Today we released cookbook-omnibus-gitlab 0.1.2 to address an issue where encrypted secrets were stored in plaintext on the Chef Server.
Update 2014-10-09: fix incorrect post date.
Cookbook-omnibus-gitlab is a Chef cookbook to install GitLab using Omnibus packages.
Cookbook-omnibus-gitlab allows you to keep secret Omnibus-gitLab settings (passwords, keys) in an encrypted data bag. These secrets then get decrypted during the Chef client run on your GitLab server. Due to a programming error, the cookbook-omnibus-gitlab would then send the plaintext secrets back to the Chef server to be stored in the node's database record. This defeats one of the purposes of using encrypted data bags, namely to keep plaintext secrets off of the Chef server.
In version 0.1.2 we make sure that the secrets stored in the encrypted data bag do not get sent back to the server.
Cookbook-omnibus-gitlab 0.1.1 and older.
Cookbook-omnibus-gitlab 0.1.2 and newer.
Diagnosis and fixes
If you have been using cookbook-omnibus-gitlab with an encrypted data bag you should upgrade to cookbook-omnibus-gitlab 0.1.2 or newer and inspect your GitLab nodes to look for secrets:
knife node show gitlab.example.com --format json
If some of your cookbook-omnibus-gitlab secrets got uploaded to the Chef server
you can delete them from the node object using
knife node edit
gitlab.example.com after you upgrade cookbook-omnibus-gitlab to 0.1.2 or
As an additional measure you may want to consider changing the affected passwords and keys.