autosignr

autosignr

A Custom Policy Executable or a daemon (depending on your desired mode of operation) that watches for new Puppet CSRs from instances in AWS (or other clouds), validates the instances belong to you via the cloud provider's API, then signs the cert. Currently only supports AWS, Azure, GPC, but looking to add support for Openstack, Cloudstack, and generic REST APIs.

Autosignr can optionally be configured to validate pre-shared-keys embedded within the CSR. See the blurb in the Puppet Client Configuration section below for more details on how to embed a PSK into your CSRs.

This is a work-in-progress and is far from complete. Use at your own risk

Puppet Client Configuration (optional)

The Puppet client can use the instance ID as the certname in puppet.conf.

# Configures an AWS instance to use the instance ID as the certname. Use something like this to set it before the puppet client starts for the first time:

CONF=/etc/puppetlabs/puppet/puppet.conf

INSTANCE_ID=`wget -q -O - http://169.254.169.254/latest/meta-data/instance-id`

grep certname $CONF > /dev/null 2>&1
if [ $? -ne 0 ]; then
    echo "certname = $INSTANCE_ID" >> $CONF
else
    sed -i "s/certname =.*/certname = $INSTANCE_ID/" $CONF
fi

Optionally embedding a pre-shared key in the CSR

To embed a PSK in your CSR, create the csr_attributes.yaml file in Puppet's $confdir. The file looks something like this:

extension_requests:
    pp_preshared_key: my_preshared_key

For the full list of possible extensions and options that can be put into that file, see the Puppet documentation.

Modes of operation

Autosignr can function as either a custom policy executable (a process run by the Puppetmaster when a new CSR arrives) or as a standalone daemon that watches for new CSR's and signs them.

Configuring to run as a custom policy executable

To run as a custom policy executable, add the following to your Puppetmaster's puppet.conf in the [master] section:

autosign = /path/to/autosignr

Running as a daemon

To run as a daemon, simply start the executable. It doesn't fork itself. The redhat packaging includes a systemd unit file which should allow you to start the service as:

service autosignr start

Or more correctly:

systemctl start autosignr.service

If you're on el6 or older, you'll have to craft an init script, run under a process supervisor, etc.

Configuration Options

The configuration file lives at /etc/autosignr/config.yaml.

Example Configuration:

dir: /etc/puppetlabs/puppet/ssl/ca/requests
cmd_sign: /opt/puppetlabs/bin/puppet cert sign %s
logfile: /var/log/autosignr/autosignr.log
accounts_aws:
  - name: jhancock aws packer
    key: AWS_KEY_ID
    secret: AWS_SECRET_KEY
    regions:
      - us-west-2
      - us-east-1
preshared_keys:
  - abc123
  - defghi

Account Configuration

Each account must have a name specified. In addition, each type of account may require its own set of attributes.

Account Type: aws

Account Type: azure

Account Type: gcp

GCP checks the hostnames on instances with the cert name. Other attributes not supported at this time.

autocleanr

Monitor the PuppetDB for inactive nodes (report_timestamp < X hours) then use the cloud provider's API to verify the certname no longer exists. Then runs custom commands to deactivate and clean the cert name.

Run as a CronJob

Example

15 */4 * * * /usr/sbin/autocleanr > /dev/null 2>&1

Configuration Options

The configuration file lives at /etc/autosignr/autocleanr.yaml.

Example Configuration:

logfile: /var/log/autosignr/autocleanr.log
clean_commands:
  - /opt/puppetlabs/bin/puppet node deactivate %s
  - /opt/puppetlabs/bin/puppet node clean %s
include_filters:
  - and facts{name = \"locations\" and value in [\"aws\"]}
inactive_hours: 4
puppetdb_host: puppetdb.example.com
puppetdb_protocol: https
puppetdb_ignore_cert_errors: false
puppetdb_nodes_uri: /api/pdb/query/v4

include_filters

Optional setting to include additional queries to the API call to PuppetDB.

This setting currently supports PQL

If include_filters is omitted:

curl -XPOST -H 'Content-Type:application/json' "http://localhost:8080/pdb/query/v4" \
-d '{ "query": "nodes[certname]{ report_timestamp < \"2019-01-26T04:02:27Z\" }" }'

If you add the following to the config file

include_filters:
   - and facts{name = \"location\" and value in [\"aws\"]}

Adding the filter above results:

curl -XPOST -H 'Content-Type:application/json' "http://localhost:8080/pdb/query/v4" \
-d '{ "query": "nodes[certname]{ report_timestamp < \"2019-01-28T04:02:27Z\" and facts{name = \"role\" and value in [\"nomad-client\"]} }" }'