SELinux and icinga2::feature::api

[b3n4kh]

Enabling API Feature with 'puppet' as pki requires second puppetrun to work, if selinux set to Enforcing.

class { 'icinga2::feature::api':
  pki => 'puppet',
}

Expected Behavior

Puppet copies the certificates and starts icinga.

Current Behavior

Puppet failes to start icinga service since the certificates can not be read, due to wrong seltype, even though icinga2-selinux is installed.

Possible Solution

Installing icinga2-selinux not beforehand but during between icinga2 installation and configuration should fix the issue. Example https://github.com/b3n4kh/puppet-icinga2/tree/selinux

Steps to Reproduce (for bugs)

Apply following manifest with selinux set to Enforcing:

package { 'icinga2-selinux':
  ensure => 'installed'
}

include ::icinga2

class { 'icinga2::feature::api':
  pki => 'puppet',
}

Context

Use icinga2 with selinux on Enforcing Mode.

Your Environment

• Module version (puppet module list): 2.3.0
• Puppet version (puppet -V): 6.10
• Operating System and version: RHEL 7.6

[lbetz]

To solve your problem, the module has the feature to disable the package management.

package { ['icinga2', 'icinga2-selinux']: }

class { 'icinga2':
manage_package => false,
}

Bye
Lennart