Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: All
• Ruby: All
• Distribution: All
• Module version: All

How to reproduce (e.g Puppet code you use)

https://github.com/voxpupuli/puppet-gitlab/blob/master/manifests/omnibus_config.pp#L110-L121 should have show_diff set to false.

Given the discussion in #301, users can no longer set the root password after gitlab has been initially configured. Given this, the root password must be passed into the configuration file directly and will be output to the resource diff when updated which leaks the password into the logs.

Alternatively, the entire content string could be marked as Sensitive.

The ability to set the root password securely would be preferred.

What behaviour did you expect instead

Sensitive information should not be leaked into the run logs.