Skip to content

Commit 310fe29

Browse files
Filipovici-AndreiFilipovici-Andrei
committed
(PDB-4764) Agent SSL certificates are used for communication with the postgresql
1 parent 11dc0df commit 310fe29

8 files changed

Lines changed: 123 additions & 16 deletions

File tree

‎lib/puppet/type/puppetdb_conn_validator.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
end
2424

2525
newparam(:use_ssl) do
26-
desc 'Whether the connection will be attemped using https'
26+
desc 'Whether the connection will be attempted using https'
2727
defaultto true
2828
end
2929

‎manifests/database/postgresql.pp‎

Lines changed: 69 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,19 @@
11
# Class for creating the PuppetDB postgresql database. See README.md for more
22
# information.
33
class puppetdb::database::postgresql(
4-
$listen_addresses = $puppetdb::params::database_host,
5-
$database_name = $puppetdb::params::database_name,
6-
$database_username = $puppetdb::params::database_username,
7-
$database_password = $puppetdb::params::database_password,
8-
$database_port = $puppetdb::params::database_port,
9-
$manage_database = $puppetdb::params::manage_database,
10-
$manage_server = $puppetdb::params::manage_dbserver,
11-
$manage_package_repo = $puppetdb::params::manage_pg_repo,
12-
$postgres_version = $puppetdb::params::postgres_version,
4+
$listen_addresses = $puppetdb::params::database_host,
5+
$database_name = $puppetdb::params::database_name,
6+
$database_username = $puppetdb::params::database_username,
7+
$database_password = $puppetdb::params::database_password,
8+
$database_port = $puppetdb::params::database_port,
9+
$manage_database = $puppetdb::params::manage_database,
10+
$manage_server = $puppetdb::params::manage_dbserver,
11+
$manage_package_repo = $puppetdb::params::manage_pg_repo,
12+
$postgres_version = $puppetdb::params::postgres_version,
13+
$postgresql_ssl_on = $puppetdb::params::postgresql_ssl_on,
14+
$postgresql_ssl_key_path = $puppetdb::params::postgresql_ssl_key_path,
15+
$postgresql_ssl_cert_path = $puppetdb::params::postgresql_ssl_cert_path,
16+
$postgresql_ssl_ca_cert_path = $puppetdb::params::postgresql_ssl_ca_cert_path
1317
) inherits puppetdb::params {
1418

1519
if $manage_server {
@@ -24,6 +28,62 @@
2428
port => scanf($database_port, '%i')[0],
2529
}
2630

31+
# configure PostgreSQL communication with Puppet Agent SSL certificates if
32+
# postgresql_ssl_on is set to true
33+
if $postgresql_ssl_on {
34+
file {'postgres private key':
35+
ensure => present,
36+
path => "${postgresql::params::datadir}/server.key",
37+
source => $postgresql_ssl_key_path,
38+
owner => 'postgres',
39+
mode => '0600',
40+
require => Package['postgresql-server'],
41+
}
42+
43+
concat {'postgres cert bundle':
44+
ensure => present,
45+
path => "${postgresql::params::datadir}/server.crt",
46+
owner => 'postgres',
47+
require => Package['postgresql-server'],
48+
}
49+
50+
concat::fragment {'agent cert':
51+
target => 'postgres cert bundle',
52+
source => $postgresql_ssl_cert_path,
53+
order => '1',
54+
}
55+
56+
concat::fragment {'CA bundle':
57+
target => 'postgres cert bundle',
58+
source => $postgresql_ssl_ca_cert_path,
59+
order => '2',
60+
}
61+
62+
postgresql::server::config_entry {'ssl':
63+
ensure => present,
64+
value => 'on',
65+
require => [File['postgres private key'], Concat['postgres cert bundle']]
66+
}
67+
68+
postgresql::server::config_entry {'ssl_key_file':
69+
ensure => present,
70+
value => "${postgresql::params::datadir}/server.key",
71+
require => [File['postgres private key'], Concat['postgres cert bundle']]
72+
}
73+
74+
postgresql::server::config_entry {'ssl_cert_file':
75+
ensure => present,
76+
value => "${postgresql::params::datadir}/server.crt",
77+
require => [File['postgres private key'], Concat['postgres cert bundle']]
78+
}
79+
80+
# postgresql::server::config_entry {'ssl_ca_file':
81+
# ensure => present,
82+
# value => $postgresql_ssl_ca_cert_path,
83+
# require => [File['postgres private key'], Concat['postgres cert bundle']]
84+
# }
85+
}
86+
2787
# Only install pg_trgm extension, if database it is actually managed by the module
2888
if $manage_database {
2989

‎manifests/init.pp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@
1919
$ssl_cert = $puppetdb::params::ssl_cert,
2020
$ssl_ca_cert = $puppetdb::params::ssl_ca_cert,
2121
$ssl_protocols = $puppetdb::params::ssl_protocols,
22+
$postgresql_ssl_on = $puppetdb::params::postgresql_ssl_on,
23+
$postgresql_ssl_folder = $puppetdb::params::postgresql_ssl_folder,
24+
$postgresql_ssl_cert_path = $puppetdb::params::postgresql_ssl_cert_path,
25+
$postgresql_ssl_key_path = $puppetdb::params::postgresql_ssl_key_path,
26+
$postgresql_ssl_ca_cert_path = $puppetdb::params::postgresql_ssl_ca_cert_path,
2227
$cipher_suites = $puppetdb::params::cipher_suites,
2328
$migrate = $puppetdb::params::migrate,
2429
$manage_dbserver = $puppetdb::params::manage_dbserver,

