In Puppet, how would I secure a password variable (in this case a MySQL password)?
- by Beaming Mel-Bin
I am using Puppet to provision MySQL with a parameterised class:
class mysql::server( $password ) {
package { 'mysql-server': ensure => installed }
package { 'mysql': ensure => installed }
service { 'mysqld':
enable => true,
ensure => running,
require => Package['mysql-server'],
}
exec { 'set-mysql-password':
unless => "mysqladmin -uroot -p$password status",
path => ['/bin', '/usr/bin'],
command => "mysqladmin -uroot password $password",
require => Service['mysqld'],
}
}
How can I protect $password? Currently, I removed the default world readable permission from the node definition file and explicitly gave puppet read permission via ACL.
I'm assuming others have come across a similar situation so perhaps there's a better practice.
