Bootstrap with chef-vault options

What is Chef Valut ?

Chef vault is alternative tool which allows you to securely manage passwords, certs, and other secrets in Chef. It was developed as an open source project originally by Nordstrom, but transferred to Chef in 2015. 

Using knife commands you can create and manage chef-valut

knife vault create passwords mysql '{"user":"root", "password" : "mysqlroot"}'  --mode client -c ~/chef-repo/.chef/knife.rb 

Note : by default the --mode is set to solo and your chef-vault databag will not get generated on chef-server so remember to set it to client.

You can get more details about knife vault option here https://github.com/Nordstrom/chef-vault

The data bag is generated on the chef server & each encrypted Chef-Vault data bag contains two items - a data bag containing the encrypted data & another data bag containing the public keys used to do the encryption.  

Following are the different vault options available for knife bootstrap:

--bootstrap-vault-file VAULT_FILE A JSON file with a list of vault(s) and item(s) to be updated

--bootstrap-vault-item VAULT_ITEM A single vault and item to update as "vault:item"

--bootstrap-vault-json VAULT_JSON A JSON string with the vault(s) and item(s) to be updated

Bootstrap examples with knife windows

knife bootstrap windows winrm <FQDN> -x <username> -P <password> -c <knife.rb path> --bootstrap-valut-file <path to valut file>

knife bootstrap windows winrm <FQDN> -x <username> -P <password> -c <knife.rb path> --bootstrap-vault-item '{"passwords": "mysql"}

knife bootstrap windows winrm <FQDN> -x <username> -P <password> -c <knife.rb path>

--bootstrap-vault-json '{"passwords": "mysql", "creds": "fooapi"}'