documentation/admin-guide/puppet/eyaml.md

EYAML Secrets in Hiera

To encrypt data with eyaml you need the hiera-eyaml tool installed on your system.

Encrypt Data

To encrypt data you have to use the public key from your Hiera (data-*) git repository named eyaml_public_key.pem

For the lower layers (global, server or data) it is on the Puppet server at /etc/puppetlabs/keys/eyaml/public_key.pkcs7.pem.

For to encrypt a simple string do

eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem -s secret_string

and for a complete file

eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem -f secret_file

and from pipe

eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem --stdin

Example

To encrypting password for a system you can do like this:
```bash

```bash
# openssl passwd -6 | eyaml encrypt --pkcs7-public-key=eyaml_public_key.pem --stdin
Password: 
Verifying - Password: 
string: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQ...sfLHuai6p+Mdukw/TT1BlKA==]

OR

block: >
  ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBAD
  AFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEA1vyV8J3LYjfBz5zY1PIs9k9zIC
  ...
  c+MJa+CzicugI0Ptyq/anhhfWeDeBnZza1/9OCxWqqf3wEcnhJCmxYxBEOLR
  AxVw2cf3w0wGRuZ0373LHljGTsfLHuai6p+Mdukw/TT1BlKA==]
#

and place either the string or the block at the required place in your Hiera YAML.