Skip to content

Commit 7717c46

Browse files
committed
Implement a sensitive param for postgresql_psql
1 parent ef76e63 commit 7717c46

File tree

3 files changed

+14
-8
lines changed

3 files changed

+14
-8
lines changed

lib/puppet/provider/postgresql_psql/ruby.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,8 @@ def run_command(command, user, group, environment)
6262
failonfail: false,
6363
combine: true,
6464
override_locale: true,
65-
custom_environment: environment)
65+
custom_environment: environment,
66+
sensitive: resource[:sensitive] == :true)
6667
[output, $CHILD_STATUS.dup]
6768
end
6869
end

lib/puppet/type/postgresql_psql.rb

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,13 @@ def matches(value)
124124
newvalues(:true, :false)
125125
end
126126

127+
newparam(:sensitive, boolean: true) do
128+
desc "If 'true', then the executed command will not be echoed into the log. Use this to protect sensitive information passing through."
129+
130+
defaultto(:false)
131+
newvalues(:true, :false)
132+
end
133+
127134
autorequire(:class) { ['Postgresql::Server::Service'] }
128135

129136
def should_run_sql(refreshing = false)

manifests/server/role.pp

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
# @param update_password If set to true, updates the password on changes. Set this to false to not modify the role's password after creation.
44
# @param password_hash Sets the hash to use during password creation.
55
# @param createdb Specifies whether to grant the ability to create new databases with this role.
6-
# @param createrole Specifies whether to grant the ability to create new roles with this role.
7-
# @param db Database used to connect to.
6+
# @param createrole Specifies whether to grant the ability to create new roles with this role.
7+
# @param db Database used to connect to.
88
# @param port Port to use when connecting.
99
# @param login Specifies whether to grant login capability for the new role.
1010
# @param inherit Specifies whether to grant inherit capability for the new role.
@@ -76,18 +76,16 @@
7676
$superuser_sql = $superuser ? { true => 'SUPERUSER', default => 'NOSUPERUSER' }
7777
$replication_sql = $replication ? { true => 'REPLICATION', default => '' }
7878
if ($password_hash != false) {
79-
$environment = "NEWPGPASSWD=${password_hash}"
80-
$password_sql = "ENCRYPTED PASSWORD '\$NEWPGPASSWD'"
79+
$password_sql = "ENCRYPTED PASSWORD '${password_hash}'"
8180
} else {
8281
$password_sql = ''
83-
$environment = []
8482
}
8583

8684
postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****":
8785
command => "CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}",
8886
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'",
89-
environment => $environment,
9087
require => undef,
88+
sensitive => true,
9189
}
9290

9391
postgresql_psql { "ALTER ROLE \"${username}\" ${superuser_sql}":
@@ -136,7 +134,7 @@
136134
postgresql_psql { "ALTER ROLE ${username} ENCRYPTED PASSWORD ****":
137135
command => "ALTER ROLE \"${username}\" ${password_sql}",
138136
unless => "SELECT 1 FROM pg_shadow WHERE usename = '${username}' AND passwd = '${pwd_hash_sql}'",
139-
environment => $environment,
137+
sensitive => true,
140138
}
141139
}
142140
} else {

0 commit comments

Comments
 (0)