This message was deleted.

What should be used instead of eyaml for encrypted hiera data? Should the workaround sentence say "... you can use a non-FIPS-enabled primary server with FIPS-enabled agents, which limits the issue to situations where only the primary uses the Ruby Library"?

Yeah, I think you’re right. I don’t think we have a great answer on what to use instead. Probably something like Vault with https://forge.puppet.com/modules/petems/hiera_vault.

Ugh, vault. More infrastructure. unhappyduck