Skip to content

Commit f100c65

Browse files
MartyEwingsMartyEwings
authored
Merge pull request #121 from m0dular/SUP-2539-terminology-refactor
(SUP-2539) Update terminology and refactor
2 parents 7175f5b + 0bdf360 commit f100c65

File tree

4 files changed

+35
-90
lines changed

4 files changed

+35
-90
lines changed

‎tasks/st0299_regen_primary_server_cert.json‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
{
2-
"puppet_task_version": 1,
32
"supports_noop": false,
43
"description": "ST0299 Regen Primary Server Cert - This Task to be used in conjunction with Puppet Enterprise Knowledge Base Article KB0299 - https://support.puppet.com/hc/en-us/articles/360008505193",
5-
"parameters": {
6-
"dnsaltname_override": {
7-
"description": "Override to prevent existing DNS alt name carryover. Will force the use of only the DNS alt names present in pe.conf.",
8-
"type": "Optional[Boolean]"
4+
"implementations": [
5+
{
6+
"name": "st0299_regen_primary_server_cert.sh",
7+
"requirements": [
8+
"shell"
9+
],
10+
"files": [
11+
"support_tasks/files/common.sh"
12+
],
13+
"input_method": "environment"
914
}
10-
}
15+
]
1116
}

‎tasks/st0299_regen_primary_server_cert.sh‎

Lines changed: 16 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,23 @@
11
#!/bin/bash
2-
# shellcheck disable=2181
3-
# shellcheck disable=2013
4-
declare PT_dnsaltname_override
5-
CERTNAME="$(puppet config print certname)"
6-
PUPPET_BIN_DIR="/opt/puppetlabs/bin"
7-
PUPPETCMD="${PUPPET_BIN_DIR}/puppet"
8-
PUPPETSERVERCMD="${PUPPET_BIN_DIR}/puppetserver"
9-
PATH="${PUPPET_BIN_DIR}":"${PATH}"
102

11-
backup_ssl() {
12-
tar -cvf "/etc/puppetlabs/puppet/ssl_$(date +%Y-%m-%d-%M-%S).tar.gz" /etc/puppetlabs/puppet/ssl /etc/puppetlabs/puppetdb/ssl /opt/puppetlabs/server/data/console-services/certs /opt/puppetlabs/server/data/postgresql/9.6/data/certs /etc/puppetlabs/orchestration-services/ssl
13-
}
3+
declare PT__installdir
4+
source "$PT__installdir/support_tasks/files/common.sh"
145

15-
exit_if_compile_master() {
16-
grep reverse-proxy-ca-service /etc/puppetlabs/puppetserver/bootstrap.cfg 2>&1 /dev/null
17-
if [ $? -eq 0 ]; then
18-
echo "Target server appears to be a PE compile master. This script is intended to be targeted only at a PE Master of Masters. Exiting."
19-
exit 255
20-
elif [ $? -eq 2 ]; then
21-
echo "Target server does not appear to be a PE master. This script is intended to be targeted only at a PE Master of Masters. Exiting."
22-
exit 255
23-
fi
24-
}
6+
PUPPET_BIN='/opt/puppetlabs/puppet/bin'
7+
ssldir="$($PUPPET_BIN/puppet config print ssldir)"
8+
cadir="$($PUPPET_BIN/puppet config print cadir)"
9+
certname="$($PUPPET_BIN/puppet config print certname).pem"
10+
# Starting in 2021, the CA directory may or may not be under the ssldir
11+
# Add cadir and ssldir to an array and pass them to find to ensure we delete all necessary files
12+
ca_dirs=("$ssldir" "$cadir")
2513

26-
check_dns_alt_names() {
27-
if [ "${PUPPET_6}" = true ]; then
28-
str=$(/opt/puppetlabs/bin/puppetserver ca list --all |grep "${CERTNAME}")
29-
else
30-
str=$(puppet cert list "${CERTNAME}")
31-
fi
14+
[[ -d $cadir ]] || fail 'ERROR: could not find cadir. Please ensure this task is run on the primary Puppet server'
3215

33-
for host in $(grep -oP '(?<="DNS:)(.*?)(?<=")' <<<"${str}"); do
34-
tmphost="$(echo "${host}"|cut -d'"' -f 1)"
35-
if [ "$tmphost" == "$CERTNAME" ] || [ "$tmphost" == "puppet" ]
36-
then
37-
continue
38-
fi
39-
if ! grep "pe_install::puppet_master_dnsaltname.*${tmphost}" /etc/puppetlabs/enterprise/conf.d/pe.conf > /dev/null 2>&1
40-
then
41-
echo "'${tmphost}' is set up as a DNS alt name in the existing certificate, but is not present in the 'pe_install::puppet_master_dnsaltnames' setting of '/etc/puppetlabs/enterprise/conf.d/pe.conf'. Please add it to continue, or use the 'dnsaltname_override' task parameter to skip this check."
42-
exit 255
43-
fi
44-
done
45-
}
16+
mkdir -p /var/puppetlabs/backups/
17+
cp -aR "$ssldir" /var/puppetlabs/backups || fail "Error backing up ssldir"
4618

