PuppetDB gets base64 encoded string on exported ressources

[jocelynthode]

Hey,

I'm trying to use exported resources where one of the parameter of the resource is a variable from hiera. This variable is retrieved using automatic lookup and is encrypted in hiera using hiera-eyaml.

However when the ressource is exported instead of the clear password being exported, I get the base64 encoded version of the clear password as argument. This does not happen if I don't use a hiera-eyaml encrypted password.

I posted on the puppet user list and was redirected here. Henrik Lindberg offered a possible reason as to why this happens in hiera-eyaml. Is there a workaround this issue ?

Puppet-agent version: 6.0.4
Puppetdb version: 6.1.0
Puppetserver version: 6.0.2

P.S.: https://groups.google.com/forum/#!topic/puppet-users/KCyV2Grjfsg

[hlindberg]

There was an issue logged with puppet about this: https://tickets.puppetlabs.com/browse/PUP-9436
The problem manifests itself slightly differently depending on Puppet version - the report in PUP-9436 is for Puppet 6.
Basically, the issue is that Base64.decode returns and ASCII-8BIT encoded Ruby String and this string is taken by Puppet as a binary value - hence it may be Base64 encoded in the output, and in Puppet 6 serialized as rich data of Binary type with a Base64 encoded payload.

The real fix for this is to return an UTF-8 encoded String by simply changing the encoding of the returned Base64.decode. If that change in encoding fails the value is not representable as a String in the rest of the eko-system and hiera-eyaml can then return it as an ASCII-8BIT encoded String - thus, for such string Puppet will treat them as binary.

I think a fix for this is badly needed.