We've made some more progress integrating Puppet 6+ Deferred lookups with
Vault for secrets storage.
The basic principle we've used for the isolation is to upload and sync a
Puppet TLS certificate per host, and lookup the relevant keys under there
for the secret storage.
```
vault write secret/test1.exampledomain.com policies=test1.exampledomain.com
certificate=@/etc/puppetlabs/puppet/ssl/ca/signed/test1.exampledomain.com.pem
vault kv put secret/test1.exampledomain.com
mysql_root=TheVerySecureMySQLRootPassword123!
echo "path \"secret/test1.exampledomain.com\" {capabilities = [\"read\"]}"
> test1.exampledomain.com.hcl
vault policy write test1.exampledomain.com test1.exampledomain.com.hcl
```
We can then see the above working on the client with this code -
```
$mysql_root = Deferred('vault_lookup::lookup', ["secret/
test1.exampledomain.com", 'https://puppet.exampledomain.com:8200'])
notify {mysql_root: message => $mysql_root}
```
What we can't figure out is how to reference the KV pair inside a Puppet
manifest as a parameter. Eg, in YAML:
```
---
mysql::server::root_password: "%{something wonderful happens here}"
```
Any ideas?
On Tuesday, October 9, 2018 at 11:12:39 PM UTC+11, comport3 wrote:
>
> Mentioned in the Puppet 6 release notes are the ability for a client to
> lookup secret data from Vault.
>
> Is there any more info on how to implement this?
>
> I have done extensive work on POC environments that use Vault as a top
> level in Hierarchy and mark the secrets as 'sensitive' so they do not
> appear in logs and reports, but do not want to continue deploying this
> methodology if it's not the way the technology is headed.
>
> https://github.com/comport3/puppet5-hiera-vault-poc
>
>
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/070062ff-0956-47d6-9202-0cba97c67cfa%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
