Puppet Class: splunk::certs::web

Defined in:
manifests/certs/web.pp

Overview

Parameters:

  • package (Any) (defaults to: $splunk::package)
  • splunk_os_user (Any) (defaults to: $splunk::real_splunk_os_user)
  • splunk_os_group (Any) (defaults to: $splunk::real_splunk_os_group)
  • splunk_dir_mode (Any) (defaults to: $splunk::real_splunk_dir_mode)
  • splunk_file_mode (Any) (defaults to: $splunk::real_splunk_file_mode)
  • splunk_home (Any) (defaults to: $splunk::splunk_home)
  • privkeypath (Any) (defaults to: $splunk::privkeypath)
  • servercert (Any) (defaults to: $splunk::servercert)
  • reuse_puppet_certs_for_web (Any) (defaults to: $splunk::reuse_puppet_certs_for_web) 


6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'manifests/certs/web.pp', line 6

class splunk::certs::web (
  $package = $splunk::package,
  $splunk_os_user = $splunk::real_splunk_os_user,
  $splunk_os_group = $splunk::real_splunk_os_group,
  $splunk_dir_mode = $splunk::real_splunk_dir_mode,
  $splunk_file_mode = $splunk::real_splunk_file_mode,
  $splunk_home = $splunk::splunk_home,
  $privkeypath = $splunk::privkeypath,
  $servercert = $splunk::servercert,
  $reuse_puppet_certs_for_web = $splunk::reuse_puppet_certs_for_web
){
  case $::osfamily {
    /^[Ww]indows$/: {
      #################################### WINDOWS #################################
      if $reuse_puppet_certs_for_web {
        # reuse certs from open source Puppet
        exec { 'openssl web privkey opensource puppet':
          command     => "powershell -command \"Copy-Item c:/ProgramData/PuppetLabs/puppet/etc/ssl/private_keys/${::fqdn}.pem \'${splunk_home}/etc/auth/${privkeypath}\'\"",
          path        => ['c:/windows/system32/windowspowershell/v1.0', 'c:/windows/system32', "${splunk_home}/bin"],
          environment => "OPENSSL_CONF=${splunk_home}/openssl.cnf",
          creates     => [ "${splunk_home}/etc/auth/${privkeypath}", ],
          require     => File["${splunk_home}/etc/auth/certs"],
          onlyif      => "powershell -command \"Test-Path C:/ProgramData/PuppetLabs/puppet/etc/ssl/private_keys/${::fqdn}.pem\""
        }
        -> file { "${splunk_home}/etc/auth/certs/${privkeypath}":
          owner => $splunk_os_user,
          group => $splunk_os_group,
          mode  => $splunk_file_mode,
        }
        -> exec { 'openssl web cert opensource puppet':
          command     => "powershell -command \"Copy-Item C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/${::fqdn}.pem \'${splunk_home}/etc/auth/${servercert}\'\"",
          path        => ['c:/windows/system32/windowspowershell/v1.0', 'c:/windows/system32', "${splunk_home}/bin"],
          environment => "OPENSSL_CONF=${splunk_home}/openssl.cnf",
          creates     => [ "${splunk_home}/etc/auth/${servercert}", ],
          onlyif      => "powershell -command \"Test-Path C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/${::fqdn}.pem\""
        }
        -> file { "${splunk_home}/etc/auth/${servercert}":
          owner => $splunk_os_user,
          group => $splunk_os_group,
          mode  => $splunk_file_mode,
        }

      }
    }
    default: {
      #################################### NIX #################################
      if $reuse_puppet_certs_for_web {
        # reuse certs from open source Puppet
        exec { 'openssl web privkey opensource puppet':
          command => "cat /etc/puppet/ssl/private_keys/${::fqdn}.pem > ${splunk_home}/etc/auth/${privkeypath}",
          path    => ['/bin', '/sbin', '/usr/bin', '/usr/sbin', "${splunk_home}/bin"],
          creates => [ "${splunk_home}/etc/auth/${privkeypath}", ],
          onlyif  => "/usr/bin/test -e /etc/puppet/ssl/private_keys/${::fqdn}.pem"
        }
        -> exec { 'openssl web cert opensource puppet':
          command => "cat /etc/puppet/ssl/certs/${::fqdn}.pem > ${splunk_home}/etc/auth/${servercert}",
          path    => ['/bin', '/sbin', '/usr/bin', '/usr/sbin', "${splunk_home}/bin"],
          creates => [ "${splunk_home}/etc/auth/${servercert}", ],
          onlyif  => "/usr/bin/test -e /etc/puppet/ssl/certs/${::fqdn}.pem"
        }
        # reuse certs from commercial Puppet
        -> exec { 'openssl web privkey commercial puppet':
          command => "cat /etc/puppetlabs/puppet/ssl/private_keys/${::fqdn}.pem > ${splunk_home}/etc/auth/${privkeypath}",
          path    => ['/bin', '/sbin', '/usr/bin', '/usr/sbin', "${splunk_home}/bin"],
          creates => [ "${splunk_home}/etc/auth/${privkeypath}", ],
          onlyif  => "/usr/bin/test -e /etc/puppetlabs/puppet/ssl/private_keys/${::fqdn}.pem"
        }
        -> exec { 'openssl web cert commercial puppet':
          command => "cat /etc/puppetlabs/puppet/ssl/certs/${::fqdn}.pem > ${splunk_home}/etc/auth/${servercert}",
          path    => ['/bin', '/sbin', '/usr/bin', '/usr/sbin', "${splunk_home}/bin"],
          creates => [ "${splunk_home}/etc/auth/${servercert}", ],
          onlyif  => "/usr/bin/test -e /etc/puppetlabs/puppet/ssl/certs/${::fqdn}.pem"
        }
        # reuse certs from Red Hat packaged Puppet
        -> exec { 'openssl web privkey redhat puppet':
          command => "cat /var/lib/puppet/ssl/private_keys/${::fqdn}.pem > ${splunk_home}/etc/auth/${privkeypath}",
          path    => ['/bin', '/sbin', '/usr/bin', '/usr/sbin', "${splunk_home}/bin"],
          creates => [ "${splunk_home}/etc/auth/${privkeypath}", ],
          onlyif  => "/usr/bin/test -e /var/lib/puppet/ssl/private_keys/${::fqdn}.pem"
        }
        -> exec { 'openssl web cert redhat puppet':
          command => "cat /var/lib/puppet/ssl/private_keys/${::fqdn}.pem > ${splunk_home}/etc/auth/${servercert}",
          path    => ['/bin', '/sbin', '/usr/bin', '/usr/sbin', "${splunk_home}/bin"],
          creates => [ "${splunk_home}/etc/auth/${servercert}", ],
          onlyif  => "/usr/bin/test -e /var/lib/puppet/ssl/private_keys/${::fqdn}.pem"
        }

        # Fix permissions
        -> file { "${splunk_home}/etc/auth/${privkeypath}":
          owner => $splunk_os_user,
          group => $splunk_os_group,
          mode  => $splunk_file_mode,
        }
        -> file { "${splunk_home}/etc/auth/${servercert}":
          owner => $splunk_os_user,
          group => $splunk_os_group,
          mode  => $splunk_file_mode,
        }
      }
    }
  }
}