Use Puppet-Datatype Sensitive #1400

cocker-cc · 2021-06-16T21:15:53Z

fix some Puppetlint-Complaints, f.e. use Hash $::facts['blubb'] instead of specific global Variables
let Function mysql::password accept Datatype Sensitive for Password
let Function mysql_password accept Datatype Sensitive for Password
add Parameter "sensitive" to Function mysql::password to decide if its Returnvalue should be of Datatype Sensitive
add Parameter "sensitive" to Function mysql_password to decide if its Returnvalue should be of Datatype Sensitive
let mysql_user accept Datatype Sensitive for Parameter password_hash
let mysql::backup::mysqlbackup accept Datatype Sensitive for Parameter $backuppassword
let mysql::backup::mysqldump accept Datatype Sensitive for Parameter $backuppassword
let mysql::backup::xtrabackup accept Datatype Sensitive for Parameter $backuppassword
let mysql::db accept Datatype Sensitive for Parameter $password
let mysql::server accept Datatype Sensitive for Parameter $root_password
let mysql::server::backup accept Datatype Sensitive for Parameter $backuppassword
let mysql::server::monitor accept Datatype Sensitive for Parameter $mysql_monitor_password
let mysql::server::root_password accept Datatype Sensitive for $root_password
refactor Logic for unset Password for mysql::server::root_password

puppet-community-rangefinder · 2021-06-16T21:16:37Z

mysql::password is a function

Breaking changes to this file WILL impact these 7 modules (exact match):

Breaking changes to this file MAY impact these 1 modules (near match):

icinga-icinga

mysql_password is a function

Breaking changes to this file WILL impact these 17 modules (exact match):

Breaking changes to this file MAY impact these 26 modules (near match):

mysql::backup::mysqlbackup is a class

that may have no external impact to Forge modules.

mysql::backup::mysqldump is a class

that may have no external impact to Forge modules.

mysql::backup::xtrabackup is a class

that may have no external impact to Forge modules.

mysql::bindings is a class

Breaking changes to this file WILL impact these 14 modules (exact match):

Breaking changes to this file MAY impact these 17 modules (near match):

mysql::bindings::client_dev is a class

that may have no external impact to Forge modules.

mysql::bindings::daemon_dev is a class

that may have no external impact to Forge modules.

mysql::db is a type

Breaking changes to this file WILL impact these 67 modules (exact match):

Breaking changes to this file MAY impact these 16 modules (near match):

mysql::server is a class

Breaking changes to this file WILL impact these 77 modules (exact match):

Breaking changes to this file MAY impact these 51 modules (near match):

mysql::server::backup is a class

Breaking changes to this file WILL impact these 4 modules (exact match):

mysql::server::monitor is a class

that may have no external impact to Forge modules.

mysql::server::root_password is a class

that may have no external impact to Forge modules.

This module is declared in 143 of 576 indexed public `Puppetfiles`.

These results were generated with Rangefinder, a tool that helps predict the downstream impact of breaking changes to elements used in Puppet modules. You can run this on the command line to get a full report.

Exact matches are those that we can positively identify via namespace and the declaring modules' metadata. Non-namespaced items, such as Puppet 3.x functions, will always be reported as near matches only.

pmcmaw · 2021-06-21T13:42:38Z

spec/functions/mysql_password_spec.rb

+  end
+
+  # Test of a Returnvalue of Datatype Sensitive does not work:
+  # it 'returns Sensitive with sensitive=true' do


Hey @cocker-cc

Just wondering if you have more information on why this test does not work? I would be inclined to advise if there is a suitable reason, marking this test in the suite as pending and just adding the comment as to why for future reference.

Here is an example from stdlib on how to mark as pending: https://github.com/puppetlabs/puppetlabs-stdlib/blob/276e7b7cd97580c9c08b264b3727e5902df1f487/spec/functions/is_mac_address_spec.rb#L22

Just wondering if you have more information on why this test does not work?

Too bad, I have no Idea how to make this Test work

pmcmaw · 2021-06-21T13:51:45Z

manifests/backup/mysqlbackup.pp

@@ -32,6 +32,11 @@
  $compression_command      = undef,
  $compression_extension    = undef,
 ) inherits mysql::params {
+  if $backuppassword =~ Sensitive {
+    $_backuppassword = $backuppassword.unwrap


I know this isn't a big deal but would it be possible to rename this variable? I found when reviewing this PR with a colleague it took us a while to work out what it is doing. I would suggest using something such as plaintext_backuppassword. (this name change will need revisited throughout your codebase changes).

