Azure Key Vault Chef Cookbook

Question

I am a noobie with coding but am learning. I was hoping someone can help look at this ruby code that I found online that helps to get a secret from an Azure Key vault. I will paste it below. I just need help clarifying what each block of code is referring to.

Not sure what the below code is referring to. I know they are attributes but how do they work?

node.default['azurespn']['client_id'] = azurespn[node.environment]['client_id']
node.default['azurespn']['tenant_id'] = azurespn[node.environment]['tenant_id']
node.default['azurespn']['client_secret'] = azurespn[node.environment]['client_secret']

Recipe:

# retrieve the secret stored in azure key vault using this chef recipe
 include_recipe 'microsoft_azure'
 azurespn = data_bag_item('azurespn', 'azurespnenv')
 node.default['azurespn']['client_id'] = azurespn[node.environment]['client_id']
 node.default['azurespn']['tenant_id'] = azurespn[node.environment]['tenant_id']
 node.default['azurespn']['client_secret'] = azurespn[node.environment]['client_secret']
 spn = {
 'tenant_id' => "#{node['azurespn']['tenant_id']}",
 'client_id' => "#{node['azurespn']['client_id']}",
 'secret' => "#{node['azurespn']['client_secret']}"
 }
 secret = vault_secret("#{node['windowsnode']['vault_name']}", "#{node['windowsnode'] 
['secret']}", spn)
 file 'c:/jenkins/secret' do
 action :create
 content "#{secret}"
 rights :full_control, 'Administrators', :one_level_deep => true
 end
 Chef::Log.info("secret is '#{secret}' ")

Answer 1

Q. Not sure what the below code is referring to. I know they are attributes but how do they work?

As you understood, this block of code is setting some node attributes. The value of these attributes is being read from a data bag (in the line above), ie azurespn = data_bag_item('azurespn', 'azurespnenv')

Now azurespn variable contains the contents of the data bag item azurespnenv . For better understanding, try knife data bag show azurespn azurespnenv . I created a dummy data bag structure just to illustrate.

dev:
  client_id:     win10
  client_secret: topsecret
  tenant_id:     testtenant
qa:
  client_id:     ubuntu
  client_secret: changeme
  tenant_id:     footenant
id:       azurespnenv

In this data bag, we have two environments - dev and qa .

Let's take 1 line for example:

node.default['azurespn']['client_id'] = azurespn[node.environment]['client_id']

So the azurespn[node.environment]['client_id'] will pick up the appropriate client_id based on the Chef environment of that node. Which translates to:

node.default['azurespn']['client_id'] = azurespn['dev']['client_id']
#=> 'win10'
node.default['azurespn']['client_id'] = azurespn['qa']['client_id']
#=> 'ubuntu'