Hiera & encrypted data

Separate data from code; eyaml secrets.

Advanced14 min · lesson 9 of 12

Hiera is Puppet’s data-separation system: instead of hard-coding values in manifests, you look them up from a hierarchy of YAML (or JSON/eyaml) data files, ordered from most specific (this node) to most general (defaults). Puppet even does automatic parameter lookup — a class parameter is filled from Hiera by the key module::param — so manifests stay generic code and all the environment-specific values live in data.

HIERA LOOKUP ORDER

1Per-node

nodes/%{trusted.certname}.yaml — most specific

2Per-OS

os/%{facts.os.family}.yaml

3Common

common.yaml — defaults

4Resolved value

first match wins; class params auto-looked-up by module::param

Puppet walks the hierarchy top-down and resolves each key on first match, so a node-specific value overrides the OS and common defaults.

hiera.yaml

version: 5
hierarchy:
  - name: 'Per-node'
    path: 'nodes/%{trusted.certname}.yaml'
  - name: 'Per-OS'
    path: 'os/%{facts.os.family}.yaml'
  - name: 'Common'
    path: 'common.yaml'

data/common.yaml

nginx::workers: 4
nginx::port: 80
---
# data/nodes/web1.acme.internal.yaml overrides just for that node:
nginx::port: 8080

Encrypted secrets with eyaml

Secrets in Hiera use hiera-eyaml, which encrypts individual values with a public/private key pair — the ciphertext lives safely in Git, and the Puppet master decrypts at catalog-compile time with the private key. So a database password sits in your data repo as an ENC[...] blob, readable to Puppet but not to anyone browsing the repo. It is the Puppet equivalent of Ansible Vault or SOPS.

data/secrets.eyaml

db::password: >
  ENC[PKCS7,MIIBiQYJKoZIhvcN...]     # encrypted; safe in version control
# eyaml encrypt -l 'db::password' -s 'S3cr3t!'  produces this
# the master decrypts with its private key at compile time

Data separation is also a security boundary

Hiera keeps secrets out of manifests, but the eyaml private key on the master is now the key to every secret — protect it with tight file permissions and treat the master as a crown-jewel host. And the automatic-lookup convenience means a mis-scoped Hiera key can silently apply the wrong (or a more privileged) value to a node; keep the hierarchy simple and review data changes like code.

Modules & the ForgeRoles & profiles