Refs #24012 - Add PuppetCA providers settings #434

juliantodt · 2018-06-25T13:22:27Z

This adds the settings for the puppetca_hostname_whitelisting provider for the new modular PuppetCa module. This should fix the current nightlies. @tbrisker @ekohl

This is a part of #433 but without the token_whitelisting provider's settings and with the suggested additions

closes theforemanGH-227

Clsoes theforemanGH-230

closes theforemanGH-232

[ci skip]

Add new variable in params dhcp_subnets Set dhcp_subnets accordingly via template dhcp.yml.erb Fixes theforemanGH-109

…heforeman#246)

The smart proxy module is simply called 'puppet' and is used for environment importing as well as Puppet runs, so this should make the relationship clearer.

1.12 splits the Puppet module up into many config files per puppetrun provider and per environment import provider. 1.11 users must set the `puppet_split_config_files` parameter to false to keep the single puppet.yml. A `mcollective_user` parameter has been added to expose the setting that was introduced in 1.9.0 and is now in puppet_proxy_mcollective.yml.

Unused by the smart proxy since 1.9.0. Closes theforemanGH-250

[ci skip] Closes theforemanGH-245

When using Puppet split config files, the provider name should be 'puppet_proxy_ssh' so when puppetrun_provider is given as 'puppetssh', it's changed to 'ssh' to help migrations. Fixes theforemanGH-254 Fixes theforemanGH-255

- remove libvirt_backend parameter - remove puppet_split_config_files parameter - remove unneeded ERB in dhcp.yml and dns.yml template - mark Fedora 24 supported instead of Fedora 21 - remove Debian 7 (wheezy) support - remove Ubuntu 12.04 (precise) support

[skip ci]

In puppet 4 AIO packaging, it's the `puppetserver` package that creates a `puppet` user and group. The `puppet-agent` package doesn't create the group and unless `puppetserver` is also installed the ssl keys and certs are owned by `root:root` and are not readable by the foreman proxy. (It's the installation of `puppetserver` that chowns the ssldir to `puppet:puppet`) With this commit, the module ensures that the `puppet_group` group exists even on puppet 4. It also makes sure the ssl_key/cert/ca files and parent directories are group owned by the `puppet_group` The change is hopefully quite conservative. Only if both `$puppet` and `$puppetca` are false and `$ssl` is true will it have any effect. By default, it also only applies to puppet 4 and can be turned off completely by setting `manage_puppet_group` to `false`. Users who already manage the creation of the puppet group, (for instance to workaround https://tickets.puppetlabs.com/browse/SERVER-1381) are further protected by the `if !defined`.

This reduces the amount of default help text and confusing options for plugins. This is especially confusing for 'enabled' as there are 2 options: ``` --[no-]enable-foreman-proxy-plugin-remote-execution-ssh --foreman-proxy-plugin-remote-execution-ssh-enabled ``` The former REALLY enables the plugin, the latter is only controlling the value in the .yml configuration which has a sane default value. We should hide this, and some of the other options like `listen_on`, `group`, etc which probably don't need changing ever.

Using /etc/ansible means that the ~foreman-proxy/.ansible.cfg file we had set up will be ignored. This means the callback is ignored and any other options we might set in /etc/foreman-proxy/ansible.cfg

ekohl

Could you document puppetca_modular?

I'm considering defaulting to false so it's backwards compatible but it's probably better to start the 1.19 development cycle in this module. We've seen with the previous setting that it can be better to go for the future.

ekohl · 2018-06-25T13:41:39Z

And by documenting I mean adding a note to https://github.com/theforeman/puppet-foreman_proxy#compatibility similar to https://github.com/theforeman/puppet-foreman_proxy/tree/5.1-stable#115-compatibility-notes

juliantodt · 2018-06-25T13:46:34Z

~~You mean document in the README?~~
Defaulting to false would mean its breaking nightlies again. Imho the current version of this module should work with the current version of the SmartProxy, not an older version.

ekohl · 2018-06-25T13:51:23Z

Defaulting to false would mean its breaking nightlies again. Imho the current version of this module should work with the current version of the SmartProxy, not an older version.

I was mostly thinking out loud. We can change the value in the installer but you're right that it creates more difficulty than needed.

ekohl · 2018-06-25T14:57:03Z

manifests/config.pp

@@ -87,6 +87,13 @@
    feature   => 'Puppet CA',
    listen_on => $::foreman_proxy::puppetca_listen_on,
  }
+  if $::foreman_proxy::puppetca_modular {
+    foreman_proxy::settings_file { [


nit: there's no need for a list here and it can just be a string. The code is slightly more readable then.

Well, it will be an array eventually when we add the other provider's setting file...

ekohl

Looks good. Could you have a last look? I'm also fine with fixing this later.

ekohl · 2018-06-25T17:50:10Z

manifests/init.pp

@@ -81,7 +81,11 @@
 #
 # $puppet_group::               Groups of Foreman proxy user
 #
-# $autosignfile::               Path to the autosign file
+# $puppetca_modular::           Using the current modular PuppetCa implementation?


How about: Whether the PuppetCA implementation is modular. This is true for 1.19 or later.

