Ben Vincent
fe296d52d9
- add puppet service - add puppetca service - add ability to write to puppet/puppetca service in consul - add puppet.(query,service).consul to dns_alt_names of all masters - add puppetca.(query,service).consul to dns_alt_names of puppetca
57 lines
1.6 KiB
Puppet
57 lines
1.6 KiB
Puppet
# Class: profiles::puppet::puppetca
|
|
#
|
|
# This class manages Puppet CA
|
|
class profiles::puppet::puppetca (
|
|
Boolean $allow_subject_alt_names = false,
|
|
Boolean $allow_authorization_extensions = false,
|
|
Boolean $enable_infra_crl = false,
|
|
Boolean $is_puppetca = false,
|
|
) {
|
|
|
|
# manage the ca.cfg file
|
|
file { '/etc/puppetlabs/puppetserver/conf.d/ca.conf':
|
|
ensure => 'file',
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
content => template('profiles/puppet/puppet_ca.cfg.erb'),
|
|
notify => Service['puppetserver'],
|
|
}
|
|
|
|
# manage the crl file
|
|
if $is_puppetca {
|
|
# export the puppet crl.pem
|
|
@@file { '/etc/puppetlabs/puppet/ssl/crl.pem':
|
|
ensure => file,
|
|
content => file('/etc/puppetlabs/puppet/ssl/crl.pem'),
|
|
tag => 'crl_pem_export',
|
|
}
|
|
}else{
|
|
# import the puppet crl.pem
|
|
File <<| tag == 'crl_pem_export' |>> {
|
|
require => Service['puppetserver'],
|
|
}
|
|
}
|
|
|
|
# register the PuppetCA service with consul
|
|
if $is_puppetca {
|
|
consul::service { 'puppetca':
|
|
service_name => 'puppetca',
|
|
tags => ['ca', 'puppet', 'ssl'],
|
|
address => $facts['networking']['ip'],
|
|
port => 8140,
|
|
checks => [
|
|
{
|
|
id => 'puppetca_https_check',
|
|
name => 'PuppetCA HTTPS Check',
|
|
http => "https://${facts['networking']['fqdn']}:8140/status/v1/simple",
|
|
method => 'GET',
|
|
tls_skip_verify => true,
|
|
interval => '10s',
|
|
timeout => '1s',
|
|
}
|
|
],
|
|
}
|
|
}
|
|
}
|