Fix command to generate Puppetserver CA certs for load balancer #3398
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The PR preview for 2323834 is available at theforeman-foreman-documentation-preview-pr-3398.surge.sh The following output files are affected by this PR: |
|
@ekohl Hi, Ewoud! Would you be able to confirm technical accuracy on this one with your current knowledge? |
Lennonka
changed the title
ekohl
requested changes
Oct 31, 2024
There was a problem hiding this comment.
I had to take a close look at this and many comments are mostly my notes of what I did.
It largely looks OK, though we should use systemctl stop puppetserver and systemctl start puppetserver if we stop/start the service. But I also raised the question if we need to do that in the first place because I don't think it's needed.
The other big thing is that the default certs and custom certs files should almost entirely be the same. For this PR I have no preference whether you do that manually now or properly with snippets and/or macros, though I'd like to see the latter in the long term.
...mart-proxy-server-with-custom-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Outdated
Show resolved
Hide resolved
...art-proxy-server-with-default-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Show resolved
Hide resolved
...mart-proxy-server-with-custom-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Show resolved
Hide resolved
Comment on lines
69
to
80
| * `/etc/puppetlabs/puppet/ssl/certs/ca.pem` | ||
| * `/etc/puppetlabs/puppet/ssl/certs/{smartproxy-example-com}.pem` | ||
| * `/etc/puppetlabs/puppet/ssl/private_keys/{smartproxy-example-com}.pem` | ||
| * `/etc/puppetlabs/puppet/ssl/public_keys/{smartproxy-example-com}.pem` | ||
| * `/etc/puppetlabs/puppetserver/ca/signed/{smartproxy-example-com}.pem` |
There was a problem hiding this comment.
I recall there was a split in this area. You have 2 directories with files now: /etc/puppetlabs/puppet/ssl for the client (puppet-agent) and /etc/puppetlabs/puppetserver/ca/ for the server (puppetserver).
For my own notes, what happens:
# dnf install puppetserver --quiet --yes
# puppet config set server $HOSTNAME
# find /etc/puppetlabs/
/etc/puppetlabs/
/etc/puppetlabs/code
/etc/puppetlabs/code/environments
/etc/puppetlabs/code/environments/production
/etc/puppetlabs/code/environments/production/data
/etc/puppetlabs/code/environments/production/manifests
/etc/puppetlabs/code/environments/production/modules
/etc/puppetlabs/code/environments/production/environment.conf
/etc/puppetlabs/code/environments/production/hiera.yaml
/etc/puppetlabs/code/modules
/etc/puppetlabs/puppet
/etc/puppetlabs/puppet/hiera.yaml
/etc/puppetlabs/puppet/puppet.conf
/etc/puppetlabs/puppet/ssl
/etc/puppetlabs/pxp-agent
/etc/puppetlabs/pxp-agent/modules
/etc/puppetlabs/puppetserver
/etc/puppetlabs/puppetserver/conf.d
/etc/puppetlabs/puppetserver/conf.d/auth.conf
/etc/puppetlabs/puppetserver/conf.d/ca.conf
/etc/puppetlabs/puppetserver/conf.d/global.conf
/etc/puppetlabs/puppetserver/conf.d/metrics.conf
/etc/puppetlabs/puppetserver/conf.d/puppetserver.conf
/etc/puppetlabs/puppetserver/conf.d/web-routes.conf
/etc/puppetlabs/puppetserver/conf.d/webserver.conf
/etc/puppetlabs/puppetserver/services.d
/etc/puppetlabs/puppetserver/services.d/ca.cfg
/etc/puppetlabs/puppetserver/logback.xml
/etc/puppetlabs/puppetserver/request-logging.xml
# puppetserver ca setup
Generation succeeded. Find your files in /etc/puppetlabs/puppetserver/ca
# find /etc/puppetlabs/
/etc/puppetlabs/
/etc/puppetlabs/code
/etc/puppetlabs/code/environments
/etc/puppetlabs/code/environments/production
/etc/puppetlabs/code/environments/production/data
/etc/puppetlabs/code/environments/production/manifests
/etc/puppetlabs/code/environments/production/modules
/etc/puppetlabs/code/environments/production/environment.conf
/etc/puppetlabs/code/environments/production/hiera.yaml
/etc/puppetlabs/code/modules
/etc/puppetlabs/puppet
/etc/puppetlabs/puppet/hiera.yaml
/etc/puppetlabs/puppet/puppet.conf
/etc/puppetlabs/puppet/ssl
/etc/puppetlabs/puppet/ssl/certs
/etc/puppetlabs/puppet/ssl/certs/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppet/ssl/certs/ca.pem
/etc/puppetlabs/puppet/ssl/private_keys
/etc/puppetlabs/puppet/ssl/private_keys/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppet/ssl/public_keys
