如何使用Hiera在Puppet5中創建安全文件？

Question

我想創建SSL證書並嘗試保護此操作的安全。 我正在使用Puppet 5.5.2和gem hiera-eyaml。

創建簡單清單

cat /etc/puppetlabs/code/environments/production/manifests/site.pp

package { 'tree':
  ensure => installed,
}
package { 'httpd':
  ensure => installed,
}
$filecrt = lookup('files')
create_resources( 'file', $filecrt )

希拉配置

---
version: 5
defaults:
  # The default value for "datadir" is "data" under the same directory as the hiera.yaml
  # file (this file)
  # When specifying a datadir, make sure the directory exists.
  # See https://puppet.com/docs/puppet/latest/environments_about.html for further details on environments.
  datadir: data
  data_hash: yaml_data
hierarchy:
  - name: "Secret data: per-node, per-datacenter, common"
    lookup_key: eyaml_lookup_key # eyaml backend
    paths:
      - "nodes/%{facts.fqdn}.eyaml"
      - "nodes/%{trusted.certname}.eyaml"  # Include explicit file extension
      - "location/%{facts.whereami}.eyaml"
      - "common.eyaml"
    options:
      pkcs7_private_key: /etc/puppetlabs/puppet/eyaml/keys/private_key.pkcs7.pem
      pkcs7_public_key:  /etc/puppetlabs/puppet/eyaml/keys/public_key.pkcs7.pem
  - name: "YAML hierarchy levels"
    paths:
      - "common.yaml"
      - "nodes/%{facts.fqdn}.yaml"
      - "nodes/%{::trusted.certname}.yaml"

和common.yaml

---
files:
'/etc/httpd/conf/server.crt':
ensure: present
mode: '0600'
owner: 'root'
group: 'root'
content: 'ENC[PKCS7,{LOT_OF_STRING_SKIPPED}+uaCmcHgDAzsPD51soM+AIkIlv0ANpUXzBpwM3tqQ3ysFtz81S0xuVbKvslK]'

但是在應用清單時出錯

Error: Evaluation Error: Error while evaluating a Function Call, create_resources(): second argument must be a hash (file: /etc/puppetlabs/code/environments/production/manifests/site.pp, line: 12, column: 1) on node test1.com

我真的不知道該怎么辦）

Answer 1

問題似乎是common.yaml中的縮進不正確-當前， file將為null而不是散列，這說明了錯誤消息。 此外，該文件應稱為common.eyaml ，否則ENC字符串將不會被解密。 嘗試

---
files:
  '/etc/httpd/conf/server.crt':
    ensure: present
    mode: '0600'
    owner: 'root'
    group: 'root'
    content: 'ENC[PKCS7{LOTS_OF_STRING_SKIPPED}UXzBpwM3tqQ3ysFtz81S0xuVbKvslK]'

如果您想了解縮進帶來的不同，可以在http://yaml-online-parser.appspot.com/上找到一個在線YAML解析器。

Answer 2

找到了另一個解決方案。

這是查找和哈希的問題。 當我在hiera哈希中有多行時，必​​須指定它們https://docs.puppet.com/puppet/4.5/function.html#lookup

所以我決定只使用'content'變量來查找

cat site.pp
$filecrt = lookup('files')

file { 'server.crt':
  ensure  => present,
  path    => '/etc/httpd/conf/server.crt',
  content => $filecrt,
  owner   => 'root',
  group   => 'root',
  mode    => '0600',
}

和希拉

---
files:'ENC[PKCS7{LOT_OF_STRING_SKIPPED}+uaCmcHgDAzsPD51soM+AIkIlv0ANpUXzBpwM3tqQ3ysFtz81S0xuVbKvslK]'