You often need to handle sensitive data in manifests when using Puppet. Private keys, passwords, etc. There has not been a native way to deal with these and so a cottage industry of community tools have spring up.
To deal with data at rest various Hiera backends like the popular hiera-eyaml exist, to deal with data on nodes a rather interesting solution called binford2k-node_encrypt exist. There are many more but less is more, these are good and widely used.
The problem is data leaks all over the show in Puppet – diffs, logs, reports, catalogs, PuppetDB – it’s not uncommon for this trusted data to show up all over the place. And dealing with this problem is a huge scope issue that will require adjustments to every component – Puppet, Hiera / Lookup, PuppetDB, etc.
But you have to start somewhere and Puppet is the right place, lets look at the first step.
Sensitive[T]
Puppet 4.6.0 introduce – and 4.6.1 fixed – a new data type that decorates other data telling the system it’s sensitive. And this data cannot by accident become logged or leaked since the type will only return a string indicating it’s redacted.
It’s important to note this is step one of a many step process towords having a unified blessed way of dealing with Sensitive data all over. But lets take a quick look at them. The official specification for this feature lives here.
In the most basic case we can see how to make sensitive data, how it looks when logged or leaked by accident:
$secret = Sensitive("My Socrates Note")
notice($secret) |
This prints out the following:
Notice: Scope(Class[main]): Sensitive [value redacted] |
To unwrap this and gain access to the real original data:
$secret = Sensitive(hiera("secret"))
$unwrapped = $secret.unwrap |$sensitive| { $sensitive }
notice("Unwrapped: ${unwrapped}")
$secret.unwrap |$sensitive| { notice("Lambda: ${sensitive}") } |
Here you can see how to assign it unwrapped to a new variable or just use it in a block. Important to note you should never print these values like this and ideally you’d only ever use them inside a lambda if you have to use them in .pp code. Puppet has no concept of private variables so this $unwrapped variable could be accessed from outside of your classes. A lambda scope is temporary and private.
The output of above is:
Notice: Scope(Class[main]): Unwrapped: Too Many Secrets Notice: Scope(Class[main]): Lambda: Too Many Secrets |
So these are the basic operations, you can now of course pass the data around classes.
class mysql (
Sensitive[String] $root_pass
) {
# somehow set the password
}
class{"mysql":
root_pass => Sensitive(hiera("mysql_root"))
} |
Note here you can see the class specifically wants a String that is sensitive and not lets say a Number using the Sensitive[String] markup. And if you attempted to pass Sensitive(1) into it you’d get a type missmatch error.
Conclusion
So this appears to be quite handy, you can see down the line that lookup() might have a eyaml like system and emit Sensitive data directly and perhaps some providers and types will support this. But as I said it’s early days so I doubt this is actually useful yet.
I mentioned how other systems like PuppetDB and so forth also need updates before this is useful and indeed today PuppetDB is oblivious to these types and stores the real values:
$ puppet query 'resources[parameters] { type = "Class" and title = "Test" }' ... { "parameters": { "string": "My Socrates Note" } }, ... |
So this really does not yet serve any purpose but as a step one it’s an interesting look at what will come.
