Skip to content

Commit b0d31be

Browse files
authored
(GH-101) Fix documentation for secret lookup using hiera data file interpolation (#102)
interpolation inside of a hiera data file must be done using alias and not lookup. This is because the Sensitive[String] data type must be preserved.
1 parent c158fe7 commit b0d31be

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

README.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,12 +144,15 @@ notify { 'lookup':
144144
}
145145
```
146146

147-
This function can also be used in hiera files, for example to set class parameters:
147+
The alias function can also be used in hiera files, for example to set class parameters:
148148

149149
```yaml
150-
some_class::password: "%{lookup('important-secret')}"
150+
some_class::password: "%{alias('important-secret')}"
151151
```
152152

153+
**NOTE: The alias function must be used in the above example. Attempting to use the lookup function inside of your hiera files will not work. This is because, when using lookup, the result is interpolated as a string. Since this module is safe by default, it always returns secrets as Sensitive[String]. The reason we have to use alias is because it will preserve the datatype of the value. More information can be found [here](https://www.puppet.com/docs/puppet/7/hiera_merging.html#interpolation_functions)**
154+
155+
153156
You can use a fact to specify different vaults for different groups of nodes. It is
154157
recommended to use a trusted fact such as trusted.extensions.pp_environment as these facts
155158
cannot be altered.

0 commit comments

Comments
 (0)