能否将节点对象设为Chef Vault管理员？刷新权限异常求助

Great question—yes, node objects (which are just Chef client objects under the hood) can be added as Chef Vault admins, but your error is rooted in missing Chef Server ACL permissions, not a problem with the vault's admin list configuration. Let's walk through what's going on and how to fix it.

Why You're Seeing the "missing update permission" Error #

Your knife data bag show output confirms the node nithin-desktop.nithinsworld.com is listed in the vault's admins field, which is correct. However, Chef Vault relies on Chef Server's Access Control Lists (ACLs) to enforce permissions for underlying data bag operations. Even if a client is in the vault's admins list, it still needs explicit update permissions on the vault's data bags (and their items) to run knife vault refresh.

Step-by-Step Fix #

1. Verify Current Permissions
   First, check what permissions the node client has on the vault's data bag:

   knife acl show data bags/nithin_test1
   

   Look for the clients section—you'll likely see that nithin-desktop.nithinsworld.com doesn't have the update permission listed.

2. Add Required ACL Permissions
   Chef Vault uses two data bag items for each secret: the encrypted secret itself (db-secrets) and the keys that unlock it (db-secrets_keys). You need to grant update permissions for both, plus the parent data bag:

   # Grant update access to the parent data bag
   knife acl add data bags/nithin_test1 clients nithin-desktop.nithinsworld.com update
   
   # Grant update access to the secret item
   knife acl add data bags/nithin_test1/db-secrets clients nithin-desktop.nithinsworld.com update
   
   # Grant update access to the keys item
   knife acl add data bags/nithin_test1/db-secrets_keys clients nithin-desktop.nithinsworld.com update
   

3. Validate the Fix
   Re-run your knife vault refresh command from the node:

   sudo knife vault refresh nithin_test1 db-secrets -M client -c /etc/chef/client.rb -V
   

   It should now complete successfully, as the node client has the necessary permissions to update the vault data bags.

Key Notes #

• The vault's admins list controls who can manage vault membership (adding/removing clients) and trigger refreshes, but it doesn't bypass Chef Server's core ACL system. You need both the vault admin assignment and the corresponding Server permissions.
• When running commands as the node client, ensure you're using the correct client.rb and associated PEM file (your command already specifies -c /etc/chef/client.rb, which is the right approach for a node).

内容的提问来源于stack exchange，提问作者nithin sunny