-
Notifications
You must be signed in to change notification settings - Fork 145
Description
Certificate deployment is far from ideal as files are stored in plain text and generated on the puppet master (also mentioned in #1038).
Many file resources use source (file path) rather than content (file contents), thus we can't use eyaml with hiera to store encrypted certs and keys.
Before Example
file { "${dashboard_path_certs}/dashboard.pem":
ensure => file,
owner => $dashboard_fileuser,
group => $dashboard_filegroup,
mode => '0400',
source => $dashboard_cert_source,
require => Package['wazuh-dashboard'],
notify => Service['wazuh-dashboard'],
}
After Example
file { "${dashboard_path_certs}/dashboard.pem":
ensure => file,
owner => $dashboard_fileuser,
group => $dashboard_filegroup,
mode => '0400',
content => $dashboard_cert_source,
require => Package['wazuh-dashboard'],
notify => Service['wazuh-dashboard'],
}
The following code needs updating if this approach is acceptable?
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/dashboard.pp#L72
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/dashboard.pp#L82
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/dashboard.pp#L92
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/filebeat_oss.pp#L96
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/filebeat_oss.pp#L104
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/filebeat_oss.pp#L112
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L70
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L80
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L90
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L100
https://github.com/wazuh/wazuh-puppet/blob/main/manifests/indexer.pp#L110