Retrieved secrets are not wrapped in Sensitive

[ldaneliukas]

As per the documentation, all secrets retrieved by vault_lookup should be wrapped in Sensitive. This was definitely the case when using Puppet v7.

We have just upgrade to puppetserver v8 - everything worked the same as with v7, all secrets were Sensitive. Then we upgraded our puppet-agent to v8 and now all secrets retrieved via vault_lookup are of the String type, which is causing a lot of errors in catalogs.

Has the module been tested on v8 puppet infrastructure?

[alexjfisher]

Odd. Are you using this with Deferred? Does the agent setting preprocess_deferred setting make any difference? The default for this changed between puppet 7 and 8.

[nrhall]

We noticed this too - and setting preprocess_deferred didn't help - the issue (appears) to be that the Deferred/Sensitive resolvers (the internal puppet ruby code) now resolve/unwrap both types in order to peek inside them to see if they contain nested items. For us that meant things like deferred EPPs no longer received a Sensitive input, because the resolver unwrapped them before calling the epp machinery (which in turn meant they no longer returned a Sensitive).

I posted a comment on the github PR where this change appears to have been made (where there's also a comment suggesting that further testing might be needed...). We've had to scaffold things so that in the puppet code, we force-rewrap everything in a Sensitive (we were lucky in that we wrap vault_lookup anyway for a bunch of reasons (mostly so it uses the puppet client cert to authenticate to Vault), so we had an easy place to add this that everyone already called - and because we are mid-migration we have a mixed puppet7/8 environment that needed to continue to be compatible.

FWIW, it's also broken puppet::concat too because it would only accept a Sensitive[String], Deferred or String, but ended up getting called with a Sensitive because the outer deferred was resolved (previously would have been called with a Deferred I think) leaving a bare Sensitive (it's not a Sensitive[String] until the deferred code is executed as far as I can tell - it doesn't get the types from the Ruby functions). That PR is puppetlabs/puppetlabs-concat#824 (but is stuck because of delays in the legal process to get a company CLA signed but hopefully moving soon!).

[ldaneliukas]

mostly so it uses the puppet client cert to authenticate to Vault

Why do you need to wrap it for this? The lookup function already defaults to this auth method without any modifications.

Though it seems we'll need to do the same, as changing all uses to now re-wrap vault lookup outputs into Sensitive will be much too tedious. Could you potentially share a snippet of how you handled the wrapper function?