Jira (PUP-9644) Improve documentation around sensitive data in puppet

[Rob Braden (JIRA)]

Rob Braden created an issue

Puppet / PUP-9644 Improve documentation around sensitive data in puppet Issue Type: Task Assignee: Unassigned Created: 2019/04/15 9:54 AM Priority: Normal Reporter: Rob Braden Currently, the docs don't accurately reflect the behavior of sensitive data in puppet catalogs. We should update the docs to reduce customer surprise. Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

[Rob Braden (JIRA)]

Rob Braden updated an issue

Puppet / PUP-9644 Improve documentation around sensitive data in puppet

Change By: Rob Braden Sprint: Coremunity Grooming

Add Comment

[Jorie Tappa (JIRA)]

Jorie Tappa updated an issue

Puppet / PUP-9644 Improve documentation around sensitive data in puppet

Change By: Jorie Tappa Component/s: Docs

Add Comment

[Jorie Tappa (JIRA)]

Jorie Tappa updated an issue

Puppet / PUP-9644 Improve documentation around sensitive data in puppet

Change By: Jorie Tappa Team: Coremunity

Add Comment

[Jorie Tappa (JIRA)]

Jorie Tappa updated an issue

Puppet / PUP-9644 Improve documentation around sensitive data in puppet Change By: Jorie Tappa

Currently, the docs don't accurately reflect the behavior of sensitive data in puppet catalogs. We should update the docs to reduce customer surprise.

Not every provider is supported, so we should be clear which those are and under which circumstances data can be leaked.

Add Comment

[Jean Bond (JIRA)]

Jean Bond assigned an issue to Jean Bond

Puppet / PUP-9644 Improve documentation around sensitive data in puppet

Change By: Jean Bond Assignee: Jean Bond

Add Comment

[Jean Bond (JIRA)]

Jean Bond commented on PUP-9644

Re: Improve documentation around sensitive data in puppet Rob Braden, this ticket asks for documentation about what providers are supported, how data can be leaked, and corrections to inaccuracy about sensitive data behavior, but it doesn't provide information about those things. Can you recommend an SME for this ticket? (I know there's a related ticket, but it's 2+ years old and a whole lot to wade through and parse; if someone can offer more explicit answers, it would be really helpful.)

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-9644

Improve documentation around sensitive data in puppet

Change By: Josh Cooper Sprint: Coremunity Grooming Hopper

Add Comment

[Jean Bond (JIRA)]

Jean Bond assigned an issue to Unassigned

Puppet / PUP-9644 Improve documentation around sensitive data in puppet

Change By: Jean Bond Assignee: Jean Bond

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-9644 Improve documentation around sensitive data in puppet

Change By: Josh Cooper Sprint: Coremunity Hopper Grooming

Add Comment

[Rob Braden (Jira)]

Rob Braden commented on PUP-9644

Re: Improve documentation around sensitive data in puppet We should probably add some clarification that the "core" types and providers make an effort to redact sensitive information, custom types and providers may need to be updated to respect the sensitive flag. For example: https://github.com/puppetlabs/puppet/blob/f482005b92807a4bdd350e86fa80f2da39c936a2/lib/puppet/util/execution.rb#L159 sets it as 'false' by default, anyone that needs to redact sensitive information from the execution API should pass the value as 'true'

Add Comment

This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)

[Chris Cowell (Jira)]

Chris Cowell assigned an issue to Chris Cowell

Puppet / PUP-9644

Improve documentation around sensitive data in puppet

Change By: Chris Cowell Assignee: Chris Cowell

Add Comment

[Chris Cowell (Jira)]

Chris Cowell commented on PUP-9644

Re: Improve documentation around sensitive data in puppet Hi Rob Braden I'm picking up this ticket for Tech Pubs, but need a little more info. Are you the right person to ask for more info about stuff like this: "Not every provider is supported, so we should be clear which those are and under which circumstances data can be leaked"?

Add Comment

[Chris Cowell (Jira)]

Chris Cowell commented on PUP-9644

Re: Improve documentation around sensitive data in puppet

Rob Braden another question: does this ticket look like a dup of DOCUMENT-634?

Add Comment

[Jean Bond (Jira)]

Jean Bond commented on PUP-9644

Re: Improve documentation around sensitive data in puppet

Chris Cowell, this is definitely an iteration/dupe of DOCUMENT-634.

Add Comment

[Chris Cowell (Jira)]

Chris Cowell updated an issue

Puppet / PUP-9644

Improve documentation around sensitive data in puppet

Change By: Chris Cowell Comment: [~bradejr] another question: does this ticket look like a dup of DOCUMENT-634?

Add Comment

[Rob Braden (Jira)]

Rob Braden commented on PUP-9644

Re: Improve documentation around sensitive data in puppet Hi Chris, for the moment I'll defer to Melissa Stone but she's only available for a few more days

Add Comment

[Melissa Stone (Jira)]

Melissa Stone commented on PUP-9644

Re: Improve documentation around sensitive data in puppet

I'm happy to help, but I have very little information myself and my last day at Puppet is Friday. So, if I can help at all in the next two days, let me know! The examples provided in https://tickets.puppetlabs.com/browse/DOCUMENT-634 are helpful, and I also found a very thorough write up at https://puppet.com/blog/my-journey-securing-sensitive-data-puppet-code/. Gene Liverman might be a helpful resource too, given his thoughtful writeup and his experience with sensitive data.

Add Comment

[Gene Liverman (Jira)]

Gene Liverman commented on PUP-9644

Re: Improve documentation around sensitive data in puppet

Happy to help. Ben Ford also has a lot of good insight into this.

Add Comment

[Jean Bond (Jira)]

Jean Bond commented on PUP-9644

Re: Improve documentation around sensitive data in puppet

We just got some user feedback about these docs, so I'm adding the request here for context: "Add a proper example to use in a class. When you define a var as Sensitive[String], you get the error "parameter 'XXXXX' expects a Sensitive[String] value, got String". When following the docs it is unclear how to properly configure this."

Add Comment

[Josh Cooper (Jira)]

Josh Cooper updated an issue

Puppet / PUP-9644

Improve documentation around sensitive data in puppet

Change By: Josh Cooper Sprint: Coremunity Grooming

Add Comment

[William Hurt (Jira)]

William Hurt commented on PUP-9644

Re: Improve documentation around sensitive data in puppet Hi, I just want to +1 getting this prioritized for release somewhere with examples from DOCUMET-634 and from Gene's blog post. I am myself trying to figure out how to properly right a module with the Sensitive type in a way that is easy for end users to utilize. In my searching around for how to do this properly it looks to me like our documentation on the Sensitive type is still very very light, and frankly that ticket above and Gene's blog post are the only things I've found so far that the least bit helpful.

Add Comment

[Claire Cadman (Jira)]

Claire Cadman assigned an issue to Claire Cadman

Puppet / PUP-9644

Improve documentation around sensitive data in puppet

Change By: Claire Cadman Assignee: Chris Cowell Claire Cadman

Add Comment