Using hiera-eyaml-gpg with Vagrant

[Amos S]

Hello,

I'm introducing hiera-eyaml-gpg to our workflow and hit a snag.

I configured hiera like this:

---

:backends:

    - eyaml

:eyaml:

    :datadir: '/etc/puppet/hieradata'

    :extension: 'yaml'

    :gpg_gnupghome: /vagrant/keyrings/live

:hierarchy:

    - "fqdn/%{fqdn}"

    - "os/%{osfamily}"

    - common

:logger: console

And I manage to get Vagrant to execute puppet with eyaml inside the Vagrant box and eyaml finds the hiera data, but it fails on access my private key inside the Vagrant box.

I managed to setup gpg-agent on the host, and found that more recent versions of OpenSSH support UNIX-domain socket forwarding (http://superuser.com/a/884602/27453).

My question now is:

1. How do others manage to use eyaml inside Vagrant?

2. If forwarding gpg-agent is the way to go, is there any Vagrant configuration trick to set it up automatically? I didn't find anything about this in https://docs.vagrantup.com/v2/vagrantfile/ssh_settings.html

3. Should I instead import my private gpg key into the Vagrant box using a shell provisioner?

Thanks.

[Amos S]

I managed to get it working by copying over my private key from my personal ~/.gnupg/secring.gpg to under the Vagrant directory then removing the passphrase protecting the copy.

This way, Hiera eyaml inside the Vagrant boxes can use my private key to decrypt the secrets without prompting me for a passphrase.

I can provide the couple of scripts I wrote to do that.

I'm still curios to hear how others have solved this.