Skip to content

Use hiera for cert deployment #1491

@pearsondavid

Description

@pearsondavid

Certificate deployment is far from ideal as files are stored in plain text and generated on the puppet master (also mentioned in #1038).

Many file resources use source (file path) rather than content (file contents), thus we can't use eyaml with hiera to store encrypted certs and keys.

Before Example

  file { "${dashboard_path_certs}/dashboard.pem":
    ensure  => file,
    owner   => $dashboard_fileuser,
    group   => $dashboard_filegroup,
    mode    => '0400',
    source  => $dashboard_cert_source,
    require => Package['wazuh-dashboard'],
    notify  => Service['wazuh-dashboard'],
  }

After Example

  file { "${dashboard_path_certs}/dashboard.pem":
    ensure  => file,
    owner   => $dashboard_fileuser,
    group    => $dashboard_filegroup,
    mode    => '0400',
    content => $dashboard_cert_source,
    require  => Package['wazuh-dashboard'],
    notify     => Service['wazuh-dashboard'],
  }

The following code needs updating if this approach is acceptable?

https://github.com/wazuh/wazuh-puppet/blob/main/manifests/dashboard.pp#L72
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/dashboard.pp#L82
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/dashboard.pp#L92

https://github.com/wazuh/wazuh-puppet/blob/main/manifests/filebeat_oss.pp#L96
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/filebeat_oss.pp#L104
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/filebeat_oss.pp#L112

https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L70
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L80
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L90
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L100
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L110

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions