Skip to content

fix switching from sparse keys to default #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
justintsteele wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix switching from sparse keys to default #461

justintsteele wants to merge 1 commit into from

Conversation

@justintsteele
Copy link

@justintsteele justintsteele commented Jan 6, 2026

When switching from sparse keys to default keys, the default keys never get updated and the sparse keys never get deleted rendering the vault inaccessible.

Description

As a means of example, beginning with a vault in default keys mode, everything is as expected:

irb(main):133> Chef::DataBagItem.load("test_vault", "test_val_keys").raw_data
=>
{"id"=>"test_val_keys",
 "admins"=>["jtsteele"],
 "clients"=>[],
 "search_query"=>[],
 "mode"=>"default",
 "jtsteele"=> "==redacted key==\n"}
irb(main):134> Chef::DataBagItem.load("test_vault", "test_val_key_jtsteele").raw_data
/opt/chef-workstation/embedded/lib/ruby/3.1.0/net/http/response.rb:142:in `error!': 404 "Object Not Found" (Net::HTTPClientException)

If we then switch to sparse keys mode, everything is still as expected:

irb(main):137> Chef::DataBagItem.load("test_vault", "test_val_keys").raw_data
=> {"id"=>"test_val_keys", "admins"=>["jtsteele"], "clients"=>[], "search_query"=>[], "mode"=>"sparse"}
irb(main):138> Chef::DataBagItem.load("test_vault", "test_val_key_jtsteele").raw_data
=>
{"id"=>"test_val_key_jtsteele",
 "jtsteele"=> "==new redacted key==\n"}

If we switch back to default keys mode, without this fix, we get the following:

irb(main):139> Chef::DataBagItem.load("test_vault", "test_val_keys").raw_data
=> {"id"=>"test_val_keys", "admins"=>["jtsteele"], "clients"=>[], "search_query"=>[], "mode"=>"default"}
irb(main):140> Chef::DataBagItem.load("test_vault", "test_val_key_jtsteele").raw_data
=>
{"id"=>"test_val_key_jtsteele",
 "jtsteele"=> "==yet another new redacted key==\n"}

and probably most importantly:

> knife vault show test_vault test_val
ERROR: ChefVault::Exceptions::SecretDecryption: test_vault/test_val is not encrypted with your public key.  Contact an administrator of the vault item to encrypt for you!

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

  • I have read the CONTRIBUTING document.
  • I have run the pre-merge tests locally and they pass.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
  • All new and existing tests passed.
  • All commits have been signed-off for the Developer Certificate of Origin.

@justintsteele justintsteele requested review from a team as code owners January 6, 2026 16:21
@justintsteele justintsteele force-pushed the jtsteele/sparse_keys_fix branch from ac425d8 to 2675f68 Compare January 7, 2026 16:18
@sonarqubecloud
Copy link

sonarqubecloud bot commented Jan 7, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@justintsteele