This message was deleted.
# puppet-enterprises
Slackbot
02/02/2023, 9:21 PMThis message was deleted.
b
bastelfreak
02/02/2023, 9:22 PMhi o/
bastelfreak
02/02/2023, 9:22 PMused that a few months ago and worked fine
z
ziggy
02/02/2023, 9:22 PM👋 Thank you!
b
bastelfreak
02/02/2023, 9:23 PMalso the maintainer worked for puppet and then hashicorp, so if you have some trouble Peter csn usually quickly help out
z
ziggy
02/02/2023, 9:24 PMGreat! Thanks so much for the info
ziggy
02/02/2023, 9:26 PMI might be curious if this supports certificate-based auth rather than using a token. E.g. if the client/server is signed with the Puppet CA, allow access to vault
b
bastelfreak
02/02/2023, 9:28 PMI think the recommendation is to run vault agent on the puppetserver. puppetsetver/hiera can authenticate with a token to vault agent and the agent uses cert or approle authentication to the vault cluster
bastelfreak
02/02/2023, 9:28 PMand the cert auth can use puppet CA
c
csharpsteen
02/02/2023, 9:32 PMWe've had a recent report of Vault not being able to properly validate certificates issued by the Puppet 6 CA.
csharpsteen
02/02/2023, 9:33 PMIf I recall correctly, the Puppet Root CA having a serial number of 1 and the Puppet sub-CA also having a serial number of 1 confuses Vault TLS validation --- it doesn't recognize those numbers are in separate "namespaces".
b
bastelfreak
02/02/2023, 9:34 PMwell theres an old feature request to switch to UIDs as serials :D
bastelfreak
02/02/2023, 9:34 PMthat would be nice <3
c
csharpsteen
02/02/2023, 9:37 PMYeah, they looked into it for Puppet 8, but the switch isn't straight-forward due to Java not having a 128 bit integer type:
https://tickets.puppetlabs.com/browse/SERVER-2640
b
bastelfreak
02/02/2023, 9:39 PMyeah :(
bastelfreak
02/02/2023, 9:40 PMwould really be nice to have that for active/active CAs
c
csharpsteen
02/02/2023, 9:41 PMIt would enable active/active issuing of certs. Revocation is still tricky.
b
bastelfreak
02/02/2023, 9:41 PMyep
z
ziggy
02/02/2023, 9:46 PMCurious if this poses a risk to have a long-lived token, given that it has to be manually specified in the hiera config
ziggy
02/02/2023, 9:46 PMtoo bad that Puppet cant fetch a new token over time before ttl has expired
b
bastelfreak
02/02/2023, 9:47 PMI think I used a path to a tokenfile
bastelfreak
02/02/2023, 9:47 PMbut I dont remember how the renewal worked :D
z
ziggy
02/02/2023, 9:47 PMright, but that's still long-lived, correct?
ziggy
02/02/2023, 9:47 PMI will definitely use a file.
b
bastelfreak
02/02/2023, 9:48 PMI am not sure
bastelfreak
02/02/2023, 9:48 PMI think it can do some auto token refresh?
bastelfreak
02/02/2023, 9:48 PMa good question for Peter :D
bastelfreak
02/02/2023, 9:48 PMmaybe raise a github issue with ,"how to use this in a secure way"
m
magisus
02/02/2023, 9:53 PMIf anyone tries using the cert auth and sees it work, I'd love to hear it. We have some internal testing that does it successfully...
b
bastelfreak
02/02/2023, 9:54 PMI need to spin a vault stack up for some PE customers soon, I will update you. It worked fine the last time
bastelfreak
02/02/2023, 9:55 PM@csharpsteen do you know if theres a bugreport somewhere about vault nit liking the PuppetCA chain?
bastelfreak
02/02/2023, 9:55 PMI would like to know if this is a regresssion
m
magisus
02/02/2023, 9:56 PMAs far as I know no bug ticket has been filed (I've been working with the customer in question), but I was also brought into the convo kinda late
b
bastelfreak
02/02/2023, 9:56 PMah okay
m
magisus
02/02/2023, 9:56 PMA lot of their other related complaints were more "this seems bad" than "this is actually broken" so I'm not totally sure what to make of the report
magisus
02/02/2023, 9:57 PMThe docs in question I found that refer to the issue are here https://developer.hashicorp.com/vault/docs/auth/cert There's a note in there about unique serials
b
bastelfreak
02/02/2023, 9:57 PMah the usual customer reports :D
bastelfreak
02/02/2023, 10:00 PMas a workaround recreating the intermediate cert should be quite easy 🤔
m
magisus
02/02/2023, 10:01 PMYeah for sure, if you were willing to redistribute the new certs across your fleet.
magisus
02/02/2023, 10:01 PMThe UUID thing is unfortunately quite complicated and touches a lot of components, even though that does feel like the "right" way to solve this (and many other) problems
b
bastelfreak
02/02/2023, 10:02 PMI already feared that :(
9 Views