Skip to content

Commit

Permalink
update documentation to reflect puppetdb_ssl is supposed to be a bool…
Browse files Browse the repository at this point in the history
…ean and not a string
  • Loading branch information
mkinney committed Oct 23, 2015
1 parent f48245a commit 6b95a6a
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 15 deletions.
26 changes: 13 additions & 13 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -194,12 +194,12 @@ Here's an example, using new certificates:
$ssl_dir = '/var/lib/puppetboard/ssl'
$puppetboard_certname = 'puppetboard.example.com'
class { 'puppetboard':
manage_virtualenv => true,
puppetdb_host => 'puppetdb.example.com',
puppetdb_port => '8081',
puppetdb_key => "${ssl_dir}/private_keys/${puppetboard_certname}.pem",
puppetdb_ssl => 'True',
puppetdb_cert => "${ssl_dir}/certs/${puppetboard_certname}.pem",
manage_virtualenv => true,
puppetdb_host => 'puppetdb.example.com',
puppetdb_port => '8081',
puppetdb_key => "${ssl_dir}/private_keys/${puppetboard_certname}.pem",
puppetdb_ssl_verify => true,
puppetdb_cert => "${ssl_dir}/certs/${puppetboard_certname}.pem",
}
```
If you are re-using the existing puppet client certificates, they will already exist on the node (assuming puppet has been run and the client cert signed by the puppet master). However, the puppetboaard user will not have permission to read the private key unless you add it to the puppet group.
Expand All @@ -210,13 +210,13 @@ Here's a complete example, re-using the puppet client certs:
$ssl_dir = $::settings::ssldir
$puppetboard_certname = $::certname
class { 'puppetboard':
groups => 'puppet',
manage_virtualenv => true,
puppetdb_host => 'puppetdb.example.com',
puppetdb_port => '8081',
puppetdb_key => "${ssl_dir}/private_keys/${puppetboard_certname}.pem",
puppetdb_ssl => 'True',
puppetdb_cert => "${ssl_dir}/certs/${puppetboard_certname}.pem",
groups => 'puppet',
manage_virtualenv => true,
puppetdb_host => 'puppetdb.example.com',
puppetdb_port => '8081',
puppetdb_key => "${ssl_dir}/private_keys/${puppetboard_certname}.pem",
puppetdb_ssl_verify => true,
puppetdb_cert => "${ssl_dir}/certs/${puppetboard_certname}.pem",
}
```
Note that both the above approaches only work if you have the Puppet CA root certificate added to the root certificate authority file used by your operating system. If you want to specify the location to the Puppet CA file ( you probably do) you have to use the syntax below. Currently this is a bit of a gross hack, but it's an open issue to resolve it in the Puppet module:
Expand Down
5 changes: 3 additions & 2 deletions manifests/init.pp
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,8 @@
# Defaults to 'None' ($::puppetboard::params::puppetdb_key)
#
# [*puppetdb_ssl_verify*]
# (string) whether PuppetDB uses SSL or not, 'True' or 'False', or the path to the puppet CA
# Defaults to 'False' ($::puppetboard::params::puppetdb_ssl_verify)
# (string) whether PuppetDB uses SSL or not (true or false)
# Defaults to false ($::puppetboard::params::puppetdb_ssl_verify)
#
# [*puppetdb_cert*]
# (string, absolute path) path to PuppetMaster/CA signed client SSL cert
Expand Down Expand Up @@ -170,6 +170,7 @@
validate_bool($experimental)
validate_bool($localise_timestamp)
validate_hash($extra_settings)
validate_bool($puppetdb_ssl_verify)

if $manage_group {
group { $group:
Expand Down

1 comment on commit 6b95a6a

@ryno75
Copy link

@ryno75 ryno75 commented on 6b95a6a Feb 4, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is wrong. That parameter should be EITHER a bool or a string.
Check the readme from puppetboard... https://github.com/voxpupuli/puppetboard/blob/master/README.rst#id16

Further... if you look at the app.py file where it uses the PUPPETDB_SSL_VERIFY it is using the pypuppetdb.connect method which has the following in its docstring:
:param ssl_verify: (optional) Verify PuppetDB server certificate.
:type ssl_verify: :obj:bool or :obj:string True, False or filesystem path to CA certificate.

Also... this breaks PuppetDB SSL auth. That arg needs to point to the CA cert.

Please sign in to comment.