Re: [Puppet Users] Re: using return value of a shell command as a puppet conditional

Nigel Kersten
Sat, 05 Feb 2011 05:56:58 -0000

On Thu, Feb 3, 2011 at 11:45 AM, Nick Moffitt <nick@zork.net>
wrote:
> Nigel Kersten:
>> On Wed, Feb 2, 2011 at 5:10 PM, Daniel Pittman
<daniel@puppetlabs.com> wrote:
>> > (Also, I went looking and found zero attempts to solve this in a
>> > reusable, FOSS way, let alone working solutions.)
>>
>> Yep. I''ve been dreaming of a Puppet-integrated Password Safe
for a while :)
>
> Alas!  I''m currently enjoying a powerful need for such a thing.
 My one
> need is that someone who compromises a puppet client host
shouldn''t have
> access to the safe except in specific circumstances specified by
> external conditions.
>
> I''d also like a pony.  Have it on my desk by Monday.

I actually did some work on this on the plane recently, re-using the
certificates that nodes already have to do arbitrary encryption and
decryption.

It''s not as seamless as I''d like, I''ve essentially
subclassed the file
type, but it''s giving me some ideas about how we might want to come up
with something more integrated.

I''ll polish it up and put it up on github next week when I get back
from FOSDEM.