TomPoulton/hiera-eyaml — pull request #11 by gtmtech (2013-07-30 14:41:57+00:00)
Title: Refactor to allow for encryption plugins

Hi guys,

So I have refactored the hiera-eyaml project as follows:

Firstly the PKCS7 encryption type (also bundled) is now a plugin in lib/hiera/backend/eyaml/encryptors which will allow further encryption types to be added as separate gems. This has just 3 interfaces - encrypt_string, decrypt_string and create_keys. I envisage all further encryption plugins to have only these 3 methods.

The biggest other refactor change is to limit the size of the eyaml tool - I have separated out different actions into the actions directory, and separated the CLI off into its own class. This is mainly because large ruby files become unreadable. A bunch of generic utils which didn't really fit anywhere else go in utils.rb

So the eyaml tool itself merely calls the CLI, the CLI's sole job is to parse the command-line, and return an options hash detailing the work to do. The tool then executes these "instructions" using the relevant action class. At the point where a decrypt/encrypt is necessary, a specific encryptor (Pkcs7) is invoked with parent class Encryptor. The parent class does much of the heavy lifting, in a generic way, deferring the actual decrypting/encrypting of the strings to the specific encryptor where necessary.

The flags are largely speaking the same, but have slightly changed in places - please refamiliarise yourself with them.

Finally, it is of course now necessary to state in .eyaml files which encryption method was used to encrypt a string/block of text. The format: ENC[PKCS7,..........] is used as the base64encoded string never contains commas. Likewise in edit mode, the string is temporarily decrypted to use the tag DEC::PKCS7[.........]! - This seemed the be the least "noisy" way of doing so (I started with ENC! and !ENC, but it didn't read easy on the eyes.

I have tested all my testcases and tried it in a real puppet/hiera setup and it works fine, however there may be the odd small bug here and there, so give it a test and feel free to report back if you find anything that needs fixing.

The edit mode of the eyaml tool is particularly useful now, and this will be invaluable to me, so many thanks to Simon for his initial work on this.

Enjoy!