From 3aa6b341302d15fe48a213aad2333dc13668b30c Mon Sep 17 00:00:00 2001 From: dforste Date: Tue, 2 Dec 2025 07:34:29 -0500 Subject: [PATCH 1/3] Fix puppetserver ca sign with puppet 8. (#969) Co-authored-by: Brian Witt (cherry picked from commit 46cfd86db3a5f11bd22d207e99ba20aa0c29a168) --- .../puppet_server_puppetserver_spec.rb | 46 +++++++++++++++++++ spec/classes/puppet_server_spec.rb | 5 ++ .../server/puppetserver/conf.d/auth.conf.erb | 40 ++++++++++++++++ 3 files changed, 91 insertions(+) diff --git a/spec/classes/puppet_server_puppetserver_spec.rb b/spec/classes/puppet_server_puppetserver_spec.rb index 4e5a4dd1..bc1f140a 100644 --- a/spec/classes/puppet_server_puppetserver_spec.rb +++ b/spec/classes/puppet_server_puppetserver_spec.rb @@ -117,6 +117,10 @@ .with_content(/^\s+name: "puppetlabs cert status"/) .with_content(%r{^\s+path: "/puppet-ca/v1/certificate_statuses"}) .with_content(/^\s+name: "puppetlabs cert statuses"/) + .with_content(%r{^\s+path: "/puppet-ca/v1/sign"}) + .with_content(/^\s+name: "puppetlabs cert sign"/) + .with_content(%r{^\s+path: "/puppet-ca/v1/sign/all"}) + .with_content(/^\s+name: "puppetlabs cert sign all"/) .with_content(%r{^\s+path: "/puppet-admin-api/v1/environment-cache"}) .with_content(/^\s+name: "environment-cache"/) .with_content(%r{^\s+path: "/puppet-admin-api/v1/jruby-pool"}) @@ -577,6 +581,48 @@ it { expect(rule['allow']).to eq(['localhost', 'host.example.com']) } end end + + describe 'cert sign endpoint' do + let(:content) { catalogue.resource('file', auth_conf).send(:parameters)[:content] } + let(:rules) { Hocon.parse(content)['authorization']['rules'] } + let(:rule) { rules.find {|rule| rule['name'] == 'puppetlabs cert sign' } } + + context 'by default' do + it { expect(rule).not_to be_nil } + it { expect(rule['match-request']['path']).to eq('/puppet-ca/v1/sign') } + it { expect(rule['match-request']['type']).to eq('path') } + it { expect(rule['match-request']['method']).to eq('post') } + it { expect(rule['sort-order']).to eq(500) } + it { expect(rule['allow']).to eq(['localhost', 'foo.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) } + end + + context 'with server_ca_client_allowlist set' do + let(:params) { super().merge(server_ca_client_allowlist: ['puppetserver.example.com', 'admin.example.com']) } + + it { expect(rule['allow']).to eq(['puppetserver.example.com', 'admin.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) } + end + end + + describe 'cert sign all endpoint' do + let(:content) { catalogue.resource('file', auth_conf).send(:parameters)[:content] } + let(:rules) { Hocon.parse(content)['authorization']['rules'] } + let(:rule) { rules.find {|rule| rule['name'] == 'puppetlabs cert sign all' } } + + context 'by default' do + it { expect(rule).not_to be_nil } + it { expect(rule['match-request']['path']).to eq('/puppet-ca/v1/sign/all') } + it { expect(rule['match-request']['type']).to eq('path') } + it { expect(rule['match-request']['method']).to eq('post') } + it { expect(rule['sort-order']).to eq(500) } + it { expect(rule['allow']).to eq(['localhost', 'foo.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) } + end + + context 'with server_ca_client_allowlist set' do + let(:params) { super().merge(server_ca_client_allowlist: ['puppetserver.example.com', 'admin.example.com']) } + + it { expect(rule['allow']).to eq(['puppetserver.example.com', 'admin.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) } + end + end end end end diff --git a/spec/classes/puppet_server_spec.rb b/spec/classes/puppet_server_spec.rb index a54c71dc..d8143203 100644 --- a/spec/classes/puppet_server_spec.rb +++ b/spec/classes/puppet_server_spec.rb @@ -530,6 +530,11 @@ it 'should not sync the crl' do should_not contain_file('/etc/custom/puppetlabs/puppet/ssl/crl.pem') end + it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/certificate_renewal"}) } + it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/certificate_status"}) } + it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/certificate_statuses"}) } + it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/sign"}) } + it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/sign/all"}) } end