Use Puppet-Datatype Sensitive for Passwords #1279

cocker-cc · 2021-06-12T21:34:22Z

add Parameter "sensitive" to Function postgresql_password to decide if its Returnvalue should be of Datatype Sensitive
let defined Type postgresql::server::role accept Datatype Sensitive for $password_hash
let defined Type postgresql::server::db accept Datatype Sensitive for $password
let Class postgresql::server accept Datatype Sensitive for $postgres_password
let defined Type postgresql::validate_db_connection accept Sensitive for $database_password

puppet-community-rangefinder · 2021-06-12T21:34:44Z

postgresql::postgresql_password is a function

Breaking changes to this file WILL impact these 8 modules (exact match):

Breaking changes to this file MAY impact these 1 modules (near match):

icinga-icinga

postgresql::server is a class

Breaking changes to this file WILL impact these 38 modules (exact match):

Breaking changes to this file MAY impact these 15 modules (near match):

postgresql::server::db is a type

Breaking changes to this file WILL impact these 37 modules (exact match):

Breaking changes to this file MAY impact these 16 modules (near match):

postgresql::server::passwd is a class

that may have no external impact to Forge modules.

postgresql::server::role is a type

Breaking changes to this file WILL impact these 20 modules (exact match):

Breaking changes to this file MAY impact these 5 modules (near match):

postgresql::validate_db_connection is a type

Breaking changes to this file WILL impact these 3 modules (exact match):

Breaking changes to this file MAY impact these 2 modules (near match):

This module is declared in 71 of 576 indexed public `Puppetfiles`.

These results were generated with Rangefinder, a tool that helps predict the downstream impact of breaking changes to elements used in Puppet modules. You can run this on the command line to get a full report.

Exact matches are those that we can positively identify via namespace and the declaring modules' metadata. Non-namespaced items, such as Puppet 3.x functions, will always be reported as near matches only.

.puppet-lint.rc

lib/puppet/functions/postgresql/postgresql_password.rb

manifests/server/passwd.pp

ekohl · 2021-06-21T13:33:00Z

manifests/server.pp

@@ -83,7 +83,7 @@
 # @param extra_systemd_config Adds extra config to systemd config file, can for instance be used to add extra openfiles. This can be a multi line string
 #
 class postgresql::server (
-  $postgres_password                               = undef,
+  Optional[Variant[String, Sensitive[String]]] $postgres_password = undef,


Just thinking about compatibility here: could a user specify an integer password?

You mean Compatibility to postgresql::postgresql_password?

required_param 'Variant[String[1], Sensitive[String[1]], Integer]', :password

I don't see Integer as valid there neither.

Due to other work I didn't have time to look into this for a while. How is it not valid?

In my Understanding a Password is a String, not an Integer. But anyway, I adapted your Suggestion:

Optional[Variant[String[1], Sensitive[String[1]], Integer]] $postgres_password = undef,

Just for your understanding, you can have a numeric password and if you don't quote it in YAML (with Hiera for example) it becomes Integer. I agree it's not that likely, but it can happen and we should be consistent.

ekohl

Given what we've seen in theforeman/foreman, I think a function stdlib::unwrap_sensitive may actually make sense, given how common it is that you need to unwrap something. What do you think?

cocker-cc · 2021-06-23T10:42:30Z

Given what we've seen in theforeman/foreman, I think a function stdlib::unwrap_sensitive may actually make sense, given how common it is that you need to unwrap something. What do you think?

I have this PR pending. If and when this is accepted, your suggested Function is not needed anymore. Perhaps You could vote for this PR.

david22swan · 2021-08-02T11:36:42Z

@ekohl Now that the associated pr has been merged what are your thoughts on this?
Everything LGTM but don't want to step on your toes since you've got an open comment on it.

lib/puppet/functions/postgresql/postgresql_password.rb

- add Parameter "sensitive" to Function postgresql_password to decide if its Returnvalue should be of Datatype Sensitive - let defined Type postgresql::server::role accept Datatype Sensitive for $password_hash - let defined Type postgresql::server::db accept Datatype Sensitive for $password - let Class postgresql::server accept Datatype Sensitive for $postgres_password - let defined Type postgresql::validate_db_connection accept Sensitive for $database_password

CLAassistant · 2021-09-01T18:06:46Z

All committers have signed the CLA.

manifests/server/passwd.pp

david22swan · 2021-09-20T09:40:08Z

@cocker-cc Everything LGTM so gonna go ahead and merge once the test's go green.
Thank you for all the work you have put in and I look forward to seeing more from you in the future :)

puppet-community-rangefinder · 2021-09-20T09:43:52Z

postgresql::postgresql_password is a function

that may have no external impact to Forge modules.

postgresql::server is a class

that may have no external impact to Forge modules.

postgresql::server::db is a type

that may have no external impact to Forge modules.

postgresql::server::default_privileges is a type

that may have no external impact to Forge modules.

postgresql::server::passwd is a class

that may have no external impact to Forge modules.

postgresql::server::role is a type

that may have no external impact to Forge modules.

postgresql::validate_db_connection is a type

that may have no external impact to Forge modules.

