Introduction
fingerpuppet is a simple library and commandline tool to interact with Puppet's REST API
without needing to have Puppet itself installed. This may be integrated, for example,
into a provisioning tool to allow your provisioning process to remotely sign certificates
of newly built systems. Alternatively, you could use it to request known facts about
a node from your Puppet Master, or even to request a catalog for a node to, for example,
perform acceptance testing against a new version of Puppet before upgrading your
production master.
Limitations
This is still in early development. Features may not work completely as advertised, and will certainly be less polished than an established product. Pull requests are welcome!
Usage
fingerpuppet [commandstring]
Steps for using the API with fingerpuppet:
fingerpuppet --init --certname my.cert.name --server my.server.name- Builds the config file
- Generates the certificate and CSR
- Submits the CSR to the Puppetmaster
- On puppetmaster:
puppet cert sign my.cert.name fingerpuppet --install- Downloads the signed certificate and installs it
- ...
- Profit!
Your Puppetmaster must be configured to allow requests other than certificate requests. See http://docs.puppetlabs.com/guides/rest_auth_conf.html for more information.
An example auth.conf might look something like:
path ~ ^/catalog/([^/]+)$
method find
auth yes
allow $1, provisioner.example.com
path ~ ^/node/([^/]+)$
method find
auth yes
allow $1, provisioner.example.com
path /certificate_revocation_list/ca
method find
auth yes
allow *
path /report
method save
auth yes
allow *
path /file
auth yes
allow *
path /resource
method find
auth any
allow provisioner.example.com
path /status
method find
auth any
allow provisioner.example.com
path /certificate/ca
method find
auth any
allow *
path /certificate/
method find
auth any
allow *
path /certificate_request
method find, save
auth any
allow *
path /certificate_status
method find, search, save, destroy
auth yes
allow pe-internal-dashboard, provisioner.example.com
path /facts
method find, search
auth any
allow *
path /facts
method save
auth yes
allow master.puppetlabs.vm, provisioner.example.com
path /
auth any