Use Sensitive for Secrets

To not reveal Secrets, accept Datatype Sensitive. Render Templates as sensitive Content, if Secrets were given as Sensitive.
voxpupuli · Jul 9, 2024 · fcf3799 · fcf3799
1 parent 5db0077
commit fcf3799
Show file tree

Hide file tree

Showing 18 changed files with 225 additions and 175 deletions.
diff --git a/REFERENCE.md b/REFERENCE.md
@@ -539,7 +539,7 @@ Default value: `$zabbix::params::server_api_user`
 
 ##### <a name="-zabbix--zabbix_api_pass"></a>`zabbix_api_pass`
 
-Data type: `Any`
+Data type: `Variant[Sensitive[String], String]`
 
 Password of the user which connects to the api. Default: zabbix
 
@@ -653,7 +653,7 @@ Default value: `$zabbix::params::server_database_user`
 
 ##### <a name="-zabbix--database_password"></a>`database_password`
 
-Data type: `Any`
+Data type: `Variant[Sensitive[String], String]`
 
 Database password. ignored for sqlite.
 
@@ -1860,7 +1860,16 @@ Default value: `$zabbix::params::agent_timeout`
 
 ##### <a name="-zabbix--agent--tlsaccept"></a>`tlsaccept`
 
-Data type: `Optional[Variant[Array[Enum['unencrypted','psk','cert']],Enum['unencrypted','psk','cert']]]`
+Data type:
+
+```puppet
+Optional[
+    Variant[
+      Array[Enum['unencrypted','psk','cert']],
+      Enum['unencrypted','psk','cert']
+    ]
+  ]
+```
 
 What incoming connections to accept from Zabbix server. Used for a passive proxy, ignored on an active proxy.
 
@@ -2290,7 +2299,7 @@ Default value: `$zabbix::params::server_database_user`
 
 ##### <a name="-zabbix--database--database_password"></a>`database_password`
 
-Data type: `Any`
+Data type: `Variant[Sensitive[String], String]`
 
 The password of the database_user.
 
@@ -2898,7 +2907,7 @@ Default value: `$zabbix::params::proxy_database_user`
 
 ##### <a name="-zabbix--proxy--database_password"></a>`database_password`
 
-Data type: `Any`
+Data type: `Variant[Sensitive[String], String]`
 
 Database password. ignored for sqlite.
 
@@ -3279,7 +3288,16 @@ Default value: `$zabbix::params::proxy_timeout`
 
 ##### <a name="-zabbix--proxy--tlsaccept"></a>`tlsaccept`
 
-Data type: `Optional[Variant[Array[Enum['unencrypted','psk','cert']],Enum['unencrypted','psk','cert']]]`
+Data type:
+
+```puppet
+Optional[
+    Variant[
+      Array[Enum['unencrypted', 'psk', 'cert']],
+      Enum['unencrypted', 'psk', 'cert']
+    ]
+  ]
+```
 
 What incoming connections to accept from Zabbix server. Used for a passive proxy, ignored on an active proxy.
 
@@ -3860,7 +3878,7 @@ API username.
 
 ##### <a name="-zabbix--resources--web--zabbix_pass"></a>`zabbix_pass`
 
-Data type: `String[1]`
+Data type: `Variant[Sensitive[String[1]], String[1]]`
 
 API password.
 
@@ -4269,7 +4287,7 @@ Default value: `$zabbix::params::server_database_user`
 
 ##### <a name="-zabbix--server--database_password"></a>`database_password`
 
-Data type: `Any`
+Data type: `Variant[Sensitive[String], String]`
 
 Database password. ignored for sqlite.
 
@@ -5254,7 +5272,7 @@ Default value: `$zabbix::params::server_api_user`
 
 ##### <a name="-zabbix--web--zabbix_api_pass"></a>`zabbix_api_pass`
 
-Data type: `Any`
+Data type: `Variant[Sensitive[String], String]`
 
 Password of the user which connects to the api. Default: zabbix
 
@@ -5312,7 +5330,7 @@ Default value: `$zabbix::params::server_database_user`
 
 ##### <a name="-zabbix--web--database_password"></a>`database_password`
 
-Data type: `Any`
+Data type: `Variant[Sensitive[String], String]`
 
 Database password. ignored for sqlite.
 

