natemccurdy / pizzaops-puppetdb_shared_cert Goto Github PK

Generates a shared certificate to be used for load-balancing PuppetDB nodes in Puppet Enterprise, as per the documented known issue.

This module uses reidmv-puppet_certificate to generate certificates on the CA node, and then distributes them to the PuppetDB node via standard file resources, before the puppet_enterprise::puppetdb class copies them into PuppetDB's ssl directory.

puppet module install pizzaops-puppetdb_shared_cert

If you're using r10k, you'll need to include the dependencies, puppetlabs-stdlib 4.5.0, and reidmv-puppet_certificate 0.0.2.

Classify the CA master with puppetdb_shared_cert::ca. By default, it will read $::puppet_enterprise::profile::puppetdb::certname for the certname and set the alt-names to puppetdb,puppetdb.${domain}.

class { 'puppetdb_shared_cert::ca':
  certname      => 'puppetdb-shared-cert',
  dns_alt_names => ['puppetdb.bar.com','puppetdb'],
}

Classify your PuppetDB nodes with puppetdb_shared_cert::puppetdb, and the standard puppet_enterprise::profile::puppetdb class. puppetdb_shared_cert::puppetdb will ship the certs generated by the CA class to your puppetdb nodes. It has the same defaults as the ca class.

class { 'puppetdb_shared_cert::puppetdb':
  certname      => 'puppetdb-shared-cert',
  dns_alt_names => ['puppetdb.bar.com','puppetdb'],
}

You may also supply all data directly to the ::puppetdb_shared_cert class to reduce duplication. For example you might add it to the PE infrastructure console group, and then add the ca and puppetdb classes to the appropriate groups.

NB: You will need to supply the datadabase password to the puppet_enterprise::profile::puppetdb class, via the console or hiera, when setting up multiple PuppetDBs. That is the only required configuration in my testing.