This module is declared in 70 of 578 indexed public `Puppetfiles`.

These results were generated with Rangefinder, a tool that helps predict the downstream impact of breaking changes to elements used in Puppet modules. You can run this on the command line to get a full report.

Exact matches are those that we can positively identify via namespace and the declaring modules' metadata. Non-namespaced items, such as Puppet 3.x functions, will always be reported as near matches only.

david22swan · 2021-09-20T09:43:52Z

Just quickly closed and reopened to rekick the test's. No need to worry

…_Sensitive Use Puppet-Datatype Sensitive for Passwords

cocker-cc requested a review from a team as a code owner June 12, 2021 21:34

ekohl mentioned this pull request Jun 21, 2021

Accept Datatype Sensitive for all Secrets theforeman/puppet-foreman#960

Merged

ekohl reviewed Jun 21, 2021

View reviewed changes

cocker-cc force-pushed the Use_Puppet-Datatype_Sensitive branch 3 times, most recently from a3f2b12 to ff0b4ae Compare June 22, 2021 23:28

ekohl reviewed Jun 23, 2021

View reviewed changes

cocker-cc force-pushed the Use_Puppet-Datatype_Sensitive branch from ff0b4ae to 4ec009d Compare June 29, 2021 18:19

ekohl reviewed Aug 16, 2021

View reviewed changes

lib/puppet/functions/postgresql/postgresql_password.rb Show resolved Hide resolved

cocker-cc force-pushed the Use_Puppet-Datatype_Sensitive branch from 4ec009d to d878d13 Compare August 16, 2021 09:54

david22swan reviewed Sep 20, 2021

View reviewed changes

manifests/server/passwd.pp Show resolved Hide resolved

david22swan approved these changes Sep 20, 2021

View reviewed changes

david22swan closed this Sep 20, 2021

david22swan reopened this Sep 20, 2021

david22swan added the feature label Sep 20, 2021

david22swan merged commit 9d0aa99 into puppetlabs:main Sep 20, 2021

cegeka-jenkins pushed a commit to cegeka/puppet-postgresql that referenced this pull request Feb 3, 2022

Merge pull request puppetlabs#1279 from cocker-cc/Use_Puppet-Datatype…

1934cfc

…_Sensitive Use Puppet-Datatype Sensitive for Passwords

smortex mentioned this pull request Feb 8, 2022

Allow Sensitive data type for secrets puppetlabs/puppetlabs-puppetdb#331

Merged

Use Puppet-Datatype Sensitive for Passwords #1279

Use Puppet-Datatype Sensitive for Passwords #1279

Uh oh!

Conversation

cocker-cc commented Jun 12, 2021

Uh oh!

puppet-community-rangefinder bot commented Jun 12, 2021

postgresql::postgresql_password is a function

postgresql::server is a class

postgresql::server::db is a type

postgresql::server::passwd is a class

postgresql::server::role is a type

postgresql::validate_db_connection is a type

This module is declared in 71 of 576 indexed public Puppetfiles.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ekohl Jun 21, 2021

Choose a reason for hiding this comment

Uh oh!

cocker-cc Jun 22, 2021

Choose a reason for hiding this comment

Uh oh!

ekohl Aug 16, 2021

Choose a reason for hiding this comment

Uh oh!

cocker-cc Aug 16, 2021

Choose a reason for hiding this comment

Uh oh!

ekohl Aug 16, 2021

Choose a reason for hiding this comment

Uh oh!

ekohl left a comment

Choose a reason for hiding this comment

Uh oh!

cocker-cc commented Jun 23, 2021

Uh oh!

david22swan commented Aug 2, 2021

Uh oh!

Uh oh!

CLAassistant commented Sep 1, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

david22swan commented Sep 20, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

puppet-community-rangefinder bot commented Sep 20, 2021

postgresql::postgresql_password is a function

postgresql::server is a class

postgresql::server::db is a type

postgresql::server::default_privileges is a type

postgresql::server::passwd is a class

postgresql::server::role is a type

postgresql::validate_db_connection is a type

This module is declared in 70 of 578 indexed public Puppetfiles.

Uh oh!

david22swan commented Sep 20, 2021

Uh oh!

Uh oh!

This module is declared in 71 of 576 indexed public `Puppetfiles`.

CLAassistant commented Sep 1, 2021 •

edited

Loading

david22swan commented Sep 20, 2021 •

edited

Loading

This module is declared in 70 of 578 indexed public `Puppetfiles`.