|
1 | 1 | plan peadm::misc::upgrade_trusted_facts ( |
2 | 2 | TargetSpec $targets, |
3 | 3 | Peadm::SingleTargetSpec $master_host, |
4 | | - Boolean $autosign = false, |
5 | 4 | ) { |
6 | 5 |
|
7 | 6 | # Convert input into array of Targets |
8 | 7 | $all_targets = peadm::get_targets($targets) |
9 | 8 | $master_target = peadm::get_targets($master_host, 1) |
10 | 9 |
|
| 10 | + # This plan doesn't work over the orchestrator due to certificates being revoked. |
| 11 | + $all_targets.peadm::fail_on_transport('pcp') |
| 12 | + |
| 13 | + # The master is treated differently than a standard node, so we need to be |
| 14 | + # able to identify it if it's in the target list |
| 15 | + $master_certname = run_task('peadm::trusted_facts', $master_target)[0]['certname'] |
| 16 | + |
| 17 | + # Get trusted fact information for all targets |
11 | 18 | $certdata = run_task('peadm::trusted_facts', $all_targets).reduce({}) |$memo,$result| { |
12 | 19 | # Keep the the OID-form trusted fact key/value pairs. If we accidentally |
13 | 20 | # include an OID and also a shortname that resolves to the same OID, |
14 | 21 | # there'll be a problem trying to sign the cert. |
15 | 22 | $memo + { $result.target => ($result.value + { |
16 | 23 | 'extensions' => ($result['extensions'].filter |$k,$v| { |
17 | | - $k =~ /^1\.3\.6\.1\.4\.1\.34380\.1/ |
| 24 | + $k =~ /^1\.3\.6\.1\.4\.1\.34380\.1(?!\.3\.39)/ |
18 | 25 | }) |
19 | 26 | })} |
20 | 27 | } |
21 | 28 |
|
| 29 | + # We'll use these when running commands |
22 | 30 | $pserver = '/opt/puppetlabs/bin/puppetserver' |
23 | 31 | $puppet = '/opt/puppetlabs/bin/puppet' |
24 | 32 |
|
25 | | - $upgrade_results = $all_targets.map |$target| { |
| 33 | + # Loop through and recert each target one at at time, because Bolt lacks |
| 34 | + # real parallelism |
| 35 | + $all_targets.map |$target| { |
| 36 | + |
| 37 | + # This will be the new trusted fact data for this node |
26 | 38 | $new_trusted = $certdata[$target]['extensions'] + { |
27 | 39 | peadm::oid('peadm_role') => $certdata[$target]['extensions'][peadm::oid('pp_application')], |
28 | 40 | peadm::oid('peadm_availability_group') => $certdata[$target]['extensions'][peadm::oid('pp_cluster')], |
29 | 41 | } |
30 | 42 |
|
| 43 | + # Make sure the csr_attributes.yaml file on the node matches |
31 | 44 | run_plan('peadm::util::insert_csr_extensions', $target, |
32 | 45 | extensions => $new_trusted, |
33 | 46 | merge => false, |
34 | 47 | ) |
35 | 48 |
|
| 49 | + # Everything starts the same; we always revoke the existing cert |
36 | 50 | run_command("${pserver} ca clean --certname ${certdata[$target]['certname']}", $master_target) |
37 | | - run_command("${puppet} ssl clean --certname ${certdata[$target]['certname']}", $target) |
38 | | - run_command("${puppet} ssl submit_request --certname ${certdata[$target]['certname']}", $target) |
39 | 51 |
|
40 | | - ctrl::sleep(2) # some lag sometimes before the cert is available to sign |
| 52 | + # Then things get crazy... |
41 | 53 |
|
42 | | - if !$autosign { |
43 | | - run_command("${pserver} ca sign --certname ${certdata[$target]['certname']}", $master_target) |
| 54 | + # The procedure for regenerating an agent's cert |
| 55 | + if ($certdata[$target]['certname'] != $master_certname) { |
| 56 | + run_command("${puppet} ssl clean --certname ${certdata[$target]['certname']}", $target) |
| 57 | + run_command("${puppet} ssl submit_request --certname ${certdata[$target]['certname']}", $target) |
| 58 | + ctrl::sleep(2) # some lag sometimes before the cert is available to sign |
| 59 | + run_command(@("HEREDOC"/L), $master_target) |
| 60 | + ${pserver} ca sign --certname ${certdata[$target]['certname']} || \ |
| 61 | + ${pserver} ca list --certname ${certdata[$target]['certname']} \ |
| 62 | + | HEREDOC |
| 63 | + run_command("${puppet} ssl download_cert --certname ${certdata[$target]['certname']}", $target) |
44 | 64 | } |
45 | 65 |
|
46 | | - run_command("${puppet} ssl download_cert --certname ${certdata[$target]['certname']}", $target) |
| 66 | + # The procedure for regenerating the master's cert |
| 67 | + else { |
| 68 | + # Store the node's current dns-alt-names, for use as a flag restoring |
| 69 | + # them later |
| 70 | + $alt_names_flag = $certdata[$target]['dns-alt-names'] ? { |
| 71 | + undef => '', |
| 72 | + default => "--subject-alt-names ${certdata[$target]['dns-alt-names'].join(',')}", |
| 73 | + } |
| 74 | + |
| 75 | + # The docs are broken, and the process is unclean. Sadface. |
| 76 | + run_command(@("HEREDOC"/L), $target) |
| 77 | + rm -f \ |
| 78 | + /etc/puppetlabs/puppet/ssl/certs/${certdata[$target]['certname']}.pem \ |
| 79 | + /etc/puppetlabs/puppet/ssl/private_keys/${certdata[$target]['certname']}.pem \ |
| 80 | + /etc/puppetlabs/puppet/ssl/public_keys/${certdata[$target]['certname']}.pem \ |
| 81 | + /etc/puppetlabs/puppet/ssl/certificate_requests/${certdata[$target]['certname']}.pem \ |
| 82 | + | HEREDOC |
| 83 | + run_task('service', $target, {action => 'stop', name => 'pe-puppetserver'}) |
| 84 | + run_command(@("HEREDOC"/L), $target) |
| 85 | + ${pserver} ca generate \ |
| 86 | + --certname ${certdata[$target]['certname']} \ |
| 87 | + ${alt_names_flag} \ |
| 88 | + --ca-client \ |
| 89 | + | HEREDOC |
| 90 | + run_task('service', $target, {action => 'start', name => 'pe-puppetserver'}) |
| 91 | + } |
47 | 92 | } |
48 | 93 |
|
| 94 | + run_command("${puppet} facts upload", $all_targets) |
49 | 95 | } |
0 commit comments