1144130 - store secrets & make them available to Puppet

Status: RESOLVED FIXED

(Socorro :: Infra, task)

Description

[Daniel Maher [:phrawzty]]

We need a way to store secrets (tokens, keys, whatever) that is accessible to Puppet.  It makes sense to leverage Hiera for this purpose.  Ideally we'd have both a Consul and an S3 back-end to Hiera, with priority going to Consul - fallback to S3 backup in the event that Consul is down (or hasn't been provisioned yet).

Comment 1

[Daniel Maher [:phrawzty]]

Of note:
* https://github.com/lynxman/hiera-consul
* https://github.com/ianshward/hiera-s3
  * https://github.com/yo61/hiera-s3   (more recent fork)

Comment 2

[Daniel Maher [:phrawzty]]

The aforementioned hiera-s3 plugin isn't that great so I rolled my own[0].  Hooray for open source!

[0] https://github.com/phrawzty/hiera-s3

Comment 3

[Daniel Maher [:phrawzty]]

Quick RPM spec for hiera-consul: https://github.com/phrawzty/hiera-consul-rpm

Comment 4

[Daniel Maher [:phrawzty]]

We now have a working model as well as the necessary packages and configs for using Hiera to access Consul and S3 (in that order).  Yay!