/etc/puppetlabs/puppet/ssl/public_keys/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppet/ssl/crl.pem
/etc/puppetlabs/puppet/ssl/ca
/etc/puppetlabs/pxp-agent
/etc/puppetlabs/pxp-agent/modules
/etc/puppetlabs/puppetserver
/etc/puppetlabs/puppetserver/conf.d
/etc/puppetlabs/puppetserver/conf.d/auth.conf
/etc/puppetlabs/puppetserver/conf.d/ca.conf
/etc/puppetlabs/puppetserver/conf.d/global.conf
/etc/puppetlabs/puppetserver/conf.d/metrics.conf
/etc/puppetlabs/puppetserver/conf.d/puppetserver.conf
/etc/puppetlabs/puppetserver/conf.d/web-routes.conf
/etc/puppetlabs/puppetserver/conf.d/webserver.conf
/etc/puppetlabs/puppetserver/services.d
/etc/puppetlabs/puppetserver/services.d/ca.cfg
/etc/puppetlabs/puppetserver/logback.xml
/etc/puppetlabs/puppetserver/request-logging.xml
/etc/puppetlabs/puppetserver/ca
/etc/puppetlabs/puppetserver/ca/signed
/etc/puppetlabs/puppetserver/ca/signed/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppetserver/ca/ca_crt.pem
/etc/puppetlabs/puppetserver/ca/ca_crl.pem
/etc/puppetlabs/puppetserver/ca/infra_crl.pem
/etc/puppetlabs/puppetserver/ca/ca_pub.pem
/etc/puppetlabs/puppetserver/ca/inventory.txt
/etc/puppetlabs/puppetserver/ca/infra_inventory.txt
/etc/puppetlabs/puppetserver/ca/infra_serials
/etc/puppetlabs/puppetserver/ca/serial
/etc/puppetlabs/puppetserver/ca/root_key.pem
/etc/puppetlabs/puppetserver/ca/ca_key.pem
# puppetserver ca generate --ca-client --certname $HOSTNAME --subject-alt-names lb.example.com
Successfully saved certificate for 86e3b0fed4cd to /etc/puppetlabs/puppet/ssl/certs/86e3b0fed4cd.pem
Successfully saved certificate for 86e3b0fed4cd to /etc/puppetlabs/puppetserver/ca/signed/86e3b0fed4cd.pem
Successfully saved private key for 86e3b0fed4cd to /etc/puppetlabs/puppet/ssl/private_keys/86e3b0fed4cd.pem
Successfully saved public key for 86e3b0fed4cd to /etc/puppetlabs/puppet/ssl/public_keys/86e3b0fed4cd.pem
# find /etc/puppetlabs/
/etc/puppetlabs/
/etc/puppetlabs/code
/etc/puppetlabs/code/environments
/etc/puppetlabs/code/environments/production
/etc/puppetlabs/code/environments/production/data
/etc/puppetlabs/code/environments/production/manifests
/etc/puppetlabs/code/environments/production/modules
/etc/puppetlabs/code/environments/production/environment.conf
/etc/puppetlabs/code/environments/production/hiera.yaml
/etc/puppetlabs/code/modules
/etc/puppetlabs/puppet
/etc/puppetlabs/puppet/hiera.yaml
/etc/puppetlabs/puppet/ssl
/etc/puppetlabs/puppet/ssl/certs
/etc/puppetlabs/puppet/ssl/certs/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppet/ssl/certs/ca.pem
/etc/puppetlabs/puppet/ssl/certs/86e3b0fed4cd.pem
/etc/puppetlabs/puppet/ssl/private_keys
/etc/puppetlabs/puppet/ssl/private_keys/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppet/ssl/private_keys/86e3b0fed4cd.pem
/etc/puppetlabs/puppet/ssl/public_keys
/etc/puppetlabs/puppet/ssl/public_keys/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppet/ssl/public_keys/86e3b0fed4cd.pem
/etc/puppetlabs/puppet/ssl/crl.pem
/etc/puppetlabs/puppet/ssl/ca
/etc/puppetlabs/puppet/puppet.conf
/etc/puppetlabs/pxp-agent
/etc/puppetlabs/pxp-agent/modules
/etc/puppetlabs/puppetserver
/etc/puppetlabs/puppetserver/conf.d
/etc/puppetlabs/puppetserver/conf.d/auth.conf
/etc/puppetlabs/puppetserver/conf.d/ca.conf
/etc/puppetlabs/puppetserver/conf.d/global.conf
/etc/puppetlabs/puppetserver/conf.d/metrics.conf
/etc/puppetlabs/puppetserver/conf.d/puppetserver.conf
/etc/puppetlabs/puppetserver/conf.d/web-routes.conf
/etc/puppetlabs/puppetserver/conf.d/webserver.conf
/etc/puppetlabs/puppetserver/services.d
/etc/puppetlabs/puppetserver/services.d/ca.cfg
/etc/puppetlabs/puppetserver/logback.xml
/etc/puppetlabs/puppetserver/request-logging.xml
/etc/puppetlabs/puppetserver/ca
/etc/puppetlabs/puppetserver/ca/signed
/etc/puppetlabs/puppetserver/ca/signed/86e3b0fed4cd.gijs.example.com.pem
/etc/puppetlabs/puppetserver/ca/signed/86e3b0fed4cd.pem
/etc/puppetlabs/puppetserver/ca/ca_crt.pem
/etc/puppetlabs/puppetserver/ca/ca_crl.pem
/etc/puppetlabs/puppetserver/ca/infra_crl.pem
/etc/puppetlabs/puppetserver/ca/ca_pub.pem
/etc/puppetlabs/puppetserver/ca/inventory.txt
/etc/puppetlabs/puppetserver/ca/infra_inventory.txt
/etc/puppetlabs/puppetserver/ca/infra_serials
/etc/puppetlabs/puppetserver/ca/serial
/etc/puppetlabs/puppetserver/ca/root_key.pem
/etc/puppetlabs/puppetserver/ca/ca_key.pemThis confirms what you wrote.
