On Monday, November 4, 2013 6:52:51 PM UTC-6, Tom Noonan wrote: > > But that doesn't address the concern that you can't auto generate > values and store them in Heira, as Arnaud mentioned. Is our > understanding on this flawed? I see a Puppet source on > http://docs.puppetlabs.com/hiera/1/data_sources.html#puppet, but that > just says "Coming soon." > > My solution thus far, for file based passwords like Bind keys and Bacula > passwords, has been to generate passwords on the puppetmaster > and then pull the values into templates via file reads. This relies on > the filesystem security of the puppetmaster, but if that is gone you're > pretty well hosed anyway. The generation script on the puppetmaster > handles password aging and regeneration. Not the most graceful > solution, but it works well for me. If there is a better way I'd love > to hear it, however. > >
It is relatively easy to write a custom hiera back end, in which you can use whatever code you like to lookup or generate a value for any given key (or not). You could use such a thing to integrate password generation and recall (and even encrypted storage, if desired) into hiera. John -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/1e7cd9de-3600-4da6-8295-971fdb5d6dc0%40googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
