Jira (PUP-8971) Agent Functions - Add encrypt/decrypt functions

[Henrik Lindberg (JIRA)]

Title: Message Title

Henrik Lindberg created an issue   Puppet / PUP-8971 Agent Functions - Add encrypt/decrypt functions Issue Type: New Feature Assignee: Henrik Lindberg Created: 2018/06/28 10:03 AM Fix Versions: PUP 5.5.z Priority: Normal Reporter: Henrik Lindberg For users that do not use a separate secrets server (yet) but want to improve the security of their puppet installation it is of value to provide the ability to encrypt data so it can only be read by the node the catalog is compiled for. The pattern is to call encrypt when compiling a catalog, and to call decrypt using a Deferred. Example usage: some_class(Sensitive $password) { some_resource { 'example': password => Deferred('decrypt', encrypt($password)) } } It may be of value to let encrypt always return a Sensitive to relieve the user of having to always wrap the result (if the source value is not already Sensitive). The encrypt should encrypt based on the certificate of the node for which the compilation is running. The decrypt is always for the localhost that is applying the catalog. Thus, it is not possible to decrypt a value that is encrypted for the agent node while compiling. (If that is a valid use case, the decrypt needs to take an argument indicating if it is for the node or for localhost. The two functions should work on any rich data type to enable sending encrypted rich data (hash, array, a sensitive value, etc). Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.