Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add option to disable output of config diff #403

Closed
wants to merge 4 commits into from
Closed

Add option to disable output of config diff #403

wants to merge 4 commits into from

Conversation

teluq-pbrideau
Copy link

Pull Request (PR) description

I configure my authentication through azure_activedirectory_v2, and I don’t want my client_secret to be displayed in clear in the puppet logs.

Converting the gitlab.rb.erb to .epp so it supports the sensitive type would probably be cleaner, but I did not have success with it. So this PR add option to disable output of the diff for sensitive information

class example {
  class { 'gitlab' :
    [...]
    config_show_diff => false,
  }
}

I’ve included the option to also affect the file containing $pgbouncer_password, as it is sensitive information. Is it is already a epp template, it could support sensitive type, but as I did not convert to the sensitive type elsewhere, it seemed simpler this way.

Feel free to comment if I missed anything.

This Pull Request (PR) fixes the following issues

Fixes #363

smortex
smortex reviewed Oct 5, 2022
View reviewed changes
Copy link
Member

@smortex smortex left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I wonder if these new parameters are required after all, and if we really want this to be optional if it should rather default to false.

manifests/host_config.pp Show resolved Hide resolved
manifests/omnibus_config.pp Show resolved Hide resolved
@teluq-pbrideau
Copy link
Author

I sure can default the $config_show_diff in the init.pp to false if you want to. I was just trying to not change anything from the default values, but I agree it could be set secured by default.

@teluq-pbrideau
Copy link
Author

Would you like me to add the config_show_diff option to global_hook.pp, system_hook.pp and custom_hook.pp, and set the default value to false? It would give option to people who want to display the diff be able to do it.

@teluq-pbrideau
Copy link
Author

@smortex I’ve stumble over this today, is there anything else I could do to make the change to get merged?

@root-expert
Copy link
Member

@teluq-pbrideau Please rebase with out master branch and it can be merged afterwards

@root-expert root-expert added the enhancement New feature or request label Feb 11, 2023
@root-expert root-expert changed the title Option to disable output of config diff Add option to disable output of config diff Feb 11, 2023
smortex
smortex reviewed Feb 13, 2023
View reviewed changes
Copy link
Member

@smortex smortex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As requested by @root-expert, can you please rebase your changes on top of the main branch?

From your working directory:

git fetch origin         # Download the latest code we have here
git rebase origin/master # Move your commits on top of the main branch
git push -f              # Send the changes (-f is required because we re-wrote history)

manifests/init.pp
@@ -114,6 +115,7 @@
Optional[Hash] $ci_unicorn = undef,
Boolean $config_manage = true,
Stdlib::Absolutepath $config_file = '/etc/gitlab/gitlab.rb',
Boolean $config_show_diff = false,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I can tell, the previous code did show the diff so if we want to be backward compatible, this should default to true?

Also, when we switch to epp templates, this setting would be useless if I recall correctly because in this case the diff is not shown when it contains sensitive data.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I can tell, the previous code did show the diff so if we want to be backward compatible, this should default to true?

That is also what I thought previously, and was then asked to put a secure default value. But any value is OK for me, i’ll set the one you want!

Also, when we switch to epp templates, this setting would be useless if I recall correctly because in this case the diff is not shown when it contains sensitive data.

As said in the PR description, I first tried to convert to an epp template without success. As it was more than 3 month ago, I do not remember why exactly… But you are right, once the template is converted to epp, the strings marked as Sensitive() will be obfuscated.

@teluq-pbrideau
Copy link
Author

Closing as it seems this is not wanted

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@smortex smortex smortex left review comments

Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

The GitLab config file resource should not show diffs
3 participants
@teluq-pbrideau @root-expert @smortex