diff --git a/manifests/agent.pp b/manifests/agent.pp
@@ -147,88 +147,93 @@
 #
 # @author Werner Dijkerman [email protected]
 class zabbix::agent (
-  $zabbix_version                                      = $zabbix::params::zabbix_version,
-  $zabbix_package_state                                = $zabbix::params::zabbix_package_state,
-  $zabbix_package_agent                                = $zabbix::params::zabbix_package_agent,
-  Optional[String[1]] $zabbix_package_provider         = $zabbix::params::zabbix_package_provider,
-  Optional[Stdlib::Windowspath] $zabbix_package_source = undef,
-  Boolean $manage_choco                                = $zabbix::params::manage_choco,
-  Boolean $manage_firewall                             = $zabbix::params::manage_firewall,
-  Boolean $manage_repo                                 = $zabbix::params::manage_repo,
-  Boolean $manage_resources                            = $zabbix::params::manage_resources,
-  $monitored_by_proxy                                  = $zabbix::params::monitored_by_proxy,
-  $agent_use_ip                                        = $zabbix::params::agent_use_ip,
-  Variant[String[1],Array[String[1]]] $zbx_groups      = $zabbix::params::agent_zbx_groups,
-  $zbx_group_create                                    = $zabbix::params::agent_zbx_group_create,
-  $zbx_templates                                       = $zabbix::params::agent_zbx_templates,
-  Array[Hash] $zbx_macros                              = [],
-  Integer[1,4] $zbx_interface_type                     = 1,
-  Variant[Array, Hash] $zbx_interface_details          = [],
-  $agent_configfile_path                               = $zabbix::params::agent_configfile_path,
-  $pidfile                                             = $zabbix::params::agent_pidfile,
-  $servicename                                         = $zabbix::params::agent_servicename,
-  Enum['console', 'file', 'system'] $logtype           = $zabbix::params::agent_logtype,
-  Optional[Stdlib::Absolutepath] $logfile              = $zabbix::params::agent_logfile,
-  $logfilesize                                         = $zabbix::params::agent_logfilesize,
-  $debuglevel                                          = $zabbix::params::agent_debuglevel,
-  $sourceip                                            = $zabbix::params::agent_sourceip,
-  Optional[String[1]] $allowkey                        = $zabbix::params::agent_allowkey,
-  Optional[String[1]] $denykey                         = $zabbix::params::agent_denykey,
-  $enableremotecommands                                = $zabbix::params::agent_enableremotecommands,
-  $logremotecommands                                   = $zabbix::params::agent_logremotecommands,
-  $server                                              = $zabbix::params::agent_server,
-  $listenport                                          = $zabbix::params::agent_listenport,
-  $listenip                                            = $zabbix::params::agent_listenip,
-  $startagents                                         = $zabbix::params::agent_startagents,
-  $serveractive                                        = $zabbix::params::agent_serveractive,
-  Stdlib::Ensure::Service $service_ensure              = $zabbix::params::agent_service_ensure,
-  Boolean $service_enable                              = $zabbix::params::agent_service_enable,
-  $hostname                                            = $zabbix::params::agent_hostname,
-  $hostnameitem                                        = $zabbix::params::agent_hostnameitem,
-  $hostmetadata                                        = $zabbix::params::agent_hostmetadata,
-  $hostmetadataitem                                    = $zabbix::params::agent_hostmetadataitem,
-  Optional[Stdlib::Fqdn] $hostinterface                = $zabbix::params::agent_hostinterface,
-  Optional[Stdlib::Fqdn] $hostinterfaceitem            = $zabbix::params::agent_hostinterfaceitem,
-  $refreshactivechecks                                 = $zabbix::params::agent_refreshactivechecks,
-  $buffersend                                          = $zabbix::params::agent_buffersend,
-  $buffersize                                          = $zabbix::params::agent_buffersize,
-  $maxlinespersecond                                   = $zabbix::params::agent_maxlinespersecond,
-  Optional[Array] $zabbix_alias                        = $zabbix::params::agent_zabbix_alias,
-  $timeout                                             = $zabbix::params::agent_timeout,
-  $allowroot                                           = $zabbix::params::agent_allowroot,
-  Optional[String[1]] $zabbix_user                     = $zabbix::params::agent_zabbix_user,
-  $include_dir                                         = $zabbix::params::agent_include,
-  $include_dir_purge                                   = $zabbix::params::agent_include_purge,
-  $unsafeuserparameters                                = $zabbix::params::agent_unsafeuserparameters,
-  $userparameter                                       = $zabbix::params::agent_userparameter,
-  Optional[String[1]] $loadmodulepath                  = $zabbix::params::agent_loadmodulepath,
