bootstrap token is sensitive, node_token is not

[rwaffen]

when defining a bootstrap_token and handing it over to a node like this:

lookup_options:
  k8s::server::resources::bootstrap::secret:
    convert_to: Sensitive

k8s::server::resources::bootstrap::secret:  foo4567890foobar
k8s::node::node_token: "puppet.%{lookup('k8s::server::resources::bootstrap::secret')}"

you end up with a /srv/kubernetes/bootstrap-kubelet.kubeconf on the node like this:

...
users:
- name: default
  user:
    token: puppet.Sensitive [value redacted]

[ananace]

The PR in question will of course only match the token itself, a Hiera-based lookup like you've posted might not result in the wanted result - since you're string-concatenating inside Hiera itself.

[rwaffen]

yes i came up to this conclusion myself 🤦 .one cannot string interpolate with sensitive strings 🤔

[ananace]

I've had a thought on this, expanding the token to allow passing it either as a sensitive string or as a struct - with an ID and a secret that's sensitive.

Your example config should then be possible, just in the form of;

lookup_options:
  k8s::server::resources::bootstrap::secret:
    convert_to: Sensitive

k8s::server::resources::bootstrap::secret:  foo4567890foobar
k8s::node::node_token:
  id: puppet
  secret: "%{alias('k8s::server::resources::bootstrap::secret')}"