Puppet Class: krb5::kdc::auto_keytabs
- Inherits:
- krb5::kdc
- Defined in:
- manifests/kdc/auto_keytabs.pp
Summary
Provides a mechanism for auto-generating keytabs on the KDC as well as provisioning those keytabs for distribution via Puppet if possible.Overview
**NOTE: THIS IS A [PRIVATE](github.com/puppetlabs/puppetlabs-stdlib#assert_private) CLASS**
The keytabs will be collected in a directory that is, by default, located at ‘/var/kerberos/krb5kdc/generated_keytabs`.
The target directory will have subdirectories created, one per ‘host/fqdn@REALM` principal that match the `fqdn` of the host.
Each of those directories will have a krb5.keytab file created that contains all discovered keytabs for the principal, *regardless of REALM*.
If this is enabled on a Puppet server, and ‘$introspect` is `true`, it will attempt to install the keytabs into the `$environmentpath/$environment/site_files/$module_name_files/files/keytabs` directory.
It will also attempt to automatically create host keytabs for any hosts in one of the following two directories:
* `${environmentpath}/${environment}/keydist`
* `${environmentpath}/${environment}/site_files/pki_files/files/keydist`
@note For any of the above, if `$environmentpath` is empty, or does not
exist, then `$confdir` will be substituted for
`${environmentpath}/${environment}`
60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 |
# File 'manifests/kdc/auto_keytabs.pp', line 60
class krb5::kdc::auto_keytabs (
Boolean $introspect = true,
Optional[Stdlib::Absolutepath] $output_dir = undef,
Boolean $all_known = false,
String $user = 'root',
String $group = 'puppet',
String $realms = simplib::lookup('krb5::kdc::auto_realm', { 'default_value' => $facts['networking']['domain'] }),
Array[String] $global_services = [],
Boolean $purge = true,
Hash[String,
Struct[{'ensure' => Enum['absent','present'],
Optional['realms'] => Array[String],
Optional['services'] => Array[String]
}]
] $hosts = {}
) inherits krb5::kdc {
assert_private()
if $output_dir {
$_output_dir = $output_dir
}
else {
$_output_dir = '__default__'
}
krb5kdc_auto_keytabs { $_output_dir:
introspect => $introspect,
all_known => $all_known,
user => $user,
group => $group,
realms => $realms,
global_services => $global_services,
hosts => $hosts,
purge => $purge
}
}
|