|
The reason I decided to look at how feasible it was to add S3 support to the puppet file type was to help with managing sensitive information and how to get it onto the puppet master.
Essentially I want to have a secure s3 bucket that only my puppet masters can pull files from, this bucket would contain private keys to decode hiera data, private keys to connect to private repos on github, bitbucket and/or a private git server and other sensitive data the puppet master needs. I would than manage access to the bucket via AWS IAM roles.
To bootstrap a new LAN I would use the puppetlabs-aws module to create a number of ec2 instances (one of which would be a puppet master) for the puppet master ec2 instance I would give it the IAM role to grant it access to the puppetmaster s3 bucket. Once the ec2 instance is created I would run a bootstrap.pp file that contained:
|
bootstrap.pp
|
# .... other bootstrap stuff ....
|
|
package { 'aws-sdk-core':
|
provider => gem,
|
before => File['/root/.ssh/bitbucket-deploy-key.openssh', '/root/.ssh/github-deploy-key.openssh', '/root/.ssh/hiera-decryption-key.openssh']
|
}
|
|
file { '/root/.ssh/bitbucket-deploy-key.openssh':
|
source => 's3://puppetmaster-IAM-locked-down-bucket/bitbucket-deploy-key.openssh',
|
mode => 0600,
|
region => 'ap-southeast-2',
|
}
|
|
file { '/root/.ssh/github-deploy-key.openssh':
|
source => 's3://puppetmaster-IAM-locked-down-bucket/github-deploy-key.openssh',
|
mode => 0600,
|
region => 'ap-southeast-2',
|
}
|
|
file { '/root/.ssh/hiera-decryption-key.openssh':
|
source => 's3://puppetmaster-IAM-locked-down-bucket/hiera-decryption-key.openssh',
|
mode => 0600,
|
region => 'ap-southeast-2',
|
}
|
|
$str = "HOST bitbucket.org
|
StrictHostKeyChecking no
|
IdentityFile /root/.ssh/bitbucket-deploy-key.openssh
|
HOST github.com
|
StrictHostKeyChecking no
|
IdentityFile /root/.ssh/github-deploy-key.openssh
|
"
|
|
file { '/root.ssh/config':
|
source => 's3://puppetmaster-IAM-locked-down-bucket/root-ssh-config',
|
mode => 0600,
|
region => 'ap-southeast-2',
|
}
|
|
# Rest of the code to pull down the encrypted hieradata repo and other configuration information to bootstrap the puppet environment
|
If I ever need to change the sensitive keys I can just replace them in the s3 bucket and puppet will do the rest for me on the next puppet run.
As the information will be pulled from within the same AWS region (hopefully in the same data centre) it is unlikely that it can be MITM'ed or tampered with in transit (yes I know I have to originally put the private keys into the s3 bucket ...).
This obviously would work for puppet clients as well for applications where you need to seed the application with various files that you don't need to store on the puppet master.
|
and I would never ever hold you to delivering a feature that you may or may not have committed to in the video 
