redacting passwords from catalogue output

[jaxxstorm]

I previously added the ability to use sensu's redaction feature to this module. I'd now like to stop the passwords that are set in sensu::client_custom being output into the catalogue output. Currently, you see things like this:

custom changed 'healthcheck => {"password"=>"a_password"}' to 'sensu => {"api"=>{"password"=>"another_password"}}'

This is suboptimal :)

There are 2 options, and I'd like to see which people think are best.

I can add an option so that the diff's aren't shown on sensu::custom or add another parameter, maybe sensu::sensitive_values and then have that ALWAYS not show diffs.

Thoughts?

[ghoneycutt]

Related to issue #682 to use Puppet v4's data types. We can use the sensitive data type for passwords.

https://docs.puppet.com/puppet/4.10/lang_data_sensitive.html

[jeffmccune]

With the use of Sensitive, we'll need to drop support for Puppet 4.5.0.

[ghoneycutt]

I'm OK with that as we still support the last five versions.

[ghoneycutt]

Puppet does not yet have the ability to test the usage of the Sensitive data type. Without this, we can't test and ultimately support it. Once this is testable, let's support it.