‎manifests/params.pp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,14 @@
180180
$cleanup_timer_interval = "*-*-* ${fqdn_rand(24)}:${fqdn_rand(60)}:00"
181181
$dlo_max_age = 90
182182

183+
# certificats used for PostgreSQL SSL configuration. Puppet certificates are used
184+
$postgresql_ssl_on = true
185+
$postgresql_ssl_folder = "${puppet_confdir}/ssl"
186+
$postgresql_ssl_cert_path = "${postgresql_ssl_folder}/certs/${trusted['certname']}.pem"
187+
$postgresql_ssl_key_path = "${postgresql_ssl_folder}/private_keys/${trusted['certname']}.pem"
188+
$postgresql_ssl_ca_cert_path = "${postgresql_ssl_folder}/certs/ca.pem"
189+
190+
# certificats used for Jetty configuration
183191
$ssl_set_cert_paths = false
184192
$ssl_cert_path = "${ssl_dir}/public.pem"
185193
$ssl_key_path = "${ssl_dir}/private.pem"

‎manifests/server/database.pp‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@
2525
$puppetdb_group = $puppetdb::params::puppetdb_group,
2626
$database_max_pool_size = $puppetdb::params::database_max_pool_size,
2727
$migrate = $puppetdb::params::migrate,
28+
$postgresql_ssl_on = $puppetdb::params::postgresql_ssl_on,
29+
$ssl_cert_path = $puppetdb::params::ssl_cert_path,
30+
$ssl_key_path = $puppetdb::params::ssl_key_path,
31+
$ssl_ca_cert_path = $puppetdb::params::ssl_ca_cert_path
2832
) inherits puppetdb::params {
2933

3034
if str2bool($database_validate) {
@@ -85,7 +89,16 @@
8589
$database_suffix = ''
8690
}
8791

88-
$subname = "//${database_host}:${database_port}/${database_name}${database_suffix}"
92+
$subname_default = "//${database_host}:${database_port}/${database_name}${database_suffix}"
93+
94+
if $postgresql_ssl_on {
95+
$subname = "${subname_default}?\
96+
ssl=true&sslfactory=org.postgresql.ssl.LibPQFactory&\
97+
sslmode=verify-full&sslrootcert=${ssl_ca_cert_path}&\
98+
sslkey=${ssl_key_path}&sslcert=${ssl_cert_path}"
99+
} else {
100+
$subname = $subname_default
101+
}
89102

90103
##Only setup for postgres
91104
ini_setting {'puppetdb_psdatabase_username':

‎manifests/server/read_database.pp‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@
1717
$puppetdb_user = $puppetdb::params::puppetdb_user,
1818
$puppetdb_group = $puppetdb::params::puppetdb_group,
1919
$database_max_pool_size = $puppetdb::params::read_database_max_pool_size,
20+
$postgresql_ssl_on = $puppetdb::params::postgresql_ssl_on,
21+
$ssl_cert_path = $puppetdb::params::ssl_cert_path,
22+
$ssl_key_path = $puppetdb::params::ssl_key_path,
23+
$ssl_ca_cert_path = $puppetdb::params::ssl_ca_cert_path
2024
) inherits puppetdb::params {
2125

2226
# Only add the read database configuration if database host is defined.
@@ -73,7 +77,17 @@
7377
$database_suffix = ''
7478
}
7579

76-
$subname = "//${database_host}:${database_port}/${database_name}${database_suffix}"
80+
$subname_default = "//${database_host}:${database_port}/${database_name}${database_suffix}"
81+
82+
notify { "ssl_on ${postgresql_ssl_on}": }
83+
if $postgresql_ssl_on {
84+
$subname = "${subname_default}?\
85+
ssl=true&sslfactory=org.postgresql.ssl.LibPQFactory&\
86+
sslmode=verify-full&sslrootcert=${ssl_ca_cert_path}&\
87+
sslkey=${ssl_key_path}&sslcert=${ssl_cert_path}"
88+
} else {
89+
$subname = $subname_default
90+
}
7791

7892
ini_setting { 'puppetdb_read_database_username':
7993
setting => 'username',

‎manifests/server/validate_db.pp‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
$database_password = $puppetdb::params::database_password,
88
$database_name = $puppetdb::params::database_name,
99
$jdbc_ssl_properties = $puppetdb::params::jdbc_ssl_properties,
10+
1011
) inherits puppetdb::params {
1112

1213
# We don't need any validation for the embedded database, presumably.
@@ -17,8 +18,11 @@
1718
postgresql::validate_db_connection { 'validate puppetdb postgres connection':
1819
database_host => $database_host,
1920
database_port => $database_port,
20-
database_username => $database_username,
21-
database_password => $database_password,
21+
# database_username => $database_username,
22+
# database_password => $database_password,
23+
connect_settings => { 'PGSSLCERT' => '/var/lib/postgresql/9.6/main/server.crt',
24+
'PGSSLKEY' => '/var/lib/postgresql/9.6/main/server.key',
25+
'PGSSLMODE' => 'verify-full'},
2226
database_name => $database_name,
2327
}
2428
}

‎manifests/server/validate_read_db.pp‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,11 @@
1717
postgresql::validate_db_connection { 'validate puppetdb postgres (read) connection':
1818
database_host => $database_host,
1919
database_port => $database_port,
20-
database_username => $database_username,
21-
database_password => $database_password,
20+
# database_username => $database_username,
21+
# database_password => $database_password,
22+
connect_settings => { 'PGSSLCERT' => '/var/lib/postgresql/9.6/main/server.crt',
23+
'PGSSLKEY' => '/var/lib/postgresql/9.6/main/server.key',
24+
'PGSSLMODE' => 'verify-full'},
2225
database_name => $database_name,
2326
}
2427
}

0 commit comments

Comments
 (0)
⚡