Xtykutl

I encrypted password using hiera:

dsc_xADUser {'FirstUser':



            dsc_ensure => 'present',

            dsc_domainname => 'ad.contoso.com',

            dsc_username   => 'tfl',

            dsc_userprincipalname => 'tfl@ad.contoso.com',

            dsc_password   => {

            'user' => 'tfl@ad.contoso.com',

            'password' => Sensitive(lookup('password'))

            },

            dsc_passwordneverexpires => true,

            dsc_domainadministratorcredential => {

            'user'  => 'Administrator@ad.contoso.com',

            'password' => Sensitive(lookup('password'))

            },



        }

but on node,when running agent -t -v password is shown as plain text in agent output and in catalog JSON file.

I also tried node_encrypt(lookup('password')) then getting content of my encrypted password (which is good) and windows complains that password doesn't meet password complexity (bad-because it's trying to set all below as password)

 'password' = '-----BEGIN PKCS7-----

    MIIMyQYJKoZIhvcNAQcDoIIMujCCDLYCAQAxggKdMIICmQIBADCBgjB9MXsweQYD

    VQQDDHJQdXBwZXQgRW50ZXJwcmlzZSBDQSBnZW5lcmF0ZWQgb24gbXlwdXBwZXQt

    eGwwZGJ5a212Z2xrYnl2eS5ldS13ZXN0LTEub3Bzd29ya3MtY20uaW8gYXQgKzIw

    MTgtMTEtMDIgMTQ6MDQ6MDAgKzAwMDACAQUwCwYJKoZIhvcNAQEBBIICABkJDfGb

    4CdHUntrVR1E......

hiera config:

---

version: 5

defaults:

  datadir: data

  data_hash: yaml_data



hierarchy:

  - name: "Eyaml hierarchy"

    lookup_key: eyaml_lookup_key # eyaml backend

    paths:

      - "nodes/%{trusted.certname}.yaml"

      - "windowspass.eyaml"

    options:

        pkcs7_private_key: "/etc/puppetlabs/puppet/keys/private_key.pkcs7.pem"

        pkcs7_public_key: "/etc/puppetlabs/puppet/keys/public_key.pkcs7.pem"

EDIT: just found this, it seems it's opened issue and related to Windows only

UPDATE: i managed to configure puppet not to cache catalog file on Windows client (adding catalog_cache_terminus="" to puppet config file on windows so i'll use this as "workaround", it seems no way to remove passwords from agent debug output