search

jsok / hiera-vault

A Hiera backend to retrieve secrets from Hashicorp's Vault
Apache License 2.0
101 stars 22 forks source link

rewrite for hiera 5? #27

Open davealden opened 7 years ago

davealden commented 7 years ago

Hi, Have you had any thoughts about rewriting this for hiera 5? It looks like it would it make it much simpler (and eliminate the need for the additional patches to keep it from going through the entire vault backend for every class call). ...dave

davealden commented 7 years ago

@jsok Any thoughts on this? :)

davealden commented 7 years ago

Is anyone using this with the latest hiera (that comes with puppet-agent 1.10)? I've been stuck at 1.8.3 for a few months now and I'm pretty sure it's due to this module.

oogs commented 7 years ago

This would be pretty nice to have in hiera 5.

davealden commented 7 years ago

@jsok I've rewritten this to be a hiera 5 backend. I believe this eliminates the need for hiera-router (and any other solutions suggested in Issue #22 ) since you can easily specify a regex for which keys should be looked up in the backend. This is my first ruby code, so it's probably not 100% - any interest in this?

jsok commented 7 years ago

@davealden I'm fairly out of the loop on hiera these days, but I'd be happy to keep supporting and maintaining this project from community contributions. We could mint a new major version which supports hiera 5 and newer based on your contribution.

hlindberg commented 7 years ago

@davealden and @jsok - If you need help with review of the code, or need any help regarding hiera 5, please ping me.

blackophelia commented 7 years ago

Hey @davealden @jsok - just came across this thread... I'm interested in using this with hiera 5.... any updates as to where/when you'll go with this?

jsok commented 7 years ago

Again I'm not involved in Puppet/Hiera enough these days to be able to make a change like this.

The project in its current state is pretty poor. There is 0 unit test coverage and I'm very hesitant to accept any changes as is. Any major refactor would need to be accompanied with a substantial test siute.

davealden commented 7 years ago

@blackophelia - I rewrote this to work with Hiera 5 (and only 5, it is not compatible with any previous versions). I did not finish testing it (and looking through the readme, I have not given proper credit to @jsok for his writing of the initial module -- I definitely want to do that before I make any official type of release). I hope to be able to finish it up sometime in the next 2-3 months, but I have been temporarily pulled off that project for now. Feel free to take a look at it:

https://github.com/davealden/hiera-vault

Note that in the install instructions, I tell you to do a "puppet module install ...", but as I haven't finished it, I have not submitted it to the forge. :) So for now you'll have to manually install the hiera_vault function.

blackophelia commented 7 years ago

@davealden thanks for the update! We've implemented our vault access in a different way for now, so the need for this functionality isn't so urgent.
Thanks again for keeping all this going!

keith-miller commented 7 years ago

So I'm a bit confused. Is Heira 5 support in? Thanks!

petems commented 6 years ago

Using @davealden's Hiera 5 version, I built a Vagrant repo as a proof of concept to play with.

It worked perfectly! 👍 https://github.com/petems/puppet-hiera-vault-vagrant