Fix puppetserver ca sign with puppet 8. (#969)

.github/workflows/ci.yml

@@ -3,6 +3,11 @@ name: CI
 
 on:
   pull_request:
+  push:
+    branches:
+      - 'develop'
+      - 'master'
+      - '*-stable'
 
 
 concurrency:
@@ -12,8 +17,7 @@ concurrency:
 jobs:
   puppet:
     name: Puppet
-    uses: voxpupuli/gha-puppet/.github/workflows/beaker.yml@v2
+    uses: voxpupuli/gha-puppet/.github/workflows/beaker.yml@v3
     with:
       pidfile_workaround: 'true'
       rubocop: false
-      cache-version: '1'

Gemfile

@@ -8,11 +8,11 @@ gem 'rake'
 
 gem 'kafo_module_lint', {"groups"=>["test"]}
 gem 'puppet-lint-spaceship_operator_without_tag-check', '~> 1.0', {"groups"=>["test"]}
-gem 'voxpupuli-test', '~> 7.0', {"groups"=>["test"]}
+gem 'voxpupuli-test', '~> 9.0', {"groups"=>["test"]}
 gem 'github_changelog_generator', '>= 1.15.0', {"groups"=>["development"]}
 gem 'puppet_metadata', '~> 4.0'
 gem 'puppet-blacksmith', '>= 6.0.0', {"groups"=>["development"]}
-gem 'voxpupuli-acceptance', '~> 3.0', {"groups"=>["system_tests"]}
+gem 'voxpupuli-acceptance', '~> 3.4', {"groups"=>["system_tests"]}
 gem 'puppetlabs_spec_helper', {"groups"=>["system_tests"]}
 gem 'hocon'
 

manifests/config.pp

@@ -27,7 +27,7 @@
     'ssldir': value => $puppet::ssldir;
     'privatekeydir': value => '$ssldir/private_keys { group = service }';
     'hostprivkey': value => '$privatekeydir/$certname.pem { mode = 640 }';
-    'show_diff': value  => $puppet::show_diff;
+    'show_diff': value => $puppet::show_diff;
     'codedir': value => $puppet::codedir;
   }
 
@@ -92,7 +92,7 @@
   -> case $facts['os']['family'] {
     'Windows': {
       concat { "${puppet_dir}/puppet.conf":
-        mode  => $puppet::puppetconf_mode,
+        mode => $puppet::puppetconf_mode,
       }
     }
 

spec/classes/puppet_server_puppetserver_spec.rb

@@ -34,8 +34,8 @@
       end
 
       describe 'with default parameters' do
         it { should contain_file('/etc/custom/puppetserver/services.d').with_ensure('directory') }
         it {
           should contain_file('/etc/custom/puppetserver/services.d/ca.cfg')
             .with_content(%r{^puppetlabs.services.ca.certificate-authority-service/certificate-authority-service})
             .with_content(%r{^#puppetlabs.services.ca.certificate-authority-disabled-service/certificate-authority-disabled-service})
@@ -117,6 +117,10 @@
             .with_content(/^\s+name: "puppetlabs cert status"/)
             .with_content(%r{^\s+path: "/puppet-ca/v1/certificate_statuses"})
             .with_content(/^\s+name: "puppetlabs cert statuses"/)
+            .with_content(%r{^\s+path: "/puppet-ca/v1/sign"})
+            .with_content(/^\s+name: "puppetlabs cert sign"/)
+            .with_content(%r{^\s+path: "/puppet-ca/v1/sign/all"})
+            .with_content(/^\s+name: "puppetlabs cert sign all"/)
             .with_content(%r{^\s+path: "/puppet-admin-api/v1/environment-cache"})
             .with_content(/^\s+name: "environment-cache"/)
             .with_content(%r{^\s+path: "/puppet-admin-api/v1/jruby-pool"})
@@ -345,7 +349,7 @@
 
       describe 'server_max_open_files', unless: facts[:osfamily] == 'FreeBSD' do
         context 'when server_max_open_files => undef' do
           it do
             if facts['service_provider'] == 'systemd'
               should contain_systemd__dropin_file('puppetserver.service-limits.conf')
                 .with_ensure('absent')
@@ -359,7 +363,7 @@
         context 'when server_max_open_files => 32143' do
           let(:params) { super().merge(server_max_open_files: 32143) }
 
