(MAINT) update SSL verification and certificate handling

- Changed SSL verification mode to VERIFY_PEER for enhanced security.
- Added Puppet settings initialization to load necessary certificates.
- Updated HTTP request to use Puppet's certname and certificate files.
- Ensured CA file is set for SSL verification.

Author: CoMfUcIoS

tasks/get_peadm_config.rb

@@ -105,7 +105,8 @@ def https(port)
     https.use_ssl = true
     https.cert = @cert ||= OpenSSL::X509::Certificate.new(File.read(Puppet.settings[:hostcert]))
     https.key = @key ||= OpenSSL::PKey::RSA.new(File.read(Puppet.settings[:hostprivkey]))
-    https.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    https.verify_mode = OpenSSL::SSL::VERIFY_PEER
+    https.ca_file = Puppet.settings[:localcacert]
     https
   end
 

tasks/rbac_token.rb

@@ -4,32 +4,36 @@
 #
 # rubocop:disable Style/GlobalVars
 require 'net/https'
-require 'uri'
 require 'json'
 require 'fileutils'
+require 'puppet'
 
 # Parameters expected:
 #   Hash
 #     String password
 $params = JSON.parse(STDIN.read)
 
-uri = URI.parse('https://localhost:4433/rbac-api/v1/auth/token')
+Puppet.initialize_settings
+
 body = {
   'login'    => 'admin',
   'password' => $params['password'],
   'lifetime' => $params['token_lifetime'],
   'label'    => 'provision-time token',
 }.to_json
 
-http = Net::HTTP.new(uri.host, uri.port)
-http.use_ssl = true
-http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-request = Net::HTTP::Post.new(uri.request_uri)
+https. = Net::HTTP.new(Puppet.settings[:certname], 4433)
+https..use_ssl = true
+https..cert = OpenSSL::X509::Certificate.new(File.read(Puppet.settings[:hostcert]))
+https..key = OpenSSL::PKey::RSA.new(File.read(Puppet.settings[:hostprivkey]))
+https..verify_mode = OpenSSL::SSL::VERIFY_PEER
+https..ca_file = Puppet.settings[:localcacert]
+request = Net::https.:Post.new('/rbac-api/v1/auth/token')
 request['Content-Type'] = 'application/json'
 request.body = body
 
-response = http.request(request)
-raise "Error requesting token, #{response.body}" unless response.is_a? Net::HTTPSuccess
+response = https.request(request)
+raise "Error requesting token, #{response.body}" unless response.is_a? Net::https.success
 token = JSON.parse(response.body)['token']
 
 FileUtils.mkdir_p('/root/.puppetlabs')