如何使用Hiera在Puppet5中创建安全文件？

Question

我想创建SSL证书并尝试保护此操作的安全。 我正在使用Puppet 5.5.2和gem hiera-eyaml。

创建简单清单

cat /etc/puppetlabs/code/environments/production/manifests/site.pp

package { 'tree':
  ensure => installed,
}
package { 'httpd':
  ensure => installed,
}
$filecrt = lookup('files')
create_resources( 'file', $filecrt )

希拉配置

---
version: 5
defaults:
  # The default value for "datadir" is "data" under the same directory as the hiera.yaml
  # file (this file)
  # When specifying a datadir, make sure the directory exists.
  # See https://puppet.com/docs/puppet/latest/environments_about.html for further details on environments.
  datadir: data
  data_hash: yaml_data
hierarchy:
  - name: "Secret data: per-node, per-datacenter, common"
    lookup_key: eyaml_lookup_key # eyaml backend
    paths:
      - "nodes/%{facts.fqdn}.eyaml"
      - "nodes/%{trusted.certname}.eyaml"  # Include explicit file extension
      - "location/%{facts.whereami}.eyaml"
      - "common.eyaml"
    options:
      pkcs7_private_key: /etc/puppetlabs/puppet/eyaml/keys/private_key.pkcs7.pem
      pkcs7_public_key:  /etc/puppetlabs/puppet/eyaml/keys/public_key.pkcs7.pem
  - name: "YAML hierarchy levels"
    paths:
      - "common.yaml"
      - "nodes/%{facts.fqdn}.yaml"
      - "nodes/%{::trusted.certname}.yaml"

和common.yaml

---
files:
'/etc/httpd/conf/server.crt':
ensure: present
mode: '0600'
owner: 'root'
group: 'root'
content: 'ENC[PKCS7,{LOT_OF_STRING_SKIPPED}+uaCmcHgDAzsPD51soM+AIkIlv0ANpUXzBpwM3tqQ3ysFtz81S0xuVbKvslK]'

但是在应用清单时出错

Error: Evaluation Error: Error while evaluating a Function Call, create_resources(): second argument must be a hash (file: /etc/puppetlabs/code/environments/production/manifests/site.pp, line: 12, column: 1) on node test1.com

我真的不知道该怎么办）

Answer 1

问题似乎是common.yaml中的缩进不正确-当前， file将为null而不是散列，这说明了错误消息。 此外，该文件应称为common.eyaml ，否则ENC字符串将不会被解密。 尝试

---
files:
  '/etc/httpd/conf/server.crt':
    ensure: present
    mode: '0600'
    owner: 'root'
    group: 'root'
    content: 'ENC[PKCS7{LOTS_OF_STRING_SKIPPED}UXzBpwM3tqQ3ysFtz81S0xuVbKvslK]'

如果您想了解缩进带来的不同，可以在http://yaml-online-parser.appspot.com/上找到一个在线YAML解析器。

Answer 2

找到了另一个解决方案。

这是查找和哈希的问题。 当我在hiera哈希中有多行时，必​​须指定它们https://docs.puppet.com/puppet/4.5/function.html#lookup

所以我决定只使用'content'变量来查找

cat site.pp
$filecrt = lookup('files')

file { 'server.crt':
  ensure  => present,
  path    => '/etc/httpd/conf/server.crt',
  content => $filecrt,
  owner   => 'root',
  group   => 'root',
  mode    => '0600',
}

和希拉

---
files:'ENC[PKCS7{LOT_OF_STRING_SKIPPED}+uaCmcHgDAzsPD51soM+AIkIlv0ANpUXzBpwM3tqQ3ysFtz81S0xuVbKvslK]'