I wrote a custom hiera backend for trocla. Would you be interested in it?

I made some design decisions open for discussion:

• To get additional parameters for the trocla function on a per-password basis, the lookup function of the custom backend does itself do hiera lookups.
• To prevent loops, the backend only reacts to namespace trocla::password:: and does all additional lookups into trocla::options::

This means that password creation has to be triggered via explicit hiera function interpolation lookups such as:

kerberos::kdc_database_password: "%{hiera('trocla::password::kdc_database_password')}"

I looked into just adding a "%{trocla('<key>')}" function but there's no API for that and the existing functions hiera and scope are pretty hard-coded in the hiera source. Getting trocla-support in there without adding a whole extension function API is unlikely.

• It implements the actual hiera hierarchy by pre-pending the hiera path to the trocla key as hiera/<source>/<trocla_key>. This way, the same trocla key could yield different passwords for different groups of machines. I'm not sure, how much use this would actually be in practice. Also, that key would need to be initialised externally, e.g by calling trocla('hiera/osfamily/Debian/jessie/root' in site.pp. Alternatively we could use hiera's concept of datafiles to look into different trocla password stores. But this would need somehow providing different troclarcs as well.

Only reacts to key namespace trocla::password::<trocla_key>. Looks up
additional parameters via hiera itself as
trocla::options::<trocla_key>::format (string) and
trocla::options::<trocla_key>::options (hash). Looks for <trocla_key> in
trocla as hiera/<source>/<trocla> with <source> iterating over the
configured hiera hierarchy. If not found, creates and returns a new
password with trocla key <trocla_key>.

example entry in hiera.yaml:

backends:
  - ...
  - trocla
trocla:
  - configfile: /etc/puppet/troclarc.yaml
  - format: plain
  - options:
    length: 16

example usage in hiera yaml file:

kerberos::kdc_database_password: "%{hiera('trocla::password::kdc_database_password')}"
trocla::options::kdc_database_password::format: 'plain'
trocla::options::kdc_database_password::options:
  length: '71'