Permit the use of type Sensitive

[m8t]

Permit the use of type Sensitive to pass credentials to the Gitlab class, in order to hide those credentials from PuppetDB.

For example LDAP credentials can be used and the binding password is pass as such:

gitlab::gitlab_rails:
  ldap_enabled: true
  ldap_servers:
    myldapserver:
      bind_dn: 'MYBINDDN'
      password: 'MYBINDPW'

To hide password from PuppetDB, the attribute gitlab::gitlab_rails needs to be passed as type Sensitive to the class.

Other sensitive information besides gitlab_rails might exist.

[m8t]

In the PR #487 it is possible to hide the class attribute gitlab::gitlab_rails.

To fully hide the credentials from PuppetDB, the following patch can hide the content of the generated template:

diff --git a/manifests/omnibus_config.pp b/manifests/omnibus_config.pp
index bcef084..5182589 100644
--- a/manifests/omnibus_config.pp
+++ b/manifests/omnibus_config.pp
@@ -121,7 +121,7 @@ class gitlab::omnibus_config (
     } else {
       file { $config_file:
         *       => $config_file_attributes,
-        content => template('gitlab/gitlab.rb.erb');
+        content => Sensitive(template('gitlab/gitlab.rb.erb'));
       }
     }
   }

This affects the output of Puppet agent, where no content diff will ever be printed out. Such behavior change should be optional for the user however. Not sure what is the best way to address this.

Other solution is an EPP template which officially supports Sensitive type.