Jira (BOLT-1270) Bolt should have an encrypted data store

Change By:	Lucy Wyman
Summary:	eyaml encryption for sensitive inventory Bolt should have an encrypted data store

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

Lucy Wyman (JIRA)

unread,

Apr 30, 2019, 12:34:17 PM4/30/19

to puppe...@googlegroups.com

Lucy Wyman updated an issue

Change By:	Lucy Wyman

Questions:
- How do you interact with this feature within the inventory ?

Out of scope:
- Connect to third party encrypted data stores, ie. Vault

Lucy Wyman (JIRA)

unread,

Apr 30, 2019, 12:57:02 PM4/30/19

to puppe...@googlegroups.com

Lucy Wyman updated an issue

Change By:	Lucy Wyman

Questions:
- How do you interact with this feature within the inventory?

- Should you be able to have a single file with encrypted data in it that can be used by multiple users, or is it on a per user basis? Do you need to be able to share the data with multiple people? *The easiest solution seems like encrypted data should be on a per user basis.*
- Does the sensitive data live in the inventory or in an external file?

TODO:
- Look at Ansible Vault - how does that work?

Out of scope:
- Connect to third party encrypted data stores, ie. Vault

Nick Maludy (JIRA)

unread,

May 2, 2019, 5:39:05 AM5/2/19

to puppe...@googlegroups.com

Nick Maludy assigned an issue to Nick Maludy

Change By:	Nick Maludy
Assignee:	Nick Maludy

Alex Dreyer (JIRA)

unread,

May 14, 2019, 1:25:03 PM5/14/19

to puppe...@googlegroups.com

Alex Dreyer updated an issue

Change By:	Alex Dreyer

Questions:
- How do you interact with this feature within Bolt should support eyaml data in the inventory ? file.
- Should you
Users should be able to have a single file with encrypted embed bolt eyaml data in it that can be used by multiple users, or is it on a per user basis? Do you need the inventory file similar to be able to share how the data with multiple people? * prompt plugin works.
The easiest solution seems like encrypted data plugin should be on called eyaml, It should have a per user basis.* single key "encrypted-value" that

{noformat}
nodes:
- Does uri: my_node
     config:
       winrm:
         password:
           _plugin: eyaml
           encrypted-value: >
                  ENC[PKCS7,Y22exl+OvjDe+drmik2XEeD3VQtl1uZJXFFF2NnrMXDWx0csyqLB/2NOWefv
                  NBTZfOlPvMlAesyr4bUY4I5XeVbVk38XKxeriH69EFAD4CahIZlC8lkE/uDh
                  jJGQfh052eonkungHIcuGKY/5sEbbZl/qufjAtp/ufor15VBJtsXt17tXP4y
                  l5ZP119Fwq8xiREGOL0lVvFYJz2hZc1ppPCNG5lwuLnTekXN/OazNYpf4CMd
                  /HjZFXwcXRtTlzewJLc+/gox2IfByQRhsI/AgogRfYQKocZgFb/DOZoXR7wm
                  IZGeunzwhqfmEtGiqpvJJQ5wVRdzJVpTnANBA5qxeA==]
{noformat}

Users should configure the sensitive data live eyaml plugin in bolt yaml under the inventory or in an external file? {{plugins:eyaml}} section. relative paths to keys should be relative to the {{Boltdir}}.

TODO {noformat}
---
ssh :
  host - Look at Ansible Vault key - check: false
plugins:
   eyaml:
      pkcs7_private_key: keys/private_key.pkcs7.pem
      pkcs7_public_key:  keys/public_key.pkcs7.pem
{noformat}

Questions:
- What should the {{encrypted-value}} key be called?
- Can bolt expose the "eyaml" command directly or do we need {{bolt eyaml encrypt}} and {{bolt eyaml create-keys}} the latter seems out of scope unless documenting how does that work to use eyaml proves difficult ? Can we put eyaml in {{/opt/puppetlabs/bin/eyaml}} or does it need to be {{/opt/puppetlabs/bolt/bin/eyaml}}.
- Should we leverage the hiera-eyaml's gem plugins or just support pkcs7. If we're not going to leverage eyaml plugins we should probably just call this the pkcs7 plugin.

Out of scope:
- Connect to third party encrypted data stores, ie. Vault . These should be separate plugins.

Cas Donoghue (JIRA)

unread,

May 15, 2019, 1:30:03 PM5/15/19

to puppe...@googlegroups.com

Cas Donoghue commented on

Re: Bolt should have an encrypted data store

Eyaml plugins https://github.com/voxpupuli/hiera-eyaml#encryption-plugins

Lucy Wyman (JIRA)

unread,

May 15, 2019, 1:42:03 PM5/15/19

to puppe...@googlegroups.com

Lucy Wyman updated an issue