-  $loadmodule                                          = $zabbix::params::agent_loadmodule,
-  Optional[Variant[Array[Enum['unencrypted','psk','cert']],Enum['unencrypted','psk','cert']]] $tlsaccept = $zabbix::params::agent_tlsaccept,
-  $tlscafile                                           = $zabbix::params::agent_tlscafile,
-  $tlscertfile                                         = $zabbix::params::agent_tlscertfile,
-  Optional[String[1]] $tlscertissuer                   = undef,
-  Optional[String[1]] $tlscertsubject                  = undef,
-  Optional[String[1]] $tlscipherall                    = $zabbix::params::agent_tlscipherall,
-  Optional[String[1]] $tlscipherall13                  = $zabbix::params::agent_tlscipherall13,
-  Optional[String[1]] $tlsciphercert                   = $zabbix::params::agent_tlsciphercert,
-  Optional[String[1]] $tlsciphercert13                 = $zabbix::params::agent_tlsciphercert13,
-  Optional[String[1]] $tlscipherpsk                    = $zabbix::params::agent_tlscipherpsk,
-  Optional[String[1]] $tlscipherpsk13                  = $zabbix::params::agent_tlscipherpsk13,
+  $zabbix_version                                        = $zabbix::params::zabbix_version,
+  $zabbix_package_state                                  = $zabbix::params::zabbix_package_state,
+  $zabbix_package_agent                                  = $zabbix::params::zabbix_package_agent,
+  Optional[String[1]] $zabbix_package_provider           = $zabbix::params::zabbix_package_provider,
+  Optional[Stdlib::Windowspath] $zabbix_package_source   = undef,
+  Boolean $manage_choco                                  = $zabbix::params::manage_choco,
+  Boolean $manage_firewall                               = $zabbix::params::manage_firewall,
+  Boolean $manage_repo                                   = $zabbix::params::manage_repo,
+  Boolean $manage_resources                              = $zabbix::params::manage_resources,
+  $monitored_by_proxy                                    = $zabbix::params::monitored_by_proxy,
+  $agent_use_ip                                          = $zabbix::params::agent_use_ip,
+  Variant[String[1],Array[String[1]]] $zbx_groups        = $zabbix::params::agent_zbx_groups,
+  $zbx_group_create                                      = $zabbix::params::agent_zbx_group_create,
+  $zbx_templates                                         = $zabbix::params::agent_zbx_templates,
+  Array[Hash] $zbx_macros                                = [],
+  Integer[1,4] $zbx_interface_type                       = 1,
+  Variant[Array, Hash] $zbx_interface_details            = [],
+  $agent_configfile_path                                 = $zabbix::params::agent_configfile_path,
+  $pidfile                                               = $zabbix::params::agent_pidfile,
+  $servicename                                           = $zabbix::params::agent_servicename,
+  Enum['console', 'file', 'system'] $logtype             = $zabbix::params::agent_logtype,
+  Optional[Stdlib::Absolutepath] $logfile                = $zabbix::params::agent_logfile,
+  $logfilesize                                           = $zabbix::params::agent_logfilesize,
+  $debuglevel                                            = $zabbix::params::agent_debuglevel,
+  $sourceip                                              = $zabbix::params::agent_sourceip,
+  Optional[String[1]] $allowkey                          = $zabbix::params::agent_allowkey,
+  Optional[String[1]] $denykey                           = $zabbix::params::agent_denykey,
+  $enableremotecommands                                  = $zabbix::params::agent_enableremotecommands,
+  $logremotecommands                                     = $zabbix::params::agent_logremotecommands,
+  $server                                                = $zabbix::params::agent_server,
+  $listenport                                            = $zabbix::params::agent_listenport,
+  $listenip                                              = $zabbix::params::agent_listenip,
+  $startagents                                           = $zabbix::params::agent_startagents,
+  $serveractive                                          = $zabbix::params::agent_serveractive,
+  Stdlib::Ensure::Service $service_ensure                = $zabbix::params::agent_service_ensure,
+  Boolean $service_enable                                = $zabbix::params::agent_service_enable,
+  $hostname                                              = $zabbix::params::agent_hostname,
+  $hostnameitem                                          = $zabbix::params::agent_hostnameitem,
+  $hostmetadata                                          = $zabbix::params::agent_hostmetadata,
+  $hostmetadataitem                                      = $zabbix::params::agent_hostmetadataitem,
+  Optional[Stdlib::Fqdn] $hostinterface                  = $zabbix::params::agent_hostinterface,
+  Optional[Stdlib::Fqdn] $hostinterfaceitem              = $zabbix::params::agent_hostinterfaceitem,
+  $refreshactivechecks                                   = $zabbix::params::agent_refreshactivechecks,
+  $buffersend                                            = $zabbix::params::agent_buffersend,
