Puppet eYAML to File

Joseph Quinn 0
Viewed 39

I have a file that I've encrypted using hiera-eyaml and included in my configuration as such:

mymodule::config_file: ENC[PKCS7,...]

Now I'm trying to write the contents of the decoded string into a file as such:

class mymodule (
  String $config_file
) {
  file { '/etc/agent_config.json':
    content => $config_file,
    mode    => '0644',
  }
}

I would expect the output file to be the decrypted string, but instead I'm getting the encrypted eYAML instead.

Is what I'm doing not possible to do in puppet?

Edit:

The file looks correct when running eyaml edit

ex:

itglue::fireeye::fireeye_config: DEC(1)::PKCS7[{
  "serverlist": {
    "servers": [
      ...
    ]
  }
}]!

Edit 2:

Our hiera.yaml is as such:

---
:backends:
  - yaml
  - eyaml
:yaml:
  :datadir: /etc/puppet/hiera/hieradata
:eyaml:
  :datadir: /etc/puppet/hiera/hieradata
  :pkcs7_private_key: /var/lib/puppet/keys/private_key.pkcs7.pem
  :pkcs7_public_key:  /var/lib/puppet/keys/public_key.pkcs7.pem
:hierarchy:
  - secure
  - "%{::clientcert}"
  - "node_role/%{::node_role}"
  - "env/%{::environment}"
  - "node_types/%{nodetype}"
  - global
:logger: console
puppet
1 Answers

I don't have a system with hiera version 3 to test this on so it's a complete stab in the dark, but try swapping the ordering of the backends so

:backends:
  - yaml
  - eyaml

becomes

:backends:
  - eyaml
  - yaml

If that doesn't work I'd suggest storing your secrets data in a different location so have

/etc/puppet/hiera/hieradata

for your yaml and

/etc/puppet/hiera/hierasecretdata

for the secrets, that way the yaml search will never be looking in the eyaml file where it can find a key match.

16c7x0
Related