{"action":"created","issue":{"url":"https://api.github.com/repos/chef/chef/issues/4613","repository_url":"https://api.github.com/repos/chef/chef","labels_url":"https://api.github.com/repos/chef/chef/issues/4613/labels{/name}","comments_url":"https://api.github.com/repos/chef/chef/issues/4613/comments","events_url":"https://api.github.com/repos/chef/chef/issues/4613/events","html_url":"https://github.com/chef/chef/issues/4613","id":135583395,"number":4613,"title":"allow custom resource properties to be marked as sensitive","user":{"login":"bleything","id":270,"avatar_url":"https://avatars.githubusercontent.com/u/270?v=3","gravatar_id":"","url":"https://api.github.com/users/bleything","html_url":"https://github.com/bleything","followers_url":"https://api.github.com/users/bleything/followers","following_url":"https://api.github.com/users/bleything/following{/other_user}","gists_url":"https://api.github.com/users/bleything/gists{/gist_id}","starred_url":"https://api.github.com/users/bleything/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bleything/subscriptions","organizations_url":"https://api.github.com/users/bleything/orgs","repos_url":"https://api.github.com/users/bleything/repos","events_url":"https://api.github.com/users/bleything/events{/privacy}","received_events_url":"https://api.github.com/users/bleything/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-02-22T23:57:14Z","updated_at":"2016-02-23T00:04:58Z","closed_at":null,"body":"## Description\r\n\r\nIt would be super cool if there was a way to tell a custom resource to suppress the output of specific property changes without needing to mark the entire resource as sensitive. Currently if you use `converge_if_changed :property_name` chef-client will emit the old and new values of the property. This happens even if the contents of that block are sensitive resources. The only alternative is to mark the entire resource as sensitive, which may not be desirable.\r\n\r\nMy specific use case is a resource that manages application users. The resource manages a lot of things about the users, so I use `converge_if_changed :property_name` a lot. The only one I care about suppressing is the password. Everything else I'd prefer to see the old and new values in the chef-client output.\r\n\r\nI imagine this as a flag to the property declaration, like `property :x, sensitive: true`. I think that if that option existed then implementing this would only require a small change to `Chef::Provider#converge_if_changed`.\r\n\r\n## Chef Version\r\n\r\n12.7.2\r\n\r\n## Platform Version\r\n\r\nUbuntu 14.04 LTS\r\n\r\n## Replication Case\r\n\r\n**resources/my_cool_user.rb**\r\n\r\n```ruby\r\nresource_name :my_cool_user\r\n\r\nproperty :username, String, name_property: true\r\nproperty :password, String\r\n\r\naction :manage do\r\n  converge_if_changed :password do\r\n    file \"/tmp/#{username}.passwd\" do\r\n      sensitive true\r\n      content password\r\n    end\r\n  end\r\nend\r\n```\r\n\r\n**recipes/default.rb**\r\n\r\n```ruby\r\nmy_cool_user \"normal\" do\r\n  password \"cats\"\r\nend\r\n\r\nmy_cool_user \"sensitive\" do\r\n  sensitive true\r\n  password \"dogs\"\r\nend\r\n```\r\n\r\n## Client Output\r\n\r\nOutput has been trimmed and empty/irrelevant lines removed:\r\n\r\n```\r\n* my_cool_user[normal] action manage\r\n- create normal\r\n-   set password to \"cats\"\r\n* file[/tmp/normal.passwd] action create\r\n- create new file /tmp/normal.passwd\r\n- update content in file /tmp/normal.passwd from none to d93660\r\n- suppressed sensitive resource\r\n\r\n* my_cool_user[sensitive] action manage\r\n- create sensitive\r\n-   set password to (suppressed sensitive property)\r\n* file[/tmp/sensitive.passwd] action create\r\n- create new file /tmp/sensitive.passwd\r\n- update content in file /tmp/sensitive.passwd from none to 23bcd2\r\n- suppressed sensitive resource\r\n```\r\n\r\nThe relevant lines are the `-    set password to...` lines. You can see that in the \"normal\" user the password is emitted even though the resource in the block is marked as sensitive.\r\n"},"comment":{"url":"https://api.github.com/repos/chef/chef/issues/comments/187445061","html_url":"https://github.com/chef/chef/issues/4613#issuecomment-187445061","issue_url":"https://api.github.com/repos/chef/chef/issues/4613","id":187445061,"user":{"login":"bleything","id":270,"avatar_url":"https://avatars.githubusercontent.com/u/270?v=3","gravatar_id":"","url":"https://api.github.com/users/bleything","html_url":"https://github.com/bleything","followers_url":"https://api.github.com/users/bleything/followers","following_url":"https://api.github.com/users/bleything/following{/other_user}","gists_url":"https://api.github.com/users/bleything/gists{/gist_id}","starred_url":"https://api.github.com/users/bleything/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bleything/subscriptions","organizations_url":"https://api.github.com/users/bleything/orgs","repos_url":"https://api.github.com/users/bleything/repos","events_url":"https://api.github.com/users/bleything/events{/privacy}","received_events_url":"https://api.github.com/users/bleything/received_events","type":"User","site_admin":false},"created_at":"2016-02-23T00:04:58Z","updated_at":"2016-02-23T00:04:58Z","body":"Ah, maybe? I asked where to file feature requests in the hangops #chef channel and was told here. Happy to move it, just let me know to where."}}