ca_expiry_check

Table of Contents

1. Description
2. Usage - Configuration options and additional functionality
3. Reference - An under-the-hood peek at what the module is doing and how

Description

This Module Provides facts and a class that are designed to inform and notify in the instance the Puppet CA is due to expire

Usage

The Facts contained in this module can be used for direct consumption by monitoring tools such as Splunk.

Alternativly assigning the class ca_expiry_check to nodes running a Puppet CA, Will "Notify" on Each Puppet run as soon as the certificate expiry is within a designated window. This window by default is 90 days, but is configurable through the use of the "alertwindow" parameter which takes an integer representing the desired alert window in seconds

Class Delcaration Optional.

To activate the notification functions of this module, classify your Primary Master (or which ever server hosts your main Puppet CA) with the ca_expiry_check class using your preferred classification method. Below is an example using site.pp.

node 'master.example.com' {
  include ca_expiry_check
}

To optionally configure the length of the window in which you are notified of impending expiry away from the default of 90 days, add the alertwindow parameter with a value in seconds to your classification.

class { 'ca_expiry_check':
  alertwindow              => 15552000,
}

Outputs

When the class is included once within the alert window period, there will be a corrective change, in the form of a notify, with the following messaging":

Puppet CA expiring on ${facts['ca_exp_date']} You should renew

Reference

Facts:

ca_exp_date

Prints the expiry date of the CA, confined to run only on Puppet Servers hosting the CA

ca_exp_seconds

Prints the number of seconds between now() and $ca_exp_date, confined to run only on Puppet Servers hosting the CA

Parameters:

alertwindow

Optional. Provides a method to alter the notification window value in seconds. Valid options: integer . Default value: 7776000 (90 days).

Reference

Table of Contents

Classes

• ca_expiry_check: Notify if CA will expire within a set window Notifys on each puppet run should the CA Cert get within a specific window

Classes

ca_expiry_check

Notify if CA will expire within a set window

Notifys on each puppet run should the CA Cert get within a specific window

Examples

include ca_expiry_check

Parameters

The following parameters are available in the ca_expiry_check class:

• alertwindow

alertwindow

Data type: Integer

Integer value representing number of seconds prior to CA expiry alerts should trigger, defaults to 90 days

Changelog

All notable changes to this project will be documented in this file.

Release 2.0.0

Features Puppet 8 compatibility

Deprecations

Dropped support for puppet 4,5,6

Release 1.1.0

Features Updated module to consider the new location of the CA directory in Puppet 7

Release 1.0

Features Cleaned up Readme

Release 0.1.1

Features Removed some of the external shell requirements on the facts

Bugfixes

Properly confined to only CA hosts

By moving the confinement to the actual CA Cert

/etc/puppetlabs/puppet/ssl/ca/ca_crt.pem

Known Issues