Release Chef Integration v1.0.0

[stas-schaller]

Summary

This PR adds the Keeper Secrets Manager Chef Integration v1.0.0 to the monorepo, enabling Chef Infra users to securely manage and inject secrets into their infrastructure automation workflows.

What is Chef Infra?

Chef Infra is a powerful automation platform that transforms infrastructure into code. This integration allows Chef-managed nodes to retrieve secrets from Keeper Secrets Manager during Chef runs, eliminating hardcoded credentials and improving security posture.

Integration Components

Chef Cookbook

Location: integration/keeper_secrets_manager_chef/cookbooks/keeper_secrets_manager/
Version: 1.0.0
License: Apache-2.0
Chef Version: >= 16.0

Custom Resources

ksm_install - Installs Keeper Secrets Manager components

• Installs Python SDK and/or CLI tool
• Supports custom installation directories
• Cross-platform (Linux, macOS, Windows)
• Properties: python_sdk, cli_tool, user_install, base_dir

ksm_fetch - Retrieves secrets from Keeper vault

• Uses Keeper Notation for flexible secret mapping
• Supports environment variables, JSON output, and file downloads
• Configurable timeouts and paths
• Properties: input_path, timeout, deploy_path

Recipes

• default - Empty entry point recipe
• install - Installs KSM with default settings
• fetch - Demonstrates secret retrieval

Helper Script

ksm.py - Python wrapper for KSM SDK

• Handles authentication from encrypted data bags, environment variables, or input files
• Supports Keeper Notation for field/file retrieval
• Outputs secrets as environment variables, JSON, or files
• Includes comprehensive error handling

Testing Suite

Unit Tests (RSpec)

• Resource property validation
• Recipe behavior testing
• Platform-specific logic verification

Integration Tests (Test Kitchen + InSpec)

• End-to-end installation testing
• Secret retrieval validation
• Cross-platform compatibility checks

Python Tests (pytest)

• KSM helper script unit tests
• Notation parsing validation
• Error handling verification

Test Script: run_all_tests.sh - Runs all test suites

Publishing Workflow

File: .github/workflows/publish.chefsupermaket.yml

Features

• Manual trigger: workflow_dispatch with publish input
• Build-only mode: Set publish=false to test without publishing
• Inline SBOM generation: Uses Syft v1.18.1 + Manifest CLI v0.18.3
• Security: Explicit least-privilege permissions on all jobs
• Authentication: Retrieves Chef credentials from KSM vault

Workflow Jobs

1. get-version

• Extracts version from metadata.rb
• Outputs version for downstream jobs
• Permissions: contents: read

2. generate-sbom

• Generates SPDX JSON SBOM using Syft
• Publishes to Manifest Cyber
• Archives SBOM artifact
• Permissions: contents: read

3. publish-chef-supermarket (conditional on publish=true)

• Retrieves Chef credentials from KSM
• Configures knife authentication
• Validates version doesn't already exist
• Runs Cookstyle linting
• Runs ChefSpec unit tests
• Publishes to Chef Supermarket
• Permissions: contents: read
• Environment: prod

Authentication Setup

The workflow uses KSM to retrieve Hosted Chef credentials:

KSM Record (UID: b9vSxs5Dn-yJTPYr7Yvfmg):

• login field: Hosted Chef username
• file attachment: keepersecurity.pem (Chef client private key)
• custom field server_url: Chef server URL (e.g., https://api.chef.io/organizations/keeper)

The workflow creates ~/.chef/config.rb with knife authentication and secures the private key with chmod 600.

SBOM Configuration

• Approach: Inline scanning (not using reusable workflow pattern)
• Format: SPDX JSON
• Components Detected: 0 runtime dependencies (expected)
• Reason: Chef cookbook is self-contained with no external runtime dependencies
• Test Dependencies: Excluded from SBOM (pytest, keeper-secrets-manager-core are test-only)

Usage Example

# Install Keeper Secrets Manager
ksm_install 'keeper_setup' do
  python_sdk true
  cli_tool true
  action :install
end

# Fetch secrets from Keeper vault
ksm_fetch 'fetch_app_secrets' do
  input_path '/opt/keeper_secrets_manager/input.json'
  action :run
end

# Use secrets in templates
secrets = lazy { JSON.parse(File.read('/opt/keeper_secrets_manager/keeper_output.txt')) }

template '/etc/myapp/config.yml' do
  source 'config.yml.erb'
  variables(
    db_password: secrets['DB_PASSWORD'],
    api_key: secrets['API_KEY']
  )
  sensitive true
end

Documentation

• Cookbook README: integration/keeper_secrets_manager_chef/cookbooks/keeper_secrets_manager/README.md
• Parent README: integration/keeper_secrets_manager_chef/cookbooks/README.md
• Changelog: integration/keeper_secrets_manager_chef/cookbooks/keeper_secrets_manager/CHANGELOG.md

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pytest-mock@​3.15.1

View full report