YJBKW9RT5EiRJPZbdNWJaEZhEawW/e9lyLq/A44sZhC+m0I
  ...
  [FILTERED]
  ...
  6RA/9XxH7pGJpJtxVYGWSQB1diHcpaT1Vg7RT48L7WZJjJcK0ZQHYZpXfIB2
  jUfIM3VY3ceD12unbZPI6FifdFq74qlr0fF4WM6V7WhJTgx3V3xCYLkjnhD9
  9mchWqaBa9oYNoflSR0vl21j2gywDG0LPI5bbgTU+Gu5A+XsGirW/FYfKS28
  08+B64Qvep0axtocs3GN2hOb

  iv:             dTFABrasdfasdfaLh5bNIJeUWQ==

  version:        1

6 - Add your public key to your node

cookbook_file "/home/otto/.ssh/id_rsa.pub" do
  source "id_rsa.pub"     <=== Contains the public key
  mode "0644"
end

cookbook_file "/home/otto/.ssh/known_hosts" do
  source "known_hosts" <=== BitBucket host
  mode "0644"               
end

7 - Verify you can connect to BitBucket

$ ssh -T [email protected] 
The authenticity of host 'bitbucket.org ([FILTERED])' can't be established.
RSA key fingerprint is [FILTERED].
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'bitbucket.org,[FILTERED]' (RSA) to the list of known hosts.
authenticated via a deploy key.

You can use git or hg to connect to Bitbucket. Shell access is disabled.

IMPORTANT: At the end of this command, you will have the known_hosts file that you need to add to your cookbook. Copy it to files/default folder of your cookbook.

After this I was about to git clone my repository.

I think I have documented exactly what I have done, but feel free to drop your questions.

Davisdavison