git commit -m "fix: configure PuppetDB HTTPS connections and add Puppetboard SSL support (#50)

- Update PuppetDB connections from HTTP (8080) to HTTPS (8081) - Add automatic certificate generation for Puppetboard using Puppet CA - Implement initContainers for proper certificate provisioning before app start - Add dedicated PVC for Puppetboard certificates with RWX access - Configure SSL verification and client authentication for secure PuppetDB access Reviewed-on: #50
2026-03-19 16:34:41 +11:00
parent 301f8dcc1a
commit 24d09744e3
6 changed files with 137 additions and 4 deletions
@@ -29,6 +29,110 @@ spec:
        app.kubernetes.io/version: 8.8.0
    spec:
      enableServiceLinks: false
+      initContainers:
+        - name: wait-puppetserver
+          image: curlimages/curl:8.11.1
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              echo 'Waiting for puppetserver to become ready...'
+              until printf "." && curl --silent --fail --insecure 'https://puppetca:8140/status/v1/simple' | grep -q '^running$'; do
+                sleep 2;
+              done;
+              echo 'Puppetserver OK ✓'
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 20m
+              memory: 32Mi
+        - name: cert-generator
+          image: git.unkin.net/unkin/almalinux9-base:20260308
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+
+              # Set the hostname for the certificate
+              HOSTNAME="puppetboard"
+              CERT_DIR="/opt/puppetboard/ssl"
+
+              # Create certificate directory
+              mkdir -p ${CERT_DIR}
+
+              # Check if certificates already exist
+              if [ -f "${CERT_DIR}/${HOSTNAME}.pem" ] && [ -f "${CERT_DIR}/${HOSTNAME}.key" ] && [ -f "${CERT_DIR}/ca.pem" ]; then
+                echo "Certificates already exist for ${HOSTNAME}, skipping generation"
+                exit 0
+              fi
+
+              # Request certificate from Puppet CA for Puppetboard
+              echo "Requesting certificate for ${HOSTNAME} from puppetca service"
+
+              # Generate private key
+              openssl genrsa -out ${CERT_DIR}/${HOSTNAME}.key 2048
+
+              # Create certificate signing request (CSR)
+              openssl req -new -key ${CERT_DIR}/${HOSTNAME}.key \
+                -out /tmp/${HOSTNAME}.csr \
+                -subj "/CN=${HOSTNAME}"
+
+              # Submit CSR to Puppet CA
+              echo "Submitting certificate request to Puppet CA..."
+              curl -X PUT \
+                --insecure \
+                --data-binary @/tmp/${HOSTNAME}.csr \
+                -H "Content-Type: text/plain" \
+                https://puppetca:8140/puppet-ca/v1/certificate_request/${HOSTNAME}
+
+              # Wait for certificate to be signed (poll the CA)
+              echo "Waiting for certificate to be signed..."
+              for i in {1..30}; do
+                if curl --insecure -f -s https://puppetca:8140/puppet-ca/v1/certificate/${HOSTNAME} > ${CERT_DIR}/${HOSTNAME}.pem; then
+                  echo "Certificate received for ${HOSTNAME}"
+                  break
+                fi
+                echo "Attempt $i: Certificate not ready yet, waiting 10 seconds..."
+                sleep 10
+              done
+
+              # Verify we got the certificate
+              if [ ! -f "${CERT_DIR}/${HOSTNAME}.pem" ] || [ ! -s "${CERT_DIR}/${HOSTNAME}.pem" ]; then
+                echo "Failed to obtain certificate for ${HOSTNAME}"
+                exit 1
+              fi
+
+              # Get CA certificate
+              curl --insecure -f https://puppetca:8140/puppet-ca/v1/certificate/ca > ${CERT_DIR}/ca.pem
+
+              # Set appropriate permissions
+              chmod 644 ${CERT_DIR}/${HOSTNAME}.pem
+              chmod 600 ${CERT_DIR}/${HOSTNAME}.key
+              chmod 644 ${CERT_DIR}/ca.pem
+
+              # Change ownership to puppetboard user (1000:1000)
+              chown -R 1000:1000 ${CERT_DIR}
+
+              echo "Certificate generation completed for ${HOSTNAME}"
+          volumeMounts:
+            - name: puppetboard-certs
+              mountPath: /opt/puppetboard/ssl
+          resources:
+            limits:
+              cpu: 100m
+              memory: 128Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: true
      containers:
        - name: puppetboard
          image: ghcr.io/voxpupuli/puppetboard:7.0.1
@@ -56,3 +160,11 @@ spec:
            capabilities:
              drop:
                - all
+          volumeMounts:
+            - name: puppetboard-certs
+              mountPath: /opt/puppetboard/ssl
+              readOnly: true
+      volumes:
+        - name: puppetboard-certs
+          persistentVolumeClaim:
+            claimName: puppetboard-certs