Handling sensitive information with Puppet

Question

What is the best way to store and handle sensitive information with puppet and safely distribute it to your nodes?

The version I am using is 2.7.

One example would be database passwords. Plain text passwords are needed on your application servers.

How can one store these without leaving them lying around inside of the puppet scripts?

Answer 1

Using Hiera for external data lookups and encrypting that data via eyaml or GPG is a good start.

https://docs.puppet.com/hiera/

https://puppet.com/blog/encrypt-your-data-using-hiera-eyaml

http://leebriggs.co.uk/blog/2016/11/15/using-hiera-eyaml-gpg.html

Answer 2

Another option, but I haven't tried it personally. https://forge.puppetlabs.com/sshipway/ss

Of course, this does require putting the data into a secure vault but that seems much more secure than storing sensitive data in Hiera.