Jira (PUP-10612) Wrap values in Sensitive in eyaml_lookup_key

[Tomáš Virtus]

Title: Message Title

Tomáš Virtus created an issue   Puppet / PUP-10612 Wrap values in Sensitive in eyaml_lookup_key Issue Type: New Feature Assignee: Unassigned Components: Functions, Hiera & Lookup Created: 2020/08/07 3:20 PM Priority: Normal Reporter: Tomáš Virtus Values looked up with eyaml_lookup_key are returned as strings. This reveals them in console, reports, etc. To prevent this the values should be wrapped in Sensitive type. Currently automatic lookup files when class parameter is of type Sensitive[String] and value looked up is of type String. This leads people to suggest manually converting each sensitive value to Sensitive type via lookup_options: https://blog.example42.com/2019/04/04/puppet_sensitive_data/ https://puppet.com/blog/my-journey-securing-sensitive-data-puppet-code/ lookup_options: '^profile::.+::sensitive_\w+$': convert_to: 'Sensitive' While this kind of does the job, it's fragile and repetitious. While I can imagine use case where someone would want encrypted values revealed in diffs, I'd guess that for most use-cases the value looked up by eyaml_lookup_key should be wrapped in Sensitive. I've managed to hack together the following function in my environment to do it: Puppet::Functions.create_function(:eyaml_lookup_key_sensitive) do def eyaml_lookup_key_sensitive(key, options, context) cleartext = call_function('eyaml_lookup_key', key, options, context) Puppet::Pops::Types::PSensitiveType::Sensitive.new(cleartext) end end But this would be better done in eyaml_lookup_key.rb to directly store wrapped values into the cache. In order to not break backward compatibility the opt-in could be stored in options hash as e.g. convert_to_sensitive boolean option. To make it fancier, the values of this opt-in could be: none: current behaviour encrypted: only wrap encrypted values all: wrap all values Another option would be to make Puppet automatically convert String to Sensitive[String] to make automatic class parameter lookup work. This will however still reveal values in e.g. puppet lookup.   Add Comment   This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.368657.1596838844000.11781.1596838860350%40Atlassian.JIRA.