How about we add a little comments template in front of each password:

{{{

purpose:

where to change:

impact of public release:

last changed:

}}}

I'm not sure we can do this for all of them in one pass, but we could require this in the new ansible private repo and enforce it there as we move things.

Thoughts?

That works for me. The idea of doing it as we transition to ansible is especially appealing as it gives a definite point where we should be doing this.

Sounds good

The old puppet private repo is retired now, so everything is in ansible and with info.