Make certmanager a drop-in for the Python script #1

Merged

benvin merged 4 commits from benvin/drop-in-rewrite into master 2026-09-19 12:46:08 +10:00

Conversation 0 Commits 4 Files Changed 24

+2086 -958

unkin-agent commented 2026-09-19 10:34:22 +10:00

Member

Copy Link

Copy Source

Puppet calls /usr/local/bin/certmanager from generate() with combine: true, so the CLI must take the common name positionally and write nothing to stderr, or the catalog compile dies on a parsejson error instead of failing cleanly.

• Flatten the CLI: drop the pki subcommand, add -a/-i/-e/-c/--json
• Emit ca_certificate so vault.pp stops writing undef to that file
• Read output_path from under vault:, where Puppet writes it
• Bound every Vault request with a timeout; exit non-zero on failure
• Gate TLS verification on vault.tls_skip_verify (default true)
• Restrict auth to approle and kubernetes, no fallback between them
• Release with goreleaser: RPM, raw binaries and checksums on the tag
• Test end to end against a real Vault dev server (make integration-test)

Puppet calls /usr/local/bin/certmanager from generate() with combine: true, so the CLI must take the common name positionally and write nothing to stderr, or the catalog compile dies on a parsejson error instead of failing cleanly. - Flatten the CLI: drop the pki subcommand, add -a/-i/-e/-c/--json - Emit ca_certificate so vault.pp stops writing undef to that file - Read output_path from under vault:, where Puppet writes it - Bound every Vault request with a timeout; exit non-zero on failure - Gate TLS verification on vault.tls_skip_verify (default true) - Restrict auth to approle and kubernetes, no fallback between them - Release with goreleaser: RPM, raw binaries and checksums on the tag - Test end to end against a real Vault dev server (make integration-test)

unkin-agent added 1 commit 2026-09-19 10:34:22 +10:00

Make certmanager a drop-in for the Python script ... b9633481a5

Puppet calls /usr/local/bin/certmanager from generate() with combine: true, so
the CLI must take the common name positionally and keep stderr clean or the
catalog compile dies on a parsejson error.

- Flatten the CLI: drop the pki subcommand, add -a/-i/-e/-c/--json
- Emit ca_certificate so vault.pp stops writing undef to that file
- Read output_path from under vault:, where Puppet writes it
- Bound every Vault request with a timeout; exit non-zero on failure
- Gate TLS verification on vault.tls_skip_verify (default true)
- Restrict auth to approle and kubernetes, no fallback between them
- Remove the SSH half; add Woodpecker CI, nfpm RPM and completions

unkin-agent added 1 commit 2026-09-19 12:12:28 +10:00

Release via goreleaser; test against a real Vault ... 618e1414e4

Replace the nfpm script with .goreleaser.yaml as the single driver for the
RPM, the raw release binaries the compiler initContainer fetches, archives
and checksums. Add an end-to-end test that issues a certificate from a real
Vault dev server over approle.

unkin-agent added 1 commit 2026-09-19 12:20:29 +10:00

Keep test/integration buildable without the integration tag 35e4c58305

unkin-agent added 1 commit 2026-09-19 12:40:07 +10:00

Run dev-mode Vault inside the integration step 8330b32971

benvin merged commit ed05597056 into master 2026-09-19 12:46:08 +10:00

benvin deleted branch benvin/drop-in-rewrite 2026-09-19 12:46:08 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/certmanager#1