Alexandros Kosiaris has uploaded a new change for review. (
https://gerrit.wikimedia.org/r/344603 )
Change subject: base::expose_puppet_certs: Also provide a keypair
......................................................................
base::expose_puppet_certs: Also provide a keypair
Expose a keypair from base::expose_puppet_certs for applications like
bacula that require such an item for operations
Bug: T161281
Change-Id: Ie8a661301bd3bd466e35576d3396e47c4a2dbaea
---
M modules/base/manifests/expose_puppet_certs.pp
1 file changed, 33 insertions(+), 4 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/03/344603/1
diff --git a/modules/base/manifests/expose_puppet_certs.pp
b/modules/base/manifests/expose_puppet_certs.pp
index f4c4e68..8fd8b32 100644
--- a/modules/base/manifests/expose_puppet_certs.pp
+++ b/modules/base/manifests/expose_puppet_certs.pp
@@ -12,19 +12,27 @@
#
# [*ensure*]
# If 'present', certificates will be exposed, otherwise they will be removed.
+# Defaults to true
#
# [*provide_private*]
-# Should the private keys also be exposed?
+# Should the private keys also be exposed? Defaults to false
+#
+# [*provide_keypair*]
+# Should the single file containing concatenated the private key and the cert
+# be exposed? The order is [key, cert] Defaults to false. Unrelated to
+# provide_private parameter
#
# [*user/group*]
-# User who will own the exposed SSL certificates.
+# User who will own the exposed SSL certificates. Default to root
#
# [*ssldir*]
-# The source directory containing the original SSL certificates.
+# The source directory containing the original SSL certificates. Avoid
+# supplying this unless you know what you are doing
#
define base::expose_puppet_certs(
$ensure = 'present',
$provide_private = false,
+ $provide_keypair = false,
$user = 'root',
$group = 'root',
$ssldir = puppet_ssldir(),
@@ -50,6 +58,7 @@
source => "${ssldir}/certs/${puppet_cert_name}.pem",
}
+ # Provide the private key
$private_key_ensure = $ensure ? {
'present' => $provide_private ? {
true => 'present',
@@ -57,10 +66,30 @@
},
default => 'absent',
}
-
file { "${target_basedir}/ssl/server.key":
ensure => $private_key_ensure,
mode => '0400',
source => "${ssldir}/private_keys/${puppet_cert_name}.pem",
}
+
+ # Provide a keypair of key and cert concatenated. The file resource is used
+ # to ensure file attributes/presence and the exec resource the contents
+ $keypair_ensure = $ensure ? {
+ 'present' => $provide_keypair ? {
+ true => 'present',
+ default => 'absent',
+ },
+ default => 'absent',
+ }
+ file { "${target_basedir}/ssl/server-keypair.pem":
+ ensure => $keypair_ensure,
+ mode => '0400',
+ }
+ exec { "create-${title}-keypair":
+ creates => "${target_basedir}/ssl/server-keypair.pem",
+ command => "/bin/cat \
+ ${ssldir}/private_keys/${puppet_cert_name}.pem \
+ ${ssldir}/certs/${puppet_cert_name}.pem \
+ > ${target_basedir}/ssl/server-keypair.pem",
+ }
}
--
To view, visit https://gerrit.wikimedia.org/r/344603
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ie8a661301bd3bd466e35576d3396e47c4a2dbaea
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Alexandros Kosiaris <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
