Allow to force reencryption of keys during refresh

[kamaradclimber]

During a refresh operation, speed optimization lead to avoid
re-encrypting symetrical key for each existing clients.

This lead to issues when clients change their chef key.

This patch adds an option --skip-reencryption to workaround that for
users having such behavior.

Fix #286

Change-Id: I0ffa71934d29198fa71aa6e1a9630ad302e21f6a
Signed-off-by: Grégoire Seux g.seux@criteo.com

[krzkowalczyk]

@kamaradclimber thanks for the path
The knife command in exception message in /lib/chef-vault/item.rb

rescue OpenSSL::PKey::RSAError raise ChefVault::Exceptions::SecretDecryption, "#{data_bag}/#{id} is encrypted for you, but your private key failed to decrypt the contents. "\ "(if you regenerated your client key, have an administrator of the vault run 'knife vault refresh')" end

Should be updated as well, to include new parameter

[whiteley]

Usage of --bootstrap-vault-[file, item, json] is also broken by #269 in cases where you are recreating a client despite answering yes to the Node/Client exists messages.

The proposed solution of --force-reencryption for the CLI will not fix this type of failure without also updating https://github.com/chef/chef/blob/master/lib/chef/knife/bootstrap/chef_vault_handler.rb to supply the force_reencryption option.

I'm all for the speedup provided by not re-encrypting all clients unnecessarily but knife bootstrap should be a first class usage pattern from the chef client. It seems to me that during bootstrap force_reencryption could be provided in all cases. It is only acting on the single client being bootstrapped so the speed concern isn't an issue and reusing the client isn't supported.

The difficulty here is that requires a change in https://github.com/chef/chef and this workflow is broken until these both are updated.

[kamaradclimber]

updated the patch to transform the option to --skip-reencryption (false by default) to restore the old behavior while enabling users to improve their performance

[thommay]

The cucumber tests are pretty unhappy, but other than that I think this is 👍

[thommay]

@kamaradclimber i think this is good to go, but please check that my change makes sense.

[kamaradclimber]

Ok for me