So we use chef-vault to manage secrets, and chef_zero as our provisioner. We have a base docker cookbook that installs docker and logs into docker hub. Then we have docker image specific cookbooks that start various docker images, like rabbitmq_docker chef recipe.

The issue in general is how to deal with secrets with ec2-kitchen. Since they are not full chef nodes, they have no access to the vaults. Obviously we don't want to check secrets into git, so im just wondering how others deal with this.

My thought is to use a local test fixture databag that is NOT checked into git for this. Does this seem like a reasonable way to solve this?

The specific issue is credentials for my recipe to be able to login to docker hub to pull our private docker image for testing in kitchen, but really we have this issue all over the place.


Generally you would create standalone test data for your kitchen instances and store it alongside the tests themselves. You can configure the data bags path in your kitchen yaml config.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.