Merge pull request #320 from gfa/gfa_mark_passwords_as_sensitive

Hide passwords from output
puppetlabs · May 7, 2024 · f9b7f7f · f9b7f7f
2 parents 8505a7c + 9592788
commit f9b7f7f
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 14 deletions.
diff --git a/manifests/server/database.pp b/manifests/server/database.pp
@@ -98,8 +98,9 @@
 
   if $database_password != undef and $manage_db_password {
     ini_setting { 'puppetdb_psdatabase_password':
-      setting => 'password',
-      value   => $database_password,
+      setting   => 'password',
+      value     => $database_password,
+      show_diff => false,
     }
   }
 

diff --git a/manifests/server/read_database.pp b/manifests/server/read_database.pp
@@ -92,8 +92,9 @@
 
     if $read_database_password != undef and $manage_db_password {
       ini_setting { 'puppetdb_read_database_password':
-        setting => 'password',
-        value   => $read_database_password,
+        setting   => 'password',
+        value     => $read_database_password,
+        show_diff => false,
       }
     }
 

diff --git a/spec/unit/classes/server/database_ini_spec.rb b/spec/unit/classes/server/database_ini_spec.rb
@@ -38,11 +38,12 @@
       it {
         is_expected.to contain_ini_setting('puppetdb_psdatabase_password')
           .with(
-            'ensure'  => 'present',
-            'path'    => "#{pdbconfdir}/database.ini",
-            'section' => 'database',
-            'setting' => 'password',
-            'value'   => 'puppetdb',
+            'ensure'    => 'present',
+            'path'      => "#{pdbconfdir}/database.ini",
+            'section'   => 'database',
+            'setting'   => 'password',
+            'value'     => 'puppetdb',
+            'show_diff' => false,
           )
       }
       it {

diff --git a/spec/unit/classes/server/read_database_ini_spec.rb b/spec/unit/classes/server/read_database_ini_spec.rb
@@ -38,11 +38,12 @@
     it {
       is_expected.to contain_ini_setting('puppetdb_read_database_password')
         .with(
-          'ensure'  => 'present',
-          'path'    => '/etc/puppetlabs/puppetdb/conf.d/read_database.ini',
-          'section' => 'read-database',
-          'setting' => 'password',
-          'value'   => 'puppetdb-read',
+          'ensure'    => 'present',
+          'path'      => '/etc/puppetlabs/puppetdb/conf.d/read_database.ini',
+          'section'   => 'read-database',
+          'setting'   => 'password',
+          'value'     => 'puppetdb-read',
+          'show_diff' => false,
         )
     }
     it {