47-
# main
19+
find "${ca_dirs[@]}" -name "$certname" -delete
20+
# shellcheck disable=SC2154
21+
PATH="${PATH}:/opt/puppetlabs/bin" puppet infrastructure configure --no-recover &>"$_tmp" || fail "Error running 'puppet infrastructure configure'"
4822

49-
puppet_version=$("${PUPPET_BIN_DIR?}/puppet" --version)
50-
if [[ ${puppet_version%%.*} -ge 6 ]];then
51-
PUPPET_6=true
52-
else
53-
PUPPET_6=false
54-
fi
55-
56-
exit_if_compile_master
57-
58-
if ! "$PT_dnsaltname_override"
59-
then
60-
check_dns_alt_names
61-
fi
62-
63-
if [ ! -x $PUPPETCMD ]; then
64-
echo "Unable to locate executable Puppet command at ${PUPPETCMD}"
65-
exit 255
66-
fi
67-
68-
# Back up the SSL directories
69-
backup_ssl
70-
71-
rm -f "/opt/puppetlabs/puppet/cache/client_data/catalog/${CERTNAME}.json"
72-
73-
if [ ${PUPPET_6} = true ]; then
74-
"${PUPPETSERVERCMD}" ca clean --certname "${CERTNAME}"
75-
find /etc/puppetlabs/puppet/ssl -name "${CERTNAME}".pem -delete
76-
else
77-
"${PUPPETCMD}" cert clean "${CERTNAME}"
78-
fi
79-
80-
"${PUPPETCMD}" infrastructure configure --no-recover
81-
"${PUPPETCMD}" agent -t
82-
83-
if [ $? -eq 2 ]; then
84-
exit 0
85-
fi
23+
success '{ "status": "success" }'

‎tasks/st0317a_clean_cert.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,14 @@
1515

1616
Puppet.initialize_settings
1717

18-
def pe_master?
18+
def pe_primary?
1919
!Facter.value('pe_build').nil?
2020
end
2121

2222
# This task only works when running against your Puppet CA server, so let's check for that.
2323
# In Puppetserver, that means the configs contain 'certificate-authority-service', uncommented.
2424
# The puppetserver config file differs between PE and open-source puppetserver.
25-
ca_cfg = pe_master? ? '/etc/puppetlabs/puppetserver/bootstrap.cfg' : '/etc/puppetlabs/puppetserver/services.d/ca.cfg'
25+
ca_cfg = pe_primary? ? '/etc/puppetlabs/puppetserver/bootstrap.cfg' : '/etc/puppetlabs/puppetserver/services.d/ca.cfg'
2626

2727
if !File.exist?(ca_cfg) || File.readlines(ca_cfg).grep(%r{^[^#].+certificate-authority-service$}).empty?
2828
puts 'This task can only be run on your certificate authority Puppetserver'

‎tasks/st1096_db_commands.sh‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ psql_options=("-d" "$database")
99
fail 'pe-postgresql service not found'
1010
}
1111

12-
case "$command" in
12+
case "${command?}" in
1313
resource_events_per_resource)
1414
query='select certname, containing_class, file, count(*) from resource_events join certnames on certnames.id = resource_events.certname_id group by certname, containing_class, file order by count desc limit 20;'
1515
psql_options+=("-c" "$query")
@@ -36,7 +36,7 @@ case "$command" in
3636
;;
3737
database_sizes)
3838
# Hard-coded to pe-puppetdb
39-
query_file="$_installdir/support_tasks/files/db_sizes.sql"
39+
query_file="${_installdir?}/support_tasks/files/db_sizes.sql"
4040
# To avoid quoting issues, putting complicated queries in files makes sense
4141
# But, _installdir is created as the --run-as user, so allow pe-postgres to read a copy of the file
4242
tmp_query="$(mktemp)"; cp "$query_file" "$tmp_query"; chmod 644 "$tmp_query"
@@ -49,5 +49,7 @@ chmod +r "$_installdir"
4949
runuser -u pe-postgres -- /opt/puppetlabs/server/bin/psql "${psql_options[@]}" || {
5050
fail "Error running query"
5151
}
52-
# Use || true to avoid exiting 1 if the tmp file doesn't exist
53-
[[ -e $tmp_query ]] && rm -- "$tmp_query" || true
52+
53+
[[ -e $tmp_query ]] && rm -- "$tmp_query"
54+
# Include a noop so we don't exit 1 if the temp file doesn't exist
55+
:

0 commit comments

Comments
 (0)