Feature #4345
open
Puppet CA proxy
Description
In my environment I have a single CA according to http://docs.puppetlabs.com/guides/scaling_multiple_masters.html#option-1-direct-agent-nodes-to-the-ca-master which foreman supports very well. Now I'm running into the problem that the clients are in subnets that are unable (and undesired) to connect to the central CA. I already set up a proxy according to http://docs.puppetlabs.com/guides/scaling_multiple_masters.html#option-2-proxy-certificate-traffic which works well manually. It would be useful if foreman supported this better.
Possible areas:- Installer should be able to set up the CA proxy in the vhost
- Installer should be able to set up auth.conf
- Foreman support so you can still use <%= @host.puppet_ca_server %>
Updated by Ewoud Kohl van Wijngaarden about 10 years ago
For foreman support I wrote the following in my puppet.conf snippet (requires safe mode off):
ca_server = <%= @host.info['classes']['puppet']['ca_server'] rescue @host.puppet_ca_server %>
Updated by Ewoud Kohl van Wijngaarden about 10 years ago
Ewoud Kohl van Wijngaarden wrote:
- Installer should be able to set up the CA proxy in the vhost
https://github.com/theforeman/puppet-puppet/pull/138 should address this part.
Updated by Ewoud Kohl van Wijngaarden about 10 years ago
Ewoud Kohl van Wijngaarden wrote:
- Installer should be able to set up auth.conf
https://github.com/theforeman/puppet-puppet/pull/139 should address this part.
Updated by Ewoud Kohl van Wijngaarden about 10 years ago
Updated by Eric Helms over 9 years ago
- Blocks Tracker #8172: Isolate Client Communication through a Capsule added
Updated by Stephen Benjamin over 9 years ago
Based on a conversation on IRC -
The installer portion is done to configure the actual proxy, but Foreman needs to be made aware of the concept. Foreman must know to set /etc/puppet/puppet.conf ca_server to the Smart Proxy, but to send the autosign request to the appropriate place.
Updated by Ewoud Kohl van Wijngaarden about 5 years ago
- Related to Feature #26164: Provide Puppet (CA) multi homing added