I'm attempting to insert a block of text into my CA certificate file on CentOS hosts with Puppet. I asked about this before, and it seems CentOS is sorely lacking in certificate management functions...

What I need to do is get a rather large chunk of text representing my CA's certificate (passed through openssl's info command for whatever silly reason) into my /etc/ssl/certs/ca-bundle.crt file and ensure it's always there, even if the host updates its CA file later from repo.

I do not want to manage the ca-bundle file in its entirety with Puppet. This is already being handled by the yum repositories the servers are pointed to.

Difficulty: Puppet doesn't officially have a way to manage chunks of text, only lines, using the file_line resource. Me attempting to be clever, though, thought you could use a newline-escaped "line" of text and manage that.

Well, sort of. It works, in that the text ends up in the file, but the problem is that it keeps getting re-added after each puppet run, like the code can't tell that it already exists.

For detail, the chunk of text looks a lot like this (truncated for obvious reasons :3)

$cacert = "Certificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            10:d8:83:91:-redacted-"

The line in my Puppet module looks like this:

class em_cacerts::centos inherits em_cacerts{
    file_line { 'ca-certificate':
            path => '/etc/ssl/certs/ca-bundle.crt',
            line => $cacert,
            #match => "(see below)",
            ensure => present,

I've tried all kinds of shenanigans with the match line (including using an inline_template to set the match regex to the entire contents of the $cacert variable, which works flawlessly in IRB, but not in Puppet) in an attempt to get it to recognize the text block already exists but it keeps getting re-added every time and just stacks up on top of itself..

I'm probably barking up the wrong tree here.. but anyways, that's part of the question.

  • Is there a better way to accomplish this goal?
  • If not, how do I get Puppet to realize the block of text already exists?



I ended up solving this with an exec line:

class em_cacerts::centos inherits em_cacerts{
        exec { 'cent-ca-certificate':
                command => "/bin/echo '$centcacert' >> '$cabundlepath'",
                onlyif => "test ! `grep (redacted CA name) $cabundlepath`", 
                provider => 'shell',

Yeah, it's using exec, which is officially discouraged, but this works reliably and uses absolute basic stuff that any CentOS box will have.

Thanks everyone!


Typically I see files managed in their entirety using erb templates. If you won't do that, you could have a script perform a sed command. https://puppetlabs.com/blog/why-puppet-isnt-a-file-management-tool/


I think you want the puppet concat module, which builds files from fragments. Or just manage a separate file and have a exec resource sed insert it into the file if not found with grep


See also augeas.


It aims to do exactly what you asked for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.