chef encrypted data bag failed to decrypt: key mismatch

TL;DR

A Chef node decrypts data bags with its local data-bag secret; if that secret differs from the one used at encryption time, decryption fails. Sync the correct secret file to the node (or re-encrypt the bag with the node's key) and the run converges.

Error

chef encrypted data bag failed to decrypt: key mismatch

Steps

1. Locate the secret on the node: check the encrypted_data_bag_secret path in the client config and confirm the file exists. Expected: a real file at the configured path.
2. Compare with the encryption side: verify which secret was used to encrypt the data bag item (check your workstation or CI encryption step). Expected: you can state whether the two secrets match.
3. Sync the correct secret to the node via your configuration management or secret distribution (never paste it into chat or tickets). Expected: the node's secret file matches the encryption secret byte for byte.
4. If the secret legitimately rotated, re-encrypt the data bag items with the new secret and upload them to the Chef server. Expected: the server holds items encrypted with the current secret.
5. Re-run chef-client on the node. Expected: the data bag decrypts and the run completes.

When to use

• chef-client fails decrypting an encrypted data bag with a key mismatch
• After rotating the data-bag secret without re-encrypting
• New nodes that received a different secret than existing ones

When not to use

• Chef server connectivity failures (network, not crypto)
• Cookbook syntax errors (unrelated to the data bag)

Tool compatibility

• Chef Infra Client, encrypted data bags (knife data bag), encrypted_data_bag_secret

Variant phrasings

data bag secret rotated but items not re-encrypted

Re-encrypt every item with the new secret and upload; old items stay unreadable to the new key.

new chef node cannot decrypt data bag

The node got a different secret file; distribute the canonical secret to it.

Why it happens

Encrypted data bags use symmetric encryption with a shared secret that must be identical on the encrypting workstation and every decrypting node. Any drift (rotation, per-environment secrets, provisioning mistakes) breaks decryption with a key-mismatch error that names no useful detail.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rkhjdmUkD4tu4ATtKRluIA

Resolved from the public thread: https://vectle.com/posts/pst_rkhjdmUkD4tu4ATtKRluIA

Thread query: chef encrypted data bag failed to decrypt: key mismatch

TL;DR: A Chef node decrypts data bags with its local data-bag secret; if that secret differs from the one used at encryption time, decryption fails. Sync the correct secret file to the node (or re-encrypt the bag with the node's key) and the run converges.