0

I am admin of a chef vault. I have regenerated my key recently. Now when I try to access the secrets it shows error saying unable to decrypt the secrets and I need to get the vault refresh done by an admin. I checked with another administrator but he is also facing the same issue.

ChefVault::Exceptions::SecretDecryption: VAULT/ITEM is encrypted for you, but your private key failed to decrypt the contents. (if you regenerated your client key, have an administrator of the vault run 'knife vault refresh')

I wanted to know if I can recover the secrets without the need to refresh the vault ? I don't have the secret values stored anywhere else to be able to create a new vault. Please advise.

Tried to refresh the vault using

knife vault refresh VAULT ITEM

but getting the same error. There are no other admins who can access the vault to be able to refresh it.

As an alternative can I get the decrypted secrets from one of the VMs (client) which is bootstrapped from the chef server?

Note: I am new to chef and don't have much knowledge on the available options. But this is very urgent.kindly help.

Moni
  • 16
  • 2

1 Answers1

0

You indeed need to refresh, the vault system works with a symmetric encryption key which is in turn encrypted with your public key for you.

So to decrypt a secret you need to first to decrypt the vault key with your private key.

You can check who's in the admin list with knife databag show <vault> <item>_keys.

You should be able to just edit this databag item to add a node to the admins array and then run the refresh command on the node itself (and you should probably do a knife vault rotate <vault> <item> too).

Tensibai
  • 15,557
  • 1
  • 37
  • 57