puppet forge module

[milesstoetzner]

Hello,

I would be really interessted in a puppet module to manage step-ca and step-cli.

Our goal:

• step-ca instance on a VM in the cloud managed by puppet
• puppet manages issuing and renewing certificates on managed devices including hooks to restart services after renewals

Is there any change that smallstep publishes an official puppet module on puppet forge?
I would be happy to help writing one.
I am not an puppet expert tho.

I have already seen https://github.com/smallstep/certificates/tree/master/examples.

Greetings

[milesstoetzner]

Some inspiration for managing certificates. One downside of my approach is that currently during each puppet run a token is generated (the certificate is not renewed each run tho).

• custom function that generates a token (expects step cli installed on puppet master)

  Puppet::Functions.create_function(:'step_ca_token') do
    dispatch :up do
      param 'String', :subject
      param 'String', :issuer
      param 'String', :password_file
      param 'String', :ca_url
      param 'String', :root
    end
  
    def up(subject, issuer, password_file, ca_url, root)
      command = "step ca token #{subject} --issuer #{issuer} --password-file #{password_file} --ca-url #{ca_url} --root #{root}"
      output = Puppet::Util::Execution.execute(command)
      data = output.split("\n")
      token = data[1]
    end
  end
  

• step::cert for issuing a certificate using the custom function and creating a service for renewing the certificate

  define step::cert (
    String $subject       = $name,
    String $cert          = "/etc/tls/${subject}.crt",
    String $key           = "/etc/tls/${subject}.key",
    String $hook          = "/etc/step/step-renew-${subject}-hook.sh",
  
    String $issuer,
    String $password_file = "/etc/puppetlabs/puppet/step/password",
    String $ca_url,
    String $root          = "/etc/puppetlabs/puppet/step/root.pem"
  ) {
  
  
    # Generate token
    $token = step_ca_token($subject, $issuer, $password_file, $ca_url, $root)
  
    # Issue cert using token
    exec { "step-issue-${subject}":
      command => "step ca certificate ${subject} ${cert} ${key} --token ${token} --force",
      path    => $path,
      unless  => "step certificate verify ${cert}"
    }
  
    # Renewal service
    systemd::unit_file { "step-renew-${subject}.service":
      require => Exec["step-issue-${subject}"],
      content => "[Unit]
  Description=Step Renew ${subject}
  After=network.target
  StartLimitIntervalSec=0
  
  [Service]
  Type=simple
  ExecStart=/usr/bin/step ca renew --daemon --exec \"/bin/bash ${hook}\" ${cert} ${key}
  Restart=always
  RestartSec=2s
  
  [Install]
  WantedBy=multi-user.target",
      enable  => true,
      active  => true,
    }
  
    # Renewal Hook
    concat { $hook:
      ensure => present,
      warn   => true,
      mode   => '0755'
    }
  
    concat::fragment { 'header':
      target  => $hook,
      content => '
  #!/bin/bash
  set -e
  ',
      order   => '01'
    }
  
  }
  

• step::hook for concatenating a command to the renewing exec call. produces e.g.

  # This file is managed by Puppet. DO NOT EDIT.
  
  #!/bin/bash
  set -e
  
  # grafana
  echo 'running grafana hook'
  systemctl restart grafana-server.service
  
  # nginx
  echo 'running nginx hook'
  systemctl reload nginx
  
  # promtail
  echo 'running promtail hook'
  systemctl restart promtail
  

  define step::hook (
    String $certname = $fqdn,
    String $command,
  ) {
  
    concat::fragment { "${name}_command":
      target  => "/etc/step/step-renew-${certname}-hook.sh",
      content => "
  # ${name}
  echo 'running ${name} hook'
  ${command}
  ",
      order   => '02'
    }
  
  }