Oh, and I think all of these should be under advanced parameters. I think we don't want to expose these options to every user via --help and for 1.19 we should ensure proper defaults and migrations.

domcleal and others added 30 commits April 12, 2016 11:58

Add ssl_disabled_ciphers configuration option for 1.12

c10bb85

Permit upcoming version of theforeman/puppet

ca6f712

Add puppetlabs-apt to test fixtures for puppet-foreman changes

92d572b

Use foreman::providers to install foreman_smartproxy deps

91d8b58

closes theforemanGH-227

move autosign.conf file to theforeman-puppet

eae70ff

Clsoes theforemanGH-230

Pass ssl_ca into foreman_smartproxy during registration

996e258

closes theforemanGH-232

bump major version

4113df4

[ci skip]

Remove deprecated features and pre-1.11 support

90a0a47

Add dhcp_search_domains parameter

baf46ee

Expose dhcp_subnets parameter

d72b660

Add new variable in params dhcp_subnets Set dhcp_subnets accordingly via template dhcp.yml.erb Fixes theforemanGH-109

support libvirt DNS/DHCP provider

c0664ce

add tftp_managed parameter (theforeman#243)

7016749

refs #14942 - require puppet::server::install first for puppet group (t…

2b974e1

…heforeman#246)

fix libvirt template typos (theforeman#247)

e773d79

refs #14995 - change default log_level to INFO (theforeman#248)

a17027e

Rename puppetrun/puppetrun_listen_on to puppet

36c382a

The smart proxy module is simply called 'puppet' and is used for environment importing as well as Puppet runs, so this should make the relationship clearer.

Remove puppet_cache_location parameter

8c52e6f

Unused by the smart proxy since 1.9.0. Closes theforemanGH-250

msync: update Ubuntu OS strings, add Ruby 2.3

848f9a3

Update changelog

81c6f9c

[ci skip] Closes theforemanGH-245

Prepare 3.0.0 changelog [skip ci]

34218dc

[blacksmith] Bump version to 3.0.1

abdbfab

Permit theforeman/foreman 6.x

5498e14

Rename 'puppetssh' Puppet run provider to 'ssh'

fcc28c6

When using Puppet split config files, the provider name should be 'puppet_proxy_ssh' so when puppetrun_provider is given as 'puppetssh', it's changed to 'ssh' to help migrations. Fixes theforemanGH-254 Fixes theforemanGH-255

restrict extlib version to be Ruby 1.8 compatible

accaf49

Permit theforeman/puppet 6.x

e1af197

[skip ci]

msync: pin json_pure on Ruby 1.x

1c4f672

dLobatog and others added 3 commits June 16, 2018 14:45

Fixes #23905 - Use /usr/share/foreman-proxy as ansible_dir

0613b73

Using /etc/ansible means that the ~foreman-proxy/.ansible.cfg file we had set up will be ignored. This means the callback is ignored and any other options we might set in /etc/foreman-proxy/ansible.cfg

Release 7.2.2

d28dea2

[blacksmith] Bump version to 7.2.3

c65456e

theforeman-bot added Needs testing Not yet reviewed labels Jun 25, 2018

ekohl requested changes Jun 25, 2018

View reviewed changes

theforeman-bot added Waiting on contributor and removed Not yet reviewed labels Jun 25, 2018

ekohl added the Backwards incompatible label Jun 25, 2018

juliantodt force-pushed the 24012_puppetcahostnamesettings branch from ffb3664 to 7356223 Compare June 25, 2018 13:57

theforeman-bot added Needs re-review Needs testing and removed Waiting on contributor labels Jun 25, 2018

juliantodt force-pushed the 24012_puppetcahostnamesettings branch 3 times, most recently from 058d358 to fec2839 Compare June 25, 2018 14:25

ekohl reviewed Jun 25, 2018

View reviewed changes

ekohl approved these changes Jun 25, 2018

View reviewed changes

theforeman-bot removed the Needs re-review label Jun 25, 2018

juliantodt force-pushed the 24012_puppetcahostnamesettings branch 2 times, most recently from 214f100 to d231391 Compare June 25, 2018 18:51

Refs #24012 - Add PuppetCA providers settings

3962a68

juliantodt force-pushed the 24012_puppetcahostnamesettings branch 2 times, most recently from 5e75b24 to 3962a68 Compare June 25, 2018 18:58

juliantodt closed this Jun 25, 2018

juliantodt deleted the 24012_puppetcahostnamesettings branch June 25, 2018 19:05

juliantodt mentioned this pull request Jun 25, 2018

Refs #24012 - Add PuppetCA providers settings #435

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refs #24012 - Add PuppetCA providers settings #434

Refs #24012 - Add PuppetCA providers settings #434

juliantodt commented Jun 25, 2018

ekohl left a comment

ekohl commented Jun 25, 2018

juliantodt commented Jun 25, 2018

ekohl commented Jun 25, 2018

ekohl Jun 25, 2018

juliantodt Jun 25, 2018

ekohl left a comment

ekohl Jun 25, 2018

ekohl Jun 25, 2018

Refs #24012 - Add PuppetCA providers settings #434

Refs #24012 - Add PuppetCA providers settings #434

Conversation

juliantodt commented Jun 25, 2018

ekohl left a comment

Choose a reason for hiding this comment

ekohl commented Jun 25, 2018

juliantodt commented Jun 25, 2018

ekohl commented Jun 25, 2018

ekohl Jun 25, 2018

Choose a reason for hiding this comment

juliantodt Jun 25, 2018

Choose a reason for hiding this comment

ekohl left a comment

Choose a reason for hiding this comment

ekohl Jun 25, 2018

Choose a reason for hiding this comment

ekohl Jun 25, 2018

Choose a reason for hiding this comment