Duplicate: Add sensitive support by teluq-pbrideau · Pull Request #857 · voxpupuli/puppet-zabbix

teluq-pbrideau · 2022-12-12T20:18:30Z

Pull Request (PR) description

This is a copy of #828, where @bdeferme do not have any more time to work on it. Here I tried to fix the tests.

This Pull Request (PR) fixes the following issues

Fixes #440
Fixes #950

….epp

teluq-pbrideau · 2022-12-12T22:16:00Z

While trying to add some basic tests about this change, I’ve discovered that the zabbix::proxy tests aren’t run at all, it is restricted to when 'RedHat' which is not in the listed OS on_supported_os(baseline_os_hash)…

I’ve fixed the tests for them to run at least for CentOS, but they fail for other OS for reasons outside the scope of this PR:

zabbix::proxy
  on debian-10-x86_64
[...]
      is expected to contain Yumrepo[zabbix-nonsupported] (FAILED - 1)

It should probably be fixed it its own PR…

teluq-pbrideau · 2022-12-13T18:01:19Z

manifests/params.pp

  $ldap_clientkey                           = undef
  $ldap_reqcert                             = undef
-  $server_api_pass                          = 'zabbix'
+  $server_api_pass                          = Sensitive('zabbix')


I’m not sure if we should set default values as sensitive.

I’ve changed some tests because of this: if the default value is Sensitive, the output may be masked during tests, and the validation cannot be made. These lines are marked with this comment below:

# cleartext password must be explicitly declared in this test, otherwise the parser will secure content of the file

For example, see spec/classes/proxy_spec.rb:115

IMO that's okay

root-expert

Thanks for the PR! I left some inline comments 😄

root-expert · 2023-02-11T09:46:17Z

manifests/server.pp

+# @param vmwareperffrequency
+#   Delay in seconds between performance counter statistics retrieval from a single VMware service.
+#   This delay should be set to the least update interval of any VMware monitoring item that uses VMware performance counters.


It would be better to open a new PR for the new parameter

root-expert · 2023-02-11T09:46:21Z

manifests/server.pp

 # @param include_dir You may include individual files or all files in a directory in the configuration file.
 # @param loadmodulepath Full path to location of server modules.
 # @param loadmodule Module to load at server startup.
+# @param sslcalocation_dir Location of certificate authority (CA) files for SSL server certificate verification.


It would be better to open a new PR for the new parameter

My guess is @bdeferme discovered the following parameters in zabbix_server.conf while converting to the new epp template:

SSLCALocation

VMwarePerfFrequency

As they were present in upstream config, and noticed they were missing in the old erb template, and added them to be consistent with upstream config.

@root-expert I’ve deleted them as requested, but I think they should be included. However, I won’t go out of my way to create a new PR if it is not required in my own production environment.

root-expert · 2023-02-11T09:46:46Z

manifests/params.pp

  $ldap_clientkey                           = undef
  $ldap_reqcert                             = undef
-  $server_api_pass                          = 'zabbix'
+  $server_api_pass                          = Sensitive('zabbix')


IMO that's okay

Should be in its own pull request

It should be in its own PR

…pport

bastelfreak · 2024-07-03T13:27:54Z

@teluq-pbrideau thanks for working on this! Can you please rebase against our master branch?

teluq-pbrideau · 2024-07-03T15:32:31Z

@bastelfreak I’m sorry but rebasing was just a pain in the ass with all the conflicts. I solved the conflict once with the merge of your master branch

teluq-pbrideau · 2024-07-03T15:36:25Z

You might see I added back the SSLCALocation and VMwarePerfFrequency parameters as they were already defined in the .erb template, without beeing defined in the class. I think it is cleaner to follow how the template was, and adapting the class accordingly. It is such a pain to modify and update the erb vs the epp to keep them consistent.

teluq-pbrideau · 2024-07-03T16:02:48Z

I’m not quite sure how to cleanup my git tree… Can we just squash to only one commit when we merge into master?

teluq-pbrideau · 2024-07-03T17:51:31Z

I’ve been running the old changes in my production environment since my original PR, but I cannot test these new changes right now in a live environment. I’m stuck with a dependency cycle in my Puppetfile with stdlib9, which I’m in the process of solving right now, but might take a few days still to solve on my side.
Feel free to freeze this PR until I come back with confirmation on my side, or if someone can test in a more complete environment.

teluq-pbrideau · 2024-07-09T18:38:31Z

I’ve just successfully tested this PR in my development environment. The failing tests are out of my control, it was a timeout after 360 minutes:

Error: The operation was canceled.

