Encrypted Data Bag for Itamae
Ruby Shell
Switch branches/tags
Clone or download
Latest commit a9efd6f Jun 22, 2017
Failed to load latest commit information.
bin First goal Aug 25, 2015
lib/itamae v0.2.3 Mar 13, 2017
script init Aug 24, 2015
spec init Aug 24, 2015
.gitignore init Aug 24, 2015
.rspec init Aug 24, 2015
.travis.yml init Aug 24, 2015
Gemfile init Aug 24, 2015
LICENSE.txt init Aug 24, 2015
README.md Fix README typo Jun 16, 2017
Rakefile init Aug 24, 2015
itamae-secrets.gemspec 📝 gem Description Aug 25, 2015


Itamae::Secrets - Encrypted Data Bag for Itamae

This is itamae plugin that provides store for secrets, like encrypted data bag in chef.


gem 'itamae-secrets'


$ gem install itamae-secrets


  • itamae-secrets command for storing data or manually reading
  • Itamae::Secrets interface for itamae recipes
  • Data are stored in base directory.
    • You must avoid ${base}/keys from checked into VCS. (.gitignore it!)


Generate a key

$ itamae-secrets newkey --base=./secret --method=aes-random
from passphrase
$ itamae-secrets newkey --base=./secret --method=aes-passphrase

Both generates ./secret/keys/default. Make sure ./secret/keys be excluded from VCS.

Store value

$ itamae-secrets set --base=./secret awesome_secret value

(when omit value, it'll read from STDIN until EOF. You can also use --noecho if you want hide value in your terminal's buffer completely.)

Reading data from itamae

on your itamae recipe, do:

require 'itamae/secrets'
node[:secrets] = Itamae::Secrets(File.join(__dir__, 'secret'))

# Use it
p node[:secrets][:awesome_secret]

Reading data from CLI

$ itamae-secrets get --base=./secret awesome_secret

Remembering --base

$ echo 'base: ./secret' >> .itamae-secrets.yml


After checking out the repo, run bin/setup to install dependencies. Then, run rake rspec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.


Bug reports and pull requests are welcome on GitHub at https://github.com/sorah/itamae-secrets.

Security issues? Send me directly at security@sorah.jp. My GPG key is available here: http://sorah.jp/id.html (SSL)


The gem is available as open source under the terms of the MIT License.


  • Missing test :(