omit secret data from env.yaml

[gerhardqux]

We would like to omit passwords and ssh keys from the env.yaml file, and provide them statically on the install-server.

Would it be possible to either:

• modify generate.py to read additional configuration from a secrets.yaml file, or
• modify hiera to fall back on a secrets.yaml file when the secrets are not defined in the other files?

This way, passwords will never leak out through diffs, backups, public source control, etc.

[rafaelrosafu]

@fcharlier any updates on this item?

[fcharlier]

@rafaelrosafu the second option has a fix in #25, the secrets.yaml file has to be dropped by an operator in the correct folder (the use case was to avoid having the passwords in a git repository)

[rafaelrosafu]

@fcharlier so when #25 gets merged this will be solved right? I'll make sure to track these issues on the internal tickets. Thanks a ton :)

[fcharlier]

@rafaelrosafu you're right! Thanks to you too !