Jira (PUP-7205) Backport Hiera 5 eyaml support to Puppet 4.9.x

John Duarte (JIRA) Mon, 06 Mar 2017 11:17:30 -0800

Title: Message Title

John Duarte commented on

PUP-7205

This has passed manual validation on RedHat 7 using puppet-agent at SHA b3e54a4 containing puppet at SHA 5e33d5f3c.

Steps to re-create

Install puppet-agent and puppetserver

This was done with the puppet/acceptance ci:test:aio rake task

SHA=b3e54a4178c32619e968f614123fcf4f6d8c266f SUITE_VERSION=1.9.2.33.gb3e54a4 TEST_TARGET=ubuntu1404-64a OPTIONS='--preserve-hosts=always' be rake ci:test:aio TESTS=tests/lookup

Install eyaml on master

/opt/puppetlabs/puppet/bin/gem install hiera-eyaml

/opt/puppetlabs/bin/puppetserver gem install hiera-eyaml

Create production hiera config

Create a hiera.yaml file for the production environment using eyaml as per the documentation found at the following:
https://docs.puppet.com/puppet/4.9/hiera_config_yaml_5.html
https://docs.puppet.com/puppet/4.9/hiera_config_yaml_5.html#configuring-a-hierarchy-level-hiera-eyaml

cat >> /etc/puppetlabs/code/environments/production/hiera.yaml <<EOF

---

version: 5

defaults:

  datadir: data

  data_hash: yaml_data

hierarchy:

  - name: "Encrypted data using eyaml backend"

    path: "secure.yaml"

    lookup_key: eyaml_lookup_key

    options:

        pkcs7_private_key: "/etc/puppetlabs/puppet/keys/private_key.pkcs7.pem"

        pkcs7_public_key: "/etc/puppetlabs/puppet/keys/public_key.pkcs7.pem"

  - name: "Per-node data"

    path: "{%fqdn}.yaml"

  - name: "Other"

    path: "common.yaml"

EOF

Create hiera data

Create data directory

mkdir /etc/puppetlabs/code/environments/production/data

Encrypt a value using eyaml

/opt/puppetlabs/puppet/bin/eyaml encrypt --pkcs7-private-key=/etc/puppetlabs/puppet/keys/private_key.pkcs7.pem  --pkcs7-public-key=/etc/puppetlabs/puppet/keys/public_key.pkcs7.pem  -s 'bar'

The above command produced the following in this instance. The encrypted data will be inserted into the data file.

string: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEANBVkCNlEMcD5kTWLQ+aLONe72H3FfNMj2YrI+gF7ZfdfGc0qzgaF3elRag4IXDmv6X5cKnnizuciSIWJcv59UBraS5auKISywGG6MlUSOHEkfFj6YFKbTZkmseasxQDbN3giVMaVhnWcyGyewLR9AyjeeBPVTaUi7a7pK6kCc0dA3c9EmT0240KC8DzssIDUTIIh+LR0SX2DoT/zx91Bq2l2llL5ostNeaxqQOctese7BucgkN3bKXfrelI76TLhtLsv18VMvvSO3Jl3ZOi8/THc4jAKPQIkiiJUMBD+YP/i0t6PrWusp4O+sDhoJ0aQ9PGGF1sh7N0aP2I40wxSQDA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAuqEVvLPPWh7WnjnyIWyZ3gBBq1s37dC1LPc2JiVecOB+h]

OR

block: >

    ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEw

    DQYJKoZIhvcNAQEBBQAEggEANBVkCNlEMcD5kTWLQ+aLONe72H3FfNMj2YrI

    +gF7ZfdfGc0qzgaF3elRag4IXDmv6X5cKnnizuciSIWJcv59UBraS5auKISy

    wGG6MlUSOHEkfFj6YFKbTZkmseasxQDbN3giVMaVhnWcyGyewLR9AyjeeBPV

    TaUi7a7pK6kCc0dA3c9EmT0240KC8DzssIDUTIIh+LR0SX2DoT/zx91Bq2l2

    llL5ostNeaxqQOctese7BucgkN3bKXfrelI76TLhtLsv18VMvvSO3Jl3ZOi8

    /THc4jAKPQIkiiJUMBD+YP/i0t6PrWusp4O+sDhoJ0aQ9PGGF1sh7N0aP2I4

    0wxSQDA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAuqEVvLPPWh7WnjnyI

    WyZ3gBBq1s37dC1LPc2JiVecOB+h]

Create data file

cat >> /etc/puppetlabs/code/environments/production/data/secure.yaml <<EOF

---

encrypted_test:

    "%{hiera('encrypted_yaml')}": {}

unencrypted_yaml: foo

encrypted_yaml: >

    ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEw

    DQYJKoZIhvcNAQEBBQAEggEANBVkCNlEMcD5kTWLQ+aLONe72H3FfNMj2YrI

    +gF7ZfdfGc0qzgaF3elRag4IXDmv6X5cKnnizuciSIWJcv59UBraS5auKISy

    wGG6MlUSOHEkfFj6YFKbTZkmseasxQDbN3giVMaVhnWcyGyewLR9AyjeeBPV

    TaUi7a7pK6kCc0dA3c9EmT0240KC8DzssIDUTIIh+LR0SX2DoT/zx91Bq2l2

    llL5ostNeaxqQOctese7BucgkN3bKXfrelI76TLhtLsv18VMvvSO3Jl3ZOi8

    /THc4jAKPQIkiiJUMBD+YP/i0t6PrWusp4O+sDhoJ0aQ9PGGF1sh7N0aP2I4

    0wxSQDA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAuqEVvLPPWh7WnjnyI

    WyZ3gBBq1s37dC1LPc2JiVecOB+h]

EOF

Verify eyaml lookup with hiera 5 config

Verify encrypted lookup

# puppet lookup encrypted_yaml

--- bar

...

Verify encrypted interpolated lookup

# puppet lookup encrypted_test

---

bar: {}

Verify unencrypted lookup

# puppet lookup unencrypted_yaml

--- foo

...

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.