Search code examples
securitypuppet

Handling sensitive information with Puppet

What is the best way to store and handle sensitive information with puppet and safely distribute it to your nodes?

The version I am using is 2.7.

One example would be database passwords. Plain text passwords are needed on your application servers.

How can one store these without leaving them lying around inside of the puppet scripts?

Solution

  • Using Hiera for external data lookups and encrypting that data via eyaml or GPG is a good start.

    https://docs.puppet.com/hiera/

    https://puppet.com/blog/encrypt-your-data-using-hiera-eyaml

    http://leebriggs.co.uk/blog/2016/11/15/using-hiera-eyaml-gpg.html