Debugging hiera Eyaml encryption, decryption failed
When Hiera works without any problems everything is fine. But when not
it is quite hard to debug why it is not working. Here is a troubleshooting
list for Hiera when used with hiera-eyaml-gpg.
hiera-eyaml-gpg Decryption failed
First check your GPG key listgpg --list-keys --homedir=<.gnupg dir>Check that at least one of the keys listed is in the recipients you use for decrypting. The recipients you used are either listed in your Hiera/Eyaml config file or in a file referenced from there. To verify what you active config is run eyaml in tracing mode. Note that the "-t" option is only available in newer Eyaml versions (e.g. 2.0.5):
eyaml decrypt -v -t -f somefile.yamlTrace output
[hiera-eyaml-core] (Symbol) trace_given = (TrueClass) true [hiera-eyaml-core] (Symbol) gpg_always_trust = (FalseClass) false [hiera-eyaml-core] (Symbol) trace = (TrueClass) true [hiera-eyaml-core] (Symbol) encrypt_method = (String) pkcs7 [hiera-eyaml-core] (Symbol) gpg_gnupghome = (String) /etc/hiera/.gnupg [hiera-eyaml-core] (Symbol) pkcs7_private_key = (String) ./keys/private_key.pkcs7.pem [hiera-eyaml-core] (Symbol) version = (FalseClass) false [hiera-eyaml-core] (Symbol) gpg_gnupghome_given = (TrueClass) true [hiera-eyaml-core] (Symbol) help = (FalseClass) false [hiera-eyaml-core] (Symbol) quiet = (FalseClass) false [hiera-eyaml-core] (Symbol) gpg_recipients_file = (String) ./gpg_recipients [hiera-eyaml-core] (Symbol) string = (NilClass) [hiera-eyaml-core] (Symbol) file_given = (TrueClass) trueAlternatively try manually enforcing recipients and .gnupg location to make it work.
eyaml decrypt -v -t -f somefile.yaml --gpg-recipients-file=<recipients> --gpg-gnupghome=<.gnupg dir>If it works manually you might want to add the keys ":gpg-recipients-file:" to hiera.yaml and ensure that the mandatory key ":gpg-gnupghome:" is correct.
Checking Necessary Gems
hiera-eyaml-gpg can be run with different GPG-libraries depending on the version you run. Check dependencies on Github. A possible stack is the followinggem list [...] gpgme (2.0.5) hiera (1.3.2) hiera-eyaml (2.0.1) hiera-eyaml-gpg (0.4) [...]The GEM gpgme additionally needs the C library
dpkg -l "*gpg*" ||/ Name Version Beschreibung +++-===================-===================-====================================================== ii libgpgme11 1.2.0-1.2+deb6u1 GPGME - GnuPG Made Easy
Using Correct Ruby Version
Another pitfall is running multiple Ruby versions. Ensure to install the GEMs into the correct one. One Debian consider using "ruby-switch" or manually running "update-alternatives" for "gem" and "ruby".Ruby Switch
apt-get install ruby-switch ruby-switch --set ruby1.9.1
update-alternatives
# Print available versions update-alternatives --list ruby update-alternatives --list gem # Show current config update-alternatives --display ruby update-alternatives --display gem # If necessary change it update-alternatives --set ruby /usr/bin/ruby1.9.1 update-alternatives --set gem /usr/bin/gem1.9.1See also