Regarding the order of execution on the recipes, (comment to rgnever's answer) you are correct that some things seem to happen out of order. Here is an Opscode article on Chef Recipe execution:
Chef processes recipes in two phases, Compile and Execute.
- During the compile phase, the recipes are evaluated as Ruby code and recognized resources are added to the resource collection.
- During the execute phase, Chef takes the appropriate Provider action on each resource.
I haven't found a document that explicitly confirms this, but the behavior is clearly that Data Bags are one such resource type that gets evaluated during compile time. Therefore, that part of your recipe does in fact break the order of the run list, jumping ahead of whatever other recipe you had to actually load in the secret file.
We were able to work around this by using the trick the described in that document (adapted to the cookbook_file
resource).
cb_file = cookbook_file "/etc/chef/encrypted_data_bag_secret" do
source "chef_secret_file"
mode 0755
owner "root"
group "root"
end
cb_file.run_action(:create)
Note that the :nothing
action is not supported for the cookbook_file resource, and the lack of an action in the resource block there will default to :create
, which will actually overwrite your secret file during the execute phase of the recipe as well.