Fixes #33733 - generate key for db encryption

[jlsherrill]

No description provided.

[jlsherrill]

I'll write a test for this, but wanted to get some initial impressions

[jlsherrill]

not sure if there's more to test here, but i added a test

[jlsherrill]

🟢 i don't have merge access

[wbclark]

I previously took a stab at this with #205 , using a puppet function to wrap Ruby's SecureRandom.urlsafe_base64(32) rather than relying on an exec and openssl. Longer term if we want to avoid the exec, that idea may be worth revisiting.

[wbclark]

Does the file resource require show_diff => false ? Since it manages only attributes other than the file contents

Is the key visible in puppet logs when the exec resource is evaluated?

[ehelms]

Does the file resource require show_diff => false ? Since it manages only attributes other than the file contents

Is the key visible in puppet logs when the exec resource is evaluated?

Good question, if I look at the test output:

  Notice: /Stage[main]/Pulpcore::Config/Exec[Create database symmetric key]/returns: executed successfully
  Notice: /Stage[main]/Pulpcore::Config/Exec[Create database symmetric key]: Triggered 'refresh' from 1 event
  Notice: /Stage[main]/Pulpcore::Config/File[/etc/pulp/certs/database_fields.symmetric.key]/group: group changed 'root' to 'pulp'
  Notice: /Stage[main]/Pulpcore::Config/File[/etc/pulp/certs/database_fields.symmetric.key]/mode: mode changed '0644' to '0640'

[jlsherrill]

sorry @wbclark didn't realize you had been working on this!

[ekohl]

Notice: /Stage[main]/Pulpcore::Config/File[/etc/pulp/certs/database_fields.symmetric.key]/mode: mode changed '0644' to '0640'

This does bring a good point. We should set umask on exec so there isn't a short window where it is world readable.