mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
183 lines
8.6 KiB
Plaintext
183 lines
8.6 KiB
Plaintext
---
|
|
title: "Chef"
|
|
description: "Learn how to configure a Chef Certificate Sync for Infisical PKI."
|
|
---
|
|
|
|
**Prerequisites:**
|
|
|
|
- Create a [Chef Connection](/integrations/app-connections/chef)
|
|
- Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
|
|
|
|
<Note>
|
|
The Chef Certificate Sync requires the following permissions to be set on the Chef user
|
|
for Infisical to sync certificates to Chef: `data bag read`, `data bag create`, `data bag update`, `data bag delete`.
|
|
|
|
Any role with these permissions would work such as a custom role with **Data Bag** permissions.
|
|
|
|
</Note>
|
|
|
|
<Note>
|
|
Certificates synced to Chef will be stored as data bag items within the specified data bag,
|
|
preserving both the certificate and private key components as separate fields.
|
|
</Note>
|
|
|
|
<Tabs>
|
|
<Tab title="Infisical UI">
|
|
1. Navigate to **Project** > **Integrations** > **Certificate Syncs** and press **Add Sync**.
|
|
|
|
|
|
2. Select the **Chef** option.
|
|
|
|
|
|
3. Configure the **Destination** to where certificates should be deployed, then click **Next**.
|
|
|
|
|
|
- **Chef Connection**: The Chef Connection to authenticate with.
|
|
- **Data Bag Name**: The name of the Chef data bag where certificates will be stored.
|
|
|
|
4. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
|
|
|
|
|
|
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
|
|
- **Preserve Data Bag Item on Renewal**: Only applies to certificate renewals. When a certificate is renewed in Infisical, this option controls how the renewed certificate is handled. If enabled, the renewed certificate will update the existing data bag item, preserving the same item name. If disabled, the renewed certificate will be created as a new data bag item with a new name.
|
|
- **Update Existing Certificates**: If enabled, Infisical will update existing data bag items when certificate content changes.
|
|
- **Certificate Name Schema** (Optional): Customize how certificate item names are generated in Chef data bags. Use `{{certificateId}}` as a placeholder for the certificate ID. Available placeholders: `{{certificateId}}`, `{{profileId}}`, `{{commonName}}`, `{{friendlyName}}`, `{{environment}}`. If not specified, defaults to `{{certificateId}}`.
|
|
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
|
|
|
|
<Tip>
|
|
**Chef Data Bag Item Structure**: Certificates are stored in Chef data bags as items with the following structure:
|
|
```json
|
|
{
|
|
"id": "certificate-item-name",
|
|
"certificate": "-----BEGIN CERTIFICATE-----\n...",
|
|
"private_key": "-----BEGIN PRIVATE KEY-----\n...",
|
|
"certificate_chain": "-----BEGIN CERTIFICATE-----\n...",
|
|
"metadata": {
|
|
"common_name": "example.com",
|
|
"serial_number": "1234567890",
|
|
"not_before": "2023-01-01T00:00:00Z",
|
|
"not_after": "2024-01-01T00:00:00Z"
|
|
}
|
|
}
|
|
```
|
|
</Tip>
|
|
|
|
5. Configure the **Details** of your Chef Certificate Sync, then click **Next**.
|
|
|
|
|
|
- **Name**: The name of your sync. Must be slug-friendly.
|
|
- **Description**: An optional description for your sync.
|
|
|
|
6. Select which certificates should be synced to Chef.
|
|
|
|
|
|
7. Review your Chef Certificate Sync configuration, then click **Create Sync**.
|
|
|
|
|
|
8. If enabled, your Chef Certificate Sync will begin syncing your certificates to the destination endpoint.
|
|
|
|
</Tab>
|
|
<Tab title="API">
|
|
To create a **Chef Certificate Sync**, make an API request to the [Create Chef Certificate Sync](/api-reference/endpoints/pki/syncs/chef/create) API endpoint.
|
|
|
|
### Sample request
|
|
|
|
<Note>
|
|
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
|
|
If not provided, you can add certificates later using the certificate management endpoints.
|
|
</Note>
|
|
|
|
```bash Request
|
|
curl --request POST \
|
|
--url https://app.infisical.com/api/v1/pki/syncs/chef \
|
|
--header 'Authorization: Bearer <access-token>' \
|
|
--header 'Content-Type: application/json' \
|
|
--data '{
|
|
"name": "my-chef-cert-sync",
|
|
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
|
"description": "an example certificate sync",
|
|
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
|
"destination": "chef",
|
|
"isAutoSyncEnabled": true,
|
|
"certificateIds": [
|
|
"550e8400-e29b-41d4-a716-446655440000",
|
|
"660f1234-e29b-41d4-a716-446655440001"
|
|
],
|
|
"syncOptions": {
|
|
"canRemoveCertificates": true,
|
|
"preserveItemOnRenewal": true,
|
|
"updateExistingCertificates": true,
|
|
"certificateNameSchema": "myapp-{{certificateId}}",
|
|
"includeMetadata": true,
|
|
"encryptDataBag": true
|
|
},
|
|
"destinationConfig": {
|
|
"dataBagName": "ssl_certificates"
|
|
}
|
|
}'
|
|
```
|
|
|
|
### Sample response
|
|
|
|
```json Response
|
|
{
|
|
"pkiSync": {
|
|
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
|
"name": "my-chef-cert-sync",
|
|
"description": "an example certificate sync",
|
|
"destination": "chef",
|
|
"isAutoSyncEnabled": true,
|
|
"destinationConfig": {
|
|
"dataBagName": "ssl_certificates"
|
|
},
|
|
"syncOptions": {
|
|
"canRemoveCertificates": true,
|
|
"preserveItemOnRenewal": true,
|
|
"updateExistingCertificates": true,
|
|
"certificateNameSchema": "myapp-{{certificateId}}",
|
|
"includeMetadata": true,
|
|
"encryptDataBag": true
|
|
},
|
|
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
|
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
|
"createdAt": "2023-01-01T00:00:00.000Z",
|
|
"updatedAt": "2023-01-01T00:00:00.000Z"
|
|
}
|
|
}
|
|
```
|
|
</Tab>
|
|
|
|
</Tabs>
|
|
|
|
## Certificate Management
|
|
|
|
Your Chef Certificate Sync will:
|
|
|
|
- **Automatic Deployment**: Deploy certificates in Infisical to Chef data bags.
|
|
- **Certificate Updates**: Update certificates in Chef data bags when renewals occur
|
|
- **Expiration Handling**: Optionally remove expired certificates from Chef data bags (if enabled)
|
|
- **Format Preservation**: Maintain certificate format and metadata during sync operations
|
|
- **Data Bag Encryption**: Support Chef's encrypted data bag functionality for secure storage
|
|
|
|
<Note>
|
|
Chef Certificate Syncs support both automatic and manual
|
|
synchronization modes. When auto-sync is enabled, certificates are
|
|
automatically deployed as they are issued or renewed.
|
|
</Note>
|
|
|
|
## Manual Certificate Sync
|
|
|
|
You can manually trigger certificate synchronization to Chef using the sync certificates functionality. This is useful for:
|
|
|
|
- Initial setup when you have existing certificates to deploy
|
|
- One-time sync of specific certificates
|
|
- Testing certificate sync configurations
|
|
- Force sync after making changes
|
|
|
|
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/chef/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
|
|
|
|
<Note>
|
|
Chef does not support importing certificates back into Infisical
|
|
due to the nature of Chef data bags where certificates are stored as data
|
|
rather than managed certificate objects.
|
|
</Note> |