Just out of interest, I tried to rerun the command to see what happens:
# puppetserver ca generate --ca-client --certname $HOSTNAME --subject-alt-names lb.example.com
Error:
Existing file at '/etc/puppetlabs/puppet/ssl/certs/86e3b0fed4cd.pem'
Existing file at '/etc/puppetlabs/puppet/ssl/private_keys/86e3b0fed4cd.pem'
Existing file at '/etc/puppetlabs/puppet/ssl/public_keys/86e3b0fed4cd.pem'
Existing file at '/etc/puppetlabs/puppetserver/ca/signed/86e3b0fed4cd.pem'
Please delete these files if you really want to generate a new cert for 86e3b0fed4cd.This is what a user will see if they run the generate command for the host that is the CA itself, which they may see if the reader missed the except this first system where you configure Puppet certificates signing.
There was a problem hiding this comment.
@ekohl So are they supposed to run the command on the Puppet CA SmartProxy? Or on all other SmartProxies that aren't the Puppet CA? Please, clarify.
There was a problem hiding this comment.
Oh, I think I get that. The command runs on the Puppet CA SP, but the parameter is not supposed to include the hostname of the Puppet CA SP itself. Right?
...art-proxy-server-with-default-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Show resolved
Hide resolved
...art-proxy-server-with-default-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Show resolved
Hide resolved
pr-processor
bot
added
Waiting on contributor
pr-processor
bot
added
Needs re-review
and removed
Waiting on contributor
Lennonka
force-pushed
the
fix-command-cert-puppet-loadbalancer
branch
from
5452564
to
47d50b5
Compare
|
I've tried to incorporate your suggestions, @ekohl |
apinnick
reviewed
Nov 13, 2024
...mart-proxy-server-with-custom-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Outdated
Show resolved
Hide resolved
apinnick
reviewed
Nov 13, 2024
...mart-proxy-server-with-custom-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Outdated
Show resolved
Hide resolved
apinnick
reviewed
Nov 13, 2024
...mart-proxy-server-with-custom-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Outdated
Show resolved
Hide resolved
apinnick
reviewed
Nov 13, 2024
...art-proxy-server-with-default-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Outdated
Show resolved
Hide resolved
apinnick
reviewed
Nov 13, 2024
...art-proxy-server-with-default-ssl-certificates-to-generate-and-sign-puppet-certificates.adoc
Outdated
Show resolved
Hide resolved
Lennonka
force-pushed
the
fix-command-cert-puppet-loadbalancer
branch
from
47d50b5
to
2323834
Compare
|
Incorporated Avital's suggestions. |
ekohl
approved these changes
Nov 15, 2024
| * `/etc/puppetlabs/puppet/ssl/private_keys/_{smartproxy-example-com}_.pem` | ||
| * `/etc/puppetlabs/puppet/ssl/public_keys/_{smartproxy-example-com}_.pem` | ||
| * `/etc/puppetlabs/puppetserver/ca/signed/_{smartproxy-example-com}_.pem` | ||
| . Restart the Puppet server: |
There was a problem hiding this comment.
Nit: technically I think you're correct, but my mind using restart here and start in the command was inconsistent. I'll leave this up to the technical writers, but wonder if it should be
Suggested change
| . Restart the Puppet server: | |
| . Start the Puppet server again: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes are you introducing?
Fixing a command to generate certs on Puppet CA SmartProxy
Why are you introducing these changes? (Explanation, links to references, issues, etc.)
It was reported as incorrect and suggested another command instead.
https://issues.redhat.com/browse/SAT-28859
Anything else to add? (Considerations, potential downsides, alternative solutions you have explored, etc.)
Checklists
Please cherry-pick my commits into: