Jira (PUP-9692) hiera explain should redact values converted to Sensitive in --debug mode

[Josh Cooper (Jira)]

Title: Message Title

Josh Cooper updated an issue   Puppet / PUP-9692 hiera explain should redact values converted to Sensitive in --debug mode Change By: Josh Cooper When using hiera's convert_to Sensitive, the explain output that is turned on by --debug will include the clear text looked up value as the explainer traces the lookup. Later this value is converted to Sensitive. The desire is that such values would be redacted in the log. *Original Text* Problem 1: When puppet agent is run with --debug option, passwords get logged in plain-text, although the passwords are stored encrypted in the yaml. Example: 2019-05-03 15:58:36 -0700 Puppet (debug): Lookup of 'my_con_pwd' Searching for "my_con_pwd" Global Data Provider (hiera configuration version 3) Using configuration "/home/tstuser/puppet/hiera.yaml" Hierarchy entry "eyaml" Path "/home/tstuser/puppet/production/data/defaults.yaml" Original path: "defaults" No such key: "my_con_pwd" Path "/home/tstuser/puppet/production/data/my_prod_config.yaml" Original path: "my_prod_config." Found key: "my_con_pwd" value: "MyT3stP" The password is not redacted even if lookup_options is added for this data, with convert_to: Sensitive -- The lookup_options is set in common.yaml like: lookup_options: "^*my_con_pwd": convert_to: - "Sensitive" Puppet seems to detect that this data is sensitive,  because it displays the following message after the lookup: Applying convert_to lookup_option with arguments [Sensitive] But the value is not redacted, as shown in the log snippet. Problem 2: If lookup_option is configured as shown above but this data is interpolated for another setting in a list, like: my_env_list:   db_settings:      db_pwd: "%\{hiera('my_con_pwd')}" then the following error occurs: 2019-05-03 16:11:26 -0700 Puppet (err): Evaluation Error: Error while evaluating a Function Call, Lookup of key failed: The convert_to lookup_option for key 'my_con_pwd' raised error: undefined method `call_function' for #<Hiera::Scope:0x0000000003a1cab8> Please let me know if there is any other way to redact passwords when --debug is used. Although this occurs only when --debug is passed, it is not acceptable security practice. Add Comment   This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.307422.1556927311000.154257.1614628680151%40Atlassian.JIRA.