+  $buffersize                                            = $zabbix::params::agent_buffersize,
+  $maxlinespersecond                                     = $zabbix::params::agent_maxlinespersecond,
+  Optional[Array] $zabbix_alias                          = $zabbix::params::agent_zabbix_alias,
+  $timeout                                               = $zabbix::params::agent_timeout,
+  $allowroot                                             = $zabbix::params::agent_allowroot,
+  Optional[String[1]] $zabbix_user                       = $zabbix::params::agent_zabbix_user,
+  $include_dir                                           = $zabbix::params::agent_include,
+  $include_dir_purge                                     = $zabbix::params::agent_include_purge,
+  $unsafeuserparameters                                  = $zabbix::params::agent_unsafeuserparameters,
+  $userparameter                                         = $zabbix::params::agent_userparameter,
+  Optional[String[1]] $loadmodulepath                    = $zabbix::params::agent_loadmodulepath,
+  $loadmodule                                            = $zabbix::params::agent_loadmodule,
+  Optional[
+    Variant[
+      Array[Enum['unencrypted','psk','cert']],
+      Enum['unencrypted','psk','cert']
+    ]
+  ] $tlsaccept                                           = $zabbix::params::agent_tlsaccept,
+  $tlscafile                                             = $zabbix::params::agent_tlscafile,
+  $tlscertfile                                           = $zabbix::params::agent_tlscertfile,
+  Optional[String[1]] $tlscertissuer                     = undef,
+  Optional[String[1]] $tlscertsubject                    = undef,
+  Optional[String[1]] $tlscipherall                      = $zabbix::params::agent_tlscipherall,
+  Optional[String[1]] $tlscipherall13                    = $zabbix::params::agent_tlscipherall13,
+  Optional[String[1]] $tlsciphercert                     = $zabbix::params::agent_tlsciphercert,
+  Optional[String[1]] $tlsciphercert13                   = $zabbix::params::agent_tlsciphercert13,
+  Optional[String[1]] $tlscipherpsk                      = $zabbix::params::agent_tlscipherpsk,
+  Optional[String[1]] $tlscipherpsk13                    = $zabbix::params::agent_tlscipherpsk13,
   Optional[Enum['unencrypted','psk','cert']] $tlsconnect = $zabbix::params::agent_tlsconnect,
-  $tlscrlfile                                          = $zabbix::params::agent_tlscrlfile,
-  $tlskeyfile                                          = $zabbix::params::agent_tlskeyfile,
-  $tlspskfile                                          = $zabbix::params::agent_tlspskfile,
-  $tlspskidentity                                      = $zabbix::params::agent_tlspskidentity,
-  $tlsservercertissuer                                 = $zabbix::params::agent_tlsservercertissuer,
-  $tlsservercertsubject                                = $zabbix::params::agent_tlsservercertsubject,
-  Optional[String[1]] $agent_config_owner              = $zabbix::params::agent_config_owner,
-  Optional[String[1]] $agent_config_group              = $zabbix::params::agent_config_group,
-  Boolean $manage_selinux                              = $zabbix::params::manage_selinux,
-  Array[String] $selinux_require                       = $zabbix::params::selinux_require,
-  Hash[String, Array] $selinux_rules                   = $zabbix::params::selinux_rules,
-  String $additional_service_params                    = $zabbix::params::additional_service_params,
-  String $service_type                                 = $zabbix::params::service_type,
-  Boolean $manage_startup_script                       = $zabbix::params::manage_startup_script,
+  $tlscrlfile                                            = $zabbix::params::agent_tlscrlfile,
+  $tlskeyfile                                            = $zabbix::params::agent_tlskeyfile,
+  $tlspskfile                                            = $zabbix::params::agent_tlspskfile,
+  $tlspskidentity                                        = $zabbix::params::agent_tlspskidentity,
+  $tlsservercertissuer                                   = $zabbix::params::agent_tlsservercertissuer,
+  $tlsservercertsubject                                  = $zabbix::params::agent_tlsservercertsubject,
+  Optional[String[1]] $agent_config_owner                = $zabbix::params::agent_config_owner,
+  Optional[String[1]] $agent_config_group                = $zabbix::params::agent_config_group,
+  Boolean $manage_selinux                                = $zabbix::params::manage_selinux,
+  Array[String] $selinux_require                         = $zabbix::params::selinux_require,
+  Hash[String, Array] $selinux_rules                     = $zabbix::params::selinux_rules,
+  String $additional_service_params                      = $zabbix::params::additional_service_params,
+  String $service_type                                   = $zabbix::params::service_type,
+  Boolean $manage_startup_script                         = $zabbix::params::manage_startup_script,
 ) inherits zabbix::params {
   $agent2 = $zabbix_package_agent == 'zabbix-agent2'