I'm attempting to insert a block of text into my CA certificate file on CentOS hosts with Puppet. I asked about this before, and it seems CentOS is sorely lacking in certificate management functions...
What I need to do is get a rather large chunk of text representing my CA's certificate (passed through openssl
's info command for whatever silly reason) into my /etc/ssl/certs/ca-bundle.crt
file and ensure it's always there, even if the host updates its CA file later from repo.
I do not want to manage the ca-bundle file in its entirety with Puppet. This is already being handled by the yum repositories the servers are pointed to.
Difficulty: Puppet doesn't officially have a way to manage chunks of text, only lines, using the file_line
resource. Me attempting to be clever, though, thought you could use a newline-escaped "line" of text and manage that.
Well, sort of. It works, in that the text ends up in the file, but the problem is that it keeps getting re-added after each puppet run, like the code can't tell that it already exists.
For detail, the chunk of text looks a lot like this (truncated for obvious reasons :3)
$cacert = "Certificate:\n Data:\n Version: 3 (0x2)\n Serial Number:\n 10:d8:83:91:-redacted-"
The line in my Puppet module looks like this:
class em_cacerts::centos inherits em_cacerts{
file_line { 'ca-certificate':
path => '/etc/ssl/certs/ca-bundle.crt',
line => $cacert,
#match => "(see below)",
ensure => present,
}
I've tried all kinds of shenanigans with the match
line (including using an inline_template
to set the match regex to the entire contents of the $cacert
variable, which works flawlessly in IRB, but not in Puppet) in an attempt to get it to recognize the text block already exists but it keeps getting re-added every time and just stacks up on top of itself..
I'm probably barking up the wrong tree here.. but anyways, that's part of the question.
- Is there a better way to accomplish this goal?
- If not, how do I get Puppet to realize the block of text already exists?
Thanks!