Can we force the tests to rerun and move forward with this? Or It can also be the changes #973!

teluq-pbrideau · 2025-05-13T19:15:25Z

Hoping #973 will be merged someday…

DEFERME Bert and others added 14 commits December 12, 2022 11:39

Add sensitive support

892e593

Fix exposing password for debug mode

d975ad9

Lint fixes

31ac5d7

Make mysql db password undef by default

58ec2af

test: fix mysql test for password as variable

f34d865

test: fix postgresql sensitive /root/.pgpass content

fbb5a45

fix: values are already masked when Sensitive type is used within epp

a4ad064

fix: use known types (and what tests are using) in zabbix_server.conf…

3ff1d95

….epp

test: cleartext password to not mask part of template

2819839

fix: define settings similar to what was in old erb

e5ced74

test: fix for the new template (erb to epp)

b4729ac

test: cleartext password to not mask part of template

2733015

test: fix linter

02662c5

fix: linter

e206bbd

teluq-pbrideau force-pushed the feat/sensitive_support branch from 611265b to e206bbd Compare December 12, 2022 20:25

teluq-pbrideau marked this pull request as draft December 12, 2022 20:25

teluq-pbrideau added 5 commits December 12, 2022 17:04

test: enable tests of proxy on CentOS

1032eee

fix: define settings similar to what was in old erb

ee0c75b

test: cleartext password to not mask part of template

de0755c

test: is_expected_to compile when sensitive password is passed

bdab8bf

test: linter

1081c1b

teluq-pbrideau marked this pull request as ready for review December 13, 2022 14:05

fix: add sensitive type for api_pass in web.pp

1ac4869

teluq-pbrideau commented Dec 13, 2022

View reviewed changes

root-expert reviewed Feb 11, 2023

View reviewed changes

teluq-pbrideau and others added 4 commits February 13, 2023 10:20

refactor: Remove vmwareperffrequency parameter

90576c9

Should be in its own pull request

refactor: remove sslcalocation_dir parameter

8cf6557

It should be in its own PR

Merge branch 'master' into feat/sensitive_support

5a4b258

fix: duplicate parameter after merge

e0e2d07

teluq-pbrideau mentioned this pull request Jul 2, 2024

Accept Datatype Sensitive[String] for Passwords #950

Open

teluq-pbrideau added 2 commits July 3, 2024 09:18

Merge remote-tracking branch 'upstream/master' into feat/sensitive_su…

4080c66

…pport

fix: update REFERENCE.md

fe65cd9

doc: sslcalocation_dir

887219d

fix: add back unsensitive password removed from upstream merge

0a42efb

cocker-cc mentioned this pull request Jul 9, 2024

Use Sensitive for Secrets #973

Open

teluq-pbrideau mentioned this pull request Nov 7, 2024

Prepare Release 11.0.0 #979

Closed

teluq-pbrideau closed this May 13, 2025

Uh oh!

Conversation

teluq-pbrideau commented Dec 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request (PR) description

This Pull Request (PR) fixes the following issues

Uh oh!

teluq-pbrideau commented Dec 12, 2022

Uh oh!

teluq-pbrideau Dec 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

root-expert Feb 11, 2023

Choose a reason for hiding this comment

Uh oh!

root-expert left a comment

Choose a reason for hiding this comment

Uh oh!

root-expert Feb 11, 2023

Choose a reason for hiding this comment

Uh oh!

root-expert Feb 11, 2023

Choose a reason for hiding this comment

Uh oh!

teluq-pbrideau Feb 13, 2023

Choose a reason for hiding this comment

Uh oh!

root-expert Feb 11, 2023

Choose a reason for hiding this comment

Uh oh!

bastelfreak commented Jul 3, 2024

Uh oh!

teluq-pbrideau commented Jul 3, 2024

Uh oh!

teluq-pbrideau commented Jul 3, 2024

Uh oh!

teluq-pbrideau commented Jul 3, 2024

Uh oh!

teluq-pbrideau commented Jul 3, 2024

Uh oh!

teluq-pbrideau commented Jul 9, 2024

Uh oh!

teluq-pbrideau commented May 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

teluq-pbrideau commented Dec 12, 2022 •

edited

Loading

teluq-pbrideau Dec 13, 2022 •

edited

Loading