So we use chef-vault to manage secrets, and chef_zero as our provisioner. We have a base docker cookbook that installs docker and logs into docker hub. Then we have docker image specific cookbooks that start various docker images, like rabbitmq_docker chef recipe.
The issue in general is how to deal with secrets with ec2-kitchen. Since they are not full chef nodes, they have no access to the vaults. Obviously we don't want to check secrets into git, so im just wondering how others deal with this.
My thought is to use a local test fixture databag that is NOT checked into git for this. Does this seem like a reasonable way to solve this?
The specific issue is credentials for my recipe to be able to login to docker hub to pull our private docker image for testing in kitchen, but really we have this issue all over the place.