Merge pull request #488 from cultuurnet/feature/trusted_puppet_ca

Add Puppet CA certificate to system truststore

Author: willaerk

manifests/ca_certificates.pp

@@ -1,5 +1,6 @@
 class profiles::ca_certificates (
   Variant[String, Array[String]] $disabled_ca_certificates = [],
+  Boolean                        $puppet_ca                = true,
   Boolean                        $publiq_development_ca    = false
 ) inherits ::profiles {
 
@@ -21,6 +22,22 @@
     }
   }
 
+  file { 'Puppet CA certificate directory':
+    ensure => 'directory',
+    path   => '/usr/local/share/ca-certificates/puppet'
+  }
+
+  file { 'Puppet CA certificate':
+    ensure  => $puppet_ca ? {
+                true  => 'file',
+                false => 'absent'
+              },
+    path    => '/usr/local/share/ca-certificates/puppet/puppet-ca.crt',
+    source  => '/etc/puppetlabs/puppet/ssl/certs/ca.pem',
+    require => File['Puppet CA certificate directory'],
+    notify  => Exec['Update CA certificates']
+  }
+
   exec { 'Update CA certificates':
     command     => 'update-ca-certificates',
     path        => [ '/usr/local/bin', '/usr/bin', '/usr/sbin', '/bin'],

spec/classes/ca_certificates_spec.rb

@@ -12,6 +12,7 @@
 
         it { is_expected.to contain_class('profiles::ca_certificates').with(
           'disabled_ca_certificates' => [],
+          'puppet_ca'                => true,
           'publiq_development_ca'    => false
         ) }
 
@@ -20,16 +21,31 @@
 
         it { is_expected.to have_augeas_resource_count(0) }
 
+        it { is_expected.to contain_file('Puppet CA certificate directory').with(
+          'ensure' => 'directory',
+          'path'   => '/usr/local/share/ca-certificates/puppet'
+        ) }
+
+        it { is_expected.to contain_file('Puppet CA certificate').with(
+          'ensure' => 'file',
+          'path'   => '/usr/local/share/ca-certificates/puppet/puppet-ca.crt',
+          'source' => '/etc/puppetlabs/puppet/ssl/certs/ca.pem'
+        ) }
+
         it { is_expected.to contain_exec('Update CA certificates').with(
           'command'     => 'update-ca-certificates',
           'path'        => [ '/usr/local/bin', '/usr/bin', '/usr/sbin', '/bin'],
           'refreshonly' => true
         ) }
+
+        it { is_expected.to contain_file('Puppet CA certificate').that_requires('File[Puppet CA certificate directory]') }
+        it { is_expected.to contain_file('Puppet CA certificate').that_notifies('Exec[Update CA certificates]') }
       end
 
-      context "with disabled_ca_certificates => 'foobar'" do
+      context "with disabled_ca_certificates => 'foobar' and puppet_ca => false" do
         let(:params) { {
-            'disabled_ca_certificates' => 'foobar'
+          'disabled_ca_certificates' => 'foobar',
+          'puppet_ca'                => false
         } }
 
         it { is_expected.not_to contain_apt__source('publiq-tools') }
@@ -43,13 +59,24 @@
           'changes' => 'set *[.= \'foobar\'] \'!foobar\'',
         ) }
 
+        it { is_expected.to contain_file('Puppet CA certificate directory').with(
+          'ensure' => 'directory',
+          'path'   => '/usr/local/share/ca-certificates/puppet'
+        ) }
+
+        it { is_expected.to contain_file('Puppet CA certificate').with(
+          'ensure' => 'absent',
+          'path'   => '/usr/local/share/ca-certificates/puppet/puppet-ca.crt'
+        ) }
+
         it { is_expected.to contain_exec('Update CA certificates').with(
           'command'     => 'update-ca-certificates',
           'path'        => [ '/usr/local/bin', '/usr/bin', '/usr/sbin', '/bin'],
           'refreshonly' => true
         ) }
 
         it { is_expected.to contain_augeas('Disable CA certificate foobar').that_notifies('Exec[Update CA certificates]') }
+        it { is_expected.to contain_file('Puppet CA certificate').that_notifies('Exec[Update CA certificates]') }
       end
 
       context "with disabled_ca_certificates => ['badcert', 'expiredcert'] and publiq_development_root_ca => true" do