-
Notifications
You must be signed in to change notification settings - Fork 40
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Agent unable to connect to Vault because of cert issue #62
Comments
I think you need to use actual values where you have 'nil' or at least use '', but I don't think the .nil checks in the code will handle that right. I think the code needs something like this: |
@BobSF67 |
@andrewjkeith For example, try this: $role_id = 'xxxxxx'
$secret_id = 'yyyyy'
$d = Deferred('vault_lookup::lookup', ['aws/creds/build_role', 'https://vault:8200', undef, undef, undef, undef, 'approle', $role_id, $secret_id])
notify { 'vault':
message => $d,
} Also note that as of PR #64 , you can use a hash of options rather than positional arguments. Which would make this simpler for you. $role_id = 'xxxxxx'
$secret_id = 'yyyyy'
# This will only work after version 0.6.0 of the module:
$d = Deferred('vault_lookup::lookup', ['aws/creds/build_role', {
'vault_addr' => 'https://vault:8200',
'auth_method' => 'approle',
'role_id' => $role_id,
'secret_id' => $secret_id,
}])
notify { 'vault':
message => $d,
} |
Closing this issue as the problem was due to improperly calling the function with positional arguments. Use The options hash feature is available as of version |
I'm having a problem with a puppet agent connecting to the vault cluster because of a cert issue. The vault endpoint is a puppet agent as well under the same primary server.
The vault listener is setup with a cert that was created off of our root issuing cert infra, but the puppet CA cert is separate.
The agent is setup to trust any cert signed by the root cert, but it appears the Puppet HTTP client is not trusting the cert.
I have tried adding the vault cert to the agent's CA bundle as described here: https://support.puppet.com/hc/en-us/articles/115000390993-Add-certificates-to-the-Puppet-certificate-bundle-in-Puppet-Enterprise
(I know I'm trying the approle auth that was just released but I suspect I would have this same issue with cert auth.)
Affected Puppet, Ruby, OS and module versions/distributions
How to reproduce (e.g Puppet code you use)
Vault tcp listener
What are you seeing
when puppet is run:
Failed to apply catalog: certificate verify failed [unable to get local issuer certificate for ,CN=vault,OU=....]
What behaviour did you expect instead
successful puppet run
The text was updated successfully, but these errors were encountered: