Jira (PUP-8947) Automatically cast to Sensitive when returning a string to a lookup for a Sensitive type

[Gene Liverman (JIRA)]

Title: Message Title

Gene Liverman created an issue   Puppet / PUP-8947 Automatically cast to Sensitive when returning a string to a lookup for a Sensitive type Issue Type: Improvement Assignee: Unassigned Created: 2018/06/15 6:29 AM Priority: Normal Reporter: Gene Liverman It seems that when doing a hiera lookup for a class parameter that is of type Sensitive that the string being returned should automatically be cast to Sensitive. The use case here is that I store sensitive data in hiera encrypted in eyaml. I have corresponding profiles that have class parameters defined like so: class profile::some_profile ( Sensitive[String[1]] $some_sensitive_value, ) { # puppet code here } It is currently a significant amount of extra work to mark each hiera entry that is already encrypted as Sensitive; it actually quadruples the number of lines of data in a given yaml file for the first entry and triples it for all subsequent entries because, as of now, you must do this to mark the value as Sensitive: --- lookup_options: profile::some_profile::some_sensitive_value: convert_to: "Sensitive"   profile::some_profile::some_sensitive_value: ENC[PKCS7,encrypted_value_here]   As a bonus, I think it would be ideal if all eyaml encrypted values were returned as Sensitive automatically, regardless of how they were looked up. I have proposed this idea in PUP-8946. That ticket does not negate this one as someone may have unencrypted values in hiera that they still want use for Sensitive class parameters and the like. Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.