end diff --git a/templates/server/puppetserver/conf.d/auth.conf.erb b/templates/server/puppetserver/conf.d/auth.conf.erb index 85c69346..d6069ecc 100644 --- a/templates/server/puppetserver/conf.d/auth.conf.erb +++ b/templates/server/puppetserver/conf.d/auth.conf.erb @@ -202,6 +202,46 @@ authorization: { sort-order: 500 name: "puppetlabs cert clean" }, + { + # Allow the CA CLI to access the certificate sign endpoint + match-request: { + path: "/puppet-ca/v1/sign" + type: path + method: post + } + allow: [ +<%- @server_ca_client_allowlist.each do |client| -%> + "<%= client %>", +<%- end -%> + { + extensions: { + pp_cli_auth: "true" + } + } + ] + sort-order: 500 + name: "puppetlabs cert sign" + }, + { + # Allow the CA CLI to access the certificate sign all endpoint + match-request: { + path: "/puppet-ca/v1/sign/all" + type: path + method: post + } + allow: [ +<%- @server_ca_client_allowlist.each do |client| -%> + "<%= client %>", +<%- end -%> + { + extensions: { + pp_cli_auth: "true" + } + } + ] + sort-order: 500 + name: "puppetlabs cert sign all" + }, { # Allow unauthenticated access to the status service endpoint match-request: { From 0885997b942f93391d1b0a2625254d26ce1e190c Mon Sep 17 00:00:00 2001 From: Ewoud Kohl van Wijngaarden Date: Tue, 4 Mar 2025 20:36:35 +0100 Subject: [PATCH 2/3] Update to gha-puppet v3 & voxpupuli-test 9.x (cherry picked from commit 59df4f3f0b2bca2d7268c82eeb90181bc2dde814) --- .github/workflows/ci.yml | 8 ++++++-- Gemfile | 4 ++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e1f03a29..af68c0d2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,6 +3,11 @@ name: CI on: pull_request: + push: + branches: + - 'develop' + - 'master' + - '*-stable' concurrency: @@ -12,8 +17,7 @@ concurrency: jobs: puppet: name: Puppet - uses: voxpupuli/gha-puppet/.github/workflows/beaker.yml@v2 + uses: voxpupuli/gha-puppet/.github/workflows/beaker.yml@v3 with: pidfile_workaround: 'true' rubocop: false - cache-version: '1' diff --git a/Gemfile b/Gemfile index 2b29d833..19dfab89 100644 --- a/Gemfile +++ b/Gemfile @@ -8,11 +8,11 @@ gem 'rake' gem 'kafo_module_lint', {"groups"=>["test"]} gem 'puppet-lint-spaceship_operator_without_tag-check', '~> 1.0', {"groups"=>["test"]} -gem 'voxpupuli-test', '~> 7.0', {"groups"=>["test"]} +gem 'voxpupuli-test', '~> 9.0', {"groups"=>["test"]} gem 'github_changelog_generator', '>= 1.15.0', {"groups"=>["development"]} gem 'puppet_metadata', '~> 4.0' gem 'puppet-blacksmith', '>= 6.0.0', {"groups"=>["development"]} -gem 'voxpupuli-acceptance', '~> 3.0', {"groups"=>["system_tests"]} +gem 'voxpupuli-acceptance', '~> 3.4', {"groups"=>["system_tests"]} gem 'puppetlabs_spec_helper', {"groups"=>["system_tests"]} gem 'hocon' From 677cf4f21874856dfa002ecaacdc625a51757eab Mon Sep 17 00:00:00 2001 From: Tim Meusel Date: Tue, 11 Mar 2025 08:27:15 +0100 Subject: [PATCH 3/3] puppet-lint: fix space_before_arrow There was a bug in puppet-lint < 4.3 which didn't detect this previously. https://github.com/puppetlabs/puppet-lint/commit/0e8da67124f293208928a86775bc6f07af28faa4 (cherry picked from commit 8e8793c913624bea760b37acbe90bc1a1356100c) --- manifests/config.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/manifests/config.pp b/manifests/config.pp index 00eebd0d..66b35e0a 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -27,7 +27,7 @@ 'ssldir': value => $puppet::ssldir; 'privatekeydir': value => '$ssldir/private_keys { group = service }'; 'hostprivkey': value => '$privatekeydir/$certname.pem { mode = 640 }'; - 'show_diff': value => $puppet::show_diff; + 'show_diff': value => $puppet::show_diff; 'codedir': value => $puppet::codedir; } @@ -92,7 +92,7 @@ -> case $facts['os']['family'] { 'Windows': { concat { "${puppet_dir}/puppet.conf": - mode => $puppet::puppetconf_mode, + mode => $puppet::puppetconf_mode, } }