tobami/littlechef — Issue #66: Remove all sensible data from a node after a configuration run
Author: tobami
Created: 2011-10-20 13:34:48+00:00
State: open

Security fix: currently all kitchen information is left on the tmp directory of every node. The reason is speed: on the next run, rsync will only cope files that have changed.

Removing the whole kitchen would result in getting no benefits from rsync vs ssh push, and would be pretty slow for big cookbook repositories.

A compromise would be to only delete the really sensitive files: the automatic node data bag, and the node.json file. It is there where actual passwords can be found. Cookbooks shouldn't really hold "secrets".

Post chef-solo run clean-up is the goal of this issue.