Rework passwords management

[smortex]

In this PR, we drop the default value for all passwords, and mandate the use of a Sensitive data type.

Rationale

The module used to provide default values for password, which is prone to errors because forgetting to change them do not cause catalog compilation failures. This issue is mitigated by the use of TLS, but we should rather stop providing default value for these passwords completely.

The module also support usage of Sensitive[String] to provide passwords since version 8.1.0, in addition to String which was available before. It make sense to only support the former.

What needs to be done

If your already provide custom passwords, and provide them as Sensitive values, no change is required.

If you provide custom passwords as String, you need to transform them to Sensitive:

class { 'bacula::director':
  password => Sensitive('...'),
  # ...
}

If you did not provided a custom password, add one :-)

[smortex]

What? Exported resources do not include sensitive values? $password above is mandatory, provided as a Sensitive[String], yet the exported resource does not include it:

romain@zappy ~ % puppet query  'resources[certname,type,title,file,line,parameters] { type = "Bacula::Director::Client" and title = "ns3006942.ip-151-80-35.eu" and exported = true }'
[
  {
    "certname": "ns3006942.ip-151-80-35.eu",
    "type": "Bacula::Director::Client",
    "title": "ns3006942.ip-151-80-35.eu",
    "file": "/etc/puppetlabs/code/environments/romain/modules/bacula/manifests/client.pp",
    "line": 111,
    "parameters": {
      "tag": "bacula-vps-bee4e253.vps.ovh.net",
      "port": 9102,
      "address": "ns3006942.ip-151-80-35.eu",
      "autoprune": true,
      "job_retention": "6 months",
      "file_retention": "45 days"
    }
  }
]

and the catalog that collect this exported resource is not valid:

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Bacula::Director::Client[ns3006942.ip-151-80-35.eu]: expects a value for parameter 'password' on node vps-bee4e253.vps.ovh.net

One level up, the class that pass the Sensitive password around also does not show passwords in puppetdb:

romain@zappy ~ % puppet query  'resources[certname,type,title,file,line,parameters] { title = "Bacula::Client" and certname = "ns3006942.ip-151-80-35.eu"  }'
[
  {
    "certname": "ns3006942.ip-151-80-35.eu",
    "type": "Class",
    "title": "Bacula::Client",
    "file": "/etc/puppetlabs/code/environments/romain/site-modules/profile/manifests/bacula_client.pp",
    "line": 127,
    "parameters": {
      "port": 9102,
      "client": "ns3006942.ip-151-80-35.eu",
      "ensure": "present",
      "address": "ns3006942.ip-151-80-35.eu",
      "messages": {
        "Standard-fd": {
          "mname": "Standard",
          "append": "\"/var/log/bacula/bacula-fd.log\" = all, !skipped",
          "daemon": "fd",
          "director": "ns3006942.ip-151-80-35.eu-dir = all, !skipped, !restored"
        }
      },
      "packages": [
        "bacula-client"
      ],
      "services": "bacula-fd",
      "autoprune": true,
      "pki_keypair": "/etc/bacula/ssl/ns3006942.ip-151-80-35.eu_pki_crt+key.pem",
      "default_pool": "OpusLabs",
      "director_name": "vps-bee4e253.vps.ovh.net",
      "job_retention": "6 months",
      "file_retention": "45 days",
      "listen_address": [
        "::"
      ],
      "pki_encryption": true,
      "pki_signatures": true,
      "max_concurrent_jobs": 2
    }
  }
]

Am I missing something?

[smortex]

I opened OpenVoxProject/openvoxdb#177 to discuss the issue.

[smortex]

So follow-up to the above discussion: passing them as String is fine for our use case given the current limitations of PuppetDB.

Another issue is raised as concatenated fragments of sensitive data are not sensitive and result in passwords being logged. I opened puppetlabs/puppetlabs-concat#828 to fix this issue. Maybe we should wait for a release of the concat module that include this, and bump the required version of concat in this module?