Now it's done. I needed a second push.

https://github.com/cocker-cc/puppetlabs-mysql/compare/f9d507f..8413dbe

pmcmaw · 2021-06-21T13:54:31Z

Hey @cocker-cc
I would like to thank you for such an awesome PR!
I have added some minor comments and as soon as they are addressed I will work on getting this PR merged.
🥇

cocker-cc · 2021-06-21T14:39:59Z

I would like to thank you for such an awesome PR!
1st_place_medal

Thanks. Reason for that one is: we switched from Trocla to Vault, and our Function vault_secrets::lookup natively returns a Sensitive, and that's good. My Understanding of Sensitive is, that the unwrap should be done as late as possible. Using EPP instead of ERB, in fact there never has to be an unwrap. Maybe I will spawn another Pullrequest with the relevant EPP-Files.

- fix some Puppetlint-Complaints, f.e. use Hash $::facts['blubb'] instead of specific global Variables - let Function mysql::password accept Datatype Sensitive for Password - let Function mysql_password accept Datatype Sensitive for Password - add Parameter "sensitive" to Function mysql::password to decide if its Returnvalue should be of Datatype Sensitive - add Parameter "sensitive" to Function mysql_password to decide if its Returnvalue should be of Datatype Sensitive - let mysql_user accept Datatype Sensitive for Parameter password_hash - let mysql::backup::mysqlbackup accept Datatype Sensitive for Parameter $backuppassword - let mysql::backup::mysqldump accept Datatype Sensitive for Parameter $backuppassword - let mysql::backup::xtrabackup accept Datatype Sensitive for Parameter $backuppassword - let mysql::db accept Datatype Sensitive for Parameter $password - let mysql::server accept Datatype Sensitive for Parameter $root_password - let mysql::server::backup accept Datatype Sensitive for Parameter $backuppassword - let mysql::server::monitor accept Datatype Sensitive for Parameter $mysql_monitor_password - let mysql::server::root_password accept Datatype Sensitive for $root_password - refactor Logic for unset Password for mysql::server::root_password

pmcmaw · 2021-06-22T13:44:15Z

What a fantastic addition to our code base @cocker-cc.
Again thank you for such a quick turnaround and such a great feature.

pmcmaw · 2021-06-22T13:45:14Z

Changes will be released on our next Community Day (Monday)

cocker-cc requested a review from a team as a code owner June 16, 2021 21:15

pmcmaw added the feature label Jun 21, 2021

pmcmaw reviewed Jun 21, 2021

View reviewed changes

pmcmaw approved these changes Jun 22, 2021

View reviewed changes

pmcmaw merged commit 1fb7245 into puppetlabs:main Jun 22, 2021

cocker-cc deleted the Use_Puppet-Datatype_Sensitive branch June 22, 2021 14:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use Puppet-Datatype Sensitive #1400

Use Puppet-Datatype Sensitive #1400

cocker-cc commented Jun 16, 2021

puppet-community-rangefinder bot commented Jun 16, 2021

pmcmaw Jun 21, 2021

pmcmaw Jun 21, 2021

cocker-cc Jun 21, 2021

cocker-cc Jun 21, 2021

pmcmaw Jun 21, 2021

cocker-cc Jun 21, 2021

cocker-cc Jun 21, 2021

cocker-cc Jun 21, 2021

pmcmaw commented Jun 21, 2021

cocker-cc commented Jun 21, 2021

pmcmaw commented Jun 22, 2021

pmcmaw commented Jun 22, 2021

Use Puppet-Datatype Sensitive #1400

Use Puppet-Datatype Sensitive #1400

Conversation

cocker-cc commented Jun 16, 2021

puppet-community-rangefinder bot commented Jun 16, 2021

mysql::password is a function

mysql_password is a function

mysql::backup::mysqlbackup is a class

mysql::backup::mysqldump is a class

mysql::backup::xtrabackup is a class

mysql::bindings is a class

mysql::bindings::client_dev is a class

mysql::bindings::daemon_dev is a class

mysql::db is a type

mysql::server is a class

mysql::server::backup is a class

mysql::server::monitor is a class

mysql::server::root_password is a class

This module is declared in 143 of 576 indexed public Puppetfiles.

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pmcmaw commented Jun 21, 2021

cocker-cc commented Jun 21, 2021

pmcmaw commented Jun 22, 2021

pmcmaw commented Jun 22, 2021

This module is declared in 143 of 576 indexed public `Puppetfiles`.