           it do
             if facts['service_provider'] == 'systemd'
                 should contain_systemd__dropin_file('puppetserver.service-limits.conf')
                   .with_ensure('present')
@@ -577,6 +581,48 @@
           it { expect(rule['allow']).to eq(['localhost', 'host.example.com']) }
         end
       end
+
+      describe 'cert sign endpoint' do
+        let(:content) { catalogue.resource('file', auth_conf).send(:parameters)[:content] }
+        let(:rules) { Hocon.parse(content)['authorization']['rules'] }
+        let(:rule) { rules.find {|rule| rule['name'] == 'puppetlabs cert sign' } }
+
+        context 'by default' do
+          it { expect(rule).not_to be_nil }
+          it { expect(rule['match-request']['path']).to eq('/puppet-ca/v1/sign') }
+          it { expect(rule['match-request']['type']).to eq('path') }
+          it { expect(rule['match-request']['method']).to eq('post') }
+          it { expect(rule['sort-order']).to eq(500) }
+          it { expect(rule['allow']).to eq(['localhost', 'foo.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) }
+        end
+
+        context 'with server_ca_client_allowlist set' do
+          let(:params) { super().merge(server_ca_client_allowlist: ['puppetserver.example.com', 'admin.example.com']) }
+
+          it { expect(rule['allow']).to eq(['puppetserver.example.com', 'admin.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) }
+        end
+      end
+
+      describe 'cert sign all endpoint' do
+        let(:content) { catalogue.resource('file', auth_conf).send(:parameters)[:content] }
+        let(:rules) { Hocon.parse(content)['authorization']['rules'] }
+        let(:rule) { rules.find {|rule| rule['name'] == 'puppetlabs cert sign all' } }
+
+        context 'by default' do
+          it { expect(rule).not_to be_nil }
+          it { expect(rule['match-request']['path']).to eq('/puppet-ca/v1/sign/all') }
+          it { expect(rule['match-request']['type']).to eq('path') }
+          it { expect(rule['match-request']['method']).to eq('post') }
+          it { expect(rule['sort-order']).to eq(500) }
+          it { expect(rule['allow']).to eq(['localhost', 'foo.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) }
+        end
+
+        context 'with server_ca_client_allowlist set' do
+          let(:params) { super().merge(server_ca_client_allowlist: ['puppetserver.example.com', 'admin.example.com']) }
+
+          it { expect(rule['allow']).to eq(['puppetserver.example.com', 'admin.example.com', {'extensions' => {'pp_cli_auth' => 'true'}}]) }
+        end
+      end
     end
   end
 end

spec/classes/puppet_server_spec.rb

@@ -47,10 +47,10 @@
       end
 
       describe 'with no custom parameters' do
         it { should compile.with_all_deps }
 
         # install
         it { should contain_class('puppet::server::install') }
         it { should contain_user('puppet') }
         it { should contain_package(puppetserver_pkg).with_install_options(nil) }
 
@@ -484,7 +484,7 @@
             )
           end
 
           it 'should not sync the crl' do
             # https://github.com/puppetlabs/rspec-puppet/issues/37
             pending("rspec-puppet always sets $server_facts['servername']")
             should_not contain_file('/etc/custom/puppetlabs/puppet/ssl/crl.pem')
@@ -530,6 +530,11 @@
           it 'should not sync the crl' do
             should_not contain_file('/etc/custom/puppetlabs/puppet/ssl/crl.pem')
           end
+          it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/certificate_renewal"}) }
+          it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/certificate_status"}) }
+          it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/certificate_statuses"}) }
+          it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/sign"}) }
+          it { should contain_file("#{conf_d_dir}/auth.conf").with_content(%r{path:\s*"/puppet-ca/v1/sign/all"}) }
         end
       end
 

templates/server/puppetserver/conf.d/auth.conf.erb

@@ -202,6 +202,46 @@ authorization: {
             sort-order: 500
             name: "puppetlabs cert clean"
         },
+        {
+            # Allow the CA CLI to access the certificate sign endpoint
+            match-request: {
+                path: "/puppet-ca/v1/sign"
+                type: path
+                method: post
+            }
+            allow: [
+<%- @server_ca_client_allowlist.each do |client| -%>
+                "<%= client %>",
+<%- end -%>
+                {
+                    extensions: {
+                        pp_cli_auth: "true"
+                    }
+                }
+            ]
+            sort-order: 500
+            name: "puppetlabs cert sign"
+        },
+        {
+            # Allow the CA CLI to access the certificate sign all endpoint
+            match-request: {
+                path: "/puppet-ca/v1/sign/all"
+                type: path
+                method: post
+            }
+            allow: [
+<%- @server_ca_client_allowlist.each do |client| -%>
+                "<%= client %>",
+<%- end -%>
+                {
+                    extensions: {
+                        pp_cli_auth: "true"
+                    }
+                }
+            ]
+            sort-order: 500
+            name: "puppetlabs cert sign all"
+        },
         {
             # Allow unauthenticated access to the status service endpoint
             match-request: {