-
Notifications
You must be signed in to change notification settings - Fork 241
Description
Just wanted to document that commit bdbcecd3 as part of Release 15.1.0
actually introduces a breaking change in regards to use of puppet::server_ssl_dir and should have been documented/declared as a breaking change.
In previous aforementioned commit in the server.pp class, where if $ca is checked the variables are then hard coded to $cadir which is not exposed at the class level.
We are currently using 15.0.0 on RHEL7 with puppet 7.x and relied on puppet::server_ssl_dir to place CA cert data in a shared mounted EFS volume such as '/etc/puppetlabs/shared/ssl'
However when testing to upgrade >= 15.1.0 ran into issue of ca configuration defaulting to '/etc/puppetlabs/puppetserver/ca' which is not what we desire.
However complaints aside, an unsupported workaround as the puppet::server::puppertserver class is listed as private API is setting
puppet::server::puppetserver::server_ssl_ca_cert: '/etc/puppetlabs/shared/ssl/ca/ca_crt.pem'
puppet::server::puppetserver::server_ssl_ca_crl: '/etc/puppetlabs/shared/ssl/ca/ca_crl.pem'