Keeping data secure

One of the key elements of managing data is ensuring that secret data is kept secure, and this can be challenging with Puppet when this data must be stored, transferred across the infrastructure to the client, and used within Puppet code to set the state. In this section, we will discuss the methods available to secure data, what levels data can be secured at, and the limitations of the methods used at each level.

The most common first step is to secure data in storage. This can be achieved using hiera-eyaml, a custom Hiera backend available at https://github.com/voxpupuli/hiera-eyaml. This module creates pkcs7 keys, which are then used to encrypt and decrypt data. Having followed the instructions in the module to create and distribute keys, a hierarchy can be created, such as the following:

hierarchy:
  - name: "Hiera data in yaml and eyaml files committed to the control-repo"
    lookup_key: eyaml_lookup_key
 ...