{"action":"created","issue":{"url":"https://api.github.com/repos/sensu/sensu-go/issues/1437","repository_url":"https://api.github.com/repos/sensu/sensu-go","labels_url":"https://api.github.com/repos/sensu/sensu-go/issues/1437/labels{/name}","comments_url":"https://api.github.com/repos/sensu/sensu-go/issues/1437/comments","events_url":"https://api.github.com/repos/sensu/sensu-go/issues/1437/events","html_url":"https://github.com/sensu/sensu-go/issues/1437","id":319990057,"node_id":"MDU6SXNzdWUzMTk5OTAwNTc=","number":1437,"title":"sensuctl does not provider a way to get the value of a password for a user","user":{"login":"ghoneycutt","id":313891,"node_id":"MDQ6VXNlcjMxMzg5MQ==","avatar_url":"https://avatars3.githubusercontent.com/u/313891?v=4","gravatar_id":"","url":"https://api.github.com/users/ghoneycutt","html_url":"https://github.com/ghoneycutt","followers_url":"https://api.github.com/users/ghoneycutt/followers","following_url":"https://api.github.com/users/ghoneycutt/following{/other_user}","gists_url":"https://api.github.com/users/ghoneycutt/gists{/gist_id}","starred_url":"https://api.github.com/users/ghoneycutt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghoneycutt/subscriptions","organizations_url":"https://api.github.com/users/ghoneycutt/orgs","repos_url":"https://api.github.com/users/ghoneycutt/repos","events_url":"https://api.github.com/users/ghoneycutt/events{/privacy}","received_events_url":"https://api.github.com/users/ghoneycutt/received_events","type":"User","site_admin":false},"labels":[{"id":942597844,"node_id":"MDU6TGFiZWw5NDI1OTc4NDQ=","url":"https://api.github.com/repos/sensu/sensu-go/labels/config-management","name":"config-management","color":"ead198","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-05-03T16:21:13Z","updated_at":"2018-07-01T21:29:44Z","closed_at":null,"author_association":"MEMBER","body":"Configuration management tools need both get and set methods to ensure idempotency. We do a get to see if the system is in the desired state and if not, then do a set. If there is no get, then the set always runs, which is not idempotent.\r\n\r\n`sensuctl user list` does not have a way to get the password, so there is no idempotent way to set the password.\r\n\r\n## Expected Behavior\r\n`sensuctl user list` has a way of showing the actual password or a hashed password. This way it can be matched against desired state and the configuration management tool can decide if the password needs to be updated.\r\n\r\n## Current Behavior\r\n`sensuctl user list` does not allow you to see the current state with regards to a user's password.\r\n\r\n## Possible Solution\r\nOutput a sha256 hash of the password.\r\nOnly allow the `admin` role to do so.\r\n\r\n## Context\r\nThis is needed for configuration management tools to act in an idempotent way.\r\n\r\n## Your Environment\r\n* Sensu version used (sensuctl, sensu-backend, and/or sensu-agent):\r\n\r\n`sensu-ctl version dev-nightly#cc2ded6, build cc2ded623f0646610c0d3135430544dc2993169b, built 2018-05-03T09:26:06+0000`\r\n\r\n* Installation method (packages, binaries, docker etc.): packages\r\n\r\n* Operating System and version (e.g. Ubuntu 14.04): EL7"},"comment":{"url":"https://api.github.com/repos/sensu/sensu-go/issues/comments/401634563","html_url":"https://github.com/sensu/sensu-go/issues/1437#issuecomment-401634563","issue_url":"https://api.github.com/repos/sensu/sensu-go/issues/1437","id":401634563,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTYzNDU2Mw==","user":{"login":"treydock","id":739622,"node_id":"MDQ6VXNlcjczOTYyMg==","avatar_url":"https://avatars1.githubusercontent.com/u/739622?v=4","gravatar_id":"","url":"https://api.github.com/users/treydock","html_url":"https://github.com/treydock","followers_url":"https://api.github.com/users/treydock/followers","following_url":"https://api.github.com/users/treydock/following{/other_user}","gists_url":"https://api.github.com/users/treydock/gists{/gist_id}","starred_url":"https://api.github.com/users/treydock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/treydock/subscriptions","organizations_url":"https://api.github.com/users/treydock/orgs","repos_url":"https://api.github.com/users/treydock/repos","events_url":"https://api.github.com/users/treydock/events{/privacy}","received_events_url":"https://api.github.com/users/treydock/received_events","type":"User","site_admin":false},"created_at":"2018-07-01T21:29:44Z","updated_at":"2018-07-01T21:29:44Z","author_association":"NONE","body":"@echlebek Passing the hash with `sensuctl create` would be half of what would be needed.  In order for the same code in Puppet to handle both `sensuctl create` and the necessary `sensuctl configure` for admin password changes, both would have to accept the hash.  We could technically do the `sensuctl configure` using a plain text password in Puppet code (Exec) and not Ruby provider but that's less ideal."}}
{"actor":{"display_login":"treydock"}}