Allow compilers and replicas to merge csr_attributes.

Author: bwilcox

plans/add_compiler.pp

@@ -47,13 +47,19 @@
     default => ["main:dns_alt_names=${dns_alt_names}"],
   }
 
+  # Check for and merge csr_attributes.
+  run_plan('peadm::util::insert_csr_extension_requests', $compiler_target,
+      extension_requests => {
+        peadm::oid('pp_auth_role')             => 'pe_compiler',
+        peadm::oid('peadm_availability_group') => $avail_group_letter
+      }
+    )
+
   # we first assume that there is no agent installed on the node. If there is, nothing will happen.
   run_task('peadm::agent_install', $compiler_target,
     server        => $primary_target.peadm::certname(),
     install_flags => $dns_alt_names_flag + [
       '--puppet-service-ensure', 'stopped',
-      "extension_requests:${peadm::oid('pp_auth_role')}=pe_compiler",
-      "extension_requests:${peadm::oid('peadm_availability_group')}=${avail_group_letter}",
       "main:certname=${compiler_target.peadm::certname()}",
     ],
   )

plans/add_replica.pp

@@ -37,12 +37,18 @@
   # This has the effect of revoking the node's certificate, if it exists
   run_command("puppet infrastructure forget ${replica_target.peadm::certname()}", $primary_target, _catch_errors => true)
 
+  # Check for and merge csr_attributes.
+  run_plan('peadm::util::insert_csr_extension_requests', $replica_target,
+      extension_requests => {
+        peadm::oid('peadm_role')               => 'puppet/server',
+        peadm::oid('peadm_availability_group') => $replica_avail_group_letter
+      }
+    )
+
   run_task('peadm::agent_install', $replica_target,
     server        => $primary_target.peadm::certname(),
     install_flags => [
       '--puppet-service-ensure', 'stopped',
-      "extension_requests:${peadm::oid('peadm_role')}=puppet/server",
-      "extension_requests:${peadm::oid('peadm_availability_group')}=${replica_avail_group_letter}",
       "main:certname=${replica_target.peadm::certname()}",
       "main:dns_alt_names=${dns_alt_names.join(',')}",
     ],

plans/subplans/install.pp

@@ -324,23 +324,28 @@
     ]
 
     $role_and_group =
-      if ($target in $compiler_a_targets) {[
-        "extension_requests:${peadm::oid('pp_auth_role')}=pe_compiler",
-        "extension_requests:${peadm::oid('peadm_availability_group')}=A",
-      ]}
-      elsif ($target in $compiler_b_targets) {[
-        "extension_requests:${peadm::oid('pp_auth_role')}=pe_compiler",
-        "extension_requests:${peadm::oid('peadm_availability_group')}=B",
-      ]}
-      elsif ($target in $replica_target) {[
-        "extension_requests:${peadm::oid('peadm_role')}=puppet/server",
-        "extension_requests:${peadm::oid('peadm_availability_group')}=B",
-      ]}
+      if ($target in $compiler_a_targets) {{
+        peadm::oid('pp_auth_role')             => 'pe_compiler',
+        peadm::oid('peadm_availability_group') => 'A',
+      }}
+      elsif ($target in $compiler_b_targets) {{
+        peadm::oid('pp_auth_role')             => 'pe_compiler',
+        peadm::oid('peadm_availability_group') => 'B',
+      }}
+      elsif ($target in $replica_target) {{
+        peadm::oid('peadm_role')               => 'puppet/server',
+        peadm::oid('peadm_availability_group') => 'B',
+      }}
+
+    # Merge extension requests with csr_attributes.yaml or create it
+    run_plan('peadm::util::insert_csr_extension_requests', $target,
+      extension_requests => $role_and_group
+    )
 
     # Get an agent installed and cert signed
     run_task('peadm::agent_install', $target,
       server        => $primary_target.peadm::certname(),
-      install_flags => $common_install_flags + $role_and_group,
+      install_flags => $common_install_flags,
     )
 
     # Ensure certificate requests have been submitted, then run Puppet

spec/plans/add_compiler_spec.rb

@@ -28,8 +28,6 @@ def allow_standard_non_returning_calls
         .with_params({ 'server'        => 'primary',
                        'install_flags' => [
                          '--puppet-service-ensure', 'stopped',
-                         'extension_requests:1.3.6.1.4.1.34380.1.3.13=pe_compiler',
-                         'extension_requests:1.3.6.1.4.1.34380.1.1.9813=A',
                          'main:certname=compiler'
                        ] })
 
@@ -53,8 +51,6 @@ def allow_standard_non_returning_calls
                          'install_flags' => [
                            'main:dns_alt_names=foo,bar',
                            '--puppet-service-ensure', 'stopped',
-                           'extension_requests:1.3.6.1.4.1.34380.1.3.13=pe_compiler',
-                           'extension_requests:1.3.6.1.4.1.34380.1.1.9813=A',
                            'main:certname=compiler'
                          ] })
 

spec/plans/add_replica_spec.rb

@@ -20,8 +20,6 @@ def allow_standard_non_returning_calls
         .with_params({ 'server'        => 'primary',
                        'install_flags' => [
                          '--puppet-service-ensure', 'stopped',
-                         'extension_requests:1.3.6.1.4.1.34380.1.1.9812=puppet/server',
-                         'extension_requests:1.3.6.1.4.1.34380.1.1.9813=B',
                          'main:certname=replica',
                          'main:dns_alt_names=replica'
                        ] })
@@ -36,8 +34,6 @@ def allow_standard_non_returning_calls
         .with_params({ 'server'        => 'primary',
                        'install_flags' => [
                          '--puppet-service-ensure', 'stopped',
-                         'extension_requests:1.3.6.1.4.1.34380.1.1.9812=puppet/server',
-                         'extension_requests:1.3.6.1.4.1.34380.1.1.9813=B',
                          'main:certname=replica',
                          'main:dns_alt_names=replica,alt'
                        ] })