Handle secrets as Sensitive values

The cephx keys and passwords passed to ceph::key, ceph::mon, ceph::mgr, ceph::rgw::keystone and ceph::rgw::barbican were plain strings, so they ended up unredacted in the catalog and could leak into logs, reports and PuppetDB. The error raised by ceph::mon when both key and keyring were set also printed the key.

All secret parameters now accept a Sensitive value and are always wrapped in Sensitive where they are consumed, including the exec commands that embed them. The profile classes wrap the values they pass on, and ceph::keys wraps the secret of each key before creating the ceph::key resources.

ceph::rgw::keystone::auth also accepts a Sensitive password, but unwraps it before passing it to keystone::resource::service_identity, which does not accept a Sensitive value.

Change-Id: I8cf3fa8e0406bff047718110d050ce3bc7a78571 Assisted-By: Claude Fable 5.1 noreply@anthropic.com Signed-off-by: Sam Morrison sorrison@gmail.com

Team and repository tags

ceph

Overview - What is the ceph module?
Module Description - What does the module do?
Setup - The basics of getting started with ceph
Implementation - An under-the-hood peek at what the module is doing
Limitations - OS compatibility, etc.
Use Cases - Examples of how to use this module
Development - Guide for contributing to the module
Contributors - Those with commits
Release Notes - Notes on the most recent updates to the module
Repository - Repository for the module

Overview

The ceph module is intended to leverage all Ceph has to offer and allow for a wide range of use case. Although hosted on the OpenStack infrastructure, it does not require to sign a CLA nor is it restricted to OpenStack users. It benefits from a structured development process that helps federate the development effort. Each feature is tested with integration tests involving virtual machines to show that it performs as expected when used with a realistic scenario.

Module Description

The ceph module deploys a Ceph cluster ( MON, OSD ), the Cephfs file system and the RadosGW object store. It provides integration with various environments ( OpenStack … ) and components to be used by third party puppet modules that depend on a Ceph cluster.

Setup

Implementation

A blueprint contains an inventory of what is desirable. It was decided to start from scratch and implement one module at a time.

Limitations

We follow the OS compatibility of Ceph. With the release of infernalis this is currently:

CentOS 7 or later
Debian Jessie 8.x or later
Ubuntu Trusty 14.04 or later
Fedora 22 or later

Use Cases

Development

git clone https://github.com/openstack/puppet-ceph.git
cd puppet-ceph
sudo gem install bundler
bundle install

The developer documentation of the puppet-openstack project is the reference:

https://docs.openstack.org/puppet-openstack-guide/latest/

Mailing lists:

IRC channels:

irc.oftc.net#puppet-openstack
irc.oftc.net#ceph-devel

Development

Developer documentation for the entire puppet-openstack project.

https://docs.openstack.org/puppet-openstack-guide/latest/

Contributors

https://github.com/openstack/puppet-ceph/graphs/contributors

Release Notes

https://docs.openstack.org/releasenotes/puppet-ceph

Repository

https://opendev.org/openstack/puppet-ceph

Team and repository tags

ceph

Table of Contents

Overview

Module Description

Setup

Implementation

Limitations

Use Cases

Development

Development

Contributors

Release Notes

Repository