Change 985125 had a related patch set uploaded (by Filippo Giunchedi; author: Filippo Giunchedi):

[operations/puppet@production] pontoon: copy post-receive hook from puppetmaster

https://gerrit.wikimedia.org/r/985125

Change 985125 merged by Filippo Giunchedi:

[operations/puppet@production] pontoon: copy post-receive hook from puppetmaster

https://gerrit.wikimedia.org/r/985125

I have made some progress on getting puppetserver::pontoon to be a thing.

Things mostly work, however for a successful bootstrap I have made the following changes:

• The puppetserver CA is used to issue certificates (as opposed to PKI) and to bootstrap pki.discovery.wmnet I'm using SANs on the multirootca host. Therefore I have changes to set the CA name to a well known name (as opposed to defaulting to the puppetserver fqdn) and allow_san option
• puppetdb cert key at the moment allows only secret() calls, whereas in Pontoon the key might be found on the server filesystem. For this I've implemented an approach similar to what we're doing in pki where content/source for the key can come either from secret() or the filesystem

Change 1002384 had a related patch set uploaded (by Filippo Giunchedi; author: Filippo Giunchedi):

[operations/puppet@production] multirootca: depend on cfssl when generating CRLs

https://gerrit.wikimedia.org/r/1002384

Change 1002385 had a related patch set uploaded (by Filippo Giunchedi; author: Filippo Giunchedi):

[operations/puppet@production] puppetserver: add Puppet CA custom name and SANs

https://gerrit.wikimedia.org/r/1002385

Change 1002386 had a related patch set uploaded (by Filippo Giunchedi; author: Filippo Giunchedi):

[operations/puppet@production] puppetdb: allow both secret() and source for site key material

https://gerrit.wikimedia.org/r/1002386

Change 1002387 had a related patch set uploaded (by Filippo Giunchedi; author: Filippo Giunchedi):

[operations/puppet@production] postgresql: install configuration before starting the server

https://gerrit.wikimedia.org/r/1002387

Change 1002388 had a related patch set uploaded (by Filippo Giunchedi; author: Filippo Giunchedi):

[operations/puppet@production] postgresql: use 'systemd reload' for pgreload

https://gerrit.wikimedia.org/r/1002388

Change 1002384 merged by Filippo Giunchedi:

[operations/puppet@production] multirootca: depend on cfssl when generating CRLs

https://gerrit.wikimedia.org/r/1002384

Change 1002388 merged by Filippo Giunchedi:

[operations/puppet@production] postgresql: use 'systemd reload' for pgreload

https://gerrit.wikimedia.org/r/1002388

Change 1002385 merged by Filippo Giunchedi:

[operations/puppet@production] puppetserver: add Puppet CA custom name and SANs

https://gerrit.wikimedia.org/r/1002385

Mentioned in SAL (#wikimedia-operations) [2024-02-13T14:18:26Z] <godog> bounce puppetserver on puppetserver1003 to test noop config change - T352640

Change 1002386 merged by Filippo Giunchedi:

[operations/puppet@production] puppetdb: allow both secret() and source for site key material

https://gerrit.wikimedia.org/r/1002386