Project: external-secrets (Provisioning / Security & Compliance)
File: chef.md

`Chef External Secrets provider` will enable users to seamlessly integrate their Chef-based secret management with Kubernetes through the existing External Secrets framework. In many enterprises, legacy applications and infrastructure are still tightly integrated with the Chef/Chef Infra Server/Chef Server Cluster for configuration and secrets management. Teams often rely on to securely store sensitive information such as application secrets and infrastructure configurations. These data bags serve as a centralized repository for managing and distributing sensitive data across the Chef ecosystem. NOTE: `Chef External Secrets provider` is designed only to fetch data from the Chef data bags into Kubernetes secrets, it won't update/delete any item in the data bags. Every request made to the Chef Infra server needs to be authenticated. is done using the Private keys of the Chef Users. The User needs to have appropriate to the data bags containing the data that they want to fetch using the External Secrets Operator. The following command can be used to create Chef Users: ```sh chef-server-ctl user-create USERNAME FIRSTNAME [MIDDLENAME] LASTNAME EMAIL 'PASSWORD' (options) ``` More details on the above command are available here . The above command will return the default private key (PRIVATEKEYVALUE), which we will use for authentication. Additionally, a Chef User with access to specific data bags, a private key pair with an expiration date can be created with the help of the command. We need to store the above User's API key into a secret resource. Example: ```sh kubectl create secret generic chef-user-secret -n vivid --from-literal=user-private-key='PRIVATEKEYVALUE' ``` The Chef `ClusterSecretStore` is a cluster-scoped SecretStore that can be referenced by all Chef `ExternalSecrets` from all namespaces. You can follow the below example to create a `ClusterSecretStore` resource. ```yaml apiVersion: external-secrets.io/v1beta1 kind: ClusterSecretStore metadata: name: vivid-clustersecretstore # name of ClusterSecretStore spec: provider: chef: username: user # Chef User name serverUrl: https://manage.chef.io/organizations/testuser/ # Chef server URL auth: secretRef: privateKeySecretRef: key:

# name of the key inside Secret resource name: chef-user-secret # name of Kubernetes Secret resource containing the Chef User's private key namespace: vivid # the namespace in which the above Secret resource resides ``` Chef `SecretStores` are bound to a namespace and can not reference resources across namespaces. For cross-namespace SecretStores, you must use Chef `ClusterSecretStores`. You can follow the below example to create a `SecretStore` resource. ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: vivid-secretstore # name of SecretStore namespace: vivid # must be required for kind: SecretStore spec: provider: chef: username: user # Chef User name serverUrl: https://manage.chef.io/organizations/testuser/ # Chef server URL auth: secretRef: privateKeySecretRef: name: chef-user-secret # name of Kubernetes Secret resource containing the Chef User's private key key: user-private-key # name of the key inside Secret resource namespace: vivid # the ns where the k8s secret resource containing Chef User's private key resides ``` The Chef `ExternalSecret` describes what data should be fetched from Chef Data bags, and how the data should be transformed and saved as a Kind=Secret. You can follow the below example to create an `ExternalSecret` resource. ```yaml {% include 'chef-external-secret.yaml' %} ``` When the above `ClusterSecretStore` and `ExternalSecret` resources are created, the `ExternalSecret` will connect to the Chef Server using the private key and will fetch the data bags contained in the `vivid-credentials` secret resource. To get all data items inside the data bag, you can use the `dataFrom` directive: ```yaml apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: vivid-external-secrets # name of ExternalSecret namespace: vivid # namespace inside which the ExternalSecret will be created annotations: company/contacts: user.a@company.com, user.b@company.com company/team: vivid-dev labels: app.kubernetes.io/name: external-secrets spec: refreshInterval: 15m secretStoreRef: name: vivid-clustersecretstore # name of ClusterSecretStore kind: ClusterSecretStore dataFrom: extract: key: vivid_global # only data bag name target: name: vividglobalall_cred # name of Kubernetes Secret resource that will be created and will contain the obtained secrets creationPolicy: Owner ``` follow : for more info